feat(cloud-agent): add native downloaded runtime startup

[eshurakov]

Native Cloud Agent allocations can select downloaded startup independently of the native image. The Worker validates a trusted release before allocation, issues a short-lived two-object grant, and supplies one bootstrap command for both repository restore and image fallback. Default startup remains preinstalled.

Startup failures use the current signed launch binding. Permanent artifact/probe failures fail preparing routes promptly; retryable failures keep the existing preparation deadline. Both report/provider race orders, credential rotation, persisted startup mode and snapshot keys have integration coverage. Stopped retryable allocations retain the existing retry alarm. After Durable Object reconstruction, that alarm resumes work with the same route attempt and deadline. No persisted state or provider polling was added. Native PID1 diagnostics redact bootstrap arguments.

Validation: 498 initial focused unit tests passed. After the retry-recovery fix, 40 focused unit tests and 264 Worker integration tests passed, including a forced-reconstruction regression. Typecheck, service lint, repository formatting and Markdown checks passed. Local native preinstalled and downloaded cold starts plus three warm messages passed. Native HTTPS allowlist downloads and a denied-host control passed. Unauthorized download failed in 8.4 seconds and produced the specific session-stream error.

Local native A-to-B snapshot restore passed: B ran, A's start counter stayed one, and user configuration, files and an executable dependency remained. Wrangler changes local image tags on restart, so this test used a controlled snapshot-index fixture after verifying the unchanged image digest. It does not prove production snapshot reuse across deployment.

Real-provider qualification and production rollout belong to later approved gates. No production target selects downloaded startup. Native HTTPS CLI-probe failure also passed in 20.6 seconds with the correct stream error. Dropped startup reports retained the existing five-minute first-connect retry and 12-minute preparation timeout; the final timeout appeared in the stream. All temporary public tunnels are closed.

Stack: #7915 → #7917 → this PR. Base: eshurakov/ca-runtime-release-format.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental change re-arms an alarm for a stopped allocation that still has retryable preparing routes and lets the alarm handler resume that allocation after instance loss, closing the eviction gap raised in the previous review; the changed lines introduce no new problems.

Files Reviewed (3 files)

• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts
• services/cloud-agent-next/test/integration/sandbox-runtime-startup.test.ts
• services/cloud-agent-next/docs/control-plane.md

Previous Review Summary (commit 7f8e0c2)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 7f8e0c2)

Status: 1 Issues Found | Recommendation: Address before merge

Executive Summary

The downloaded-startup path (trusted release preflight, scoped artifact grant, bounded bootstrap report) is well-guarded; the one concern is that a native allocation stopped while a create is still in flight no longer has a durable restart if the in-flight create is lost to a Durable Object eviction, risking a late preparation_timeout.

Fix these issues in Kilo Cloud

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts	3206	if (retry && !this.createInFlight) defers the restart to runCreate's finally; because reduceTick has no stopped case and nextAllocationAlarmAt(stopped) is null, a stopped allocation whose in-flight create is lost to eviction never restarts and its routes fail at the preparation deadline instead of retrying within it

Files Reviewed (27 files)

• services/cloud-agent-next/docs/control-plane.md
• services/cloud-agent-next/scripts/publish-runtime.ts
• services/cloud-agent-next/scripts/runtime-publish-store.ts
• services/cloud-agent-next/src/control-plane/sandbox/allocation.ts
• services/cloud-agent-next/src/control-plane/sandbox/repository-launch.ts - 1 issue
• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts - 1 issue
• services/cloud-agent-next/src/control-plane/session/failure-messages.ts
• services/cloud-agent-next/src/sandbox-containers/main-process.test.ts
• services/cloud-agent-next/src/sandbox-containers/main-process.ts
• services/cloud-agent-next/src/sandbox-control/downloaded-startup.test.ts
• services/cloud-agent-next/src/sandbox-control/downloaded-startup.ts
• services/cloud-agent-next/src/sandbox-control/runtime-artifact-grant.ts
• services/cloud-agent-next/src/sandbox-control/runtime-artifact-routes.ts
• services/cloud-agent-next/src/sandbox-control/runtime-release-loader.ts
• services/cloud-agent-next/src/sandbox-control/startup-failure.ts
• services/cloud-agent-next/src/sandbox-control/startup-selection.ts
• services/cloud-agent-next/src/server.ts
• services/cloud-agent-next/src/shared/control-plane-protocol.ts
• services/cloud-agent-next/src/shared/runtime-distribution.ts
• services/cloud-agent-next/src/shared/runtime-environment.ts
• services/cloud-agent-next/src/telemetry/control-plane-failure.ts
• services/cloud-agent-next/src/types.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-repo-snapshots.test.ts
• services/cloud-agent-next/test/integration/sandbox-runtime-startup.test.ts
• services/cloud-agent-next/worker-configuration.d.ts
• services/cloud-agent-next/wrangler.jsonc
• services/cloud-agent-next/wrapper/src/control-plane/kilo-runtime.ts

---

_{Reviewed by deepseek-v4.1-flash · Input: 72.1K · Output: 18.2K · Cached: 1.2M}

_{Review guidance: REVIEW.md from base branch eshurakov/ca-runtime-release-format}