ateworker internal packages cleanup

.golangci.yaml

@@ -27,10 +27,25 @@ linters:
   default: standard
 
   enable:
+    # Import restrictions, see depguard settings below.
+    - depguard
     # Spelling errors in comments, strings, and identifiers.
     - misspell
 
   settings:
+    depguard:
+      rules:
+        # internal/ateworker is the ateworker binaries' shared code. Anything
+        # else should import a flat package under internal/ instead.
+        ateworker:
+          files:
+            - "$all"
+            - "!**/cmd/ateworker-*/**"
+            - "!**/internal/ateworker/**"
+          deny:
+            - pkg: github.com/agent-substrate/substrate/internal/ateworker
+              desc: only the ateworker binaries may import internal/ateworker
+
     errcheck:
       # Functions where ignoring the return is idiomatic in this codebase.
       # Note: errcheck's exclude-functions matches on the static receiver

cmd/ateapi/internal/controlapi/workflow_resume.go

@@ -619,7 +619,7 @@ func workerAssignmentFrom(w *ateapipb.Worker, snapRuntime *ateapipb.SandboxRunti
 		// with a runtime that did not produce it. Resolve the assets for the
 		// matched version once SandboxConfig can name them, or treat a
 		// restorable-only match as incompatible until it can. Latent for now:
-		// worker reports no restorable_runtimes (internal/ateom/register.go).
+		// worker reports no restorable_runtimes (internal/ateworker/register.go).
 		SandboxRuntime: proto.CloneOf(hardware.RuntimeFor(w.GetStatus(), snapRuntime)),
 	}
 }

cmd/atecontroller/internal/controllers/workerpool_apply.go

@@ -26,11 +26,11 @@ import (
 	corev1ac "k8s.io/client-go/applyconfigurations/core/v1"
 	metav1ac "k8s.io/client-go/applyconfigurations/meta/v1"
 
-	"github.com/agent-substrate/substrate/internal/ateom"
 	"github.com/agent-substrate/substrate/internal/deviceplugin"
 	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/preview"
+	"github.com/agent-substrate/substrate/internal/workercapacity"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 )
 
@@ -185,7 +185,7 @@ func buildDeploymentApplyConfig(wp *atev1alpha1.WorkerPool, otel workerOTelSetti
 		WithVolumeMounts(
 			corev1ac.VolumeMount().
 				WithName(workerCapacityVolume).
-				WithMountPath(ateom.CapacityMountPath).
+				WithMountPath(workercapacity.MountPath).
 				WithReadOnly(true),
 			corev1ac.VolumeMount().
 				WithName("ate-base").
@@ -210,8 +210,8 @@ func buildDeploymentApplyConfig(wp *atev1alpha1.WorkerPool, otel workerOTelSetti
 				WithName(workerCapacityVolume).
 				WithDownwardAPI(corev1ac.DownwardAPIVolumeSource().
 					WithItems(
-						resourceFieldRefFile(ateom.CPULimitFile, "limits.cpu", milliCores),
-						resourceFieldRefFile(ateom.MemoryLimitFile, "limits.memory", wholeBytes),
+						resourceFieldRefFile(workercapacity.CPULimitFile, "limits.cpu", milliCores),
+						resourceFieldRefFile(workercapacity.MemoryLimitFile, "limits.memory", wholeBytes),
 					)),
 			corev1ac.Volume().
 				WithName("ate-base").

cmd/atecontroller/internal/controllers/workerpool_apply_test.go

@@ -30,12 +30,12 @@ import (
 	metav1ac "k8s.io/client-go/applyconfigurations/meta/v1"
 	"k8s.io/utils/ptr"
 
-	"github.com/agent-substrate/substrate/internal/ateom"
 	"github.com/agent-substrate/substrate/internal/deviceplugin"
 	"github.com/agent-substrate/substrate/internal/egresspolicy"
 	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/preview"
+	"github.com/agent-substrate/substrate/internal/workercapacity"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 )
 
@@ -783,8 +783,8 @@ func expectedDeploymentApplyConfig(mutatePodSpec func(*corev1ac.PodSpecApplyConf
 				WithName(workerCapacityVolume).
 				WithDownwardAPI(corev1ac.DownwardAPIVolumeSource().
 					WithItems(
-						resourceFieldRefFile(ateom.CPULimitFile, "limits.cpu", milliCores),
-						resourceFieldRefFile(ateom.MemoryLimitFile, "limits.memory", wholeBytes),
+						resourceFieldRefFile(workercapacity.CPULimitFile, "limits.cpu", milliCores),
+						resourceFieldRefFile(workercapacity.MemoryLimitFile, "limits.memory", wholeBytes),
 					)),
 			corev1ac.Volume().
 				WithName("ate-base").
@@ -883,7 +883,7 @@ func expectedDeploymentApplyConfig(mutatePodSpec func(*corev1ac.PodSpecApplyConf
 			WithVolumeMounts(
 				corev1ac.VolumeMount().
 					WithName(workerCapacityVolume).
-					WithMountPath(ateom.CapacityMountPath).
+					WithMountPath(workercapacity.MountPath).
 					WithReadOnly(true),
 				corev1ac.VolumeMount().
 					WithName("ate-base").

