Run the dev-base docker build + main-only validations on PRs as build-only checks #541

Open

coilyco-ops wants to merge 12 commits from issue-454 into main

pull from: issue-454

merge into: coilyco-flight-deck:main

coilyco-flight-deck:main

coilyco-flight-deck:release

coilyco-flight-deck:issue-573

coilyco-flight-deck:fix-action-run-list-page

coilyco-flight-deck:issue-568

coilyco-flight-deck:issue-565

coilyco-flight-deck:issue-561

coilyco-flight-deck:issue-556-replacement

coilyco-flight-deck:issue-553

coilyco-flight-deck:issue-539-profile-substrate

coilyco-flight-deck:issue-454-v2

coilyco-flight-deck:issue-505

coilyco-flight-deck:issue-504

coilyco-flight-deck:issue-501

coilyco-flight-deck:issue-499

coilyco-flight-deck:issue-496

coilyco-flight-deck:issue-491

coilyco-flight-deck:issue-490

coilyco-flight-deck:issue-488

coilyco-flight-deck:issue-486

coilyco-flight-deck:feat/two-stage-release

coilyco-flight-deck:fix/comment-cap-and-pr-gate

coilyco-flight-deck:feat/sync-actions-secrets

coilyco-flight-deck:fix/actions-logs-bridge

coilyco-flight-deck:fix/launch-config-stability

coilyco-flight-deck:fix/defaults-are-wards-not-aos

coilyco-flight-deck:experiment/no-ops-forgejo

coilyco-flight-deck:fix/ci-pytest-gate-and-repos-kdl

coilyco-flight-deck:issue-434

coilyco-flight-deck:issue-447

coilyco-flight-deck:issue-453

coilyco-flight-deck:issue-450

coilyco-flight-deck:issue-446

coilyco-flight-deck:issue-435

coilyco-flight-deck:issue-393

coilyco-flight-deck:issue-268

coilyco-flight-deck:issue-438

coilyco-flight-deck:issue-397

coilyco-flight-deck:issue-419

coilyco-flight-deck:issue-431

coilyco-flight-deck:issue-427

coilyco-flight-deck:issue-425

coilyco-flight-deck:issue-421

coilyco-flight-deck:issue-422

coilyco-flight-deck:issue-403

coilyco-flight-deck:issue-805

coilyco-flight-deck:issue-355

coilyco-flight-deck:issue-362-clean2

coilyco-flight-deck:issue-356

coilyco-flight-deck:issue-343

coilyco-flight-deck:issue-315

coilyco-flight-deck:issue-223

Conversation 7 Commits 12 Files changed 12 +494 -45

coilyco-ops commented 2026-07-15 01:06:14 +00:00

Member

Copy link

This adds PR-only dev-base build validation without publish credentials. The shared build/verify action exercises the tiered dev-base family and the in-image ward-doctor gate, so Dockerfile drift or pinned ARG drift fails before merge.

• What changed: shared build/verify action, PR build-only job, updated docs/tests for the workflow split
• Why: catch the aos#452 class on the PR that introduces it, instead of after merge
• Validation: ward exec test and ward exec pre-commit-all both passed locally

closes #454
ward.workflow: pull-request-and-merge

This adds PR-only dev-base build validation without publish credentials. The shared build/verify action exercises the tiered dev-base family and the in-image ward-doctor gate, so Dockerfile drift or pinned ARG drift fails before merge. - What changed: shared build/verify action, PR build-only job, updated docs/tests for the workflow split - Why: catch the aos#452 class on the PR that introduces it, instead of after merge - Validation: `ward exec test` and `ward exec pre-commit-all` both passed locally closes #454 ward.workflow: pull-request-and-merge

coilyco-ops added 3 commits 2026-07-15 01:06:14 +00:00

ci: run the dev-base build + main-only validations on PRs as build-only checks ... 7c51971514

Factor the build/verify half of release.yml's publish-dev-base into the
shared ./actions/dev-base-build composite so PR validation and the main
publish run one definition and cannot drift apart. ci.yml gains a
pull_request-only build-dev-base job that builds every tier (exercising
the in-image CLIGUARD_NO_SANDBOX=1 ward doctor gate) with no push, no
tag, and no registry auth, plus a compute-only tag-bump step in gate so
release planning is validated pre-merge. Publish, tag, and the GitHub
mirror stay main-only. The manifest verify loop now derives its tier
refs from the build plan instead of a hand-maintained suffix list.

