more stuff

2025-10-12 21:36:00 +02:00
parent 0ba7410162
commit b8266d80f9
31 changed files with 578 additions and 778 deletions
--- a/pkg/actor/grain.go
+++ b/pkg/actor/grain.go
@@ -0,0 +1,11 @@
+package actor
+
+import "time"
+
+type Grain[V any] interface {
+	GetId() uint64
+	Apply(content any, isReplay bool) (*V, error)
+	GetLastAccess() time.Time
+	GetLastChange() time.Time
+	GetCurrentState() (*V, error)
+}
--- a/pkg/actor/grain_pool.go
+++ b/pkg/actor/grain_pool.go
@@ -0,0 +1,25 @@
+package actor
+
+import "net/http"
+
+type GrainPool[V any] interface {
+	Apply(id uint64, mutation any) (V, error)
+	Get(id uint64) (V, error)
+	OwnerHost(id uint64) (Host, bool)
+	Hostname() string
+	TakeOwnership(id uint64)
+	HandleOwnershipChange(host string, ids []uint64) error
+	HandleRemoteExpiry(host string, ids []uint64) error
+	Negotiate(otherHosts []string)
+	GetLocalIds() []uint64
+	RemoveHost(host string)
+	IsHealthy() bool
+	Close()
+}
+
+// Host abstracts a remote node capable of proxying cart requests.
+type Host interface {
+	Name() string
+	Proxy(id uint64, w http.ResponseWriter, r *http.Request) (bool, error)
+	GetActorIds() []uint64
+}
--- a/pkg/actor/grpc_server.go
+++ b/pkg/actor/grpc_server.go
@@ -0,0 +1,105 @@
+package actor
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net"
+	"time"
+
+	messages "git.tornberg.me/go-cart-actor/pkg/messages"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/reflection"
+)
+
+// ControlServer implements the ControlPlane gRPC services.
+// It delegates to a grain pool and cluster operations to a synced pool.
+type ControlServer[V any] struct {
+	messages.UnimplementedControlPlaneServer
+
+	pool GrainPool[V]
+}
+
+func (s *ControlServer[V]) AnnounceOwnership(ctx context.Context, req *messages.OwnershipAnnounce) (*messages.OwnerChangeAck, error) {
+	err := s.pool.HandleOwnershipChange(req.Host, req.Ids)
+	if err != nil {
+		return &messages.OwnerChangeAck{
+			Accepted: false,
+			Message:  "owner change failed",
+		}, err
+	}
+
+	log.Printf("Ack count: %d", len(req.Ids))
+	return &messages.OwnerChangeAck{
+		Accepted: true,
+		Message:  "ownership announced",
+	}, nil
+}
+
+func (s *ControlServer[V]) AnnounceExpiry(ctx context.Context, req *messages.ExpiryAnnounce) (*messages.OwnerChangeAck, error) {
+	err := s.pool.HandleRemoteExpiry(req.Host, req.Ids)
+	return &messages.OwnerChangeAck{
+		Accepted: err == nil,
+		Message:  "expiry acknowledged",
+	}, nil
+}
+
+// ControlPlane: Ping
+func (s *ControlServer[V]) Ping(ctx context.Context, _ *messages.Empty) (*messages.PingReply, error) {
+	// Expose cart owner cookie (first-touch owner = this host) for HTTP gateways translating gRPC metadata.
+	// Gateways that propagate Set-Cookie can help establish sticky sessions at the edge.
+	//_ = grpc.SendHeader(ctx, metadata.Pairs("set-cookie", fmt.Sprintf("cartowner=%s; Path=/; HttpOnly", s.syncedPool.Hostname())))
+	return &messages.PingReply{
+		Host:     s.pool.Hostname(),
+		UnixTime: time.Now().Unix(),
+	}, nil
+}
+
+// ControlPlane: Negotiate (merge host views)
+func (s *ControlServer[V]) Negotiate(ctx context.Context, req *messages.NegotiateRequest) (*messages.NegotiateReply, error) {
+
+	s.pool.Negotiate(req.KnownHosts)
+	return &messages.NegotiateReply{Hosts: req.GetKnownHosts()}, nil
+}
+
+// ControlPlane: GetCartIds (locally owned carts only)
+func (s *ControlServer[V]) GetLocalActorIds(ctx context.Context, _ *messages.Empty) (*messages.ActorIdsReply, error) {
+	return &messages.ActorIdsReply{Ids: s.pool.GetLocalIds()}, nil
+}
+
+// ControlPlane: Closing (peer shutdown notification)
+func (s *ControlServer[V]) Closing(ctx context.Context, req *messages.ClosingNotice) (*messages.OwnerChangeAck, error) {
+	if req.GetHost() != "" {
+		s.pool.RemoveHost(req.GetHost())
+	}
+	return &messages.OwnerChangeAck{
+		Accepted: true,
+		Message:  "removed host",
+	}, nil
+}
+
+// StartGRPCServer configures and starts the unified gRPC server on the given address.
