Add trust quorum reconfiguration endpoints to sled-agent API #9556

plaidfinch · 2025-12-21T00:44:22Z

Add trust quorum endpoints to the sled-agent API and factors trust-quorum types into versioned crates following the pattern blazed by RFD 619.

New sled-agent API endpoints (Version 13: `ADD_TRUST_QUORUM`)

PUT /trust-quorum/configuration - Initiate a reconfiguration
PUT /trust-quorum/upgrade - Upgrade from legacy (LRTQ) trust quorum
PUT /trust-quorum/commit - Commit a configuration
GET /trust-quorum/coordinator-status - Get coordinator status
PUT /trust-quorum/prepare-and-commit - Prepare and commit a configuration
PUT /trust-quorum/proxy/commit - Proxy commit to another node
PUT /trust-quorum/proxy/prepare-and-commit - Proxy prepare-and-commit to another node
GET /trust-quorum/proxy/status - Get status from another node (destination via query params)

Trust-Quorum types are now versioned

Two new crates:

trust-quorum-types: Re-exports latest::* from the versions crate
trust-quorum-types-versions: Contains versioned type definitions with JsonSchema derives for OpenAPI generation

Note that this required turning some inherent methods into free functions (e.g. Configuration::new into new_configuration) because it's not possible to define an inherent method across a crate boundary, and it's not desirable to pull across a bunch of the trust-quorum-protocol implementation into the -types crate's impl area.

`BaseboardId` moved into `sled-hardware-types`

Moved BaseboardId from sled-agent-types-versions to sled-hardware-types to allow sharing across crates without a circular dependency (trust-quorum-types on sled-agent-types and vice-versa). Both sled-agent-types-versions and trust-quorum-types-versions now re-export from sled-hardware-types.

sled-agent/src/http_entrypoints.rs

sled-agent/src/sim/http_entrypoints.rs

sled-agent/types/versions/src/add_trust_quorum/trust_quorum.rs

trust-quorum/protocol/src/lib.rs

nexus/mgs-updates/src/test_util/host_phase_2_test_state.rs

sled-agent/api/src/lib.rs

sled-agent/src/http_entrypoints.rs

sled-agent/src/sim/http_entrypoints.rs

sled-agent/types/versions/src/add_trust_quorum/trust_quorum.rs

sled-agent/api/src/lib.rs

trust-quorum/protocol/src/lib.rs

sled-agent/types/versions/src/add_trust_quorum/trust_quorum.rs

sled-agent/src/http_entrypoints.rs

sled-agent/types/versions/src/add_trust_quorum/trust_quorum.rs

This commit addresses feedback from PR #9556 review: - Changed all idempotent mutating endpoints from POST to PUT - `/trust-quorum/reconfigure` → `/trust-quorum/configuration` - `/trust-quorum/upgrade-from-lrtq` → `/trust-quorum/upgrade` - `trust_quorum_commit` now returns `HttpResponseUpdatedNoContent` and returns an error if `CommitStatus::Pending` is returned (which indicates an unexpected state) - `trust_quorum_proxy_commit` follows the same pattern - `trust_quorum_prepare_and_commit` continues to return `CommitStatus` (per discussion, `Pending` is valid here, unlike above) - Changed from `PUT` with `TypedBody<TrustQuorumProxyStatusRequest>` to `GET` with `Query<BaseboardId>` - The destination baseboard ID is now passed as query parameters instead of a request body, which is more appropriate for a read-only operation Added `#[serde(rename_all = "snake_case")]` to enum types for consistent JSON serialization: - `Alarm` variants - `CommitStatus` variants - `ConfigurationError` variants - `RackSecretReconstructError` variants - `DecryptionError` variants - `SplitError` and `CombineError` (in gfss) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

andrewjstone

This looks great @plaidfinch! Thanks for taking care of this.

