Add recurring fleet CI tools to dev-base before consumers drop installs

coilyco-ops commented

2026-07-09 03:51:57 +00:00

Member

Fleet CI scan found several repeated runtime installs that cannot be removed by a simple job-level dev-base swap because the current pinned dev-base image does not appear to include the tools yet.

Tools found in active workflows:

GitHub CLI gh - used by coilyco-bridge/agentic-os-kai sync workflows.
Helm - used by coilyco-flight-deck/lunch-money-k8s chart lint/template job.
kubectl - used by coilyco-flight-deck/backend deploy job.
yq - used by coilyco-flight-deck/infrastructure caddy-shortcuts workflow.
Docker buildx - still self-installed in agentic-os image publishing.
Rust + wasm-pack - used by coilyco-flight-deck/galaxy-gen workflows.

Acceptance criteria:

Decide which of these belong in dev-base versus which should stay job-local because they are too domain-specific or heavy.
Add accepted tools to docker/dev-base/Dockerfile with pinned versions and bounded installs.
Update dev-base docs and auto-bump coverage where appropriate.
Leave a clear note for rejected tools so consuming repos do not assume dev-base owns them.
After publish, downstream repos can remove their package-manager/setup-action installs in a separate per-repo pass.

Fleet CI scan found several repeated runtime installs that cannot be removed by a simple job-level dev-base swap because the current pinned dev-base image does not appear to include the tools yet. Tools found in active workflows: * GitHub CLI `gh` - used by `coilyco-bridge/agentic-os-kai` sync workflows. * Helm - used by `coilyco-flight-deck/lunch-money-k8s` chart lint/template job. * kubectl - used by `coilyco-flight-deck/backend` deploy job. * yq - used by `coilyco-flight-deck/infrastructure` caddy-shortcuts workflow. * Docker buildx - still self-installed in `agentic-os` image publishing. * Rust + wasm-pack - used by `coilyco-flight-deck/galaxy-gen` workflows. Acceptance criteria: * Decide which of these belong in dev-base versus which should stay job-local because they are too domain-specific or heavy. * Add accepted tools to `docker/dev-base/Dockerfile` with pinned versions and bounded installs. * Update dev-base docs and auto-bump coverage where appropriate. * Leave a clear note for rejected tools so consuming repos do not assume dev-base owns them. * After publish, downstream repos can remove their package-manager/setup-action installs in a separate per-repo pass.

coilyco-ops commented

2026-07-09 03:52:19 +00:00

Author

Member

🔒 Reserved by ward agent --harness codex — container engineer-codex-agentic-os-355 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-09T03:52:17Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#355 · branch issue-355 · harness codex · workflow pr
Run: engineer-codex-agentic-os-355 · ward v0.470.0 · dispatched 2026-07-09T03:52:17Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.470.0).

— Codex, via ward agent

🔒 Reserved by `ward agent --harness codex` — container `engineer-codex-agentic-os-355` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-09T03:52:17Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#355` · branch `issue-355` · harness `codex` · workflow `pr` - **Run:** `engineer-codex-agentic-os-355` · ward `v0.470.0` · dispatched `2026-07-09T03:52:17Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.470.0). </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-09 03:59:11 +00:00

ward salvage: ward-salvage/agentic-os-dafbc03c #359

coilyco-ops commented

2026-07-09 03:59:12 +00:00

Author

Member

⚠️ Reopened: this run's work did not land on `main`

An ephemeral ward container (codex mode) dispatched for this issue finished but its work was not merged to main, so the reaper preserved it on a branch before teardown and reopened the issue (a closing reference for #355 never reached main). Recover from the salvage branch below.

Repo: coilyco-flight-deck/agentic-os
Salvage branch: ward-salvage/agentic-os-dafbc03c
Pull request: not opened - PR creation failed: forgejo: parse created pull request: unexpected end of JSON input
Reason: run workflow does not land on main (--workflow pr/patch-only)
Container uptime at reap: 6m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token)

Reap diagnostics

--- reap diagnostics ---
ward version:      v0.470.0
version source:    pinned via WARD_VERSION/--ward-version (v0.470.0)
HEAD:              f5d6b3ab7b55
origin/main:       ae3677c83d75
ancestry:          HEAD is NOT yet on origin/main - residual work remains to land
decision gate:     workflow does not land on main (--workflow pr/patch-only)
reason:            run workflow does not land on main (--workflow pr/patch-only)
provenance:        not read (workflow hold)
run-owned landed:  no
working tree:      6 dirty path(s)
container uptime:  6m (baked Forgejo PAT age proxy)
--- end reap diagnostics ---