+// It registers both the CartActor and ControlPlane services.
+func NewControlServer[V any](addr string, pool GrainPool[V]) (*grpc.Server, error) {
+	lis, err := net.Listen("tcp", addr)
+	if err != nil {
+		return nil, fmt.Errorf("failed to listen: %w", err)
+	}
+
+	grpcServer := grpc.NewServer()
+	server := &ControlServer[V]{
+		pool: pool,
+	}
+
+	messages.RegisterControlPlaneServer(grpcServer, server)
+	reflection.Register(grpcServer)
+
+	log.Printf("gRPC server listening on %s", addr)
+	go func() {
+		if err := grpcServer.Serve(lis); err != nil {
+			log.Fatalf("failed to serve gRPC: %v", err)
+		}
+	}()
+
+	return grpcServer, nil
+}
--- a/pkg/discovery/discovery.go
+++ b/pkg/discovery/discovery.go
@@ -0,0 +1,72 @@
+package discovery
+
+import (
+	"context"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
+	toolsWatch "k8s.io/client-go/tools/watch"
+)
+
+type K8sDiscovery struct {
+	ctx    context.Context
+	client *kubernetes.Clientset
+}
+
+func (k *K8sDiscovery) Discover() ([]string, error) {
+	return k.DiscoverInNamespace("")
+}
+func (k *K8sDiscovery) DiscoverInNamespace(namespace string) ([]string, error) {
+	pods, err := k.client.CoreV1().Pods(namespace).List(k.ctx, metav1.ListOptions{
+		LabelSelector: "actor-pool=cart",
+	})
+	if err != nil {
+		return nil, err
+	}
+	hosts := make([]string, 0, len(pods.Items))
+	for _, pod := range pods.Items {
+		hosts = append(hosts, pod.Status.PodIP)
+	}
+	return hosts, nil
+}
+
+type HostChange struct {
+	Host string
+	Type watch.EventType
+}
+
+func (k *K8sDiscovery) Watch() (<-chan HostChange, error) {
+	timeout := int64(30)
+	watcherFn := func(options metav1.ListOptions) (watch.Interface, error) {
+		return k.client.CoreV1().Pods("").Watch(k.ctx, metav1.ListOptions{
+			LabelSelector:  "actor-pool=cart",
+			TimeoutSeconds: &timeout,
+		})
+	}
+	watcher, err := toolsWatch.NewRetryWatcher("1", &cache.ListWatch{WatchFunc: watcherFn})
+	if err != nil {
+		return nil, err
+	}
+	ch := make(chan HostChange)
+	go func() {
+		for event := range watcher.ResultChan() {
+
+			pod := event.Object.(*v1.Pod)
+			ch <- HostChange{
+				Host: pod.Status.PodIP,
+				Type: event.Type,
+			}
+		}
+	}()
+	return ch, nil
+}
+
+func NewK8sDiscovery(client *kubernetes.Clientset) *K8sDiscovery {
+	return &K8sDiscovery{
+		ctx:    context.Background(),
+		client: client,
+	}
+}
--- a/pkg/discovery/discovery_mock.go
+++ b/pkg/discovery/discovery_mock.go
@@ -0,0 +1,102 @@
+package discovery
+
+import (
+	"context"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/watch"
+)
+
+// MockDiscovery is an in-memory Discovery implementation for tests.
+// It allows deterministic injection of host additions/removals without
+// depending on Kubernetes API machinery.
+type MockDiscovery struct {
+	mu      sync.RWMutex
+	hosts   []string
+	events  chan HostChange
+	closed  bool
+	started bool
+}
+
+// NewMockDiscovery creates a mock discovery with an initial host list.
+func NewMockDiscovery(initial []string) *MockDiscovery {
+	cp := make([]string, len(initial))
+	copy(cp, initial)
+	return &MockDiscovery{
+		hosts:  cp,
+		events: make(chan HostChange, 32),
+	}
+}
+
+// Discover returns the current host snapshot.
+func (m *MockDiscovery) Discover() ([]string, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	cp := make([]string, len(m.hosts))
+	copy(cp, m.hosts)
+	return cp, nil
+}
+
+// Watch returns a channel that will receive HostChange events.
+// The channel is buffered; AddHost/RemoveHost push events non-blockingly.
+func (m *MockDiscovery) Watch() (<-chan HostChange, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return nil, context.Canceled
+	}
+	m.started = true
+	return m.events, nil
+}
+
+// AddHost inserts a new host (if absent) and emits an Added event.
+func (m *MockDiscovery) AddHost(host string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	for _, h := range m.hosts {
+		if h == host {
+			return
+		}
+	}
+	m.hosts = append(m.hosts, host)
+	if m.started {
+		m.events <- HostChange{Host: host, Type: watch.Added}
+	}
+}
+
+// RemoveHost removes a host (if present) and emits a Deleted event.
