T8.6 — Capacity admission control

Field	Value
Phase	P8 — Operability
Size	M — 1 to 3 days
Status	Not started
Flags	—
Spec	inlined below
Blocks	—

Goal

Enforce the residency invariant at runtime, not only at load. Grading yields to agent inference.

Facts (inlined — no spec read needed)

Admission control, not backpressure. Work whose ResourceProfile does not fit the current residency is refused at admission with the limit named. Queuing it would stall behind an eviction that the first principle does not permit.
Grading yields to agent work. When both contend for the same resident model, agent inference wins and grading queues. A framework that lets a judge call delay the work it is judging has inverted its own first principle.
One resident model is the default configuration. The agent's model is pinned and never evictable; the judge and the proposer run on that same model.
A second model is legal only if the invariant holds with both resident — never by swapping between them per call, which is the failure mode this exists to prevent.
A swap is a test failure, not a slow path. A nonzero swap rate on a single-model deployment means something is requesting a non-resident model, and the load cost — tens of seconds — will dominate everything else in the trace.
Admission refusals are metered by reason, separating capacity from budget: they look identical in a queue-depth graph and have opposite fixes.
Residency is per device. A model resident on node A does not make node B's runs admissible.

Steps

Track current residency as live state: which models are resident on which devices, and current concurrent KV usage.
At admission, evaluate T5.2's invariant against the requesting work's ResourceProfile plus current residency.
Refuse when it does not fit, with the named limit in the error — not a generic capacity error, and not a queue.
Implement priority: agent inference preempts queued grading for the same resident model. Grading waits; agent work does not.
Assert on agent-call latency under grading load, not on queue ordering — a scheduler that merely queues correctly still fails the principle if grading wins the race.
Count model swaps. Emit as a metric and assert zero in the test.
Tag admission refusals capacity or budget at the refusal site (T8.1 owns the budget half).

Acceptance

With one resident model, a burst of grading work never delays agent inference past a configured bound — asserted on agent-call latency under grading load.
Zero model swaps occur across the whole run; a swap is a test failure, not a slow path.

Verify

Harness: a model runtime stub that reports residency and counts swaps, plus a latency histogram on agent calls. No GPU needed — the stub enforces the declared limits.

Integration test — tests/it_admission_control.rs:

Baseline: measure agent-call latency (p50 and p99) with no grading load.
Burst 100 grading tasks against one resident model while agent work continues.
Assert agent-call p99 stays within the configured bound of baseline. This is the acceptance criterion and it is a latency assertion, not an ordering one — a scheduler that merely queues correctly still fails the principle if grading wins the race.
Assert zero model swaps across the whole run. A swap is a test failure, not a slow path — assert swap_count == 0, not a threshold.
Submit work whose ResourceProfile does not fit current residency. Assert it is refused at admission, not queued — check the queue depth stayed at zero — and that the error names the limit.
Assert the refusal is tagged capacity, distinct from T8.1's budget refusals, and that both series exist.
Multi-node: assert a model resident on node A does not make node B's work admissible.
Assert a pinned model is never selected for eviction, even when the invariant would otherwise be satisfiable by evicting it.

Command: cargo test -p operability admission -- --test-threads=1 --nocapture

False pass:

Step 3 asserting that grading was queued behind agent work. Correct ordering with a shared lock still adds latency to agent calls; the histogram is what detects it.
Step 5 asserting an eventual error after queuing. Queuing over-capacity work stalls it behind an eviction that must not happen — assert the queue never grew.
Step 4 as swap_count < 5. Any nonzero swap rate means something is requesting a non-resident model, and the tens-of-seconds load cost will dominate the trace.
Measuring only mean latency, where a p99 stall from one swap disappears.

Traps

Queuing over-capacity work instead of refusing it. It stalls behind an eviction that must not happen.
A fair scheduler between grading and agent work. Fair is the wrong policy here; agent work wins.
Measuring only queue depth. Both refusal reasons look identical there.

Background (not required to do this task): rust-agentic-sys.md §1, §14.2, §15 · rust-agentic-task.md

5.2 KiB Raw Permalink Blame History