My biggest request is that we don't re-export types everywhere and instead use them directly from their crates.

sled-agent/api/src/lib.rs

trust-quorum/protocol/src/crypto.rs

sled-agent/types/versions/src/add_trust_quorum/trust_quorum.rs

sled-agent/types/versions/src/initial/sled.rs

trust-quorum/src/task.rs

trust-quorum/types/versions/src/impls/mod.rs

trust-quorum/types/versions/src/initial/crypto.rs

trust-quorum/types/versions/src/impls/epoch.rs

sled-agent/src/http_entrypoints.rs

- HTTP methods corrected (POST for non-idempotent operations) - Re-exports removed between TQ crates - Salt::new() reverted to inherent method - Hex schema annotations for OpenAPI - InlineErrorChain for error formatting - Lines hard-wrapped at 80 cols

The following endpoints are created for trust quorum reconfiguration: - POST `/trust-quorum/reconfigure` - Initiate a reconfiguration - POST `/trust-quorum/upgrade-from-lrtq` - Upgrade from low-rent (legacy) trust quorum - POST `/trust-quorum/commit` - Commit a trust-quorum - GET `/trust-quorum/coordinator-status` - Get coordinator status - POST `/trust-quorum/prepare-and-commit` - Prepare and commit a configuration Types are organized per RFD 619 (via feeding Claude the RFD): - API types defined in `sled-agent-types-versions/src/add_trust_quorum/` - Re-exported via `latest.rs` and `sled-agent-types/src/trust_quorum.rs` - API trait uses `latest::` paths for all trust quorum types Also exports `EncryptedRackSecrets`, `Salt`, and `Sha3_256Digest` from `trust-quorum-protocol` for use in the `prepare_and_commit` handler. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Add three new proxy endpoints to the sled-agent API that allow forwarding trust quorum operations to other nodes: - POST `/trust-quorum/proxy/commit` - POST `/trust-quorum/proxy/prepare-and-commit` - POST `/trust-quorum/proxy/status` Also refactors the trust quorum types to use `serde_with` with `Hex` encoding for cleaner serialization of digests and encrypted rack secrets, replacing manual hex string parsing with automatic encoding/decoding. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Create `trust-quorum-types` and `trust-quorum-types-versions` crates following the RFD 619 pattern for API type versioning. - `trust-quorum-types`: Re-exports `latest::*` from versions crate - `trust-quorum-types-versions`: Contains versioned type definitions Types used in the public API of sled-agent moved into these crates, while attempting to keep as much protocol implementation as possible in the `trust-quorum-protocol` crate. Since Rust doesn't allow adding inherent methods to foreign types, methods that operated on types now in `trust-quorum-types` have been converted to free functions: - `Salt::new()` → `new_salt()` - `EncryptedRackSecrets::decrypt()` → `decrypt_rack_secrets()` - `Configuration::new()` → `new_configuration()` Moved `BaseboardId` from `sled-agent-types-versions` to `sled-hardware-types` to allow sharing across crates without circular dependency. The sled-agent trust-quorum API types now re-export from `trust-quorum-types-versions` instead of duplicating definitions, eliminating the `TrustQuorum*`-prefixed wrapper types. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

This commit addresses feedback from PR #9556 review: - Changed all idempotent mutating endpoints from POST to PUT - `/trust-quorum/reconfigure` → `/trust-quorum/configuration` - `/trust-quorum/upgrade-from-lrtq` → `/trust-quorum/upgrade` - `trust_quorum_commit` now returns `HttpResponseUpdatedNoContent` and returns an error if `CommitStatus::Pending` is returned (which indicates an unexpected state) - `trust_quorum_proxy_commit` follows the same pattern - `trust_quorum_prepare_and_commit` continues to return `CommitStatus` (per discussion, `Pending` is valid here, unlike above) - Changed from `PUT` with `TypedBody<TrustQuorumProxyStatusRequest>` to `GET` with `Query<BaseboardId>` - The destination baseboard ID is now passed as query parameters instead of a request body, which is more appropriate for a read-only operation Added `#[serde(rename_all = "snake_case")]` to enum types for consistent JSON serialization: - `Alarm` variants - `CommitStatus` variants - `ConfigurationError` variants - `RackSecretReconstructError` variants - `DecryptionError` variants - `SplitError` and `CombineError` (in gfss) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Factor ReconfigureMsg, LrtqUpgradeMsg, CommitRequest, and PrepareAndCommitRequest into trust-quorum-types-versions so they can be shared between the protocol implementation and the sled-agent API without duplication. This simplifies the sled-agent HTTP handlers since the API types and protocol types are now identical - no conversion needed. The proxy request types (ProxyCommitRequest, ProxyPrepareAndCommitRequest) remain in sled-agent-types-versions since they add the proxy-specific destination field, and now embed the canonical request types. Co-Authored-By: Claude <noreply@anthropic.com>

- HTTP methods corrected (POST for non-idempotent operations) - Re-exports removed between TQ crates - Salt::new() reverted to inherent method - Hex schema annotations for OpenAPI - InlineErrorChain for error formatting - Lines hard-wrapped at 80 cols

plaidfinch

I've looked through this in full again after rebase and my non-fresh eyes don't see anything amiss.

andrewjstone

This looks great. Awesome work @plaidfinch!