+func (m *MockDiscovery) RemoveHost(host string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	idx := -1
+	for i, h := range m.hosts {
+		if h == host {
+			idx = i
+			break
+		}
+	}
+	if idx == -1 {
+		return
+	}
+	m.hosts = append(m.hosts[:idx], m.hosts[idx+1:]...)
+	if m.started {
+		m.events <- HostChange{Host: host, Type: watch.Deleted}
+	}
+}
+
+// Close closes the event channel (idempotent).
+func (m *MockDiscovery) Close() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	m.closed = true
+	close(m.events)
+}
--- a/pkg/discovery/discovery_test.go
+++ b/pkg/discovery/discovery_test.go
@@ -0,0 +1,51 @@
+package discovery
+
+import (
+	"testing"
+	"time"
+
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+func TestDiscovery(t *testing.T) {
+	config, err := clientcmd.BuildConfigFromFlags("", "/home/mats/.kube/config")
+	if err != nil {
+		t.Errorf("Error building config: %v", err)
+	}
+	client, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		t.Errorf("Error creating client: %v", err)
+	}
+	d := NewK8sDiscovery(client)
+	res, err := d.DiscoverInNamespace("")
+	if err != nil {
+		t.Errorf("Error discovering: %v", err)
+	}
+	if len(res) == 0 {
+		t.Errorf("Expected at least one host, got none")
+	}
+}
+
+func TestWatch(t *testing.T) {
+	config, err := clientcmd.BuildConfigFromFlags("", "/home/mats/.kube/config")
+	if err != nil {
+		t.Errorf("Error building config: %v", err)
+	}
+	client, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		t.Errorf("Error creating client: %v", err)
+	}
+	d := NewK8sDiscovery(client)
+	ch, err := d.Watch()
+	if err != nil {
+		t.Errorf("Error watching: %v", err)
+	}
+
+	select {
+	case m := <-ch:
+		t.Logf("Received watch %v", m)
+	case <-time.After(5 * time.Second):
+		t.Errorf("Timeout waiting for watch")
+	}
+}
--- a/pkg/discovery/types.go
+++ b/pkg/discovery/types.go
@@ -0,0 +1,6 @@
+package discovery
+
+type Discovery interface {
+	Discover() ([]string, error)
+	Watch() (<-chan HostChange, error)
+}
--- a/pkg/messages/control_plane.pb.go
+++ b/pkg/messages/control_plane.pb.go
@@ -0,0 +1,555 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.10
+// 	protoc        v6.32.1
+// source: control_plane.proto
+
+package messages
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Empty request placeholder (common pattern).
+type Empty struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Empty) Reset() {
+	*x = Empty{}
+	mi := &file_control_plane_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Empty) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Empty) ProtoMessage() {}
+
+func (x *Empty) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Empty.ProtoReflect.Descriptor instead.
+func (*Empty) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{0}
+}
+
+// Ping reply includes responding host and its current unix time (seconds).
+type PingReply struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	UnixTime      int64                  `protobuf:"varint,2,opt,name=unix_time,json=unixTime,proto3" json:"unix_time,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PingReply) Reset() {
+	*x = PingReply{}
+	mi := &file_control_plane_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PingReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PingReply) ProtoMessage() {}
+
+func (x *PingReply) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PingReply.ProtoReflect.Descriptor instead.
+func (*PingReply) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *PingReply) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *PingReply) GetUnixTime() int64 {
+	if x != nil {
+		return x.UnixTime
+	}
+	return 0
+}
+
+// NegotiateRequest carries the caller's full view of known hosts (including self).
+type NegotiateRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	KnownHosts    []string               `protobuf:"bytes,1,rep,name=known_hosts,json=knownHosts,proto3" json:"known_hosts,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NegotiateRequest) Reset() {
+	*x = NegotiateRequest{}
+	mi := &file_control_plane_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NegotiateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NegotiateRequest) ProtoMessage() {}
+
+func (x *NegotiateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NegotiateRequest.ProtoReflect.Descriptor instead.
+func (*NegotiateRequest) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *NegotiateRequest) GetKnownHosts() []string {
+	if x != nil {
+		return x.KnownHosts
+	}
+	return nil
+}
+
+// NegotiateReply returns the callee's healthy hosts (including itself).
+type NegotiateReply struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Hosts         []string               `protobuf:"bytes,1,rep,name=hosts,proto3" json:"hosts,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NegotiateReply) Reset() {
+	*x = NegotiateReply{}
+	mi := &file_control_plane_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NegotiateReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NegotiateReply) ProtoMessage() {}
+
+func (x *NegotiateReply) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NegotiateReply.ProtoReflect.Descriptor instead.
+func (*NegotiateReply) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *NegotiateReply) GetHosts() []string {
+	if x != nil {
+		return x.Hosts
+	}
+	return nil
+}
+
+// CartIdsReply returns the list of cart IDs (string form) currently owned locally.
