chore: prepare v0.7.0-rc2 release

charts/flame/Chart.yaml

@@ -3,7 +3,7 @@ name: flame
 description: Static Kubernetes deployment for Flame
 type: application
 version: 0.1.0
-appVersion: "0.7.0-rc1"
+appVersion: "0.7.0-rc2"
 home: https://github.com/xflops/flame
 sources:
   - https://github.com/xflops/flame

common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "common"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

docs/releases/v0.7.0-rc2.md

@@ -0,0 +1,55 @@
+# Flame 0.7.0-rc2 Release Notes
+
+Status: prepared, not published. No tag, crate, wheel or image for `v0.7.0-rc2` exists yet.
+
+Release branch: `release-0.7`. `v0.7.0-rc2` is a tag on this branch; the source commit is recorded when the tag is created.
+Previous release candidate: `v0.7.0-rc1`.
+
+## Why rc2
+
+`v0.7.0-rc1` was tagged and its GitHub pre-release created, but its publish run failed in the `Release Metadata` job, so **nothing was published for rc1**: no crates, no `flamepy` wheel, no images. The check compared the `flamepy` version with `uv version --short`, and the workflow forces terminal colors, so `uv` printed the version wrapped in color codes and the comparison failed (`0.7.0rc1 != ^[[36m0.7.0rc1^[[39m`). rc2 fixes that, fixes the CI install of `flamepy` on this branch, and carries eight changes that landed on `main` after the branch was cut. The rc1 release notes (`docs/releases/v0.7.0-rc1.md`) describe everything else in 0.7.0.
+
+## Versions
+
+| Artifact | Version |
+| --- | --- |
+| Git tag and Docker tag | `v0.7.0-rc2` |
+| Cargo (`flame-rs`, `flame-rs-macros`, workspace crates) | `0.7.0-rc2` |
+| `stdng` | `0.1.9` (changed since `0.1.8`; not published yet) |
+| PyPI `flamepy` | `0.7.0rc2` |
+| Helm chart `appVersion` | `0.7.0-rc2` |
+
+## Changes since rc1
+
+Backported from `main` to `release-0.7`, one pull request each:
+
+- **Agent `Session` runs on `flmbox` (#611, backport #618).** `flamepy.agent.Session` ran scripts through `flmexec` on the executor host; it now runs them in `flmbox` sandboxes, like `flamepy.agent.Sandbox`.
+  - `run_code` and `submit_code` return `CommandResult` (`exit_code`, `stdout`, `stderr`); `SessionOutput` is removed, and a nonzero exit is a normal result.
+  - `language` is chosen per call (`shell` by default, or `python`), together with `cwd`, `envs`, `input` and `timeout`; `open_session` no longer takes `language`.
+  - `open_session(image=...)` chooses the sandbox image and replaces `runtime`. The default `flmbox` image has no Python, so Python scripts need an image that has it, for example `python:3.12-slim`.
+- **`flmbox` network (#613, backport #619).** `flmbox --network <none|host>` (also `FLMBOX_NETWORK` and `sandbox.network`). The default stays `none`. The built-in `flmbox` application now starts as `flmbox -d --network=host`, so its sandboxes have every egress of the executor manager. That includes the Flame control plane, the node's own services, other pods and the cloud metadata address, so use it only where the code that sandboxes run is trusted. Remove `--network=host` from `config/applications/flmbox.yaml` to run sandboxes without a network. A per-sandbox network with egress rules is tracked in #612.
+- **`Sandbox.create(sandbox_id=...)` (#614, backport #620).** A sandbox can be created with a chosen id; an id that already exists is rejected by the server.
+- **Executor notification dropped after an executor manager reconnects (#616, backport #621).** The first notification sent to a node after its executor manager reconnected was lost, so a `Void` executor never started and the sessions allocated to it stalled until the session manager was restarted (issue #615). The stale watch consumer now stops with its stream, an executor taken just before a stream dies is queued again, and the failed-notification logs are raised to `warn`. Re-sending unregistered executors on watch start and a scheduler timeout for a `Void` executor are not part of this release.
+- **`Sandbox` commands without a state request (#617, backport #622).** `Sandbox` no longer asks the server for the session state before every command, which saves one round trip per command (about 360 ms from a client far from the cluster). A command for a suspended sandbox is accepted by the server and waits until the sandbox is resumed, instead of raising `INVALID_STATE` up front; a command for a sandbox closed through another handle is rejected by the server.
+
+- **No executors on nodes that are not ready (#625, backport #627).** The scheduler created executors, and reused `Void` and `Idle` ones, on nodes whose executor manager was not connected. Such an executor stayed `Void` and its session waited forever (seen after five nodes lost their executor managers; see #615). Allocate now creates executors only on `Ready` nodes, and an executor on a node that is not ready (including one that is draining) is skipped until the node is `Ready` again. Recovering executors already stranded by other causes is not part of this release.
+- **Executors can retract published attributes (#633, backport #634; fixes #632).** `ExecutorAttributes` carries `publish` (field 1, renamed from `attr`) and `retract` (field 2), so a service can withdraw keys when cached data is evicted or cleared. The session manager validates the whole update (each list at most 1,024 keys, 256 bytes per key and 64 KiB; a key cannot be in both lists) and applies it atomically, so a rejected update leaves the previous state unchanged. The Rust SDK gets `unpublish` on `FlameInstance` and `FlameService`; the Python SDK gets `FlameService.unpublish` and `app.unpublish_attributes`. Attributes stay volatile: they are not persisted, a replacement executor starts empty, and keys that are not retracted survive unbind and rebind.
+- **A gang's `min_instances` and `max_instances` are tied to its size (#636, backport #639).** A session with `batch_size` above 1 is now rejected, with `INVALID_ARGUMENT`, when it is created unless its `min_instances` is 0 or `batch_size` and its `max_instances` is unset or `batch_size` (the application's `max_instances` must also be at least `batch_size`). A gang kept warm (`min_instances` equal to `batch_size`) is formed all at once from the moment it exists; before, it was given idle executors one at a time between its creation and its first task, so a gang larger than the cluster could hold every executor and starve other sessions. It also sets `single_line_if_else_max_width = 60` in `rustfmt.toml`.
+
+Release tooling:
+
+- **`hack/release.sh` reads the `flamepy` version without color (#623, backport #629).** This is the fix for the rc1 publish failure above.
+- **`flmadm install` installs the wheel it just built (#626, backport #628).** It ran `uv pip install --find-links <wheels> flamepy`, and uv skips pre-releases in favor of the latest stable release on PyPI, so with a release-candidate version it installed `flamepy 0.6.0` (no `flamepy.app` or `flamepy.agent`) instead of the new wheel. Every end-to-end CI job on `release-0.7` failed with `ModuleNotFoundError: No module named 'flamepy.app'` for this reason, and so would images and installs built through `flmadm`. It now empties its wheels directory, builds, and installs the one wheel by path.
+
+## Upgrade Notes
+
+- `flamepy.agent.Session` changes from rc1: `runtime` and `language` are removed from `open_session`, `image` is added, `language` moves to `run_code` and `submit_code`, `input` is keyword-only, and the result is `CommandResult` instead of `SessionOutput`.
+- Sandboxes of the built-in `flmbox` application have host networking (see above).
+- Executor attributes (#633) are not backward compatible with rc1: the field `attr` of `ExecutorAttributes` is now `publish`, and `retract` is new, so the session manager, the executor manager and the SDKs must be upgraded together. An older session manager ignores `retract` and keeps the keys.
+- Sessions with `batch_size` above 1 and another `min_instances` or `max_instances` than the rule above are rejected when they are created (#636). A service declared with `batch_size=N` and no `warmup` (as `examples/rl/search-r1` does) stays valid; with `warmup`, it must be 0 or N, and `autoscale=False` needs `warmup=N`.
+- Everything in the rc1 notes still applies.
+
+## Known Gaps
+
+- The release sanity checks that need the registries, Docker or Kubernetes were not run as part of preparing this change.
+- The backport pull requests #618 to #622, #627 and #634 and the tooling fixes #628 and #629 are merged into `release-0.7`; #639 must be merged before `v0.7.0-rc2` is tagged. #629 in particular must be in the tagged commit, because the publish workflow runs `hack/release.sh` from it.

