Hosted deployment artifacts for sim-minutes API + worker (closes #3)#7
Merged
Merged
Conversation
Packages the M26/M30 control plane and the M27 sim-minutes worker for a hosted
deployment (no application behavior change). Adds cloud/deploy/:
- Dockerfile.api -> uvicorn volo_cloud.app:create_cloud_app --factory :8080
- Dockerfile.worker -> volo-cloud-worker --poll 2 (the queue drain loop)
- fly.toml -> one image, two processes (app + worker)
- README.md -> Postgres via VOLO_DB_URL, RS256/HS256 SSO secrets, the
VOLO_SIM_AGENT_ALLOWLIST execution gate, and fly launch/deploy
- .dockerignore -> trims the build context
Both images build from the repo root and uv sync the whole workspace so the
auth seam (volo-api) and the serve extra (uvicorn) are present. The worker only
executes allowlisted agents (ADR-0033) and should additionally be sandboxed per
job in production. Closes #3.
🛫 Volo reliability — ❌ NO-SHIPReplayed 7 adversarial scenarios against the agent (threshold ≥ 0.90).
Cost — replayed deterministically at $0 (no live API calls). baseline |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3.
Packages the M26/M30 control plane and the M27 sim-minutes worker for a hosted deployment. No application behavior change — this is packaging + docs.
Contents (
cloud/deploy/)Dockerfile.api—uvicorn volo_cloud.app:create_cloud_app --factoryon :8080.Dockerfile.worker—volo-cloud-worker --poll 2, the queue drain loop.fly.toml— one image, two processes (app+worker), HTTP service + autoscale-to-zero.README.md— Postgres viaVOLO_DB_URL, RS256/HS256 SSO secrets, theVOLO_SIM_AGENT_ALLOWLISTexecution gate, andfly launch/deploy..dockerignore— trims the build context.Both images build from the repo root and
uv syncthe whole workspace, so the auth seam (volo-api, imported by the cloud app) and theserveextra (uvicorn) are present. The worker only executes agents inVOLO_SIM_AGENT_ALLOWLIST(ADR-0033) and should additionally be sandboxed per job in production.Verification
The Docker daemon isn't running in this environment, so the images weren't built here. Instead the exact commands the containers run were verified to resolve offline:
create_cloud_app()returns a FastAPI app; uvicorn (0.48) loads thevolo_cloud.app:create_cloud_appfactory string.volo-cloud-worker --helpresolves with the--poll/--onceflags the manifests use.A slimmer cloud-only image is noted as a follow-up. Refs ADR-0033.