feat: add workspace runtime adapter (#320)

* feat: add workspace runtime adapter

* fix: clean canceled lease reservations

* fix: harden Hetzner workspace readiness

* fix: paginate Hetzner SSH keys

* fix: bound workspace recovery accounting

* fix: cap workspace recovery at hard TTL

* fix: align workspace TTL with recovery windows

* fix: preserve lease cleanup across workspace retention

* fix: preserve workspace readiness intent

Author: steipete

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Added
 
+- Added an idempotent workspace adapter over coordinator leases, with durable owner-scoped lifecycle mapping and truthful capability negotiation for external control planes.
 - Added a generated provider decision matrix with checked metadata for execution model, access, substrate, GPU fit, lifecycle, cleanup, and provider caveats; docs validation now fails on provider drift. Thanks @coygeek.
 - Added confirmed lifecycle actions to portal lease rows, with provider shutdown for coordinator-managed boxes and explicitly metadata-only deregistration for client-managed boxes.
 - Added `provider: superserve` for delegated Linux sandbox runs through the Superserve control and data planes, including archive sync, retained leases, ownership-guarded lifecycle operations, and credentialed live smoke coverage. Thanks @coygeek.

docs/operations.md

@@ -198,6 +198,9 @@ CRABBOX_HOST_ID                    optional; pins a brokered host such as an EC2
 CRABBOX_AWS_MAC_HOST_ID            optional legacy AWS alias for CRABBOX_HOST_ID
 CRABBOX_SHARED_OWNER              optional fixed owner identity for shared-token automation
 CRABBOX_ADMIN_TOKEN               required for admin routes and image promotion
+CRABBOX_WORKSPACE_SSH_PUBLIC_KEY  required for /v1/workspaces lease provisioning
+CRABBOX_WORKSPACE_PROVIDER        optional workspace provider; currently hetzner only
+CRABBOX_WORKSPACE_CLASS           optional workspace machine class; default standard
 CRABBOX_GITHUB_CLIENT_ID          required for browser login
 CRABBOX_GITHUB_CLIENT_SECRET      required for browser login
 CRABBOX_SESSION_SECRET            required for browser login
@@ -232,6 +235,11 @@ CRABBOX_AWS_ORPHAN_SWEEP_GRACE_SECONDS    optional; default 900
 CRABBOX_AWS_MAC_HOST_SWEEP_RELEASE optional; set 1 to release stale pending EC2 Mac hosts during orphan sweep
 ```
 
+Workspace leases currently use their hard TTL for provider expiry because the
+adapter does not yet receive a trustworthy activity signal. Workspace TTLs must
+be at least 1,800 seconds so a durable claim and ambiguity-recovery window both
+fit before hard TTL.
+
 ### Artifact backend
 
 The artifact backend vars are ordinary coordinator settings except

worker/src/coordinator-runtime.ts

@@ -17,6 +17,9 @@ export function coordinatorRequestQueue(request: Request): CoordinatorRequestQue
   if (method === "POST" && path.join("/") === "v1/leases") {
     return "direct";
   }
+  if (path[0] === "v1" && path[1] === "workspaces") {
+    return "direct";
+  }
   if (method === "POST" && path.join("/") === "v1/internal/scheduled") {
     return "direct";
   }