From 837fef9a6537a3d08a8f103ee7ce64a6959c3bfd Mon Sep 17 00:00:00 2001 From: Kishore Kumar Date: Fri, 31 Jul 2026 00:27:46 +0530 Subject: [PATCH 1/3] docs(changelog): every runner lease says whose workspace it belongs to Covers the runner lease workspace filter, the 30-day retention window for settled leases and their activity records, the startup-posture copy split, the account-teardown schedule unregister, and the write-time lifetime counters behind the runner page. Load-bearing facts kept verbatim: the workspace_id filter on GET /v1/fleets/runners/{id}/leases, its UZ-REQ-001 refusal, the agentsfleet_account_teardown_unregister_failures_total counter, and the 30-day window. Co-Authored-By: Claude Opus 5 (1M context) --- changelog.mdx | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/changelog.mdx b/changelog.mdx index 455a8ac..250a1ca 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -7,6 +7,32 @@ description: "Stay up to date with the latest agentsfleet product updates, new f agentsfleet is in **stealth-mode testing** and pre-production. APIs and agent behavior may change between releases without long deprecation windows. Email [agentsfleet@agentmail.to](mailto:agentsfleet@agentmail.to) if you want a hand calibrating an agent or to join as a design partner. + + ## Every runner lease says whose workspace it belongs to + + A runner's lease list showed every workspace's work in one undifferentiated table, so an operator looking at a shared host could not tell their own fleet's runs from anyone else's. Each lease now names its workspace, and one click narrows the table to that workspace alone. The same release stops the runner pages re-reading a host's whole history on every load, and starts pruning that history so it cannot grow without bound. + + ## Upgrading + + - **Runner lease and activity history is pruned after 30 days.** A background sweep deletes settled leases and their activity records once they pass the window; a lease that is still running or renewing is never touched. The lifetime counts on the runner page are unaffected — they count transitions as they happen, not surviving rows — but if you read raw history older than 30 days through `GET /v1/fleets/runners/{id}/leases`, export it before upgrading. + - **Three migrations apply on startup.** They add a per-runner counter table, an index for the activity feed's filtered reads, and the delete grants the sweep needs. The counter table backfills itself from existing history inside the migration, so no step is manual and no existing row is rewritten. + + ## What's new + + - **The lease table has a Workspace column.** Each row links to that workspace's fleet wall and carries the full identifier in its tooltip; a funnel beside it narrows the table to that workspace alone. + - **The workspace filter lives in the address bar.** `?workspace=` is deep-linkable, survives a reload, and Back steps out of it — so a narrowed view is something you can send to someone. + + ## API reference + + - `GET /v1/fleets/runners/{id}/leases?workspace_id=` — new optional filter, still requiring `runner:read`. The response shape is unchanged and `total` narrows with the page. A malformed value answers `400` `UZ-REQ-001`; a well-formed identifier that owns nothing answers an empty page rather than an error, so a stale link reads as "no leases" instead of failing. + + ## Bug fixes + + - **A runner that refused a run no longer reads as a fleet missing instructions.** Both conditions reported the same startup class, so a sandbox, egress, or resource-control refusal on the host was blamed on the fleet's own configuration. The chat row now names the runner's reason. + - **Deleting an account unregisters its scheduled runs.** The purge removed the schedule rows but never told the upstream scheduler, so an erased tenant's cron kept firing at runners indefinitely. Teardown now unregisters upstream while those rows still exist, and counts a provider failure on `agentsfleet_account_teardown_unregister_failures_total` rather than swallowing it — erasure still completes either way. + - **The runner page no longer re-counts a host's whole history to show four numbers.** Acquired, succeeded, failed, and expired are maintained as each lease settles, so the page cost stays flat however long the host has been running. + + ## The isolation you assign is the isolation the runner applies From 421fa20ce127795654d7111fb798899512b92ff3 Mon Sep 17 00:00:00 2001 From: Kishore Kumar Date: Fri, 31 Jul 2026 10:50:45 +0530 Subject: [PATCH 2/3] docs(changelog): cover the post-review hardening in the runner lease entry The Jul 31 runner-lease entry predates the review fixes it ships with. Revised: the 30-day window is measured from settlement, not acquisition; only the two per-lease activity records are pruned and the Activity feed is kept at any age; four migrations apply, not three; starting_after composes with the workspace_id filter and