chore(agent-data-plane): initialize TLS early on before spawning supervisor

[tobz]

Summary

This PR moves the initialization of TLS primitives/configuration for the privileged API worker to occur earlier so that the process can fail fast if misconfigured.

Prior to this PR, we were initializing TLS primitives/configuration during the initialization of the worker, which could mean errors or delays during loading which might cause downstream issues in the supervisor. Instead, we want to do this once at process start and surface any of the resulting errors so that we can fail fast and loudly since there's not likely anything we can do about it.

Change Type

• Bug fix
• New feature
• Non-functional (chore, refactoring, docs)
• Performance

How did you test this PR?

Built and ran ADP and ensured it still properly initialized and ran the privileged API.

References

AGTMETRICS-393

[tobz]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• enhancement(api): add dynamic API router based on runtime state #1179
• enhancement(runtime): add resource/pubsub registry for generalized state management in processes #1178
• chore(agent-data-plane): initialize TLS early on before spawning supervisor #1177 👈 (View in Graphite)
• chore(agent-data-plane): update health registry worker to allow being restarted #1176
• chore(agent-data-plane): move internal observability/control plane to supervisor scheme #1148
• enhancement(core): make initialization async in Supervisable #1146
• enhancement(core): add support for spawning supervisors on a dedicated runtime #1145
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[Copilot]

Pull request overview

Exposes Rustls ServerConfig from the crate’s net module, likely to allow TLS configuration types to be referenced earlier/higher in the agent data-plane initialization flow.

Changes:

• Re-exported rustls::ServerConfig from lib/saluki-io/src/net/mod.rs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Re-exporting a third-party type (rustls::ServerConfig) from your public API couples this crate’s semver stability to Rustls’ public API and can make future Rustls upgrades breaking for downstream users. If this is only needed internally, prefer pub(crate) use rustls::ServerConfig;. If it must be public, consider introducing a crate-owned wrapper/type alias in a dedicated TLS module (e.g., net::tls) to better control your public surface area.

Suggested change

	pub use rustls::ServerConfig;
	pub(crate) use rustls::ServerConfig;

[pr-commenter]

Binary Size Analysis (Agent Data Plane)

Target: 9fe09ef (baseline) vs 75a8e2c (comparison) diff
Analysis Type: Stripped binaries (debug symbols excluded)
Baseline Size: 26.96 MiB
Comparison Size: 27.11 MiB
Size Change: +154.92 KiB (+0.56%)
Pass/Fail Threshold: +5%
Result: PASSED ✅

Changes by Module

Module	File Size	Symbols
saluki_core::runtime::supervisor	+68.92 KiB	59
core	+45.28 KiB	11169
tokio	+23.81 KiB	2716
agent_data_plane::internal::initialize_and_launch_runtime	-22.07 KiB	2
agent_data_plane::internal::create_internal_supervisor	+16.05 KiB	1
saluki_app::memory::MemoryBoundsConfiguration	-13.70 KiB	5
agent_data_plane::internal::control_plane	-12.32 KiB	26
std	-11.37 KiB	280
[sections]	+10.74 KiB	10
saluki_core::runtime::process	+9.33 KiB	7
agent_data_plane::cli::run	+7.84 KiB	76
anyhow	+6.94 KiB	1286
saluki_core::runtime::dedicated	+5.63 KiB	4
agent_data_plane::internal::observability	+5.60 KiB	16
saluki_core::topology::running	+5.50 KiB	31
saluki_app::metrics::collect_runtime_metrics	-4.73 KiB	1
[Unmapped]	-4.62 KiB	1
saluki_core::runtime::restart	+3.50 KiB	7
saluki_core::runtime::shutdown	+2.27 KiB	4
tracing_core	+2.24 KiB	521

