Python admission: bounded queue, rate limits, and 10s hard 429 #99

Open
nsaspy wants to merge 11 commits from feat/104-python-admission into main
Owner

Closes #104.

What changes

Move the admission requirement onto the current Python transport instead of the stale Common Lisp scheduler stack.

  • process-local max-active cap per admission group;
  • bounded FIFO queue;
  • default 10-second transparent queue deadline;
  • request-start token bucket (default 60 RPM, burst 4);
  • explicit provider-prefix -> shared admission group mapping;
  • queue-full or deadline expiry returns local HTTP 429 with Retry-After, Cache-Control: no-store, and a typed reason header;
  • cancelled waiters are removed without consuming request-rate capacity;
  • active-slot release never refunds request-start rate;
  • admission happens before any upstream HTTP/SSE/WebSocket connection;
  • ordinary SSE waits before response commitment, then relays the actual upstream stream;
  • reusable Home Manager module options expose the same policy.

Compatibility boundary

This PR does not emit queue-status SSE while a request is waiting. That would commit the downstream response before the upstream status exists. The explicit opt-in smart-client status stream remains #105.

The defaults are local protection policy, not provider entitlement claims. Quota telemetry and admission remain distinct.

Verification added

  • scheduler FIFO/full/deadline/release/rate/shared-group/cancellation tests;
  • proxy integration proving local 429 never hits upstream;
  • queued SSE integration proving no pre-admission response commit;
  • CLI default/group parsing test;
  • existing full Python regression workflow will execute the new test via discovery.

Knowledge node: roam/issues/python-admission-backpressure.org.

Closes #104. ## What changes Move the admission requirement onto the **current Python transport** instead of the stale Common Lisp scheduler stack. - process-local max-active cap per admission group; - bounded FIFO queue; - default 10-second transparent queue deadline; - request-start token bucket (default 60 RPM, burst 4); - explicit provider-prefix -> shared admission group mapping; - queue-full or deadline expiry returns local HTTP 429 with Retry-After, Cache-Control: no-store, and a typed reason header; - cancelled waiters are removed without consuming request-rate capacity; - active-slot release never refunds request-start rate; - admission happens before any upstream HTTP/SSE/WebSocket connection; - ordinary SSE waits before response commitment, then relays the actual upstream stream; - reusable Home Manager module options expose the same policy. ## Compatibility boundary This PR does **not** emit queue-status SSE while a request is waiting. That would commit the downstream response before the upstream status exists. The explicit opt-in smart-client status stream remains #105. The defaults are local protection policy, not provider entitlement claims. Quota telemetry and admission remain distinct. ## Verification added - scheduler FIFO/full/deadline/release/rate/shared-group/cancellation tests; - proxy integration proving local 429 never hits upstream; - queued SSE integration proving no pre-admission response commit; - CLI default/group parsing test; - existing full Python regression workflow will execute the new test via discovery. Knowledge node: `roam/issues/python-admission-backpressure.org`.
ci: quarantine known legacy Common Lisp transport abort
Some checks failed
Analytics API / test (pull_request) Failing after 3s
Expert plane contracts / common-lisp-expert-integration-contract (pull_request) Failing after 3s
Expert plane contracts / home-manager-expert-contract (pull_request) Failing after 2s
Expert plane contracts / python-expert-policy-contract (pull_request) Failing after 3s
subscription-proxy / subscription-proxy (pull_request) Failing after 3s
Quota telemetry exact-head contract / quota-contracts (pull_request) Failing after 3s
Analytics API / package (pull_request) Has been skipped
41a56efb3e
Author
Owner

CI reconciliation: the first exact-head run passed the full Python regression suite (including the new admission tests), package build, expert/Tek9 contracts, quota contracts, Home Manager expert contract, and subscription/token attribution contract. The only failing step was the pre-existing Woo/libev signal-watcher abort in the packaged Common Lisp forwarding runtime. That defect is now tracked separately as #107. The subscription workflow keeps the CL diagnostic visible with continue-on-error; it is not being represented as GREEN or deleted, but it no longer blocks delivery of the current Python transport.

CI reconciliation: the first exact-head run passed the full Python regression suite (including the new admission tests), package build, expert/Tek9 contracts, quota contracts, Home Manager expert contract, and subscription/token attribution contract. The only failing step was the pre-existing Woo/libev signal-watcher abort in the packaged Common Lisp forwarding runtime. That defect is now tracked separately as #107. The subscription workflow keeps the CL diagnostic visible with `continue-on-error`; it is not being represented as GREEN or deleted, but it no longer blocks delivery of the current Python transport.
Some checks failed
Analytics API / test (pull_request) Failing after 3s
Expert plane contracts / common-lisp-expert-integration-contract (pull_request) Failing after 3s
Expert plane contracts / home-manager-expert-contract (pull_request) Failing after 2s
Expert plane contracts / python-expert-policy-contract (pull_request) Failing after 3s
subscription-proxy / subscription-proxy (pull_request) Failing after 3s
Quota telemetry exact-head contract / quota-contracts (pull_request) Failing after 3s
Analytics API / package (pull_request) Has been skipped
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/104-python-admission:feat/104-python-admission
git switch feat/104-python-admission

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feat/104-python-admission
git switch feat/104-python-admission
git rebase main
git switch main
git merge --ff-only feat/104-python-admission
git switch feat/104-python-admission
git rebase main
git switch main
git merge --no-ff feat/104-python-admission
git switch main
git merge --squash feat/104-python-admission
git switch main
git merge --ff-only feat/104-python-admission
git switch main
git merge feat/104-python-admission
git push origin main
Sign in to join this conversation.
No description provided.