Add ward + coily binaries to the dev-base image

coilysiren commented

2026-06-16 16:19:35 +00:00

Owner

Part of epic #220, fast follow to #221.

Add ward + coily to the dev-base image

#221 shipped the dev-base image (forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:<tag>) with the language + tooling base (uv, pre-commit, python, node, go, aws cli v2, claude). The ward + coily binaries were deliberately deferred because they need a cross-repo build token at image-build time.

Scope

Multi-stage build that clones ward (coilyco-flight-deck/ward) and coily (coilyco-bridge/coily) at pinned tags and compiles the Go binaries into the image (go is already in the base).
A build-time forgejo token to clone the source repos (coily is in the leak-tolerant coilyco-bridge org). Decide: build-arg secret vs buildx --secret mount, and which token.
Pin the ward/coily versions the way the other toolchain ARGs are pinned, so a pulled tag stays reproducible.

Notes

This couples the image build to two other repos' availability/tags. Weigh that against the convenience of a batteries-included image.
The docker/dev-base/Dockerfile and publish-image job in .forgejo/workflows/release.yml are the touch points. Walkthrough: docs/dev-base-image.md.

Part of epic https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/issues/220, fast follow to https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/issues/221. ## Add ward + coily to the dev-base image #221 shipped the dev-base image (`forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:<tag>`) with the language + tooling base (uv, pre-commit, python, node, go, aws cli v2, claude). The ward + coily binaries were deliberately deferred because they need a cross-repo build token at image-build time. ### Scope - Multi-stage build that clones ward (`coilyco-flight-deck/ward`) and coily (`coilyco-bridge/coily`) at pinned tags and compiles the Go binaries into the image (go is already in the base). - A build-time forgejo token to clone the source repos (coily is in the leak-tolerant `coilyco-bridge` org). Decide: build-arg secret vs buildx `--secret` mount, and which token. - Pin the ward/coily versions the way the other toolchain ARGs are pinned, so a pulled tag stays reproducible. ### Notes - This couples the image build to two other repos' availability/tags. Weigh that against the convenience of a batteries-included image. - The `docker/dev-base/Dockerfile` and `publish-image` job in `.forgejo/workflows/release.yml` are the touch points. Walkthrough: `docs/dev-base-image.md`.

coilysiren referenced this issue

2026-06-16 18:22:08 +00:00

Publish dev-base container image from aos (Dockerfile + CI publish) #221

coilysiren added the

P2

label

2026-06-17 07:04:26 +00:00

coilysiren added

P4

consult

and removed

P2

labels

2026-06-18 06:02:29 +00:00

coilysiren commented

2026-06-18 06:42:12 +00:00

Author

Owner

Goose triage - 2026-06-17

Tier: P4 (score 65) - Real backlog item, actionable, moderate priority
Mode: consult - Requires token access and repo availability decisions

_{Auto-generated by ward exec goose-triage (qwen3-coder:30b), edited in place on each run. Labels are the conclusion; this is the why.}

**Goose triage** - 2026-06-17 - **Tier:** `P4` (score 65) - Real backlog item, actionable, moderate priority - **Mode:** `consult` - Requires token access and repo availability decisions <sub>Auto-generated by `ward exec goose-triage` (qwen3-coder:30b), edited in place on each run. Labels are the conclusion; this is the why.</sub>

coilysiren referenced this issue from a commit

2026-06-19 09:42:03 +00:00

feat(dev-base): bake ward into the image via bot creds (agentic-os#223)

coilyco-ops added

P3

and removed

P4

labels

2026-06-25 09:09:12 +00:00

coilyco-ops commented

2026-07-04 09:01:11 +00:00

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-agentic-os-223 on host KAI-DESKTOP-TOWER is carrying this issue (reserved 2026-07-04T09:01:05Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-agentic-os-223` on host `KAI-DESKTOP-TOWER` is carrying this issue (reserved 2026-07-04T09:01:05Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-07-04 09:18:00 +00:00

feat(dev-base): build ward into the image from a pinned tag (no build token)

coilysiren closed this issue

2026-07-04 09:18:00 +00:00

coilysiren commented

2026-07-04 09:18:27 +00:00

Author

Owner

WARD-OUTCOME: done - ward baked into dev-base from a pinned WARD_VERSION tag (anonymous clone, no build token); coily dropped as retired.

