Repository navigation
Copy a provider's produced files into Otari's store on every data plane #1747
Description
Problem
A file a provider's code produces is copied into Otari's store before the response or the event mentioning it is forwarded. That path is built on local repositories, so it does not run on a data plane that holds no database.
The copy also races the provider. A container expires roughly twenty minutes after its last use and its data goes with it, so a copy that is not made promptly cannot be made at all.
Proposal
Extend the existing copy path to both bindings, per #1606, using the credentials of the attempt that produced the output rather than an unrelated default.
Reserve output capacity before dispatch, so a tenant limit refuses admission rather than being discovered after a model has run. Once inference has run, a storage failure must not discard the answer.
Honor the cumulative count, byte and deadline caps that bound the attempt, and release unused reservations when it completes.
A failed copy is a Cancel, not a silent gap. #1569 covers telling the caller, and this issue must not make that harder by leaving the outcome unrecorded.
Done when
- Produced files are stored and readable after the provider's container is gone, on every data plane.
- A storage failure preserves the model answer and releases its reservation.
- A quota refusal happens before dispatch, not after.
Activity
peteski22 commentedon Sep 29, 2026
The #1740 stack (#1758) changes the copy path this issue extends, so start from it.
Already true after #1757 and #1788:
FileService.store_produced, not a path of its own.Still open, and still this issue:
Please extend
store_producedrather than adding a second copy path.