guest-agent: freeze the unversioned API at the v0.5.11 surface - #1113
Closed
kvinwang wants to merge 2 commits into
Closed
guest-agent: freeze the unversioned API at the v0.5.11 surface#1113kvinwang wants to merge 2 commits into
kvinwang wants to merge 2 commits into
Conversation
added 2 commits
August 24, 2026 01:39
0.6.0 dropped the `Verify` RPC because verification needs no key material and no attestation, and the agent's verdict arrives over the socket unattested -- the reasoning still holds, and SDKs >= 0.6 verify locally. But dropping it broke every 0.5.x SDK against a 0.6 agent for a method those SDKs still call, and prpc answers an unknown method with a bare HTTP 400, so the caller cannot tell a removed method from a wrong socket. The unversioned surface is what 0.5.x clients speak; new API design belongs in `dstack.guest.v1`, not in breaking this one. Restore the RPC and its messages at the v0.5.11 field numbers, marked deprecated and legacy-only, and annotate the service as frozen: no renumbering, no removals, no semantic changes. Semantics are identical to 0.5.11, including k256 rejecting non-canonical high-S signatures outright.
`EmitEvent` is gone for good -- runtime RTMR3 events are system-owned in 0.6.0, so an app extending the measurement chain is no longer something this API should offer. Deleting the method outright is the wrong way to say that. prpc answers both "no such method" and "the handler failed" with HTTP 400 and drops the message, so a 0.5.x app that emits events gets a bare 400 that reads identically to a wrong socket path or a broken build, and its author has no way to learn why the events stopped being recorded. Keep the method and the args message on the unversioned service, and have the handler always bail with the reason. Nothing reaches `emit_runtime_event`; this is a deliberate error, not a code path.
Collaborator
Author
|
Folded into #1114 — the freeze commits are part of that branch's history; reviewing the 0.6.0 API change as one PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
nextbranch made breaking changes on the unversioned guest-agent paths that 0.5.x SDKs call: theVerifyRPC was deleted (all four 0.5.11 SDKs exposeverify()), andEmitEventwas deleted such that a pre-0.6 client gets a generic unknown-method HTTP 400 — prpc answers "no such method" and "handler failed" identically, so the caller cannot tell a deliberate removal from talking to the wrong socket.With the versioned
/v1API arriving in 0.6.0 (follow-up PR), the unversioned surface's job changes: it must stay wire-compatible with v0.5.x clients indefinitely, and all new capability moves to v1.Fix
Verifywith its exact v0.5.11 wire shape and semantics (ed25519 / secp256k1 / secp256k1_prehashed; k256's canonical low-S-only parsing preserved). Doc-commented as legacy-only: signature verification needs no TEE, and the RPC exists solely so 0.5.x clients keep working. It will not appear in v1.EmitEventas a deliberate always-failing stub: runtime RTMR3 events are system-owned in 0.6, and the method now fails with a self-explanatory message instead of an indistinguishable 400.dstack.guest.v1.Sanctioned behavior-only changes are kept:
GetQuotefails closed on non-TDX platforms,GetTlsKeyvalidatesnot_before < not_after.Verification
git show v0.5.11:guest-agent/rpc/proto/agent_rpc.proto: zero v0.5.11DstackGuestmethods missing.emit_event_reports_its_removal.cargo test -p dstack-guest-agent --all-features: 84 passed.cargo fmt --all --checkclean,cargo clippy -- -D warnings --allow unused_variablesclean,cargo check --workspace --all-featuresclean.