cmd/atelet/statspoller.go

@@ -37,9 +37,9 @@ import (
 	"k8s.io/client-go/kubernetes"
 
 	"github.com/agent-substrate/substrate/internal/ateattr"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 )
 
 // workerPoolLabel is the label the pool controller stamps on every worker pod
@@ -326,7 +326,7 @@ func (p *statsPoller) collect(ctx context.Context) map[templateKey]*templateAggr
 					templateNamespace: sample.GetActorTemplateAtespace(),
 					templateName:      sample.GetActorTemplateName(),
 					sandboxClass:      ateattr.NormalizeSandboxClass(sample.GetSandboxClass()),
-					source:            ateomstats.StatsSourceLabel(sample.GetSource()),
+					source:            workerstats.StatsSourceLabel(sample.GetSource()),
 					workerPool:        pools[podUID],
 				}
 				mu.Lock()

cmd/ateworker-gvisor/hosted.go

@@ -25,42 +25,42 @@ import (
 	"time"
 
 	"github.com/agent-substrate/substrate/internal/apierror"
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
 	"github.com/agent-substrate/substrate/internal/atunnel"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
 	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 )
 
 // hostedActor holds one actor's attribution, network, and runtime state.
 type hostedActor struct {
 	// Attribution is available during boot.
 	attribution resources.ActorAttribution
-	network     *ateomnet.SandboxSession
+	network     *actornet.SandboxSession
 	// resolvConf is the actor's resolver bind source, removed with its network.
 	resolvConf string
 	// Set once the containers exist.
 	session *workloadSession
 	// usage is this activation's epoch, CPU baseline, and latest sample.
-	usage *ateomstats.Activation
+	usage *workerstats.Activation
 	// deadReported keeps the usage sweep to one warning per activation.
 	deadReported atomic.Bool
 }
 
 // admitActor reserves capacity before network setup. An actor that is already
 // hosted keeps its slot; its old network is returned for the caller to close.
-func (s *AteWorkerService) admitActor(attribution resources.ActorAttribution) (*hostedActor, *ateomnet.SandboxSession, error) {
+func (s *AteWorkerService) admitActor(attribution resources.ActorAttribution) (*hostedActor, *actornet.SandboxSession, error) {
 	s.actorsMu.Lock()
 	defer s.actorsMu.Unlock()
-	var stale *ateomnet.SandboxSession
+	var stale *actornet.SandboxSession
 	if old, ok := s.actors[attribution.UID]; ok {
 		stale = old.network
 	} else if len(s.actors)+s.draining >= s.maxActors {
 		return nil, nil, apierror.ResourceExhausted("worker is full: %d actors", s.maxActors)
 	}
 	// The sandbox cgroup is new with every activation, so its counters start
 	// at zero.
-	hosted := &hostedActor{attribution: attribution, usage: ateomstats.NewActivation(time.Now(), false)}
+	hosted := &hostedActor{attribution: attribution, usage: workerstats.NewActivation(time.Now(), false)}
 	s.actors[attribution.UID] = hosted
 	return hosted, stale, nil
 }
@@ -85,7 +85,7 @@ func (s *AteWorkerService) hostActor(ctx context.Context, attribution resources.
 		}
 	}
 
-	session, err := ateomnet.ServeSandbox(ctx, ateomnet.SandboxNetworkConfig{
+	session, err := actornet.ServeSandbox(ctx, actornet.SandboxNetworkConfig{
 		ActorUID:   uid,
 		Veth:       true,
 		EgressPort: s.tunnel.EgressPort,
@@ -189,7 +189,7 @@ func (s *AteWorkerService) setSession(actorUID string, session *workloadSession)
 func (s *AteWorkerService) sandboxDialer(actorUID string) atunnel.DialFunc {
 	return func(ctx context.Context, network, address string) (net.Conn, error) {
 		s.actorsMu.RLock()
-		var session *ateomnet.SandboxSession
+		var session *actornet.SandboxSession
 		if hosted := s.actors[actorUID]; hosted != nil {
 			session = hosted.network
 		}

cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats.go

@@ -61,7 +61,7 @@ type Sample struct {
 
 	// CPUUsageUsec is cpu.stat's usage_usec: cumulative CPU time consumed by the
 	// cgroup since it was created. Zero if the cpu controller was not delegated
-	// to this cgroup (see ateomcgroup.Delegate, which enables controllers
+	// to this cgroup (see cgroup.Delegate, which enables controllers
 	// best-effort and carries on when one cannot be enabled).
 	CPUUsageUsec uint64
 

cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats_test.go

@@ -103,7 +103,7 @@ func TestRead(t *testing.T) {
 			},
 		},
 		{
-			// ateomcgroup.Delegate enables controllers one at a time and carries on
+			// cgroup.Delegate enables controllers one at a time and carries on
 			// when one cannot be enabled, so a cgroup with memory but no cpu is a
 			// state this actually reaches.
 			name: "no cpu.stat (cpu controller not delegated)",