Make release branch a promote-only last-known-good ref #551

Closed
opened 2026-07-15 04:48:34 +00:00 by coilyco-ops · 2 comments
Owner

Kai expected the current flow to be: main runs the full gate and any fallible release preparation, then promote fast-forwards release, and the release branch does not run more CI or independently fail after the SHA was vouched. agentic-os is partly aligned but still has fallible release-branch work.

Evidence from current main / release workflows:

  • .forgejo/workflows/ci.yml only pushes on main, not release. Good.
  • .forgejo/workflows/release.yml says "There is no test job here". Good.
  • But .forgejo/workflows/release.yml still runs on push to release and performs fallible work: plan-release, per-tier publish-dev-base-tier promote jobs, release creation, ward-spec asset publish, and Telegram alert steps.
  • The current exact-head release run 1277 failed at https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/1277 after the release branch was already at 24980330c233d1338be428a16a0a2750f24a3749.
  • coilyco-flight-deck/agentic-os#548 / PR #550 addresses one immediate failure mode, but it does not resolve the contract question: a release branch push can still go red after a successful promote.

Please align agentic-os with the desired contract. If release is meant to be only the last-known-good ref, move any fallible publication or retagging before the fast-forward in promote.yml, or make it a manually retryable/non-branch-gating follow-up that cannot make the promoted release branch red. Update release docs and workflow comments to match the implemented contract.

Related current-red tracker: coilyco-flight-deck/agentic-os#548.

Kai expected the current flow to be: `main` runs the full gate and any fallible release preparation, then promote fast-forwards `release`, and the `release` branch does not run more CI or independently fail after the SHA was vouched. agentic-os is partly aligned but still has fallible release-branch work. Evidence from current `main` / `release` workflows: * `.forgejo/workflows/ci.yml` only pushes on `main`, not `release`. Good. * `.forgejo/workflows/release.yml` says "There is no test job here". Good. * But `.forgejo/workflows/release.yml` still runs on `push` to `release` and performs fallible work: `plan-release`, per-tier `publish-dev-base-tier` promote jobs, release creation, ward-spec asset publish, and Telegram alert steps. * The current exact-head `release` run `1277` failed at https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/1277 after the release branch was already at `24980330c233d1338be428a16a0a2750f24a3749`. * coilyco-flight-deck/agentic-os#548 / PR #550 addresses one immediate failure mode, but it does not resolve the contract question: a `release` branch push can still go red after a successful promote. Please align agentic-os with the desired contract. If `release` is meant to be only the last-known-good ref, move any fallible publication or retagging before the fast-forward in `promote.yml`, or make it a manually retryable/non-branch-gating follow-up that cannot make the promoted `release` branch red. Update release docs and workflow comments to match the implemented contract. Related current-red tracker: coilyco-flight-deck/agentic-os#548.
Author
Owner

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-agentic-os-551 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-15T04:49:19Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)
  • Resolved: coilyco-flight-deck/agentic-os#551 · branch issue-551 · harness codex · workflow pull-request-and-merge
  • Run: engineer-codex-agentic-os-551 · ward v0.697.0 · dispatched 2026-07-15T04:49:03Z
  • Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-agentic-os-551` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-15T04:49:19Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#551` · branch `issue-551` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-551` · ward `v0.697.0` · dispatched `2026-07-15T04:49:03Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`
Author
Owner

WARDED_WORKFLOW: #552

details workflow: pull-request-and-merge; review summary: skipped. The in-container review gate was intentionally skipped because the temporary ward default pending brokered QA. Implementation felt like a contract split, not a small tweak. Confidence: high. Surprises: release.yml had to become manual retry only, and promote.yml needed a workflow_dispatch.bump input for actionlint. Follow-ups: none.
WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/552 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped. The in-container review gate was intentionally skipped because the temporary ward default pending brokered QA. Implementation felt like a contract split, not a small tweak. Confidence: high. Surprises: release.yml had to become manual retry only, and promote.yml needed a workflow_dispatch.bump input for actionlint. Follow-ups: none. </details>
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
coilyco-flight-deck/agentic-os#551
No description provided.