[PR #81] [CLOSED] fix(orchestrator): roll back network policy when metadata persist fails #164

New issue

Closed

opened 2026-10-29 14:20:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:20:31 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/81
Author: @Ayush7614
Created: 7/29/2026
Status: ❌ Closed

Base: main ← Head: fix/network-policy-metadata-rollback

📝 Commits (2)

02d187a fix(orchestrator): roll back network policy when metadata persist fails
ed44e93 fix(orchestrator): make network policy updates cancel-safe and serialized

📊 Changes

3 files changed (+398 additions, -24 deletions)

View changed files

📝 src/orchestrator/service.rs (+72 -20)
📝 src/orchestrator/tests.rs (+308 -1)
📝 src/sandbox/mock.rs (+18 -3)

📄 Description

Summary

Network policy updates applied live iptables/runtime rules before persisting metadata.
A store failure returned an error while egress rules had already changed, desyncing API metadata from enforced policy.
On persist failure, roll the runtime policy back to the previous value and map StateConflict to 409 like patch-params.

Test plan

Added sandbox_network_policy_rolls_back_when_metadata_persist_fails
cargo test -p agentenv --lib sandbox_network_policy

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/81 **Author:** [@Ayush7614](https://github.com/Ayush7614) **Created:** 7/29/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/network-policy-metadata-rollback` --- ### 📝 Commits (2) - [`02d187a`](https://github.com/kvcache-ai/AgentENV/commit/02d187a0b47619173e868d6004286f3b62fb54ab) fix(orchestrator): roll back network policy when metadata persist fails - [`ed44e93`](https://github.com/kvcache-ai/AgentENV/commit/ed44e936f0519f9fba9cc0dcae14cf7d14f21575) fix(orchestrator): make network policy updates cancel-safe and serialized ### 📊 Changes **3 files changed** (+398 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `src/orchestrator/service.rs` (+72 -20) 📝 `src/orchestrator/tests.rs` (+308 -1) 📝 `src/sandbox/mock.rs` (+18 -3) </details> ### 📄 Description ## Summary - Network policy updates applied live iptables/runtime rules before persisting metadata. - A store failure returned an error while egress rules had already changed, desyncing API metadata from enforced policy. - On persist failure, roll the runtime policy back to the previous value and map `StateConflict` to 409 like patch-params. ## Test plan - [x] Added `sandbox_network_policy_rolls_back_when_metadata_persist_fails` - [x] `cargo test -p agentenv --lib sandbox_network_policy` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-29 14:20:31 +00:00