Recover

git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os.git ward-salvage/agentic-os-dafbc03c
git checkout -b ward-salvage/agentic-os-dafbc03c FETCH_HEAD

Working tree at reap time

 M docker/dev-base/Dockerfile
 M docs/FEATURES.md
 M docs/dev-base-auto-bump.md
 M docs/dev-base-image.md
 M scripts/dep-bump.py
 M tests/test_dep_bump.py

— Codex, via ward agent

## ⚠️ Reopened: this run's work did not land on `main` An ephemeral `ward container` (codex mode) dispatched for this issue finished but its work was **not merged to `main`**, so the reaper preserved it on a branch before teardown and reopened the issue (a closing reference for #355 never reached `main`). Recover from the salvage branch below. - **Repo:** `coilyco-flight-deck/agentic-os` - **Salvage branch:** `ward-salvage/agentic-os-dafbc03c` - **Pull request:** not opened - PR creation failed: forgejo: parse created pull request: unexpected end of JSON input - **Reason:** run workflow does not land on main (--workflow pr/patch-only) - **Container uptime at reap:** 6m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token) ## Reap diagnostics ``` --- reap diagnostics --- ward version: v0.470.0 version source: pinned via WARD_VERSION/--ward-version (v0.470.0) HEAD: f5d6b3ab7b55 origin/main: ae3677c83d75 ancestry: HEAD is NOT yet on origin/main - residual work remains to land decision gate: workflow does not land on main (--workflow pr/patch-only) reason: run workflow does not land on main (--workflow pr/patch-only) provenance: not read (workflow hold) run-owned landed: no working tree: 6 dirty path(s) container uptime: 6m (baked Forgejo PAT age proxy) --- end reap diagnostics --- ``` ## Recover ```bash git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os.git ward-salvage/agentic-os-dafbc03c git checkout -b ward-salvage/agentic-os-dafbc03c FETCH_HEAD ``` ## Working tree at reap time ``` M docker/dev-base/Dockerfile M docs/FEATURES.md M docs/dev-base-auto-bump.md M docs/dev-base-image.md M scripts/dep-bump.py M tests/test_dep_bump.py ```  — Codex, via `ward agent`

coilyco-ops added the

headless

P1

labels

2026-07-09 06:38:29 +00:00

coilyco-ops referenced this issue

2026-07-09 07:21:35 +00:00

ward salvage: ward-salvage/agentic-os-dafbc03c #359

coilyco-ops commented

2026-07-09 07:21:36 +00:00

Author

Member

Director re-dispatch note, 2026-07-09T07:08Z:

PR #359 was closed as stale because its salvage branch would revert recent recovery work. Fresh run should start from current main and apply only the #355 dev-base toolchain change.

Scope:

Accept recurring fleet CI tools that belong in shared dev-base: gh, helm, kubectl, yq.
Keep heavier or domain-specific tools job-local: Docker buildx, Rust, wasm-pack.
Touch only docker/dev-base/Dockerfile, docs/FEATURES.md, docs/dev-base-auto-bump.md, docs/dev-base-image.md, scripts/dep-bump.py, and tests/test_dep_bump.py unless a test forces one more tightly related file.
Do not alter release action wrappers, ward-specs bundle files, or the director-surface audit ownership fix.

Director re-dispatch note, 2026-07-09T07:08Z: PR #359 was closed as stale because its salvage branch would revert recent recovery work. Fresh run should start from current `main` and apply only the #355 dev-base toolchain change. Scope: * Accept recurring fleet CI tools that belong in shared dev-base: `gh`, `helm`, `kubectl`, `yq`. * Keep heavier or domain-specific tools job-local: Docker buildx, Rust, wasm-pack. * Touch only `docker/dev-base/Dockerfile`, `docs/FEATURES.md`, `docs/dev-base-auto-bump.md`, `docs/dev-base-image.md`, `scripts/dep-bump.py`, and `tests/test_dep_bump.py` unless a test forces one more tightly related file. * Do not alter release action wrappers, ward-specs bundle files, or the director-surface audit ownership fix.