+type ActorIdsReply struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Ids           []uint64               `protobuf:"varint,1,rep,packed,name=ids,proto3" json:"ids,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ActorIdsReply) Reset() {
+	*x = ActorIdsReply{}
+	mi := &file_control_plane_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ActorIdsReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActorIdsReply) ProtoMessage() {}
+
+func (x *ActorIdsReply) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActorIdsReply.ProtoReflect.Descriptor instead.
+func (*ActorIdsReply) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ActorIdsReply) GetIds() []uint64 {
+	if x != nil {
+		return x.Ids
+	}
+	return nil
+}
+
+// OwnerChangeAck retained as response type for Closing RPC (ConfirmOwner removed).
+type OwnerChangeAck struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Accepted      bool                   `protobuf:"varint,1,opt,name=accepted,proto3" json:"accepted,omitempty"`
+	Message       string                 `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OwnerChangeAck) Reset() {
+	*x = OwnerChangeAck{}
+	mi := &file_control_plane_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OwnerChangeAck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OwnerChangeAck) ProtoMessage() {}
+
+func (x *OwnerChangeAck) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OwnerChangeAck.ProtoReflect.Descriptor instead.
+func (*OwnerChangeAck) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *OwnerChangeAck) GetAccepted() bool {
+	if x != nil {
+		return x.Accepted
+	}
+	return false
+}
+
+func (x *OwnerChangeAck) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+// ClosingNotice notifies peers this host is terminating (so they can drop / re-resolve).
+type ClosingNotice struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ClosingNotice) Reset() {
+	*x = ClosingNotice{}
+	mi := &file_control_plane_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClosingNotice) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClosingNotice) ProtoMessage() {}
+
+func (x *ClosingNotice) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClosingNotice.ProtoReflect.Descriptor instead.
+func (*ClosingNotice) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ClosingNotice) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+// OwnershipAnnounce broadcasts first-touch ownership claims for cart IDs.
+// First claim wins; receivers SHOULD NOT overwrite an existing different owner.
+type OwnershipAnnounce struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`       // announcing host
+	Ids           []uint64               `protobuf:"varint,2,rep,packed,name=ids,proto3" json:"ids,omitempty"` // newly claimed cart ids
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OwnershipAnnounce) Reset() {
+	*x = OwnershipAnnounce{}
+	mi := &file_control_plane_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OwnershipAnnounce) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OwnershipAnnounce) ProtoMessage() {}
+
+func (x *OwnershipAnnounce) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OwnershipAnnounce.ProtoReflect.Descriptor instead.
+func (*OwnershipAnnounce) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *OwnershipAnnounce) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *OwnershipAnnounce) GetIds() []uint64 {
+	if x != nil {
+		return x.Ids
+	}
+	return nil
+}
+
+// ExpiryAnnounce broadcasts that a host evicted the provided cart IDs.
+type ExpiryAnnounce struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	Ids           []uint64               `protobuf:"varint,2,rep,packed,name=ids,proto3" json:"ids,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExpiryAnnounce) Reset() {
+	*x = ExpiryAnnounce{}
+	mi := &file_control_plane_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExpiryAnnounce) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExpiryAnnounce) ProtoMessage() {}
+
+func (x *ExpiryAnnounce) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExpiryAnnounce.ProtoReflect.Descriptor instead.
+func (*ExpiryAnnounce) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *ExpiryAnnounce) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *ExpiryAnnounce) GetIds() []uint64 {
+	if x != nil {
+		return x.Ids
+	}
+	return nil
+}
+
+var File_control_plane_proto protoreflect.FileDescriptor
+
+const file_control_plane_proto_rawDesc = "" +
+	"\n" +
+	"\x13control_plane.proto\x12\bmessages\"\a\n" +
+	"\x05Empty\"<\n" +
+	"\tPingReply\x12\x12\n" +
+	"\x04host\x18\x01 \x01(\tR\x04host\x12\x1b\n" +
+	"\tunix_time\x18\x02 \x01(\x03R\bunixTime\"3\n" +
+	"\x10NegotiateRequest\x12\x1f\n" +
+	"\vknown_hosts\x18\x01 \x03(\tR\n" +
+	"knownHosts\"&\n" +
+	"\x0eNegotiateReply\x12\x14\n" +
+	"\x05hosts\x18\x01 \x03(\tR\x05hosts\"!\n" +
+	"\rActorIdsReply\x12\x10\n" +
+	"\x03ids\x18\x01 \x03(\x04R\x03ids\"F\n" +
+	"\x0eOwnerChangeAck\x12\x1a\n" +
+	"\baccepted\x18\x01 \x01(\bR\baccepted\x12\x18\n" +
+	"\amessage\x18\x02 \x01(\tR\amessage\"#\n" +
+	"\rClosingNotice\x12\x12\n" +
+	"\x04host\x18\x01 \x01(\tR\x04host\"9\n" +
+	"\x11OwnershipAnnounce\x12\x12\n" +
+	"\x04host\x18\x01 \x01(\tR\x04host\x12\x10\n" +
+	"\x03ids\x18\x02 \x03(\x04R\x03ids\"6\n" +
+	"\x0eExpiryAnnounce\x12\x12\n" +
+	"\x04host\x18\x01 \x01(\tR\x04host\x12\x10\n" +
+	"\x03ids\x18\x02 \x03(\x04R\x03ids2\x8d\x03\n" +
+	"\fControlPlane\x12,\n" +
+	"\x04Ping\x12\x0f.messages.Empty\x1a\x13.messages.PingReply\x12A\n" +
+	"\tNegotiate\x12\x1a.messages.NegotiateRequest\x1a\x18.messages.NegotiateReply\x12<\n" +
+	"\x10GetLocalActorIds\x12\x0f.messages.Empty\x1a\x17.messages.ActorIdsReply\x12J\n" +
+	"\x11AnnounceOwnership\x12\x1b.messages.OwnershipAnnounce\x1a\x18.messages.OwnerChangeAck\x12D\n" +
+	"\x0eAnnounceExpiry\x12\x18.messages.ExpiryAnnounce\x1a\x18.messages.OwnerChangeAck\x12<\n" +
+	"\aClosing\x12\x17.messages.ClosingNotice\x1a\x18.messages.OwnerChangeAckB.Z,git.tornberg.me/go-cart-actor/proto;messagesb\x06proto3"
+
+var (
+	file_control_plane_proto_rawDescOnce sync.Once
+	file_control_plane_proto_rawDescData []byte
+)
+
+func file_control_plane_proto_rawDescGZIP() []byte {
+	file_control_plane_proto_rawDescOnce.Do(func() {
+		file_control_plane_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_control_plane_proto_rawDesc), len(file_control_plane_proto_rawDesc)))
+	})
+	return file_control_plane_proto_rawDescData
+}
+
+var file_control_plane_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_control_plane_proto_goTypes = []any{
+	(*Empty)(nil),             // 0: messages.Empty
+	(*PingReply)(nil),         // 1: messages.PingReply
+	(*NegotiateRequest)(nil),  // 2: messages.NegotiateRequest
+	(*NegotiateReply)(nil),    // 3: messages.NegotiateReply
+	(*ActorIdsReply)(nil),     // 4: messages.ActorIdsReply
+	(*OwnerChangeAck)(nil),    // 5: messages.OwnerChangeAck
+	(*ClosingNotice)(nil),     // 6: messages.ClosingNotice
+	(*OwnershipAnnounce)(nil), // 7: messages.OwnershipAnnounce
+	(*ExpiryAnnounce)(nil),    // 8: messages.ExpiryAnnounce
+}
+var file_control_plane_proto_depIdxs = []int32{
+	0, // 0: messages.ControlPlane.Ping:input_type -> messages.Empty
+	2, // 1: messages.ControlPlane.Negotiate:input_type -> messages.NegotiateRequest
+	0, // 2: messages.ControlPlane.GetLocalActorIds:input_type -> messages.Empty
+	7, // 3: messages.ControlPlane.AnnounceOwnership:input_type -> messages.OwnershipAnnounce
+	8, // 4: messages.ControlPlane.AnnounceExpiry:input_type -> messages.ExpiryAnnounce
+	6, // 5: messages.ControlPlane.Closing:input_type -> messages.ClosingNotice
+	1, // 6: messages.ControlPlane.Ping:output_type -> messages.PingReply
+	3, // 7: messages.ControlPlane.Negotiate:output_type -> messages.NegotiateReply
+	4, // 8: messages.ControlPlane.GetLocalActorIds:output_type -> messages.ActorIdsReply
+	5, // 9: messages.ControlPlane.AnnounceOwnership:output_type -> messages.OwnerChangeAck
+	5, // 10: messages.ControlPlane.AnnounceExpiry:output_type -> messages.OwnerChangeAck
+	5, // 11: messages.ControlPlane.Closing:output_type -> messages.OwnerChangeAck
+	6, // [6:12] is the sub-list for method output_type
+	0, // [0:6] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_control_plane_proto_init() }
+func file_control_plane_proto_init() {
+	if File_control_plane_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_control_plane_proto_rawDesc), len(file_control_plane_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_control_plane_proto_goTypes,
+		DependencyIndexes: file_control_plane_proto_depIdxs,
+		MessageInfos:      file_control_plane_proto_msgTypes,
+	}.Build()
+	File_control_plane_proto = out.File
+	file_control_plane_proto_goTypes = nil
+	file_control_plane_proto_depIdxs = nil
+}
--- a/pkg/messages/control_plane_grpc.pb.go
+++ b/pkg/messages/control_plane_grpc.pb.go
@@ -0,0 +1,327 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v6.32.1
+// source: control_plane.proto
+
+package messages
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ControlPlane_Ping_FullMethodName              = "/messages.ControlPlane/Ping"
+	ControlPlane_Negotiate_FullMethodName         = "/messages.ControlPlane/Negotiate"
+	ControlPlane_GetLocalActorIds_FullMethodName  = "/messages.ControlPlane/GetLocalActorIds"
+	ControlPlane_AnnounceOwnership_FullMethodName = "/messages.ControlPlane/AnnounceOwnership"
+	ControlPlane_AnnounceExpiry_FullMethodName    = "/messages.ControlPlane/AnnounceExpiry"
+	ControlPlane_Closing_FullMethodName           = "/messages.ControlPlane/Closing"
+)
+
+// ControlPlaneClient is the client API for ControlPlane service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// ControlPlane defines cluster coordination and ownership operations.
+type ControlPlaneClient interface {
+	// Ping for liveness; lightweight health signal.
+	Ping(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*PingReply, error)
+	// Negotiate merges host views; used during discovery & convergence.
+	Negotiate(ctx context.Context, in *NegotiateRequest, opts ...grpc.CallOption) (*NegotiateReply, error)
+	// GetCartIds lists currently owned cart IDs on this node.
+	GetLocalActorIds(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ActorIdsReply, error)
+	// Ownership announcement: first-touch claim broadcast (idempotent; best-effort).
+	AnnounceOwnership(ctx context.Context, in *OwnershipAnnounce, opts ...grpc.CallOption) (*OwnerChangeAck, error)
+	// Expiry announcement: drop remote ownership hints when local TTL expires.
+	AnnounceExpiry(ctx context.Context, in *ExpiryAnnounce, opts ...grpc.CallOption) (*OwnerChangeAck, error)
+	// Closing announces graceful shutdown so peers can proactively adjust.
+	Closing(ctx context.Context, in *ClosingNotice, opts ...grpc.CallOption) (*OwnerChangeAck, error)
+}
+
+type controlPlaneClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewControlPlaneClient(cc grpc.ClientConnInterface) ControlPlaneClient {
+	return &controlPlaneClient{cc}
+}
+
+func (c *controlPlaneClient) Ping(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*PingReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PingReply)
+	err := c.cc.Invoke(ctx, ControlPlane_Ping_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) Negotiate(ctx context.Context, in *NegotiateRequest, opts ...grpc.CallOption) (*NegotiateReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(NegotiateReply)
+	err := c.cc.Invoke(ctx, ControlPlane_Negotiate_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) GetLocalActorIds(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ActorIdsReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ActorIdsReply)
+	err := c.cc.Invoke(ctx, ControlPlane_GetLocalActorIds_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) AnnounceOwnership(ctx context.Context, in *OwnershipAnnounce, opts ...grpc.CallOption) (*OwnerChangeAck, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(OwnerChangeAck)
+	err := c.cc.Invoke(ctx, ControlPlane_AnnounceOwnership_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) AnnounceExpiry(ctx context.Context, in *ExpiryAnnounce, opts ...grpc.CallOption) (*OwnerChangeAck, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(OwnerChangeAck)
+	err := c.cc.Invoke(ctx, ControlPlane_AnnounceExpiry_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) Closing(ctx context.Context, in *ClosingNotice, opts ...grpc.CallOption) (*OwnerChangeAck, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(OwnerChangeAck)
+	err := c.cc.Invoke(ctx, ControlPlane_Closing_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ControlPlaneServer is the server API for ControlPlane service.
+// All implementations must embed UnimplementedControlPlaneServer
+// for forward compatibility.
+//
+// ControlPlane defines cluster coordination and ownership operations.
+type ControlPlaneServer interface {
+	// Ping for liveness; lightweight health signal.
+	Ping(context.Context, *Empty) (*PingReply, error)
+	// Negotiate merges host views; used during discovery & convergence.
+	Negotiate(context.Context, *NegotiateRequest) (*NegotiateReply, error)
+	// GetCartIds lists currently owned cart IDs on this node.
+	GetLocalActorIds(context.Context, *Empty) (*ActorIdsReply, error)
+	// Ownership announcement: first-touch claim broadcast (idempotent; best-effort).
+	AnnounceOwnership(context.Context, *OwnershipAnnounce) (*OwnerChangeAck, error)
+	// Expiry announcement: drop remote ownership hints when local TTL expires.
+	AnnounceExpiry(context.Context, *ExpiryAnnounce) (*OwnerChangeAck, error)
+	// Closing announces graceful shutdown so peers can proactively adjust.
