Validate affected dev-base image builds on pull requests #541

Merged

coilyco-ops merged 17 commits from issue-454 into main 2026-07-29 13:52:26 +00:00

Conversation 7 Commits 17 Files changed 19 +865 -27

coilyco-ops commented 2026-07-15 01:06:14 +00:00

Owner

Copy link

Summary

• add a credential-free ci / build-dev-base pull-request status
• derive affected tiers and the full source closure from the canonical tier specification
• share Dockerfiles, build arguments, bootstrap scripts, in-image Ward checks, and full verification with publication
• load one local architecture and cap the persistent Buildx cache without registry export

Validation

• 585 tests passed, 1 skipped
• full pre-commit run --all-files passed

closes coilyco-flight-deck/agentic-os#454

## Summary - add a credential-free `ci / build-dev-base` pull-request status - derive affected tiers and the full source closure from the canonical tier specification - share Dockerfiles, build arguments, bootstrap scripts, in-image Ward checks, and full verification with publication - load one local architecture and cap the persistent Buildx cache without registry export ## Validation - 585 tests passed, 1 skipped - full `pre-commit run --all-files` passed closes coilyco-flight-deck/agentic-os#454

coilyco-ops added 3 commits 2026-07-15 01:06:14 +00:00

ci: run the dev-base build + main-only validations on PRs as build-only checks ... 7c51971514

Factor the build/verify half of release.yml's publish-dev-base into the
shared ./actions/dev-base-build composite so PR validation and the main
publish run one definition and cannot drift apart. ci.yml gains a
pull_request-only build-dev-base job that builds every tier (exercising
the in-image CLIGUARD_NO_SANDBOX=1 ward doctor gate) with no push, no
tag, and no registry auth, plus a compute-only tag-bump step in gate so
release planning is validated pre-merge. Publish, tag, and the GitHub
mirror stay main-only. The manifest verify loop now derives its tier
refs from the build plan instead of a hand-maintained suffix list.

This is the prevention for the aos#452 class: main going red on a merge
because PRs never exercised what main does.

closes #454

Merge remote-tracking branch 'origin/main' into issue-454 bb4d2ede0a

docs: update PR CI feature inventory 65c8612943

coilyco-ops referenced this pull request 2026-07-15 01:12:20 +00:00

Add PR build validation for the independent dev-base image family #454

coilyco-ops commented 2026-07-15 01:12:21 +00:00

Author

Owner

Copy link

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / gate passed on PR #541. ci / build-dev-base failed after 4m39s on the same PR. I could not recover a repo-local fix from this run, and the failure still matches the dev-base build/doctor blocker seen before.

felt: clean until the shared dev-base path tripped again.
confidence: high that this is still external to this repo.
surprises: the fresh PR on the current branch did not change the outcome.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / gate passed on PR #541. ci / build-dev-base failed after 4m39s on the same PR. I could not recover a repo-local fix from this run, and the failure still matches the dev-base build/doctor blocker seen before. felt: clean until the shared dev-base path tripped again. confidence: high that this is still external to this repo. surprises: the fresh PR on the current branch did not change the outcome. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details>

coilyco-ops added 1 commit 2026-07-15 01:31:05 +00:00

ci: refresh dev-base PR validation 84e861dd84

coilyco-ops commented 2026-07-15 01:35:42 +00:00

Author

Owner

Copy link

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541.
felt: the PR wiring was straightforward, but the same external dev-base blocker still won.
confidence: high that the remaining failure is external to this repo.
surprises: the build-only job stayed red on the refreshed head even after the branch was rebased onto current main.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541. felt: the PR wiring was straightforward, but the same external dev-base blocker still won. confidence: high that the remaining failure is external to this repo. surprises: the build-only job stayed red on the refreshed head even after the branch was rebased onto current main. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details> <!-- ward-agent-signature -->

coilyco-ops referenced this pull request 2026-07-15 01:35:42 +00:00

Add PR build validation for the independent dev-base image family #454

coilyco-ops referenced this pull request 2026-07-15 03:11:16 +00:00

Add PR build validation for the independent dev-base image family #454

coilyco-ops commented 2026-07-15 03:11:16 +00:00

Author

Owner

Copy link

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541.
I could not recover a repo-local fix from this run.
felt: the PR wiring was straightforward, but the shared dev-base blocker still won.
confidence: high that the remaining failure is external to this repo.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541. I could not recover a repo-local fix from this run. felt: the PR wiring was straightforward, but the shared dev-base blocker still won. confidence: high that the remaining failure is external to this repo. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details> <!-- ward-agent-signature -->

