Skip to content

Bind Time-Bounded Lab Access to Verified Release

Status

Accepted: A time-bounded cloud-lab session may authorise protected release at expiry, but it must not authorise unverified destruction.

Context

High-resource lab compute can remain active after an operator stops using its access path. A generic idle timeout cannot determine whether required lab state has been preserved, and closing a browser or tunnel does not establish that the environment is safe to release.

Decision

Time-bounded access is a foreground, environment-scoped session with an explicit deadline and expiry action. The supported expiry action is protected release. It invokes the blueprint's recovery verification and releases resources only if that gate passes.

The session is bound to the current resource generation. Its deadline may be extended, and its expiry action may be cancelled without closing access or changing the environment. Session state records warnings, changes, the final release result, and available cost context.

Consequences

Positive

  • Access duration and resource lifetime are connected through an explicit lifecycle decision.
  • Expiry cannot bypass the platform's recovery boundary.
  • Extension, cancellation, failure, and release remain reviewable.

Negative

  • The supervising access process must remain active.
  • Failed preservation retains the environment and its ongoing cost.
  • Session expiry is not an idle-activity detector.

Alternatives considered

  • Destroy compute when the access process closes: rejected because access closure does not prove recoverability.
  • Use an unobserved idle timer: rejected because activity is an unreliable substitute for an explicit release decision.

References