Add daemon-selected container monitor delegation

ocf/loxthelion/managed-container.d/common.sh

@@ -119,6 +119,70 @@ mc_promotion_monitor()
         esac
     fi
 
+    # A successful managed-containerd response may explicitly delegate
+    # monitoring to the RA's already-loaded packaged container/runtime path.
+    #
+    # The daemon remains authoritative for backend selection: this path is
+    # reachable only after managed-containerd successfully requested it.
+    case "${proxy_result}" in
+        delegate\|*)
+            local delegate_tag delegate_backend delegate_runtime delegate_extra
+            local configured_runtime
+
+            IFS='|' read -r                 delegate_tag                 delegate_backend                 delegate_runtime                 delegate_extra <<EOF
+${proxy_result}
+EOF
+
+            if [ "${delegate_tag}" != delegate ] ||
+               [ "${delegate_backend}" != container ] ||
+               [ -z "${delegate_runtime}" ] ||
+               [ -n "${delegate_extra}" ]; then
+
+                mc_proxy_monitor_cache_clear || true
+                mc_promotion_score_set -INFINITY || true
+                ocf_exit_reason                     "managed-containerd returned invalid monitor delegation: ${proxy_result}"
+                return "${OCF_ERR_GENERIC}"
+            fi
+
+            configured_runtime="${OCF_RESKEY_container_runtime:-podman}"
+
+            if [ "${delegate_runtime}" != "${configured_runtime}" ]; then
+                mc_proxy_monitor_cache_clear || true
+                mc_promotion_score_set -INFINITY || true
+                ocf_exit_reason                     "managed-containerd delegated runtime ${delegate_runtime} does not match loaded RA runtime ${configured_runtime}"
+                return "${OCF_ERR_GENERIC}"
+            fi
+
+            ocf_log info                 "managed-containerd delegated authoritative monitor: resource=${OCF_RESOURCE_INSTANCE:-unknown} backend=${delegate_backend} runtime=${delegate_runtime}"
+
+            mc_application_monitor
+            monitor_rc=$?
+
+            case "${monitor_rc}" in
+                "${OCF_SUCCESS}"|                "${OCF_ERR_GENERIC}"|                "${OCF_NOT_RUNNING}"|                "${OCF_RUNNING_PROMOTED}")
+                    ;;
+                *)
+                    mc_proxy_monitor_cache_clear || true
+                    mc_promotion_score_set -INFINITY || true
+                    ocf_exit_reason                         "delegated application monitor returned invalid rc ${monitor_rc}"
+                    return "${OCF_ERR_GENERIC}"
+                    ;;
+            esac
+
+            # The delegated application result is now the authoritative
+            # observation. Cache only healthy 0/8 results using the same
+            # control-plane grace mechanism as daemon-native monitoring.
+            mc_proxy_monitor_cache_write "${monitor_rc}" || {
+                ocf_log warn                     "Unable to update delegated authoritative monitor cache"
+            }
+
+            ocf_log info                 "managed-containerd delegated monitor result: resource=${OCF_RESOURCE_INSTANCE:-unknown} rc=${monitor_rc} backend=${delegate_backend} runtime=${delegate_runtime}"
+
+            mc_promotion_score_from_monitor "${monitor_rc}" || true
+            return "${monitor_rc}"
+            ;;
+    esac
+
     monitor_rc="${proxy_result%%|*}"
 
     case "${monitor_rc}" in

ocf/loxthelion/managed-container.d/proxy.sh

@@ -88,6 +88,16 @@ mc_proxy_monitor()
         return "${MC_PROXY_RC_HARD_FAILURE}"
     fi
 
+    # Delegated monitor execution is a valid control-plane response, but it is
+    # not itself an OCF observation and must never be written to the healthy
+    # role cache. The caller validates and executes the packaged runtime path.
+    case "${response}" in
+        delegate\|*)
+            printf '%s\n' "${response}"
+            return 0
+            ;;
+    esac
+
     rc="${response%%|*}"
 
     # Cache only healthy daemon-authoritative role observations. An

ocf/loxthelion/managed-container.d/proxy_client.py

@@ -117,6 +117,22 @@ def format_monitor_result(result):
     if not isinstance(result, dict):
         raise ProtocolFailure
 
+    if result.get("delegated") is True:
+        backend = result.get("backend")
+        runtime = result.get("container_runtime")
+
+        if backend != "container":
+            raise ProtocolFailure
+
+        if runtime not in ("podman", "docker"):
+            raise ProtocolFailure
+
+        return "|".join([
+            "delegate",
+            backend,
+            runtime,
+        ])
+
     ha = result.get("ha")
 
     if not isinstance(ha, dict):