answers 400 UZ-REQ-001 across filter contexts; one failed schedule unregister no longer strands the rest; missing provider credentials count as failures; concurrent deletions no longer starve the unregister pass of pool connections. Load-bearing facts kept verbatim: GET /v1/fleets/runners/{id}/leases, UZ-REQ-001, agentsfleet_account_teardown_unregister_failures_total, the 30-day window. History untouched: the M151 entry and older entries carry through the rebase verbatim. Co-Authored-By: Claude Opus 5 (1M context) --- changelog.mdx | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/changelog.mdx b/changelog.mdx index 250a1ca..193361f 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -14,8 +14,8 @@ description: "Stay up to date with the latest agentsfleet product updates, new f ## Upgrading - - **Runner lease and activity history is pruned after 30 days.** A background sweep deletes settled leases and their activity records once they pass the window; a lease that is still running or renewing is never touched. The lifetime counts on the runner page are unaffected — they count transitions as they happen, not surviving rows — but if you read raw history older than 30 days through `GET /v1/fleets/runners/{id}/leases`, export it before upgrading. - - **Three migrations apply on startup.** They add a per-runner counter table, an index for the activity feed's filtered reads, and the delete grants the sweep needs. The counter table backfills itself from existing history inside the migration, so no step is manual and no existing row is rewritten. + - **Runner lease history is pruned 30 days after settlement.** A background sweep deletes a settled lease once 30 days pass from the moment it settled — not from when it started — along with the two per-lease activity records that describe it. A lease still running or renewing is never touched, and the runner's lifecycle activity (the Activity feed) is kept at any age, so a long-lived host never shows an empty feed. The lifetime counts on the runner page are unaffected — they count transitions as they happen, not surviving rows — but if you read raw lease history older than 30 days through `GET /v1/fleets/runners/{id}/leases`, export it before upgrading. + - **Four migrations apply on startup.** They add a per-runner counter table, an index for the activity feed's filtered reads, the delete grants the sweep needs, and two indexes that keep the sweep itself off whole-table scans. The counter table backfills itself from existing history inside the migration, so no step is manual and no existing row is rewritten. ## What's new @@ -24,12 +24,14 @@ description: "Stay up to date with the latest agentsfleet product updates, new f ## API reference - - `GET /v1/fleets/runners/{id}/leases?workspace_id=` — new optional filter, still requiring `runner:read`. The response shape is unchanged and `total` narrows with the page. A malformed value answers `400` `UZ-REQ-001`; a well-formed identifier that owns nothing answers an empty page rather than an error, so a stale link reads as "no leases" instead of failing. + - `GET /v1/fleets/runners/{id}/leases?workspace_id=` — new optional filter, still requiring `runner:read`. The response shape is unchanged and `total` narrows with the page. A malformed value answers `400` `UZ-REQ-001`; a well-formed identifier that owns nothing answers an empty page rather than an error, so a stale link reads as "no leases" instead of failing. `starting_after` composes with the filter: the cursor must name a lease on the filtered page, and one taken under a different `workspace_id` answers the same `400` `UZ-REQ-001` instead of silently skipping rows. ## Bug fixes - **A runner that refused a run no longer reads as a fleet missing instructions.** Both conditions reported the same startup class, so a sandbox, egress, or resource-control refusal on the host was blamed on the fleet's own configuration. The chat row now names the runner's reason. - **Deleting an account unregisters its scheduled runs.** The purge removed the schedule rows but never told the upstream scheduler, so an erased tenant's cron kept firing at runners indefinitely. Teardown now unregisters upstream while those rows still exist, and counts a provider failure on `agentsfleet_account_teardown_unregister_failures_total` rather than swallowing it — erasure still completes either way. + - **One failed schedule no longer strands the rest.** The unregister pass stopped at the first provider error, leaving every schedule behind it firing forever. Each schedule is now attempted; a failure is logged with the identifiers needed to retire the survivor by hand, and missing provider credentials count on the same failure counter instead of passing silently. + - **Simultaneous account deletions no longer skip the scheduler.