The only thing outstanding here is perhaps to make sure that we aren't still using trust_quorum_protocol to pull in types that should be coming from trust_quorum_types.

andrewjstone · 2025-12-31T21:11:31Z

sled-agent/src/http_entrypoints.rs

 };
+use sled_hardware_types::BaseboardId;
+use slog_error_chain::InlineErrorChain;
+use trust_quorum_protocol::{


shouldn't these types be coming from trust_quorum_types as they are used in the API?

Fixed along with a few other instances in b2fd757

trust-quorum/types/versions/src/impls/salt.rs

plaidfinch force-pushed the sled-agent-trust-quorum-api branch 2 times, most recently from 79e918f to 5ccf78a Compare December 21, 2025 00:52

This comment was marked as outdated.

Sign in to view

plaidfinch commented Dec 21, 2025

View reviewed changes

This comment was marked as resolved.

Sign in to view

plaidfinch requested a review from andrewjstone December 21, 2025 01:13

plaidfinch force-pushed the sled-agent-trust-quorum-api branch from 60f26bb to 9f00be2 Compare December 21, 2025 23:30

plaidfinch commented Dec 21, 2025

View reviewed changes

andrewjstone reviewed Dec 22, 2025

View reviewed changes

plaidfinch force-pushed the sled-agent-trust-quorum-api branch from 822db60 to 720e481 Compare December 24, 2025 22:09

plaidfinch mentioned this pull request Dec 30, 2025

test failed in CI: app::sagas::instance_update::test::test_migration_target_completed_can_unwind #9573

Open

andrewjstone reviewed Dec 30, 2025

View reviewed changes

sled-agent/src/http_entrypoints.rs Outdated Show resolved Hide resolved

plaidfinch and others added 7 commits December 31, 2025 12:37

Stub out SledAgentApi methods in test utils for Nexus

0783825

Address PR review on #9556

4c3a605

- HTTP methods corrected (POST for non-idempotent operations) - Re-exports removed between TQ crates - Salt::new() reverted to inherent method - Hex schema annotations for OpenAPI - InlineErrorChain for error formatting - Lines hard-wrapped at 80 cols

plaidfinch force-pushed the sled-agent-trust-quorum-api branch from 2538651 to 4c3a605 Compare December 31, 2025 19:12

cargo fmt

a582f43

plaidfinch marked this pull request as ready for review December 31, 2025 19:16

Properly linkify Tufaceous reference for docs

9a199d8

plaidfinch commented Dec 31, 2025

View reviewed changes

andrewjstone approved these changes Dec 31, 2025

View reviewed changes

openapi

105c5f1

andrewjstone added 2 commits January 1, 2026 21:18

no more type re-exporting

b2fd757

fix comment

13d71f3

andrewjstone enabled auto-merge (squash) January 1, 2026 21:24

andrewjstone merged commit 29da4b2 into main Jan 1, 2026
19 checks passed

andrewjstone deleted the sled-agent-trust-quorum-api branch January 1, 2026 23:40

Add trust quorum reconfiguration endpoints to sled-agent API #9556

Add trust quorum reconfiguration endpoints to sled-agent API #9556

Uh oh!

Conversation

plaidfinch commented Dec 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New sled-agent API endpoints (Version 13: ADD_TRUST_QUORUM)

Trust-Quorum types are now versioned

BaseboardId moved into sled-hardware-types

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andrewjstone left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

plaidfinch left a comment

Choose a reason for hiding this comment

Uh oh!

andrewjstone left a comment

Choose a reason for hiding this comment

Uh oh!

andrewjstone Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

andrewjstone Jan 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

plaidfinch commented Dec 21, 2025 •

edited

Loading

New sled-agent API endpoints (Version 13: `ADD_TRUST_QUORUM`)

`BaseboardId` moved into `sled-hardware-types`