[delete-cloud]

Summary

• add ADR-0023 for setup/agent phase separation in remote Docker workspaces
• define setup and agent as distinct container execution boundaries sharing one host workspace directory
• capture setup secret lifecycle, fail-closed setup behavior, cleanup/GC requirements, and non-goals

Validation

• git diff --check

No implementation changes in this PR.

Summary by CodeRabbit

• Documentation
  • Added architecture documentation detailing the separation of setup and deployment phases for remote workspaces, including session management, resource handling, and cleanup procedures.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 52b768f9-24da-4bea-819f-2870250ca8f9

📥 Commits

Reviewing files that changed from the base of the PR and between 8a15b8f and e7748df.

📒 Files selected for processing (1)

• coding-agent/docs/adr/0023-setup-and-agent-phase-separation.md

---

📝 Walkthrough

Walkthrough

This PR introduces ADR-0023, which documents a Docker-based architecture for separating remote workspace execution into distinct setup and agent phases. The ADR specifies two containers sharing the workspace mount with isolated network, secrets, and sandbox policies, outlines required session events and metadata, and provides an implementation roadmap with acceptance criteria.

Changes

ADR-0023: Setup and Agent Phase Separation

Layer / File(s)	Summary
Core decision and session contract coding-agent/docs/adr/0023-setup-and-agent-phase-separation.md	Defines two separate Docker containers for setup and agent phases sharing the host-mounted workspace, with strict separation of network/secrets/sandbox policies at the execution boundary. Specifies setup phase as ephemeral (configured commands only with setup-phase policy) and agent phase as post-setup (defaulting to network = "none" in production with no setup secrets). Enumerates session status and API events required to surface phase progress and distinguish setup failures from agent execution failures.
Rationale and design alternatives coding-agent/docs/adr/0023-setup-and-agent-phase-separation.md	Articulates non-goals excluding partial Docker setup and full network/secrets preservation across phases. Documents rejected alternatives such as docker exec environment switching or maintaining network/secrets for the entire session. Enumerates consequences: staged provisioning, updated cleanup/garbage collection responsibilities, and expectation that remote clients handle setup failures as first-class outcomes.
Implementation roadmap and acceptance criteria coding-agent/docs/adr/0023-setup-and-agent-phase-separation.md	Provides phased implementation plan covering ADR/schema and request validation, provider resource model changes to represent phase-owned resources, Docker execution steps with policy application and redaction, and updates across HTTP/CLI/docs/smoke checks. Defines acceptance criteria for provider tests (distinct containers, correct network/secrets behavior, setup-failure gating, cleanup/GC), API validation, event reflection, redaction checks, and test/quality commands.
ADR references and related code coding-agent/docs/adr/0023-setup-and-agent-phase-separation.md	References related ADRs (0019, 0021) and lists relevant source files and tests that the implementation is expected to touch.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• delete-cloud/Coding-Agent-Loop#122: Implements Docker workspace container hardening (network=none, capabilities drop, resource limits) that directly realizes the runtime-sandboxing policies defined in ADR-0023.
• delete-cloud/Coding-Agent-Loop#124: Modifies remote session/workspace contract in ADR-0021, which ADR-0023 builds upon by extending session status/events and workspace operations vocabulary for phase tracking.
• delete-cloud/Coding-Agent-Loop#111: Updates ADR-0019 Docker-based remote workspace execution model; ADR-0023 directly supersedes docker exec approach with separate phase containers and distinct runtime policies.

Poem

🐰 A rabbit's tale of phases blessed,
Setup springs forth, then takes its rest,
Agent follows in its own container's nest,
No secrets shared—each phase knows best!
Two Docker homes, one workspace guest. 🏠

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title clearly summarizes the main change: adding an ADR document for setup and agent phase separation, which matches the single file modification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/adr-0023-setup-agent-phases

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}