Turning a live address on and off

Sometimes the right thing to do with an agent is to make it stop. Not to fix it, not to replace it, just to stop it accepting work while someone looks. On Czar this is one act. The operator turns the live address off. The agent stops receiving packets. Nothing else changes.

What the switch does

A stable address is what the site's applications call to reach an agent. Deploying points the address at a published version. Turning the address off means the address stops accepting new packets. The version behind it is still the version behind it. The applications are still calling the same address. But nothing new enters a run.

Turning the address back on resumes acceptance. If the operator did nothing else in between, the same version handles the new packets. If the operator pointed the address at a different version while it was off, that version handles them.

What happens to runs in progress and new packets

A run that was already underway when the address was turned off finishes under the version it started with. If it was waiting for a reviewer, it keeps waiting, and the reviewer can still approve or stop it. If it was approved, the allowed call is still made. The run's record is complete and names its version.

Turning the address off does not interrupt runs. It only closes the door to new ones. This is what makes it safe to use quickly: no run is left half-done, and no record is left incomplete.

The desk's front door is not the agent's. Packets keep arriving at the queue, the inbox, or the case system the desk already uses. While the address is off, the agent does not take them up. The desk handles them the way it did before the agent existed, by hand or by whatever process was there.

This is a direct consequence of the agent being drawn around the packet the desk already understands. Because the agent never owned the front door, turning the agent off does not break the door. The article The packet the desk already understands describes why this matters for adoption; here it matters for operations.

When to use it

Turn the address off when something looks wrong and the cause is not yet known. A reviewer notices drafts that cite the wrong clause. An application that calls the agent starts sending packets in an unexpected shape. A system the agent calls as a tool is down for maintenance. In each case the first move is the same: stop new work, then look.

Once the cause is known, the next move depends on what it was. If the version is at fault, the operator points the address back at an earlier version and turns it on. If an upstream system was at fault, the operator waits for it to be fixed and turns the address on with the same version. If a design change is needed, the operator edits the draft, publishes, points the address at the new version, and turns it on. Pointing the address back at an earlier version covers the first of these.

Turning off before deploying

Some operators prefer a clean cut when deploying a new version. They turn the address off, let in-progress runs finish, point the address at the new version, and turn it on. This guarantees that no run was in flight when the version changed. It is not required, since in-progress runs finish under their own version regardless, but it makes the deployment history simpler to read.

Who holds the switch

The operator for an agent turns its address on and off. This is one of the operator's three acts: compose the agent, publish a version, turn the live address on or off. The admin decides who is operator for which agent. Each on and each off is recorded with the operator's name and when it happened.

So the deployment history for an address reads as a list of which version was live and whether the address was accepting, with a name against each change. An auditor asking whether an agent was accepting work during a given hour reads that list.

Of all the controls on the appliance, turning the address off is the simplest, and that is its value. It requires no diagnosis, no decision about versions, and no edit. It stops the agent taking on new work while leaving everything else exactly as it was. An operator who is unsure what is wrong should reach for it first and think second. The governance page describes how this control sits alongside the others.