docs(proxy): document cluster-wide account cap partitioning - #1750
Conversation
Fix (c) of issue #1354. proxy_account_stream_limit reads like a per-replica value but is a cluster-wide target partitioned across the bridge ring (floor(cap/R) + remainder by rank, floored at 1), so the default 8 becomes 3/3/2 slots on three replicas — the amplifier behind the original report. Adds an Account Cap Sizing section to the proxy-admission-control context (SSOT) and an operator-facing subsection on the Kubernetes multi-replica page, covering the recovery reserve's selection-time-only subtraction, the share-growth hysteresis, the turn-scoped-lease interaction, the undersizing signature, and the one-process-per-pod requirement. Refs #1354 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6149da9799
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- A cap of 0 stays unlimited on every replica; the floor-of-1 applies only to positive caps. - Partitioning is the default scope; proxy_account_caps_scope=replica is the supported opt-out where every replica enforces the full cap. - On an initialized deployment the dashboard-persisted caps are authoritative over the environment values, so operators must change the cap in the dashboard, not by restarting with a new env var. - The stale-lease bound for streams is not the raw 900s TTL: a long stream must not be reclaimed mid-flight, so the sweep uses max(TTL, longest stream budget) + 60s — 7260s with default budgets. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 88b215ab3a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ception - When the cap is below the replica count, the floor of 1 makes the aggregate equal the replica count and grow with each added replica; the 'adding replicas only re-partitions' rule holds only at cap >= replicas. - There is no dashboard path back to an unset cap, so drop the 'keep it unset' alternative: env values only seed the initial dashboard row. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Fix (c) of #1354 — the last remaining item there; (a) landed in #1476 and (b) in #1747.
proxy_account_stream_limitreads like a per-replica value but is a cluster-wide target, partitioned across the bridge ring asfloor(cap / R)with the remainder distributed by rank and every share floored at 1. With the default cap of 8 and three replicas, one account gets 3/3/2 slots per replica — the amplifier behind #1354's original report, where a handful of held slots exhausted a replica's share.Two renderings of the same content, per the docs policy:
openspec/specs/proxy-admission-control/context.md(SSOT): sizing guidance, the floor-of-1 aggregate behavior whencap < replicas, the recovery reserve being selection-time-only (and proportionally heavy on small shares), share-growth hysteresis on membership changes, the turn-scoped-lease interaction and theproxy_account_lease_ttl_secondsfallback bound, and the undersizing signature (persistentaccount_stream_capwith idle replicas → raise the cap, don't add replicas).docs/deployment/kubernetes.md: an operator-facing subsection under Multi-replica behavior with the practical consequences and a link back to the owning capability, which is also added to the page footer.Docs/context only — no code, no normative spec change, so no OpenSpec change folder.
openspec validate --specspasses (57).Refs #1354
🤖 Generated with Claude Code