executor_manager/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flame-executor-manager"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 [features]

flmbench/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flmbench"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 description = "Flame benchmark: burst workloads over multiple sessions with latency percentiles and cluster health sampling"
 

flmbox/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flmbox"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 description = "flmbox: run commands and code in isolated sandboxes, from the command line or as a Flame service"
 readme = "README.md"

flmctl/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flmctl"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

flmexec/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flmexec"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

flmping/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flmping"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

object_cache/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flame-object-cache"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 [dependencies]

rpc/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rpc"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

sdk/python/README.md

@@ -133,7 +133,7 @@ python3 -m pip install -e . --user --no-build-isolation
 
 # Or build and install the wheel
 python3 -m build --wheel --no-isolation
-python3 -m pip install dist/flamepy-0.7.0rc1-py3-none-any.whl --user
+python3 -m pip install dist/flamepy-0.7.0rc2-py3-none-any.whl --user
 
 # Install development dependencies
 pip install -e .[dev]

sdk/python/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "flamepy"
-version = "0.7.0rc1"
+version = "0.7.0rc2"
 description = "Python SDK for Flame, a distributed system for Agentic AI"
 readme = "README.md"
 requires-python = ">=3.9"

sdk/python/src/flamepy/__init__.py

@@ -98,7 +98,7 @@ def __dir__():
     unregister_application,
 )
 
-__version__ = "0.7.0rc1"
+__version__ = "0.7.0rc2"
 
 __all__ = [
     # Type aliases

sdk/rust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flame-rs"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 build = "build.rs"
 
@@ -11,7 +11,7 @@ readme = "README.md"
 
 [dependencies]
 stdng = { path = "../../stdng", version = "0.1.9" }
-flame-rs-macros = { path = "macros", version = "0.7.0-rc1", optional = true }
+flame-rs-macros = { path = "macros", version = "0.7.0-rc2", optional = true }
 
 tower = { workspace = true }
 prost = { workspace = true, features = ["derive"] }

sdk/rust/macros/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flame-rs-macros"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 description = "Proc macros for the Flame Rust SDK"

session_manager/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flame-session-manager"
-version = "0.7.0-rc1"
+version = "0.7.0-rc2"
 edition = "2021"
 
 [dependencies]