Detailed Symbol Changes

    FILE SIZE        VM SIZE    
 --------------  -------------- 
  [NEW] +1.79Mi  [NEW] +1.79Mi    std::thread::local::LocalKey<T>::with::h938f6ddf7aedbbb8
  +1.1%  +174Ki  +1.1%  +145Ki    [29786 Others]
  [NEW]  +113Ki  [NEW]  +113Ki    agent_data_plane::cli::run::create_topology::_{{closure}}::hfb0b645d0bb8c8cf
  [NEW] +68.2Ki  [NEW] +68.1Ki    h2::hpack::decoder::Decoder::try_decode_string::hd1c9a39c48e78a6e
  [NEW] +63.7Ki  [NEW] +63.6Ki    agent_data_plane::cli::run::handle_run_command::_{{closure}}::hb1b79147c6e6e2ef
  [NEW] +63.7Ki  [NEW] +63.6Ki    saluki_components::common::datadog::io::run_endpoint_io_loop::_{{closure}}::hd35493454b2aefa0
  [NEW] +62.3Ki  [NEW] +62.2Ki    agent_data_plane::main::_{{closure}}::hd35953e90113f5c5
  [NEW] +59.2Ki  [NEW] +58.9Ki    _<agent_data_plane::internal::control_plane::PrivilegedApiWorker as saluki_core::runtime::supervisor::Supervisable>::initialize::_{{closure}}::h29c03b31f615628f
  [NEW] +48.8Ki  [NEW] +48.7Ki    saluki_app::bootstrap::AppBootstrapper::bootstrap::_{{closure}}::hc8e634acdf97ad33
  [NEW] +47.7Ki  [NEW] +47.6Ki    moka::sync::base_cache::Inner<K,V,S>::do_run_pending_tasks::h0ef6755dbc77ea2a
  [NEW] +46.1Ki  [NEW] +46.0Ki    h2::proto::connection::Connection<T,P,B>::poll::h1671860da0918c66
  [DEL] -46.1Ki  [DEL] -46.0Ki    h2::proto::connection::Connection<T,P,B>::poll::h2aedcbe1089b311c
  [DEL] -47.7Ki  [DEL] -47.6Ki    moka::sync::base_cache::Inner<K,V,S>::do_run_pending_tasks::ha97a2f55834f17a3
  [DEL] -48.8Ki  [DEL] -48.7Ki    saluki_app::bootstrap::AppBootstrapper::bootstrap::_{{closure}}::hbb5d0d8e944d3a21
  [DEL] -57.8Ki  [DEL] -57.7Ki    agent_data_plane::cli::run::handle_run_command::_{{closure}}::hd8d13580d16cc8a3
  [DEL] -62.3Ki  [DEL] -62.2Ki    agent_data_plane::main::_{{closure}}::h1c7c640002ce8ad1
  [DEL] -63.8Ki  [DEL] -63.6Ki    saluki_components::common::datadog::io::run_endpoint_io_loop::_{{closure}}::hc194831d658db8cc
  [DEL] -68.2Ki  [DEL] -68.1Ki    h2::hpack::decoder::Decoder::try_decode_string::hbfc0bb5a77e7669f
  [DEL] -84.5Ki  [DEL] -84.4Ki    agent_data_plane::internal::control_plane::spawn_control_plane::_{{closure}}::heace61ab0f2bde0c
  [DEL]  -113Ki  [DEL]  -113Ki    agent_data_plane::cli::run::create_topology::_{{closure}}::h6a8b41fa76a89e2c
  [DEL] -1.79Mi  [DEL] -1.79Mi    std::thread::local::LocalKey<T>::with::h0d8770940d38805b
  +0.6%  +154Ki  +0.5%  +125Ki    TOTAL

[pr-commenter]

Regression Detector (Agent Data Plane)

Regression Detector Results

Run ID: a5e59c97-a287-4064-b116-77e8d4e1d87b

Baseline: 9fe09ef
Comparison: 75a8e2c
Diff

❌ Experiments with retried target crashes

This is a critical error. One or more replicates failed with a non-zero exit code. These replicates may have been retried. See Replicate Execution Details for more information.

• dsd_uds_512kb_3k_contexts_throughput
• otlp_ingest_traces_5mb_memory
• dsd_uds_10mb_3k_contexts_memory

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	otlp_ingest_logs_5mb_throughput	ingress throughput	-0.02	[-0.15, +0.12]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_logs_5mb_cpu	% cpu utilization	-2.02	[-7.05, +3.00]	1	(metrics) (profiles) (logs)
✅	otlp_ingest_logs_5mb_memory	memory utilization	-13.99	[-14.64, -13.33]	1	(metrics) (profiles) (logs)

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	dsd_uds_1mb_3k_contexts_cpu	% cpu utilization	+2.59	[-49.29, +54.48]	1	(metrics) (profiles) (logs)
➖	quality_gates_rss_idle	memory utilization	+2.17	[+2.12, +2.23]	1	(metrics) (profiles) (logs)
➖	dsd_uds_100mb_3k_contexts_memory	memory utilization	+1.39	[+1.19, +1.59]	1	(metrics) (profiles) (logs)
➖	quality_gates_rss_dsd_low	memory utilization	+1.30	[+1.14, +1.46]	1	(metrics) (profiles) (logs)
➖	dsd_uds_1mb_3k_contexts_memory	memory utilization	+1.15	[+0.96, +1.33]	1	(metrics) (profiles) (logs)
➖	dsd_uds_500mb_3k_contexts_memory	memory utilization	+0.94	[+0.74, +1.13]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_traces_5mb_memory	memory utilization	+0.85	[+0.60, +1.10]	1	(metrics) (profiles) (logs)
➖	dsd_uds_10mb_3k_contexts_memory	memory utilization	+0.84	[+0.64, +1.04]	1	(metrics) (profiles) (logs)
➖	dsd_uds_512kb_3k_contexts_memory	memory utilization	+0.81	[+0.63, +0.99]	1	(metrics) (profiles) (logs)
➖	quality_gates_rss_dsd_medium	memory utilization	+0.81	[+0.61, +1.00]	1	(metrics) (profiles) (logs)
➖	dsd_uds_100mb_3k_contexts_cpu	% cpu utilization	+0.70	[-5.14, +6.53]	1	(metrics) (profiles) (logs)
➖	quality_gates_rss_dsd_heavy	memory utilization	+0.29	[+0.16, +0.41]	1	(metrics) (profiles) (logs)
➖	quality_gates_rss_dsd_ultraheavy	memory utilization	+0.17	[+0.05, +0.29]	1	(metrics) (profiles) (logs)
➖	dsd_uds_500mb_3k_contexts_cpu	% cpu utilization	+0.02	[-1.44, +1.48]	1	(metrics) (profiles) (logs)
➖	dsd_uds_100mb_3k_contexts_throughput	ingress throughput	+0.00	[-0.05, +0.06]	1	(metrics) (profiles) (logs)
➖	dsd_uds_1mb_3k_contexts_throughput	ingress throughput	+0.00	[-0.05, +0.06]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_traces_5mb_throughput	ingress throughput	-0.00	[-0.08, +0.08]	1	(metrics) (profiles) (logs)
➖	dsd_uds_512kb_3k_contexts_throughput	ingress throughput	-0.00	[-0.06, +0.05]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_metrics_5mb_throughput	ingress throughput	-0.01	[-0.14, +0.12]	1	(metrics) (profiles) (logs)
➖	dsd_uds_10mb_3k_contexts_throughput	ingress throughput	-0.01	[-0.15, +0.13]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_logs_5mb_throughput	ingress throughput	-0.02	[-0.15, +0.12]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_traces_5mb_cpu	% cpu utilization	-0.15	[-2.50, +2.20]	1	(metrics) (profiles) (logs)
➖	dsd_uds_512kb_3k_contexts_cpu	% cpu utilization	-0.16	[-55.86, +55.55]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_metrics_5mb_cpu	% cpu utilization	-1.29	[-7.01, +4.42]	1	(metrics) (profiles) (logs)
➖	dsd_uds_500mb_3k_contexts_throughput	ingress throughput	-1.44	[-1.56, -1.31]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_logs_5mb_cpu	% cpu utilization	-2.02	[-7.05, +3.00]	1	(metrics) (profiles) (logs)
➖	otlp_ingest_metrics_5mb_memory	memory utilization	-2.12	[-2.34, -1.90]	1	(metrics) (profiles) (logs)
➖	dsd_uds_10mb_3k_contexts_cpu	% cpu utilization	-3.49	[-32.31, +25.32]	1	(metrics) (profiles) (logs)
✅	otlp_ingest_logs_5mb_memory	memory utilization	-13.99	[-14.64, -13.33]	1	(metrics) (profiles) (logs)

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	links
✅	quality_gates_rss_dsd_heavy	memory_usage	10/10	(metrics) (profiles) (logs)
✅	quality_gates_rss_dsd_low	memory_usage	10/10	(metrics) (profiles) (logs)
✅	quality_gates_rss_dsd_medium	memory_usage	10/10	(metrics) (profiles) (logs)
✅	quality_gates_rss_dsd_ultraheavy	memory_usage	10/10	(metrics) (profiles) (logs)
✅	quality_gates_rss_idle	memory_usage	10/10	(metrics) (profiles) (logs)

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

3. Its configuration does not mark it "erratic".

Replicate Execution Details

We run multiple replicates for each experiment/variant. However, we allow replicates to be automatically retried if there are any failures, up to 8 times, at which point the replicate is marked dead and we are unable to run analysis for the entire experiment. We call each of these attempts at running replicates a replicate execution. This section lists all replicate executions that failed due to the target crashing or being oom killed.

Note: In the below tables we bucket failures by experiment, variant, and failure type. For each of these buckets we list out the replicate indexes that failed with an annotation signifying how many times said replicate failed with the given failure mode. In the below example the baseline variant of the experiment named experiment_with_failures had two replicates that failed by oom kills. Replicate 0, which failed 8 executions, and replicate 1 which failed 6 executions, all with the same failure mode.

Experiment	Variant	Replicates	Failure	Logs	Debug Dashboard
experiment_with_failures	baseline	0 (x8) 1 (x6)	Oom killed		Debug Dashboard

The debug dashboard links will take you to a debugging dashboard specifically designed to investigate replicate execution failures.

❌ Retried Normal Replicate Execution Failures (non-profiling)

Experiment	Variant	Replicates	Failure	Debug Dashboard
dsd_uds_10mb_3k_contexts_memory	comparison	5	Failed to shutdown when requested	Debug Dashboard
dsd_uds_512kb_3k_contexts_throughput	comparison	9	Failed to shutdown when requested	Debug Dashboard
otlp_ingest_traces_5mb_memory	baseline	9	Failed to shutdown when requested	Debug Dashboard

❌ Retried Profiling Replicate Execution Failures (target internal profiling)

Note: Profiling replicas may still be executing. See the debug dashboard for up to date status.

Experiment	Variant	Replicates	Failure	Debug Dashboard
quality_gates_rss_dsd_medium	comparison	11	Failed to shutdown when requested	Debug Dashboard