coilyco-ops commented

2026-07-09 07:21:41 +00:00

Author

Member

🔒 Reserved by ward agent --harness codex — container engineer-codex-agentic-os-355 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-09T07:21:40Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#355 · branch issue-355 · harness codex · workflow pr
Run: engineer-codex-agentic-os-355 · ward v0.474.0 · dispatched 2026-07-09T07:21:40Z
Comment thread: 2 included in the pre-flight read, 1 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-07-09T03:59:12Z), @coilyco-ops (2026-07-09T07:21:36Z)
- stripped: @coilyco-ops (2026-07-09T03:52:19Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.474.0).

— Codex, via ward agent

🔒 Reserved by `ward agent --harness codex` — container `engineer-codex-agentic-os-355` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-09T07:21:40Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#355` · branch `issue-355` · harness `codex` · workflow `pr` - **Run:** `engineer-codex-agentic-os-355` · ward `v0.474.0` · dispatched `2026-07-09T07:21:40Z` - **Comment thread:** 2 included in the pre-flight read, 1 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-09T03:59:12Z), @coilyco-ops (2026-07-09T07:21:36Z) - stripped: @coilyco-ops (2026-07-09T03:52:19Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.474.0). </details>  — Codex, via `ward agent`

~~coilyco-ops referenced this issue 2026-07-09 07:31:06 +00:00~~

chore(dev-base): add fleet CI tools #371

coilyco-ops commented

2026-07-09 07:31:19 +00:00

Author

Member

WARD-OUTCOME: done - added gh, helm, kubectl, and yq to dev-base and left buildx plus Rust/wasm-pack job-local.
workflow: pr; review summary: skipped by --skip-review / --no-review-gate

The only real friction was the docs size cap after the tool list grew, so I trimmed the page back under limit instead of splitting it. Confidence is high in the tool split and auto-bump coverage, but the local Docker build could not run here because the container does not have a reachable daemon.

WARD-OUTCOME: done - added gh, helm, kubectl, and yq to dev-base and left buildx plus Rust/wasm-pack job-local. workflow: pr; review summary: skipped by --skip-review / --no-review-gate The only real friction was the docs size cap after the tool list grew, so I trimmed the page back under limit instead of splitting it. Confidence is high in the tool split and auto-bump coverage, but the local Docker build could not run here because the container does not have a reachable daemon.

coilyco-ops commented

2026-07-09 16:38:22 +00:00

Author

Member

Verified against live main on 2026-07-09. The #355 payload landed in merge commit 4bba3f9 ( from ): dev-base now includes gh, helm, kubectl, and yq, auto-bump coverage includes those versions, and docs state Docker buildx plus Rust/wasm-pack stay job-local. Closing manually because the landed merge referenced but did not include a footer, so Forgejo did not auto-close it.

Verified against live main on 2026-07-09. The #355 payload landed in merge commit 4bba3f9 ( from ): dev-base now includes gh, helm, kubectl, and yq, auto-bump coverage includes those versions, and docs state Docker buildx plus Rust/wasm-pack stay job-local. Closing manually because the landed merge referenced but did not include a footer, so Forgejo did not auto-close it.

coilyco-ops closed this issue

2026-07-09 16:38:22 +00:00

coilyco-ops commented

2026-07-09 16:38:32 +00:00

Author

Member

Correction to the previous comment: verified against live main on 2026-07-09. The #355 payload landed in merge commit 4bba3f9, titled Merge pull request chore(dev-base): add fleet CI tools (#371) from issue-355 into main. Dev-base now includes gh, helm, kubectl, and yq, auto-bump coverage includes those versions, and docs state Docker buildx plus Rust/wasm-pack stay job-local. The issue needed manual closure because the landed merge referenced issue-355 but did not include a closes #355 footer.

Correction to the previous comment: verified against live main on 2026-07-09. The #355 payload landed in merge commit 4bba3f9, titled Merge pull request chore(dev-base): add fleet CI tools (#371) from issue-355 into main. Dev-base now includes gh, helm, kubectl, and yq, auto-bump coverage includes those versions, and docs state Docker buildx plus Rust/wasm-pack stay job-local. The issue needed manual closure because the landed merge referenced issue-355 but did not include a closes #355 footer.