coilyco-ops referenced this pull request 2026-07-15 03:11:27 +00:00

Add PR build validation for the independent dev-base image family #454

coilyco-ops added 1 commit 2026-07-15 03:32:18 +00:00

merge: reconcile issue-454 with main 4e2e802748

coilyco-ops commented 2026-07-15 03:42:02 +00:00

Author

Owner

Copy link

WARDED_WORKFLOW: failed ❌

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 7m50s on PR #541.
felt: the merge held, but the shared dev-base build/doctor path still tripped.
confidence: high the blocker is external to this repo.
surprises: the refreshed head kept the same failure.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: failed ❌ <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 7m50s on PR #541. felt: the merge held, but the shared dev-base build/doctor path still tripped. confidence: high the blocker is external to this repo. surprises: the refreshed head kept the same failure. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details> <!-- ward-agent-signature -->

coilyco-ops referenced this pull request 2026-07-15 03:42:02 +00:00

Add PR build validation for the independent dev-base image family #454

coilyco-ops referenced this pull request 2026-07-15 03:42:20 +00:00

Add PR build validation for the independent dev-base image family #454

coilyco-ops commented 2026-07-15 05:22:01 +00:00

Author

Owner

Copy link

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-agentic-os-541 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-15T05:22:00Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

• Resolved: coilyco-flight-deck/agentic-os#541 · branch issue-541 · harness codex · workflow pull-request-and-merge
• Run: engineer-codex-agentic-os-541 · ward v0.697.0 · dispatched 2026-07-15T05:21:48Z
• Comment thread: 4 included in the pre-flight read, 0 stripped (ward's own automated comments).
  • included: @coilyco-ops (2026-07-15T01:12:21Z), @coilyco-ops (2026-07-15T01:35:42Z), @coilyco-ops (2026-07-15T03:11:16Z), @coilyco-ops (2026-07-15T03:42:02Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-agentic-os-541` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-15T05:22:00Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#541` · branch `issue-541` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-541` · ward `v0.697.0` · dispatched `2026-07-15T05:21:48Z` - **Comment thread:** 4 included in the pre-flight read, 0 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-15T01:12:21Z), @coilyco-ops (2026-07-15T01:35:42Z), @coilyco-ops (2026-07-15T03:11:16Z), @coilyco-ops (2026-07-15T03:42:02Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`

coilyco-ops added 1 commit 2026-07-15 05:26:30 +00:00

fix(dev-base): retry dotnet installer fetch 6d369856bb

coilyco-ops added 1 commit 2026-07-15 05:38:38 +00:00

fix(ci): retry PR build bootstrap downloads e48d08d209

coilyco-ops added 1 commit 2026-07-15 05:54:46 +00:00

fix(dev-base): use redirected dotnet script host 88d94c5df5

coilyco-ops added 1 commit 2026-07-15 06:23:23 +00:00

fix(dev-base): use cache-only build validation 2e041cb7ae

coilyco-ops added 1 commit 2026-07-15 06:33:05 +00:00

fix(dev-base): restore loaded tier builds 7d1c27d5f8

coilyco-ops commented 2026-07-15 06:53:49 +00:00

Author

Owner

Copy link

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-agentic-os-541 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-15T06:53:48Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

• Resolved: coilyco-flight-deck/agentic-os#541 · branch issue-541 · harness codex · workflow pull-request-and-merge
• Run: engineer-codex-agentic-os-541 · ward v0.697.0 · dispatched 2026-07-15T06:53:36Z
• Comment thread: 4 included in the pre-flight read, 1 stripped (ward's own automated comments).
  • included: @coilyco-ops (2026-07-15T01:12:21Z), @coilyco-ops (2026-07-15T01:35:42Z), @coilyco-ops (2026-07-15T03:11:16Z), @coilyco-ops (2026-07-15T03:42:02Z)
  • stripped: @coilyco-ops (2026-07-15T05:22:01Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-agentic-os-541` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-15T06:53:48Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#541` · branch `issue-541` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-541` · ward `v0.697.0` · dispatched `2026-07-15T06:53:36Z` - **Comment thread:** 4 included in the pre-flight read, 1 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-15T01:12:21Z), @coilyco-ops (2026-07-15T01:35:42Z), @coilyco-ops (2026-07-15T03:11:16Z), @coilyco-ops (2026-07-15T03:42:02Z) - stripped: @coilyco-ops (2026-07-15T05:22:01Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`