The premise fought back in the best way: the issue deferred ward because it "needs a cross-repo build token," but all three repos (ward, its cli-guard dep, and coily) are public now, so an anonymous clone plus GOPROXY=direct resolves the whole graph with no secret at all. I verified that live before writing a line - clean clone at v0.396.0, go mod download, build, and ward version v0.396.0 prints. So the whole token-decision axis the scope asked me to weigh just evaporated, and the publish job needs no change.

The coily half I dropped on purpose: it was retired in agentic-os#261 (its surface moved into ward ops) and coilyco-bridge/coily is archived, so baking it in would reintroduce a dead command. Called it inline rather than block on it.

Confidence is high on the build recipe (it's byte-identical to what I ran by hand, plus ward's own bounded-retry pattern for the flaky direct fetch) but I could not run a full docker build here - no daemon in the container - so I syntax-checked the RUN block instead. The one thing that genuinely annoyed me was the 4000-char documentation-layout cap: my doc bullet pushed dev-base-image.md over and I spent a dozen trims clawing back under it.

Rough edges worth a follow-up: the image build now compiles ward (and fetches its module graph) on every publish, which adds real time - a prebuilt-binary or multi-stage cache could reclaim it if it bites. Also flagging two pre-existing, unrelated test reds on the branch I did not touch (test_ward_specs_bundle sees "coilysiren" in ward-kdl.fleet.kdl, and test_check_commit_closes_issue throws a TypeError) - not mine, but someone should file them.

WARD-OUTCOME: done - ward baked into dev-base from a pinned WARD_VERSION tag (anonymous clone, no build token); coily dropped as retired. The premise fought back in the best way: the issue deferred ward because it "needs a cross-repo build token," but all three repos (ward, its cli-guard dep, and coily) are public now, so an anonymous clone plus `GOPROXY=direct` resolves the whole graph with no secret at all. I verified that live before writing a line - clean clone at v0.396.0, `go mod download`, build, and `ward version v0.396.0` prints. So the whole token-decision axis the scope asked me to weigh just evaporated, and the publish job needs no change. The coily half I dropped on purpose: it was retired in agentic-os#261 (its surface moved into `ward ops`) and coilyco-bridge/coily is archived, so baking it in would reintroduce a dead command. Called it inline rather than block on it. Confidence is high on the build recipe (it's byte-identical to what I ran by hand, plus ward's own bounded-retry pattern for the flaky direct fetch) but I could not run a full `docker build` here - no daemon in the container - so I syntax-checked the RUN block instead. The one thing that genuinely annoyed me was the 4000-char documentation-layout cap: my doc bullet pushed dev-base-image.md over and I spent a dozen trims clawing back under it. Rough edges worth a follow-up: the image build now compiles ward (and fetches its module graph) on every publish, which adds real time - a prebuilt-binary or multi-stage cache could reclaim it if it bites. Also flagging two pre-existing, unrelated test reds on the branch I did not touch (test_ward_specs_bundle sees "coilysiren" in ward-kdl.fleet.kdl, and test_check_commit_closes_issue throws a TypeError) - not mine, but someone should file them.

coilyco-ops referenced this issue from a commit

2026-07-15 03:17:39 +00:00

fix(dev-base): stop the ward-bake RUN leaking the forgejo token (agentic-os#223)

coilyco-ops referenced this issue from a commit

2026-07-15 03:25:36 +00:00

Merge rescued branch tips as no-op

Rows
Columns

Add ward + coily binaries to the dev-base image #223

Add ward + coily to the dev-base image

Scope

Notes