Let Workhorse run Duo Workflow actions concurrently behind a flag

Igor Drozdovrequested to merge
634393-duoworkflow-max-concurrent-actions into master

What does this MR do and why?

Workhorse can run the Duo Workflow actions it executes itself (RunHTTPRequest, RunMCPTool, TrackLlmCallForSelfHosted) concurrently, on a bounded pool per run (!263826 (merged), merged). The pool size comes from MaxConcurrentActions in the pre-authorization response, which Rails doesn't send yet, so actions still run one at a time.

This MR sends it: 8 when the new gitlab_com_derisk flag duo_workflow_concurrent_actions_in_workhorse is enabled for the user, and 1 otherwise. At 1, Workhorse runs actions on the receiving goroutine exactly as before, so turning the flag off restores today's behaviour without a deploy. This is step 4 of the implementation plan in #634393.

The flag is checked on every pre-authorization, so it covers every transport: WebSocket (IDE, CLI, web chat) and the server-side execute endpoint. The work item's rollout order (server-side first, then web chat, then IDE/CLI) can be followed by enabling the flag for dogfooding users and watching gitlab_workhorse_duo_workflow_action_queue_wait_seconds and gitlab_workhorse_duo_workflow_action_pool_saturated_total.

References

Screenshots or screen recordings

Not applicable: no UI changes.

How to set up and validate locally

  1. In the Rails console, enable the flag for your user: 
    Feature.enable(:duo_workflow_concurrent_actions_in_workhorse, User.find_by_username('root'))
  2. Open Agentic Chat in the web UI and ask something that makes the agent call several tools in one step, such as "Summarise the three most recent issues and merge requests in this project".
  3. In the Workhorse logs, confirm the Executing HTTP request lines for one step appear together, before their responses, instead of alternating with them.
  4. Disable the flag and confirm the actions run one at a time again.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports