OSEP-0024 · Auto-Pause & Wake-on-Access

OSEP-0024 · Auto-Pause & Wake-on-Access A sequence diagram generated by Archify. Business request (exec / file / user ports) SET opensandbox:activity:{id} = now_ms EX ttl Fire-and-forget: async buffered write, coalesced to ≤ 1 per 5s per sandbox; failures are logged and dropped — never on the hot path MGET opensandbox:activity:{id} last_active; missing key ⇒ unknown, raise tombstone. Gates in order: opt-in annotation → Running → idle ≥ X → not expired → NX distributed lock → re-verify under lock GET {path} — sentinel OpenSandbox-Skip-Activity Issued via the gateway like ordinary traffic, never recorded as activity. When activeProbe is declared: busy ⇒ record activity, drop this sweep; false ⇒ proceed; failure/timeout ⇒ drop (fail-safe) PauseSandbox (idempotent CAS, idlepause-{id}) checkpoint vmstate + rootfs → release runtime accepted: Pausing → Paused (CRD kept, footprint 0) Request hits a Paused sandbox ResolveEndpoint ⇒ FailedPrecondition · GetSandbox ⇒ Paused Wakeable states: Paused / Pausing / Resuming. Read idle-policy annotation (K8s GET): no policy or wakeOnAccess=false ⇒ permanent 503, never resume ResumeSandbox (expected_checkpoint_id fence, desired state) singleflight join-or-start: acquire parking slot + restore permit first; concurrent requests join one flight, sharing the remaining budget poll GetSandbox until Ready (backoff, ≤ budget Y) forward (Runtime + DataPlane Ready) 200 response budget exhausted → 503 + Retry-After: 1 · OpenSandbox-Wake: expired Gateway-owned marker proves the request was never forwarded — safe to retry for any method. The flight is NOT canceled; the restore converges in the background Active — recording Auto-pause — idle ≥ X Wake-on-access — park ≤ Y Client / SDK · Sequence participant Client / SDK Ingress Gateway · Sequence participant Ingress Gateway Redis · Sequence participant Redis Lifecycle Server · Sequence participant Lifecycle Server Fast-Path · Sequence participant Fast-Path Sandbox Runtime · Sequence participant Sandbox Runtime Legend request return async trace default message

Single Observation Point

  • • Ingress: sole activity producer, sole wake authority
  • • Activity writes are fire-and-forget — zero added latency
  • • Missing key = unknown (tombstone): only ever delays a pause

Bounded Wake

  • • One resume flight per sandbox per replica (singleflight)
  • • Parking slot + restore permit admitted before any RPC
  • • Budget exhausted ⇒ 503 + Retry-After; restore never canceled

Three-Party Activation, Off by Default

  • • server [idle_pause] · ingress --activity/--wake · lifecycle.idlePolicy
  • • No idlePolicy declared ⇒ never auto-paused, never auto-woken
  • • Every failure resolves to keep running or 503