+	Closing(context.Context, *ClosingNotice) (*OwnerChangeAck, error)
+	mustEmbedUnimplementedControlPlaneServer()
+}
+
+// UnimplementedControlPlaneServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedControlPlaneServer struct{}
+
+func (UnimplementedControlPlaneServer) Ping(context.Context, *Empty) (*PingReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Ping not implemented")
+}
+func (UnimplementedControlPlaneServer) Negotiate(context.Context, *NegotiateRequest) (*NegotiateReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Negotiate not implemented")
+}
+func (UnimplementedControlPlaneServer) GetLocalActorIds(context.Context, *Empty) (*ActorIdsReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetLocalActorIds not implemented")
+}
+func (UnimplementedControlPlaneServer) AnnounceOwnership(context.Context, *OwnershipAnnounce) (*OwnerChangeAck, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AnnounceOwnership not implemented")
+}
+func (UnimplementedControlPlaneServer) AnnounceExpiry(context.Context, *ExpiryAnnounce) (*OwnerChangeAck, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AnnounceExpiry not implemented")
+}
+func (UnimplementedControlPlaneServer) Closing(context.Context, *ClosingNotice) (*OwnerChangeAck, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Closing not implemented")
+}
+func (UnimplementedControlPlaneServer) mustEmbedUnimplementedControlPlaneServer() {}
+func (UnimplementedControlPlaneServer) testEmbeddedByValue()                      {}
+
+// UnsafeControlPlaneServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ControlPlaneServer will
+// result in compilation errors.
+type UnsafeControlPlaneServer interface {
+	mustEmbedUnimplementedControlPlaneServer()
+}
+
+func RegisterControlPlaneServer(s grpc.ServiceRegistrar, srv ControlPlaneServer) {
+	// If the following call pancis, it indicates UnimplementedControlPlaneServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ControlPlane_ServiceDesc, srv)
+}
+
+func _ControlPlane_Ping_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).Ping(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_Ping_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).Ping(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_Negotiate_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(NegotiateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).Negotiate(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_Negotiate_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).Negotiate(ctx, req.(*NegotiateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_GetLocalActorIds_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).GetLocalActorIds(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_GetLocalActorIds_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).GetLocalActorIds(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_AnnounceOwnership_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(OwnershipAnnounce)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).AnnounceOwnership(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_AnnounceOwnership_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).AnnounceOwnership(ctx, req.(*OwnershipAnnounce))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_AnnounceExpiry_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExpiryAnnounce)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).AnnounceExpiry(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_AnnounceExpiry_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).AnnounceExpiry(ctx, req.(*ExpiryAnnounce))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_Closing_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ClosingNotice)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).Closing(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_Closing_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).Closing(ctx, req.(*ClosingNotice))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ControlPlane_ServiceDesc is the grpc.ServiceDesc for ControlPlane service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ControlPlane_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "messages.ControlPlane",
+	HandlerType: (*ControlPlaneServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Ping",
+			Handler:    _ControlPlane_Ping_Handler,
+		},
+		{
+			MethodName: "Negotiate",
+			Handler:    _ControlPlane_Negotiate_Handler,
+		},
+		{
+			MethodName: "GetLocalActorIds",
+			Handler:    _ControlPlane_GetLocalActorIds_Handler,
+		},
+		{
+			MethodName: "AnnounceOwnership",
+			Handler:    _ControlPlane_AnnounceOwnership_Handler,
+		},
+		{
+			MethodName: "AnnounceExpiry",
+			Handler:    _ControlPlane_AnnounceExpiry_Handler,
+		},
+		{
+			MethodName: "Closing",
+			Handler:    _ControlPlane_Closing_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "control_plane.proto",
+}
--- a/pkg/messages/messages.pb.go
+++ b/pkg/messages/messages.pb.go
--- a/pkg/proxy/remotehost.go
+++ b/pkg/proxy/remotehost.go
@@ -0,0 +1,210 @@
+package proxy
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"time"
+
+	messages "git.tornberg.me/go-cart-actor/pkg/messages"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// RemoteHost mirrors the lightweight controller used for remote node
+// interaction.