This is the prevention for the aos#452 class: main going red on a merge
because PRs never exercised what main does.

closes #454

Merge remote-tracking branch 'origin/main' into issue-454 bb4d2ede0a

docs: update PR CI feature inventory 65c8612943

coilyco-ops referenced this pull request 2026-07-15 01:12:20 +00:00

Run the dev-base docker build + main-only validations on PRs as a build-only validation step (prevent the aos#452 main-red class) #454

coilyco-ops commented 2026-07-15 01:12:21 +00:00

Author

Member

Copy link

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / gate passed on PR #541. ci / build-dev-base failed after 4m39s on the same PR. I could not recover a repo-local fix from this run, and the failure still matches the dev-base build/doctor blocker seen before.

felt: clean until the shared dev-base path tripped again.
confidence: high that this is still external to this repo.
surprises: the fresh PR on the current branch did not change the outcome.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / gate passed on PR #541. ci / build-dev-base failed after 4m39s on the same PR. I could not recover a repo-local fix from this run, and the failure still matches the dev-base build/doctor blocker seen before. felt: clean until the shared dev-base path tripped again. confidence: high that this is still external to this repo. surprises: the fresh PR on the current branch did not change the outcome. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details>

coilyco-ops added 1 commit 2026-07-15 01:31:05 +00:00

ci: refresh dev-base PR validation 84e861dd84

coilyco-ops commented 2026-07-15 01:35:42 +00:00

Author

Member

Copy link

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541.
felt: the PR wiring was straightforward, but the same external dev-base blocker still won.
confidence: high that the remaining failure is external to this repo.
surprises: the build-only job stayed red on the refreshed head even after the branch was rebased onto current main.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541. felt: the PR wiring was straightforward, but the same external dev-base blocker still won. confidence: high that the remaining failure is external to this repo. surprises: the build-only job stayed red on the refreshed head even after the branch was rebased onto current main. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details> <!-- ward-agent-signature -->

coilyco-ops referenced this pull request 2026-07-15 01:35:42 +00:00

Run the dev-base docker build + main-only validations on PRs as a build-only validation step (prevent the aos#452 main-red class) #454

coilyco-ops referenced this pull request 2026-07-15 03:11:16 +00:00

Run the dev-base docker build + main-only validations on PRs as a build-only validation step (prevent the aos#452 main-red class) #454

coilyco-ops commented 2026-07-15 03:11:16 +00:00

Author

Member

Copy link

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541.
I could not recover a repo-local fix from this run.
felt: the PR wiring was straightforward, but the shared dev-base blocker still won.
confidence: high that the remaining failure is external to this repo.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541. I could not recover a repo-local fix from this run. felt: the PR wiring was straightforward, but the shared dev-base blocker still won. confidence: high that the remaining failure is external to this repo. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details> <!-- ward-agent-signature -->

coilyco-ops referenced this pull request 2026-07-15 03:11:27 +00:00

Run the dev-base docker build + main-only validations on PRs as a build-only validation step (prevent the aos#452 main-red class) #454

coilyco-ops added 1 commit 2026-07-15 03:32:18 +00:00

merge: reconcile issue-454 with main 4e2e802748

coilyco-ops commented 2026-07-15 03:42:02 +00:00

Author

Member

Copy link

WARDED_WORKFLOW: failed ❌

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 7m50s on PR #541.
felt: the merge held, but the shared dev-base build/doctor path still tripped.
confidence: high the blocker is external to this repo.
surprises: the refreshed head kept the same failure.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: failed ❌ <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 7m50s on PR #541. felt: the merge held, but the shared dev-base build/doctor path still tripped. confidence: high the blocker is external to this repo. surprises: the refreshed head kept the same failure. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details> <!-- ward-agent-signature -->

coilyco-ops referenced this pull request 2026-07-15 03:42:02 +00:00

Run the dev-base docker build + main-only validations on PRs as a build-only validation step (prevent the aos#452 main-red class) #454

coilyco-ops referenced this pull request 2026-07-15 03:42:20 +00:00

Run the dev-base docker build + main-only validations on PRs as a build-only validation step (prevent the aos#452 main-red class) #454

coilyco-ops commented 2026-07-15 05:22:01 +00:00

Author

Member

Copy link

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-agentic-os-541 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-15T05:22:00Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

