coilyco-flight-deck/infrastructure

Watch

Deprovision host-local Agent Proxy and remove misplaced LiteLLM role #629

New issue

Closed

opened 2026-07-24 20:40:24 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-24 20:40:24 +00:00

Member

Parent: coilyco-flight-deck/agent-proxy#56

Decision

Kai selected one Agent Proxy deployment on ser8. Every host-local Agent Proxy instance is retired.

The canonical deployment surface already exists at coilyco-bridge/deploy/services/agent-proxy. Durable trajectory storage belongs there. LiteLLM remains a separate evaluation candidate, but its deployment also belongs in the deploy repository rather than a Mac-local Ansible role.

Scope

Set every host class to agent_proxy_enabled: false.
Convert the legacy Ansible role into an idempotent deprovision path that stops and removes any local Agent Proxy compose project or container.
Preserve old local trajectory directories as recoverable data. Do not delete them automatically.
Remove the Mac-local LiteLLM role, provisioning verb, and documentation landed under the mistaken target assumption.
Point the feature inventory and Agent Proxy documentation at the sole ser8 deployment.
Keep the Ansible cleanup role in fleet sync long enough to remove local instances everywhere.

Acceptance

Repository validation passes.
A check-mode converge can identify local cleanup without mutating a host.
An apply converge removes local Agent Proxy runtime state without deleting retained data.
No inventory group enables a local Agent Proxy.
ser8 persistence is tracked by coilyco-bridge/deploy#205.

Closes as the infrastructure correction for coilyco-flight-deck/agent-proxy#56.

Parent: coilyco-flight-deck/agent-proxy#56 ## Decision Kai selected one Agent Proxy deployment on ser8. Every host-local Agent Proxy instance is retired. The canonical deployment surface already exists at `coilyco-bridge/deploy/services/agent-proxy`. Durable trajectory storage belongs there. LiteLLM remains a separate evaluation candidate, but its deployment also belongs in the deploy repository rather than a Mac-local Ansible role. ## Scope * Set every host class to `agent_proxy_enabled: false`. * Convert the legacy Ansible role into an idempotent deprovision path that stops and removes any local Agent Proxy compose project or container. * Preserve old local trajectory directories as recoverable data. Do not delete them automatically. * Remove the Mac-local LiteLLM role, provisioning verb, and documentation landed under the mistaken target assumption. * Point the feature inventory and Agent Proxy documentation at the sole ser8 deployment. * Keep the Ansible cleanup role in fleet sync long enough to remove local instances everywhere. ## Acceptance * Repository validation passes. * A check-mode converge can identify local cleanup without mutating a host. * An apply converge removes local Agent Proxy runtime state without deleting retained data. * No inventory group enables a local Agent Proxy. * ser8 persistence is tracked by `coilyco-bridge/deploy#205`. Closes as the infrastructure correction for `coilyco-flight-deck/agent-proxy#56`.

coilyco-ops referenced this issue

2026-07-24 20:51:49 +00:00

Author Agent Proxy ledger and LiteLLM candidate roles #633

coilyco-ops referenced this issue

2026-07-24 21:01:19 +00:00

Add idempotent LiteLLM SSM secret provisioning #634

coilyco-ops commented

2026-07-24 21:05:24 +00:00

Author

Member

Authoring is landed on canonical main in 4306df2 and 47bf9c7. The hook suite and repository tests pass. The Windows-only Ansible check attempt reached the known ansible-core Windows controller failure before playbook parsing, so it is not live evidence.

The remaining step requires the local-run Mac surface:

Run the committed litellm-secrets-provision Ward verb.
Enable litellm_enabled for the Mac.
Converge the agent-proxy,litellm tags locally.
Run the committed ledger recovery and LiteLLM parity evidence.
Disable LiteLLM once and verify its Postgres state remains.

The initiating Windows surface cannot reach the Mac, and the Mac is deliberately absent from push_targets. LiteLLM remains disabled until this observed step.

Authoring is landed on canonical main in `4306df2` and `47bf9c7`. The hook suite and repository tests pass. The Windows-only Ansible check attempt reached the known ansible-core Windows controller failure before playbook parsing, so it is not live evidence. The remaining step requires the local-run Mac surface: 1. Run the committed `litellm-secrets-provision` Ward verb. 2. Enable `litellm_enabled` for the Mac. 3. Converge the `agent-proxy,litellm` tags locally. 4. Run the committed ledger recovery and LiteLLM parity evidence. 5. Disable LiteLLM once and verify its Postgres state remains. The initiating Windows surface cannot reach the Mac, and the Mac is deliberately absent from `push_targets`. LiteLLM remains disabled until this observed step.

coilyco-ops changed title from ~~Deploy durable Agent Proxy ledger and standalone LiteLLM candidate~~ to Deprovision host-local Agent Proxy and remove misplaced LiteLLM role

2026-07-24 21:23:19 +00:00

coilysiren referenced this issue from a commit

2026-07-24 21:54:43 +00:00

Retire host-local agent gateway services

coilysiren closed this issue

2026-07-24 21:54:43 +00:00

coilyco-ops referenced this issue

2026-07-24 22:37:20 +00:00

[interactive] Verify retired Agent Proxy is absent on Kai's Mac #640

coilyco-ops commented

2026-07-24 22:38:27 +00:00

Author

Member

Correction and runtime boundary

The earlier Mac-local design was a target-selection mistake. Commit 0231c83 removes that design and makes ser8 the sole declared Agent Proxy deployment.

Every inventory value now keeps agent_proxy_enabled: false.
The legacy role now removes a local compose project, standalone container, compose file, and runtime environment file while preserving the trajectory directory.
The Mac-local LiteLLM role and its operator surface are removed.
Reachable-host checks found no host-local Agent Proxy container on ser8 and no Windows container or listener on port 8080.
The Mac is visible in the tailnet but accepts neither normal SSH nor Tailscale SSH from this operator session. The agent cannot claim live Mac cleanup from repository state alone.
Infrastructure #640 now owns the native Mac converge and counts-only absence proof.

The infrastructure correction is landed. Issue #640 keeps the one unverified runtime cleanup visible.

## Correction and runtime boundary The earlier Mac-local design was a target-selection mistake. Commit `0231c83` removes that design and makes ser8 the sole declared Agent Proxy deployment. * Every inventory value now keeps `agent_proxy_enabled: false`. * The legacy role now removes a local compose project, standalone container, compose file, and runtime environment file while preserving the trajectory directory. * The Mac-local LiteLLM role and its operator surface are removed. * Reachable-host checks found no host-local Agent Proxy container on ser8 and no Windows container or listener on port 8080. * The Mac is visible in the tailnet but accepts neither normal SSH nor Tailscale SSH from this operator session. The agent cannot claim live Mac cleanup from repository state alone. * Infrastructure #640 now owns the native Mac converge and counts-only absence proof. The infrastructure correction is landed. Issue #640 keeps the one unverified runtime cleanup visible.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#629

No description provided.

Rows
Columns