** Concurrent deletions could exhaust the database connection pool, time out every unregister, and still complete the purge. The unregister pass now runs without holding a connection, so deletions queue instead of starving each other. - **The runner page no longer re-counts a host's whole history to show four numbers.** Acquired, succeeded, failed, and expired are maintained as each lease settles, so the page cost stays flat however long the host has been running. From b4ce6a5f920bc67b4bc9213585ed474189dfeec9 Mon Sep 17 00:00:00 2001 From: Kishore Kumar Date: Fri, 31 Jul 2026 16:36:00 +0530 Subject: [PATCH 3/3] docs(changelog): the abandoned-lease reaper and the refused-address way out The second review round added two user-visible behaviours the entry did not carry: a lease whose runner died on a fleet never used again is marked expired once it passes the retention window and then keeps its own window like any settled lease, and a bookmarked lease page the server refuses now links to the newest leases instead of prescribing a refresh that replays the same address. Co-Authored-By: Claude Opus 5 (1M context) --- changelog.mdx | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/changelog.mdx b/changelog.mdx index 193361f..e8b9fed 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -14,7 +14,7 @@ description: "Stay up to date with the latest agentsfleet product updates, new f ## Upgrading - - **Runner lease history is pruned 30 days after settlement.** A background sweep deletes a settled lease once 30 days pass from the moment it settled — not from when it started — along with the two per-lease activity records that describe it. A lease still running or renewing is never touched, and the runner's lifecycle activity (the Activity feed) is kept at any age, so a long-lived host never shows an empty feed. The lifetime counts on the runner page are unaffected — they count transitions as they happen, not surviving rows — but if you read raw lease history older than 30 days through `GET /v1/fleets/runners/{id}/leases`, export it before upgrading. + - **Runner lease history is pruned 30 days after settlement.** A background sweep deletes a settled lease once 30 days pass from the moment it settled — not from when it started — along with the two per-lease activity records that describe it. A lease still running or renewing is never touched, and the runner's lifecycle activity (the Activity feed) is kept at any age, so a long-lived host never shows an empty feed. A lease whose runner died without reporting, on a fleet that is never used again, is marked expired once it passes the same window and then keeps its own window like any settled lease. The lifetime counts on the runner page are unaffected — they count transitions as they happen, not surviving rows — but if you read raw lease history older than 30 days through `GET /v1/fleets/runners/{id}/leases`, export it before upgrading. - **Four migrations apply on startup.** They add a per-runner counter table, an index for the activity feed's filtered reads, the delete grants the sweep needs, and two indexes that keep the sweep itself off whole-table scans. The counter table backfills itself from existing history inside the migration, so no step is manual and no existing row is rewritten. ## What's new @@ -32,6 +32,7 @@ description: "Stay up to date with the latest agentsfleet product updates, new f - **Deleting an account unregisters its scheduled runs.** The purge removed the schedule rows but never told the upstream scheduler, so an erased tenant's cron kept firing at runners indefinitely. Teardown now unregisters upstream while those rows still exist, and counts a provider failure on `agentsfleet_account_teardown_unregister_failures_total` rather than swallowing it — erasure still completes either way. - **One failed schedule no longer strands the rest.** The unregister pass stopped at the first provider error, leaving every schedule behind it firing forever. Each schedule is now attempted; a failure is logged with the identifiers needed to retire the survivor by hand, and missing provider credentials count on the same failure counter instead of passing silently. - **Simultaneous account deletions no longer skip the scheduler.** Concurrent deletions could exhaust the database connection pool, time out every unregister, and still complete the purge. The unregister pass now runs without holding a connection, so deletions queue instead of starving each other. + - **A stale lease link offers a way back.** A bookmarked lease page whose workspace filter or page cursor the server no longer accepts showed "try refreshing", which replayed the same address every time — and the control that could clear the filter sits inside the table that a failed read does not draw. That page now links to the newest leases instead. - **The runner page no longer re-counts a host's whole history to show four numbers.** Acquired, succeeded, failed, and expired are maintained as each lease settles, so the page cost stays flat however long the host has been running.