- docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md — the full Phase 2A record: node-pty
root cause and fix, Gateway architecture, student flow (entry through
reset/recreate), API routes added, HTTP/WebSocket routing design (and why
the lab-session cookie exists), security model (what's checked, and the
explicit statement that this is pilot identity, not production auth),
reset/recreate and reaper-recovery semantics, and known limitations found
during implementation (the identity instance's k3s resource cost and its
network_mode: bridge requirement, the Gateway's in-memory cache scope, the
?sid= check's coverage). BUILT NOW vs. FUTURE (Phase 2B) called out
explicitly per the governing requirement.
- docs/LAB_ARCHITECTURE.md, docs/ENGINEERING_SOP.md — status updated to
reflect Phase 2A is implemented and tested, not just Phase 1; roadmap item 5
updated accordingly; ENGINEERING_SOP's Provisioner section corrected (it's
no longer un-fronted — the Gateway is the only caller now).
- README.md — Multi-Student Deployment section updated to describe the
Gateway and student flow, not just the Provisioner; clarifies the
node-pty fix is the only change to the Lab image itself.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
