feat(engine-process): support caller-defined engine instance paths

[NathanFlurry]

No description provided.

[NathanFlurry]

Stack for rivet-dev/rivet

• #5512 fix(actors): surface unregistered actor startup errors
• #5514 fix(rivetkit): protect local serverless handler ownership
• #5513 fix(rivetkit): reject conflicting local envoy connections
• #5510 feat(rivetkit): isolate managed engine storage by port
• #5511 feat(engine-process): support caller-defined engine instance … 👈
• main

Get stack: forklift get 5511
Push local edits: forklift submit
Merge when ready: forklift merge 5511

_{change qsuoyqxt}

[railway-app]

🚅 Deployed to the rivet-pr-5511 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
kitchen-sink	😴 Sleeping (View Logs)	Web	Jul 30, 2026 at 8:54 pm
frontend-cloud	😴 Sleeping (View Logs)	Web	Jul 30, 2026 at 8:52 pm
website	😴 Sleeping (View Logs)	Web	Jul 30, 2026 at 8:50 pm
frontend-inspector	😴 Sleeping (View Logs)	Web	Jul 30, 2026 at 8:50 pm
ladle	✅ Success (View Logs)	Web	Jul 30, 2026 at 8:42 pm
mcp-hub	✅ Success (View Logs)	Web	Jul 30, 2026 at 8:42 pm

[claude]

Review

Small, focused change: EngineResolverConfig gains an optional instance_path so embedders can point a managed engine's mutable state (db, logs, stamp, config.json) at a caller-chosen directory, defaulting to the legacy shared storage_root()/var/engine layout when unset. The refactor from free functions to config-threaded path helpers (engine_instance_path, engine_db_path, engine_stamp_path, engine_logs_dir) is clean and every call site was updated consistently.

Observations

1. Reused-engine stamp lookup can silently miss when instance_path differs across callers (lib.rs:166, :185, read_engine_stamp at :367). When an already-running engine is detected at the same endpoint (via the pre-resolve probe or the in-start_resolved health probe), the code reads the runtime stamp from engine_stamp_path(config) using the current callers instance_path. If a second caller reuses the same endpoint but passes a different instance_path than whatever process originally spawned the engine, the stamp file will not exist at that location and read_engine_stamp degrades to None (treated as unknown binding) rather than surfacing that the reused engine belongs to a different instance/config. Since the whole point of instance_path is isolating multiple managed engines, it is worth a doc note (or an explicit mismatch check) that isolation only holds if callers also give each instance a distinct endpoint/port. Otherwise the second caller silently attaches to the first instances live process while losing accurate stamp diagnostics.

2. No current caller actually sets instance_path. All three constructors of EngineResolverConfig in-tree (serverless.rs:162, registry/mod.rs:590, engine_runner.rs:22) go through EngineResolverConfig::from_parts, which hardcodes instance_path: None. So this PR is pure plumbing for now: no in-repo behavior changes, and the new isolation path is only reachable by an out-of-tree embedder constructing the struct directly. That is a reasonable way to land foundational work, but worth confirming that is the intent (e.g. a follow-up PR wires an actual caller), since otherwise it is dead code from this repos own callers perspective aside from the new unit test.

3. Test coverage gap for the default (legacy) path. caller_defined_instance_path_scopes_mutable_state only asserts the new custom-path branch (engine_db_path, engine_stamp_path, engine_logs_dir). There is no companion assertion that instance_path: None still resolves to the exact legacy paths: storage_root()/var/engine/db, storage_root()/var/engine/runtime.json, and storage_root()/var/logs/rivet-engine. A quick regression test pinning the None case would guard against a future refactor accidentally changing the shared default path.

4. write_engine_configs config.json path is not covered by the new test. It also switched to engine_instance_path(config)? but is not directly exercised for the custom-path case.

Nothing here blocks merging. These are suggestions to tighten test coverage and documentation around the new isolation contract. The #[serde(default)] on EngineRuntimeStamp::instance_path correctly keeps old on-disk stamps readable, and the dev.rs/lib.rs test-helper updates are purely mechanical to keep call sites compiling.