Skip to content

Parity with AX 6e970c5: Substrate 1.0, workspace check, ssh -n, router cert expiry - #13

Merged
h0ffmann merged 5 commits into
mainfrom
claude/project-thread-uixg5x
Nov 3, 2026
Merged

h0ffmann merged 5 commits into
mainfrom
claude/project-thread-uixg5x

Conversation

@h0ffmann

@h0ffmann h0ffmann commented Nov 3, 2026 •

Copy link
Copy Markdown
Collaborator

Requested by Hoffmann · project thread

Brings RAX from AX f0228f1 (the parity point of #12) to AX main at 6e970c5 (2026-11-03), covering the four upstream changes in between:

Upstream change RAX
Substrate v1.0.0-rc.1. The control API package is now substrate.ateapi.v1 (new gRPC paths). Templates leave storage_location empty by default, AX_SNAPSHOTS_BUCKET is gone, and the install runs ate-setup --kind. Copied api/ateapi/v1/ateapi.proto to proto/ateapi/v1/. build_actor_template sets no location unless given one. Dropped DEFAULT_SNAPSHOTS_BUCKET and the env var. hack/local runs ate-setup --kind when install-ate-kind.sh is missing. The E2E replay assertion and docs are updated.
CreateTask checks the bound Workspace. A missing one gives FailedPrecondition and nothing is stored. Store errors are Internal. Same in rax-server, with the table test ported (missing, other atespace, store error, present, no binding).
Router TLS cache follows the certificate's expiry. The cache lasts at most 30 minutes, or until 1 minute before NotAfter. Certs that are expired or near expiry are ignored, and an already-expired cert is refused. Same in rax-cli::router_tls, reading NotAfter with x509-parser, with tests for the math and the cache load.
ssh honors -n/--namespace over $AX_SYSTEM_NAMESPACE. The guest and router dialing is split out, and the mTLS setup error is reported when the port-80 fallback also fails. Same in rax-cli, with the precedence test ported. RAX's port-forward already sees EOF when kubectl exits.

Also adds AGENTS.md (and a CLAUDE.md pointing to it) with a hard rule: agents never reference upstream AX PRs or issues by number or link.

The README parity section is updated to 6e970c5, with 172 tests.

Merge note: please squash-merge. The four port commits' messages cite upstream PR numbers, and squashing replaces them with a clean message (rewriting the branch history wasn't permitted from my side).

Testing

  • CI is green: shellcheck, cargo fmt --check, clippy -D warnings, cargo test --all with PostgreSQL, the drawing check, and the rax-server image build.
  • Not run against a real Substrate 1.0 cluster. The in-memory Substrate used in the tests compiles from the new proto.

🤖 Generated with Claude Code

https://claude.ai/code/session_0193yhp48e7N3epyEKim39w7

Substrate 1.0 renamed the control API package from ateapi to
substrate.ateapi.v1, so the gRPC paths change. Copy its
api/ateapi/v1/ateapi.proto, leave the template snapshot location empty by
default so Substrate uses its cluster-wide one (a template-level location
needs the PerTemplateSnapshotLocation preview gate), and drop
AX_SNAPSHOTS_BUCKET and its default bucket. The local cluster setup
installs Substrate 1.0 with ate-setup --kind, as AX's kind setup now does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0193yhp48e7N3epyEKim39w7
Tasks are immutable, so a task created before its Workspace kept an empty
workspace for its whole life. CreateTask now fails with FailedPrecondition
and stores nothing, reports store lookup failures as Internal, and hands the
reconciler the workspace it resolved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0193yhp48e7N3epyEKim39w7
… AX #541 does

Cache credentials until 30 minutes on or a minute before the client
certificate expires, whichever is sooner; ignore cached certificates that
are expired or within that minute; and refuse a certificate issued already
expired.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0193yhp48e7N3epyEKim39w7
…44 does; README: parity as of AX 6e970c5

The system namespace defaults to $AX_SYSTEM_NAMESPACE, then ax-system, and
-n/--namespace overrides both, for ssh as for tunnels. When the plaintext
router fallback fails, the error now includes why mTLS on 443 was skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0193yhp48e7N3epyEKim39w7
@h0ffmann h0ffmann self-assigned this Nov 3, 2026
…ssues

Agents must describe upstream changes in their own words rather than cite
AX pull request or issue numbers or links. CLAUDE.md points Claude Code at
the same file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0193yhp48e7N3epyEKim39w7
@h0ffmann
h0ffmann merged commit 6c30a0e into main Nov 3, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants