feature: runtime-neutral Task execution, Cluster resource, tenant-enforced APIs, and unified contracts

.github/workflows/ci-tests.yml

@@ -46,11 +46,14 @@ jobs:
               - '.github/workflows/unit-tests.yml'
             lint_filter:
               - '**/*.go'
+              - 'api/**'
               - 'apps/rlark-ui/**'
               - 'apps/rlark/docs/**'
               - 'apps/rlark/mkdocs.yml'
               - '**/go.mod'
               - '**/go.sum'
+              - 'Makefile'
+              - '**/Makefile'
               - '.github/workflows/lint.yml'
 
   # =============================================== lint ====================================================

.github/workflows/docker-build.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
           cache-dependency-path: apps/rlark-ui/package-lock.json
 
@@ -71,4 +71,4 @@ jobs:
           context: .
           file: ./apps/embodied-runtime/Dockerfile
           push: false
-          tags: embodied-runtime:latest
+          tags: embodied-runtime:latest

.github/workflows/lint.yml

@@ -28,6 +28,69 @@ jobs:
           working-directory: ${{ matrix.module }}
           args: --timeout 5m
 
+  lint-proto:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          # buf breaking resolves its baseline from the local .git directory,
+          # so the clone must contain the default branch.
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: api/go.mod
+          cache: true
+
+      # The checked-in stubs embed their generator versions, so regenerating with
+      # a different toolchain rewrites every file. Install the versions pinned in
+      # proto/toolchain.mk and requirements-dev.txt.
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+          cache-dependency-path: sdks/embodied-runtime-python/requirements*.txt
+
+      - name: Install pinned Python proto toolchain
+        run: python -m pip install --requirement sdks/embodied-runtime-python/requirements-dev.txt
+
+      - name: Install pinned protoc
+        run: make protoc-install
+
+      - name: Lint protobuf definitions
+        run: make lint-proto
+
+      - name: Check protobuf compatibility
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.sha || format('origin/{0}', github.event.repository.default_branch) }}
+        run: make proto-breaking PROTO_BREAKING_REF="ref=$BASE_REF"
+
+      - name: Verify generated gRPC stubs are up to date
+        run: make verify-proto-generated
+
+  verify-generated:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: api/go.mod
+          cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: apps/rlark-ui/package-lock.json
+
+      - name: Verify generated artifacts are up to date
+        run: make verify-generated
+
   lint-frontend:
     runs-on: ubuntu-latest
     steps:
@@ -36,7 +99,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
           cache-dependency-path: apps/rlark-ui/package-lock.json
 
@@ -50,7 +113,7 @@ jobs:
 
       - name: Run prettier
         working-directory: apps/rlark-ui
-        run: npx prettier --check 'src/' 'index.html' 'package.json' 'vite.config.ts' 'tsconfig*.json'
+        run: npx prettier --check 'src/' 'scripts/' 'index.html' 'package.json' 'vite.config.ts' 'tsconfig*.json' --ignore-path .prettierignore
 
   lint-docs:
     runs-on: ubuntu-latest

.gitignore

@@ -21,6 +21,7 @@ tmp/
 *.profraw
 /coverage/
 /apps/rlark-ui/coverage/
+/_artifacts/
 
 # Python cache
 __pycache__/

Makefile

@@ -12,36 +12,44 @@ endif
 
 ##@ Code style
 
-.PHONY: lint-go lint-web fmt-go fmt-web
+.PHONY: lint-go lint-web lint-proto fmt-go fmt-web
 
 lint-go: ## Lint all Go projects (golangci-lint)
 	$(MAKE) -C api lint $(MAKEOVERRIDES)
 	$(MAKE) -C apps/rlark lint $(MAKEOVERRIDES)
 	$(MAKE) -C apps/embodied-runtime lint $(MAKEOVERRIDES)
 	$(MAKE) -C sdks/embodied-runtime-go lint $(MAKEOVERRIDES)
+	$(MAKE) -C sdks/execution-go lint $(MAKEOVERRIDES)
+	$(MAKE) -C test/e2e lint $(MAKEOVERRIDES)
 
 lint-web: ## Lint web UI (eslint)
 	$(MAKE) -C apps/rlark-ui lint $(MAKEOVERRIDES)
 
+lint-proto: ## Lint protobuf definitions (buf lint)
+	$(MAKE) -C proto/embodied-runtime lint-proto $(MAKEOVERRIDES)
+	$(MAKE) -C proto/execution lint-proto $(MAKEOVERRIDES)
+
 fmt-go: ## Format all Go projects (gofmt)
 	$(MAKE) -C api fmt $(MAKEOVERRIDES)
 	$(MAKE) -C apps/rlark fmt $(MAKEOVERRIDES)
 	$(MAKE) -C apps/embodied-runtime fmt $(MAKEOVERRIDES)
 	$(MAKE) -C sdks/embodied-runtime-go fmt $(MAKEOVERRIDES)
+	$(MAKE) -C sdks/execution-go fmt $(MAKEOVERRIDES)
+	$(MAKE) -C test/e2e fmt $(MAKEOVERRIDES)
 
 fmt-web: ## Format web UI (prettier)
 	$(MAKE) -C apps/rlark-ui fmt $(MAKEOVERRIDES)
 
 ##@ Go targets
 
-.PHONY: build test-go test-web go-tidy
+.PHONY: build test-go test-web test-e2e test-e2e-rlark go-tidy
 
 build: ## Build all binaries (apps/rlark)
 	$(MAKE) -C apps/rlark build $(MAKEOVERRIDES)
 
 test-go: ## Run Go unit tests with coverage
 	@mkdir -p coverage/go
-	@for module in api apps/rlark apps/embodied-runtime; do \
+	@for module in api apps/rlark apps/embodied-runtime test/e2e; do \
 		name=$$(echo $$module | tr '/' '-'); \
 		coverage=$$(cd $$module && realpath --relative-to=. $(CURDIR)/coverage/go/$$name.out); \
 		(cd $$module && go test ./... -v -count=1 -short -covermode=atomic -coverprofile=$$coverage) || exit $$?; \
@@ -51,6 +59,11 @@ test-web: ## Run web UI unit tests with coverage
 	npm ci --prefix apps/rlark-ui
 	npm run test:coverage --prefix apps/rlark-ui
 
+test-e2e: test-e2e-rlark ## Run all implemented end-to-end suites
+
+test-e2e-rlark: ## Provision Kind, deploy RLark, run smoke tests, collect evidence, and clean up
+	$(MAKE) -C test/e2e test-rlark $(MAKEOVERRIDES)
+
 go-tidy: ## Run go mod tidy on all workspace modules
 	@for dir in $$( $(GREP) '^\t\./' go.work | sed 's/^\t//' ); do \
 		echo "Running go mod tidy in $$dir"; \
@@ -59,19 +72,59 @@ go-tidy: ## Run go mod tidy on all workspace modules
 
 ##@ Code generation
 
-.PHONY: generate generate-crd generate-crd-schema-docs proto
+.PHONY: generate generate-crd generate-crd-schema-docs generate-web-models verify-generated proto proto-embodied-runtime proto-execution protoc-install proto-breaking verify-proto-generated
 
-generate: generate-crd-schema-docs ## Generate CRD manifests, clients, and schema docs
+generate: generate-crd-schema-docs generate-web-models ## Generate CRD manifests, clients, docs, and web models
 
 generate-crd: ## Generate CRD manifests and clients
 	$(MAKE) -C api generate-crd $(MAKEOVERRIDES)
 
 generate-crd-schema-docs: generate-crd ## Generate CRD schema reference docs
 	go run ./apps/rlark/cmd/crd-api-docgen api/config/crd/bases apps/rlark/docs/reference/crd.md
 
-proto: ## Generate protobuf stubs
+generate-web-models: generate-crd ## Generate TypeScript models from CRD manifests
+	npm ci --prefix apps/rlark-ui
+	npm run generate:crd-models --prefix apps/rlark-ui
+
+GENERATED_PATHS = api/config/crd/bases api/kubeclients 'api/rlark.io/**/zz_generated.deepcopy.go' apps/rlark/docs/reference/crd.md apps/rlark-ui/src/generated/rlark
+
+verify-generated: ## Fail if generated code/manifests/docs are out of date
+	@$(MAKE) generate $(MAKEOVERRIDES)
+	@if ! git diff --exit-code --stat -- $(GENERATED_PATHS); then \
+		echo ""; \
+		echo "ERROR: generated artifacts are out of date."; \
+		echo "The CRD manifests, deepcopy funcs, typed Go/TypeScript clients, or CRD reference docs"; \
+		echo "do not match the Go types in api/rlark.io/. Run 'make generate' and"; \
+		echo "commit the result."; \
+		exit 1; \
+	fi
+	@if [ -n "$$(git ls-files --others --exclude-standard -- $(GENERATED_PATHS))" ]; then \
+		echo ""; \
+		echo "ERROR: 'make generate' produced untracked files:"; \
+		git ls-files --others --exclude-standard -- $(GENERATED_PATHS); \
+		echo "Commit them or remove the stale sources that produce them."; \
+		exit 1; \
+	fi
+
+proto: proto-embodied-runtime proto-execution ## Generate all protobuf stubs
+
+proto-embodied-runtime: ## Generate embodied-runtime protobuf stubs
 	$(MAKE) -C proto/embodied-runtime proto $(MAKEOVERRIDES)
 
+proto-execution: ## Generate execution protobuf stubs
+	$(MAKE) -C proto/execution proto $(MAKEOVERRIDES)
+
+protoc-install: ## Download the pinned protoc release into proto/bin
+	$(MAKE) -C proto/embodied-runtime protoc-install $(MAKEOVERRIDES)
+
+verify-proto-generated: ## Fail if the checked-in gRPC stubs are out of date
+	$(MAKE) -C proto/embodied-runtime verify-proto-generated $(MAKEOVERRIDES)
+	$(MAKE) -C proto/execution verify-proto-generated $(MAKEOVERRIDES)
+
+proto-breaking: ## Fail if protobuf changes break the published gRPC contract
+	$(MAKE) -C proto/embodied-runtime proto-breaking $(MAKEOVERRIDES)
+	$(MAKE) -C proto/execution proto-breaking $(MAKEOVERRIDES)
+
 ##@ Docker
 
 .PHONY: docker-build docker-push-rlark docker-build-ui docker-push-rlark-ui docker-build-embodied-runtime docker-push-embodied-runtime

api/Makefile

@@ -1,4 +1,16 @@
-CONTROLLER_GEN ?= $(shell go env GOPATH)/bin/controller-gen
+# Pinned code generator. The CRD manifests and deepcopy funcs are checked in and
+# record this version in their headers, so every environment must use the same
+# pin or the next regeneration rewrites every generated file.
+CONTROLLER_TOOLS_VERSION ?= v0.18.0
+
+# The generator is installed into the gitignored, repository-local api/bin under
+# a version-stamped file name. A shared GOPATH/bin is not usable here: CI shares
+# it across jobs and projects, so a file named `controller-gen` may be stale or
+# not even executable while make still treats the install target as satisfied
+# and skips the install, which then fails mid-generation with exit code 127.
+LOCALBIN ?= $(CURDIR)/bin
+CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
+
 CRD_DIR ?= config/crd/bases
 SAMPLES_DIR ?= config/samples
 
@@ -27,14 +39,20 @@ test: ## Run tests
 ##@ Code generation
 
 .PHONY: generate-manifests generate-clients generate-crd samples clean-samples
+.PHONY: controller-gen print-controller-gen
+
+controller-gen: $(CONTROLLER_GEN) ## Install the pinned controller-gen into api/bin
+
+print-controller-gen: ## Print the path of the pinned controller-gen
+	@echo $(CONTROLLER_GEN)
 
 generate-manifests: $(CONTROLLER_GEN) ## Generate CRD YAML manifests
 	mkdir -p $(CRD_DIR)
 	$(CONTROLLER_GEN) object paths=./rlark.io/...
-	$(CONTROLLER_GEN) crd:allowDangerousTypes=true paths=./rlark.io/... output:crd:artifacts:config=$(CRD_DIR)
+	$(CONTROLLER_GEN) crd:allowDangerousTypes=true,generateEmbeddedObjectMeta=true paths=./rlark.io/... output:crd:artifacts:config=$(CRD_DIR)
 
-generate-clients: ## Generate typed clients, informers, listers
-	./hack/generate-clients.sh --with-watch
+generate-clients: | $(LOCALBIN) ## Generate typed clients, informers, listers
+	GOBIN=$(LOCALBIN) ./hack/generate-clients.sh --with-watch
 
 generate-crd: generate-manifests generate-clients ## Generate CRD manifests and clients
 
@@ -44,8 +62,17 @@ samples: ## Verify sample CRs exist
 clean-samples: ## Remove sample CRs
 	rm -rf $(SAMPLES_DIR)
 
-$(CONTROLLER_GEN):
-	GOBIN=$(shell go env GOPATH)/bin go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.18.0
+$(LOCALBIN):
+	mkdir -p $(LOCALBIN)
+
+# `go install` writes an unversioned name, so rename it to the version-stamped
+# path make depends on. The final `--version` call is the executability check:
+# if the installed file cannot be executed the install fails here instead of
+# much later, in the middle of generation.
+$(CONTROLLER_GEN): | $(LOCALBIN)
+	GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
+	mv $(LOCALBIN)/controller-gen $@
+	$@ --version
 
 ##@ Help
 

api/config/crd/bases/rlinf.io_addons.yaml

@@ -66,6 +66,7 @@ spec:
           status:
             properties:
               conditions:
+                description: Conditions 记录 Addon 的结构化状态结论，当前仅包含 ConditionTypeReady。
                 items:
                   description: Condition contains details for one aspect of the current
                     state of this API Resource.
@@ -121,9 +122,28 @@ spec:
                   - type
                   type: object
                 type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
               message:
                 type: string
+              observedGeneration:
+                description: |-
+                  ObservedGeneration 是 Addon 控制器最近一次完成调谐时所观测到的
+                  metadata.generation。它是控制器契约而非 API Server 保证：消费者在读取
+                  phase / conditions 之前，应比较本字段与 metadata.generation 以识别过期状态。
+                format: int64
+                type: integer
               phase:
+                description: |-
+                  AddonPhase 是 Addon 安装与升级流程的聚合阶段，由数据面 Agent 观测后上报。
+                  取值集合在 CRD Schema 层封闭，新增取值必须同步更新枚举校验与文档。
+                enum:
+                - Pending
+                - Installing
+                - Ready
+                - Failed
+                - Upgrading
                 type: string
               version:
                 type: string