coilyco-ops added 1 commit 2026-07-15 07:03:19 +00:00

merge: refresh issue-454 onto current main 468f007300

coilyco-ops added 1 commit 2026-07-15 07:24:38 +00:00

chore: retrigger PR ci c3563abf8a

coilyco-ops commented 2026-07-15 07:44:43 +00:00

Author

Owner

Copy link

WARDED_WORKFLOW: failed ❌

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 14m43s on PR #541.
felt: the branch refresh held, then the shared dev-base build fell over.
confidence: high the blocker is still external to this repo.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: failed ❌ <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 14m43s on PR #541. felt: the branch refresh held, then the shared dev-base build fell over. confidence: high the blocker is still external to this repo. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details> <!-- ward-agent-signature -->

coilysiren closed this pull request 2026-07-15 14:01:25 +00:00

coilyco-ops referenced this pull request 2026-07-24 06:47:15 +00:00

Add PR build validation for the independent dev-base image family #454

coilyco-ops changed title from Run the dev-base docker build + main-only validations on PRs as build-only checks to Validate affected dev-base image builds on pull requests 2026-07-29 12:53:36 +00:00

coilyco-ops reopened this pull request 2026-07-29 12:53:37 +00:00

coilyco-ops added 1 commit 2026-07-29 12:54:36 +00:00

Merge branch 'main' of https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os into issue-454 9ceced3932

coilyco-ops added 2 commits 2026-07-29 13:13:19 +00:00

fix(ci): compose PR images through local builder ... e90f77ec43

Keep the production docker-container driver unchanged while the single-architecture PR build uses Docker's local driver for credential-free full-image composition.

closes coilyco-flight-deck/agentic-os#454

Co-authored-by: Codex <noreply@openai.com>

Merge branch 'main' of https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os into issue-454 79c965268b

coilyco-ops added 1 commit 2026-07-29 13:38:36 +00:00

fix(ci): link local image targets with Buildx Bake ... f9f16cce88

Keep specialist results inside the isolated BuildKit cache, compose full through target contexts, and load only the final smoke-test image.

closes coilyco-flight-deck/agentic-os#454

Co-authored-by: Codex <noreply@openai.com>

coilyco-ops merged commit d0c3049645 into main 2026-07-29 13:52:26 +00:00

coilyco-ops referenced this pull request from a commit 2026-07-29 13:52:27 +00:00

Merge pull request 'Validate affected dev-base image builds on pull requests' (#541) from issue-454 into main

coilyco-ops referenced this pull request 2026-07-29 13:53:21 +00:00

Add PR build validation for the independent dev-base image family #454

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

burndown-2026-06

Backlog burndown June 2026

  

burndown-2026-08

Closed in the 2026-08-26 backlog burn-down. Reopen freely: state:closed label:burndown-2026-08 recovers the whole set.

  

autonomy

async-consult

A human needs to consult on the issue to upgrade it to headless

  

autonomy

epic

This issue has many units of sub work - its size makes it meaningfully exclusive with other autonomy types

  

autonomy

headless

The agent can perform the work on its own

  

autonomy

live-collab

The agent and the human need to work together in realtime

  

coherence-core

Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  

priority

P0

priority tier

  

priority

P1

priority tier

  

priority

P2

priority tier

  

priority

P3

priority tier

  

priority

P4

priority tier

  

qa-fixture

Disposable issue admitted to the bounded Ward QA verification lane.

  

role/advocate

requires work from the Developer Advocate seat

  

role/director

requires work from the Portfolio Director seat

  

role/exec

requires work from the exec role

  

role/frontend

requires work from the Frontend Engineer seat

  

role/gamedev

requires work from the Game Developer seat

  

role/human

requires a person, and specifically not an agent seat

  

role/platform

requires work from the Platform Engineer seat

  

role/qa

requires work from the QA role

  

role/science

requires work from the Applied Scientist seat

  

role/sysadmin

requires work from the Systems Administrator seat

  

state

ambient

ambient and ephemeral work, held as a maintained document rather than a queue

No labels

burndown-2026-06

burndown-2026-08

autonomy

async-consult

autonomy

epic

autonomy

headless

autonomy

live-collab

coherence-core

priority

P0

priority

P1

priority

P2

priority

P3

priority

P4

qa-fixture

role/advocate

role/director

role/exec

role/frontend

role/gamedev

role/human

role/platform

role/qa

role/science

role/sysadmin

state

ambient

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os!541

No description provided.