• Resolved: coilyco-flight-deck/agentic-os#541 · branch issue-541 · harness codex · workflow pull-request-and-merge
• Run: engineer-codex-agentic-os-541 · ward v0.697.0 · dispatched 2026-07-15T05:21:48Z
• Comment thread: 4 included in the pre-flight read, 0 stripped (ward's own automated comments).
  • included: @coilyco-ops (2026-07-15T01:12:21Z), @coilyco-ops (2026-07-15T01:35:42Z), @coilyco-ops (2026-07-15T03:11:16Z), @coilyco-ops (2026-07-15T03:42:02Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-agentic-os-541` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-15T05:22:00Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#541` · branch `issue-541` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-541` · ward `v0.697.0` · dispatched `2026-07-15T05:21:48Z` - **Comment thread:** 4 included in the pre-flight read, 0 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-15T01:12:21Z), @coilyco-ops (2026-07-15T01:35:42Z), @coilyco-ops (2026-07-15T03:11:16Z), @coilyco-ops (2026-07-15T03:42:02Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`

coilyco-ops added 1 commit 2026-07-15 05:26:30 +00:00

fix(dev-base): retry dotnet installer fetch 6d369856bb

coilyco-ops added 1 commit 2026-07-15 05:38:38 +00:00

fix(ci): retry PR build bootstrap downloads e48d08d209

coilyco-ops added 1 commit 2026-07-15 05:54:46 +00:00

fix(dev-base): use redirected dotnet script host 88d94c5df5

coilyco-ops added 1 commit 2026-07-15 06:23:23 +00:00

fix(dev-base): use cache-only build validation 2e041cb7ae

coilyco-ops added 1 commit 2026-07-15 06:33:05 +00:00

fix(dev-base): restore loaded tier builds 7d1c27d5f8

coilyco-ops commented 2026-07-15 06:53:49 +00:00

Author

Member

Copy link

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-agentic-os-541 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-15T06:53:48Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

• Resolved: coilyco-flight-deck/agentic-os#541 · branch issue-541 · harness codex · workflow pull-request-and-merge
• Run: engineer-codex-agentic-os-541 · ward v0.697.0 · dispatched 2026-07-15T06:53:36Z
• Comment thread: 4 included in the pre-flight read, 1 stripped (ward's own automated comments).
  • included: @coilyco-ops (2026-07-15T01:12:21Z), @coilyco-ops (2026-07-15T01:35:42Z), @coilyco-ops (2026-07-15T03:11:16Z), @coilyco-ops (2026-07-15T03:42:02Z)
  • stripped: @coilyco-ops (2026-07-15T05:22:01Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-agentic-os-541` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-15T06:53:48Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#541` · branch `issue-541` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-541` · ward `v0.697.0` · dispatched `2026-07-15T06:53:36Z` - **Comment thread:** 4 included in the pre-flight read, 1 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-15T01:12:21Z), @coilyco-ops (2026-07-15T01:35:42Z), @coilyco-ops (2026-07-15T03:11:16Z), @coilyco-ops (2026-07-15T03:42:02Z) - stripped: @coilyco-ops (2026-07-15T05:22:01Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`

coilyco-ops added 1 commit 2026-07-15 07:03:19 +00:00

merge: refresh issue-454 onto current main 468f007300

coilyco-ops added 1 commit 2026-07-15 07:24:38 +00:00

chore: retrigger PR ci c3563abf8a

coilyco-ops commented 2026-07-15 07:44:43 +00:00

Author

Member

Copy link

WARDED_WORKFLOW: failed ❌

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 14m43s on PR #541.
felt: the branch refresh held, then the shared dev-base build fell over.
confidence: high the blocker is still external to this repo.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: failed ❌ <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 14m43s on PR #541. felt: the branch refresh held, then the shared dev-base build fell over. confidence: high the blocker is still external to this repo. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details> <!-- ward-agent-signature -->

Some checks failed

Hide all checks

ci / ward-doctor (pull_request) Successful in 1m20s

Details

ci / gate (pull_request) Successful in 59s

Details

ci / build-dev-base (pull_request) Failing after 14m43s

Details

This pull request has changes conflicting with the target branch.

• docs/FEATURES.md
• docs/dev-base-image.md
• docs/release.md
• tests/test_pull_request_ci_workflow.py

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title Run the dev-base docker build + main-only validations on PRs as build-only checks (#541)

Merge commit body Reviewed-on: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/541

Run the dev-base docker build + main-only validations on PRs as build-only checks (#541) Reviewed-on: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/541 Copy merge commit message

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin issue-454:issue-454

git switch issue-454

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

burndown-2026-06

Backlog burndown June 2026

  

coherence-core

Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  

consult

A human decision, design, or external action must happen first. Fail-closed default for unlabeled/low-confidence.

  

headless

Agent can take it from open issue to merged change with no human in the loop. The auto-burndown queue.

  

interactive

Agent does the work but pauses at a human checkpoint mid-flight (design choice, destructive step, human-only verification).

  

P0

now / blocking / urgent

  

P1

next / important

  

P2

backlog / will do

  

P3

someday / low

  

P4

icebox / frozen / reopen if it becomes real

No labels

burndown-2026-06

coherence-core

consult

headless

interactive

P0

P1

P2

P3

P4

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-flight-deck/agentic-os!541

No description provided.