Add first-class o2r connection plugin for Ansible - sibling to ssh and local runners #55

New issue

Closed

opened 2026-06-03 09:49:23 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-03 09:49:23 +00:00

Owner

Decision

Add a first-class o2r Agent Channel connection plugin to Ansible, sitting alongside Ansible's built-in ssh and local runners. Playbooks targeted at the o2r connection dispatch their tasks as comms events on a named Agent Channel; an on-host worker subscribed to that channel executes the task locally with connection: local and posts the result back as a comms event.

Why

The fleet is migrating off Tailscale SSH for agent-to-agent traffic within ~30 days. After the cutoff, agents communicate exclusively via o2r channels. Standard ansible-playbook -i hosts.yml with the default ssh connection plugin stops working at that point.

The shape Kai sketched: Ansible already has connection: ssh and connection: local; o2r becomes the third option. From the playbook author's perspective, nothing changes except the inventory line ansible_connection: o2r and the channel id the host listens on. Existing roles run unchanged.

This keeps Ansible viable as the fleet's host-config tool without committing to a giant rewrite of how playbooks express intent.

Shape (sketch)

New Python package ansible-collection-otel-a2a-relay (or similar) shipping a connection plugin under connection_plugins/o2r.py.
Plugin implements the standard ansible.plugins.connection.ConnectionBase interface: _connect, exec_command, put_file, fetch_file, close.
Each exec_command posts a comms event of kind (e.g.) ansible.task to the configured channel, then blocks polling channel events for a matching ansible.result comms reply. Timeout configurable.
put_file / fetch_file ship file payloads through the same channel (chunked if needed, or pinned to a max size with a clear failure mode if larger).
On-host worker is a separate package: o2r-ansible-worker daemon. Subscribes to its channel, pops ansible.task events, executes via local Ansible action plugins (so the task module ecosystem works unchanged), posts ansible.result back.
Auth: same bearer token shape as the rest of the channel API. Worker resolves from local SSM equivalent or env.

Out of scope for this issue

The on-host worker implementation - separate issue, separate repo (or sub-package).
Backporting existing Ansible roles to use ansible_connection: o2r - per-role follow-ups.
Performance work for large file transfers via channel events - profile first.

Refs

Direction set by Kai on R9GH, 2026-06-03.
Companion architecture decision: agentic-os-kai#598 (Ansible local-only + channel-dispatched orchestration).
Channel protocol: otel-a2a-relay/docs/channels-protocol.md.
Channel skill: otel-a2a-relay/skills/ops-eng-o2r-agent-channel/SKILL.md.

## Decision Add a first-class **o2r Agent Channel** connection plugin to Ansible, sitting alongside Ansible's built-in `ssh` and `local` runners. Playbooks targeted at the `o2r` connection dispatch their tasks as comms events on a named Agent Channel; an on-host worker subscribed to that channel executes the task locally with `connection: local` and posts the result back as a comms event. ## Why The fleet is migrating off Tailscale SSH for agent-to-agent traffic within ~30 days. After the cutoff, agents communicate exclusively via o2r channels. Standard `ansible-playbook -i hosts.yml` with the default `ssh` connection plugin stops working at that point. The shape Kai sketched: Ansible already has `connection: ssh` and `connection: local`; o2r becomes the third option. From the playbook author's perspective, nothing changes except the inventory line `ansible_connection: o2r` and the channel id the host listens on. Existing roles run unchanged. This keeps Ansible viable as the fleet's host-config tool without committing to a giant rewrite of how playbooks express intent. ## Shape (sketch) - New Python package `ansible-collection-otel-a2a-relay` (or similar) shipping a connection plugin under `connection_plugins/o2r.py`. - Plugin implements the standard `ansible.plugins.connection.ConnectionBase` interface: `_connect`, `exec_command`, `put_file`, `fetch_file`, `close`. - Each `exec_command` posts a `comms` event of kind (e.g.) `ansible.task` to the configured channel, then blocks polling channel events for a matching `ansible.result` comms reply. Timeout configurable. - `put_file` / `fetch_file` ship file payloads through the same channel (chunked if needed, or pinned to a max size with a clear failure mode if larger). - On-host worker is a separate package: `o2r-ansible-worker` daemon. Subscribes to its channel, pops `ansible.task` events, executes via local Ansible action plugins (so the task module ecosystem works unchanged), posts `ansible.result` back. - Auth: same bearer token shape as the rest of the channel API. Worker resolves from local SSM equivalent or env. ## Out of scope for this issue - The on-host worker implementation - separate issue, separate repo (or sub-package). - Backporting existing Ansible roles to use `ansible_connection: o2r` - per-role follow-ups. - Performance work for large file transfers via channel events - profile first. ## Refs - Direction set by Kai on R9GH, 2026-06-03. - Companion architecture decision: agentic-os-kai#598 (Ansible local-only + channel-dispatched orchestration). - Channel protocol: `otel-a2a-relay/docs/channels-protocol.md`. - Channel skill: `otel-a2a-relay/skills/ops-eng-o2r-agent-channel/SKILL.md`.

coilysiren added the

label

2026-06-04 08:16:40 +00:00

coilysiren commented

2026-06-17 08:23:44 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:23:44 +00:00