+type RemoteHost struct {
+	Host          string
+	httpBase      string
+	conn          *grpc.ClientConn
+	transport     *http.Transport
+	client        *http.Client
+	controlClient messages.ControlPlaneClient
+	MissedPings   int
+}
+
+func NewRemoteHost(host string) (*RemoteHost, error) {
+
+	target := fmt.Sprintf("%s:1337", host)
+
+	conn, err := grpc.NewClient(target, grpc.WithTransportCredentials(insecure.NewCredentials()))
+
+	if err != nil {
+		log.Printf("AddRemote: dial %s failed: %v", target, err)
+		return nil, err
+	}
+
+	controlClient := messages.NewControlPlaneClient(conn)
+	for retries := range 3 {
+		ctx, pingCancel := context.WithTimeout(context.Background(), time.Second)
+		_, pingErr := controlClient.Ping(ctx, &messages.Empty{})
+		pingCancel()
+		if pingErr == nil {
+			break
+		}
+		if retries == 2 {
+			log.Printf("AddRemote: ping %s failed after retries: %v", host, pingErr)
+			conn.Close()
+			return nil, pingErr
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+
+	transport := &http.Transport{
+		MaxIdleConns:        100,
+		MaxIdleConnsPerHost: 100,
+		IdleConnTimeout:     120 * time.Second,
+	}
+	client := &http.Client{Transport: transport, Timeout: 10 * time.Second}
+
+	return &RemoteHost{
+		Host:          host,
+		httpBase:      fmt.Sprintf("http://%s:8080/cart", host),
+		conn:          conn,
+		transport:     transport,
+		client:        client,
+		controlClient: controlClient,
+		MissedPings:   0,
+	}, nil
+}
+
+func (h *RemoteHost) Name() string {
+	return h.Host
+}
+
+func (h *RemoteHost) Close() error {
+	if h.conn != nil {
+		h.conn.Close()
+	}
+	return nil
+}
+
+func (h *RemoteHost) Ping() bool {
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	_, err := h.controlClient.Ping(ctx, &messages.Empty{})
+	cancel()
+	if err != nil {
+		h.MissedPings++
+		log.Printf("Ping %s failed (%d)", h.Host, h.MissedPings)
+		return false
+	}
+
+	h.MissedPings = 0
+	return true
+}
+
+func (h *RemoteHost) Negotiate(knownHosts []string) ([]string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	resp, err := h.controlClient.Negotiate(ctx, &messages.NegotiateRequest{
+		KnownHosts: knownHosts,
+	})
+	if err != nil {
+		h.MissedPings++
+		log.Printf("Negotiate %s failed: %v", h.Host, err)
+		return nil, err
+	}
+	h.MissedPings = 0
+	return resp.Hosts, nil
+}
+
+func (h *RemoteHost) GetActorIds() []uint64 {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	reply, err := h.controlClient.GetLocalActorIds(ctx, &messages.Empty{})
+	if err != nil {
+		log.Printf("Init remote %s: GetCartIds error: %v", h.Host, err)
+		h.MissedPings++
+		return []uint64{}
+	}
+	return reply.GetIds()
+}
+
+func (h *RemoteHost) AnnounceOwnership(uids []uint64) {
+	_, err := h.controlClient.AnnounceOwnership(context.Background(), &messages.OwnershipAnnounce{
+		Host: h.Host,
+		Ids:  uids,
+	})
+	if err != nil {
+		log.Printf("ownership announce to %s failed: %v", h.Host, err)
+		h.MissedPings++
+		return
+	}
+	h.MissedPings = 0
+}
+
+func (h *RemoteHost) AnnounceExpiry(uids []uint64) {
+	_, err := h.controlClient.AnnounceExpiry(context.Background(), &messages.ExpiryAnnounce{
+		Host: h.Host,
+		Ids:  uids,
+	})
+	if err != nil {
+		log.Printf("expiry announce to %s failed: %v", h.Host, err)
+		h.MissedPings++
+		return
+	}
+	h.MissedPings = 0
+}
+
+func (h *RemoteHost) Proxy(id uint64, w http.ResponseWriter, r *http.Request) (bool, error) {
+	target := fmt.Sprintf("%s%s", h.httpBase, r.URL.RequestURI())
+	var bodyCopy []byte
+	if r.Body != nil && r.Body != http.NoBody {
+		var err error
+		bodyCopy, err = io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, "proxy read error", http.StatusBadGateway)
+			return false, err
+		}
+	}
+	if r.Body != nil {
+		r.Body.Close()
+	}
+	var reqBody io.Reader
+	if len(bodyCopy) > 0 {
+		reqBody = bytes.NewReader(bodyCopy)
+	}
+	req, err := http.NewRequestWithContext(r.Context(), r.Method, target, reqBody)
+	if err != nil {
+		http.Error(w, "proxy build error", http.StatusBadGateway)
+		return false, err
+	}
+	r.Body = io.NopCloser(bytes.NewReader(bodyCopy))
+	req.Header.Set("X-Forwarded-Host", r.Host)
+
+	for k, v := range r.Header {
+		for _, vv := range v {
+			req.Header.Add(k, vv)
+		}
+	}
+	res, err := h.client.Do(req)
+	if err != nil {
+		http.Error(w, "proxy request error", http.StatusBadGateway)
+		return false, err
+	}
+	defer res.Body.Close()
+	for k, v := range res.Header {
+		for _, vv := range v {
+			w.Header().Add(k, vv)
+		}
+	}
+	w.Header().Set("X-Cart-Owner-Routed", "true")
+	if res.StatusCode >= 200 && res.StatusCode <= 299 {
+		w.WriteHeader(res.StatusCode)
+		_, copyErr := io.Copy(w, res.Body)
+		if copyErr != nil {
+			return true, copyErr
+		}
+		return true, nil
+	}
+	return false, fmt.Errorf("proxy response status %d", res.StatusCode)
+}
+
+func (r *RemoteHost) IsHealthy() bool {
+	return r.MissedPings < 3
+}