coilyco-flight-deck/agentic-os

Watch

Interactive: promote a self-bootstrapping dev-base image to release #721

New issue

Closed

opened 2026-07-24 19:05:02 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-07-24 19:05:02 +00:00

Owner

Failure

The default launcher command fails before agent-compose starts:

aos --role engineer acompose -- codex

The host launcher is aos-v0.55.0. It resolves the default image to forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:release and sets /usr/local/bin/aos as the container entrypoint. The cached registry image was created on 2026-07-13 and contains /usr/local/bin/ward, but it contains neither /usr/local/bin/aos nor /usr/local/bin/agent-compose.

Repository evidence

Commit 85018339d448b7ac8b4c815871833ab69a086c6c on canonical main updates agent-compose to 0.36.0, embeds and validates Kai's role/personality roster, and builds a self-bootstrapping image. A full local build named agentic-os:aos-local passed the container smoke path. The installed host launcher successfully ran:

aos --role engineer --image agentic-os:aos-local --no-substrate acompose -- codex --version

The generated bundle selected role engineer, personalities curious, grounded, and meticulous, and sources person:kai plus aos-public.

Publication gap

dev-base-publish.yml publishes an immutable draft image when the release branch advances. release.yml retags a draft image to the versioned tag and moving release and latest aliases, but that workflow is manual. The current moving alias therefore predates the standalone aos launcher and agent-compose installation.

Ops verification

Confirm the draft image for a current release commit contains /usr/local/bin/aos and /usr/local/bin/agent-compose.
Promote that draft through the established release workflow.
Verify the remote :release alias contains both binaries.
Verify aos --role engineer acompose -- codex --version succeeds without an image override.
Reconcile the workflow and release documentation so the moving alias advances on the intended trigger or the manual promotion boundary is explicit.

This issue needs the interactive label and an ops-capable run. The sealed engineer must not dispatch or debug the live publication pipeline.

## Failure The default launcher command fails before agent-compose starts: ```text aos --role engineer acompose -- codex ``` The host launcher is `aos-v0.55.0`. It resolves the default image to `forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:release` and sets `/usr/local/bin/aos` as the container entrypoint. The cached registry image was created on 2026-07-13 and contains `/usr/local/bin/ward`, but it contains neither `/usr/local/bin/aos` nor `/usr/local/bin/agent-compose`. ## Repository evidence Commit `85018339d448b7ac8b4c815871833ab69a086c6c` on canonical main updates agent-compose to 0.36.0, embeds and validates Kai's role/personality roster, and builds a self-bootstrapping image. A full local build named `agentic-os:aos-local` passed the container smoke path. The installed host launcher successfully ran: ```text aos --role engineer --image agentic-os:aos-local --no-substrate acompose -- codex --version ``` The generated bundle selected role `engineer`, personalities `curious`, `grounded`, and `meticulous`, and sources `person:kai` plus `aos-public`. ## Publication gap `dev-base-publish.yml` publishes an immutable draft image when the release branch advances. `release.yml` retags a draft image to the versioned tag and moving `release` and `latest` aliases, but that workflow is manual. The current moving alias therefore predates the standalone `aos` launcher and agent-compose installation. ## Ops verification * Confirm the draft image for a current release commit contains `/usr/local/bin/aos` and `/usr/local/bin/agent-compose`. * Promote that draft through the established release workflow. * Verify the remote `:release` alias contains both binaries. * Verify `aos --role engineer acompose -- codex --version` succeeds without an image override. * Reconcile the workflow and release documentation so the moving alias advances on the intended trigger or the manual promotion boundary is explicit. This issue needs the `interactive` label and an ops-capable run. The sealed engineer must not dispatch or debug the live publication pipeline.

coilyco-ops added the

autonomy

live-collab

label

2026-07-24 19:05:46 +00:00

coilyco-ops referenced this issue

2026-07-25 05:55:08 +00:00

Bound dev-base package churn before it fills kai-server again #739

coilyco-ops commented

2026-07-25 06:23:18 +00:00

Author

Owner

CI babysit run contract

Goal - Keep the latest canonical aos workflow set under observation until every required workflow is green, or collect decisive evidence that the remaining failure belongs to the infrastructure layer.
Done-condition - For the latest commit on canonical main, the repository gate, promotion, GitHub mirror, native CLI release, and dev-base publication all complete successfully. If any workflow fails, the run instead ends only when the failing job log and repository-local validation prove that its next fix belongs to runner, registry, storage, credential distribution, or another infrastructure-owned surface.
Non-goals - This run does not redesign the publisher-retention model tracked in #739, delete package data, probe CI through repeated pushes, or absorb unrelated branch work.

Current checkpoint: the repository gate, promotion, mirror, and native CLI release are green. The dev-base publisher is still running.

## CI babysit run contract * **Goal** - Keep the latest canonical aos workflow set under observation until every required workflow is green, or collect decisive evidence that the remaining failure belongs to the infrastructure layer. * **Done-condition** - For the latest commit on canonical `main`, the repository gate, promotion, GitHub mirror, native CLI release, and dev-base publication all complete successfully. If any workflow fails, the run instead ends only when the failing job log and repository-local validation prove that its next fix belongs to runner, registry, storage, credential distribution, or another infrastructure-owned surface. * **Non-goals** - This run does not redesign the publisher-retention model tracked in #739, delete package data, probe CI through repeated pushes, or absorb unrelated branch work. Current checkpoint: the repository gate, promotion, mirror, and native CLI release are green. The dev-base publisher is still running.

coilyco-ops commented

2026-07-28 07:15:10 +00:00

Author

Owner

Checkpoint for commit dc37f74d:

Repository workflows are green: ci ward-doctor, ci gate, promotion gate and release fast-forward, GitHub mirror test and mirror push, and the native AOS CLI release.
dev-base-publish run 2250 failed only in publish-full. Both architecture builds completed and Ward doctor passed inside both images.
All four bounded Buildx attempts then failed on large registry blob uploads at about 60 seconds. Forgejo returned HTTP 500 during the upload and HTTP 499 Client Closed Request at termination.
The same boundary failed in the preceding publisher run, so the next fix belongs to the registry, reverse proxy, or storage path rather than repository build logic.

Ops action: correlate the registry and reverse-proxy logs for dev-base-publish run 2250, identify the 60-second upload termination source, and repair that live timeout or storage failure. Then an authorized Ops run should invoke the established publisher retry path without a repository probe commit.

Expected return evidence: a large blob upload remains open past 60 seconds, publish-full succeeds, and the immutable draft manifest for commit dc37f74d resolves successfully.

Checkpoint for commit dc37f74d: * Repository workflows are green: ci ward-doctor, ci gate, promotion gate and release fast-forward, GitHub mirror test and mirror push, and the native AOS CLI release. * dev-base-publish run 2250 failed only in publish-full. Both architecture builds completed and Ward doctor passed inside both images. * All four bounded Buildx attempts then failed on large registry blob uploads at about 60 seconds. Forgejo returned HTTP 500 during the upload and HTTP 499 Client Closed Request at termination. * The same boundary failed in the preceding publisher run, so the next fix belongs to the registry, reverse proxy, or storage path rather than repository build logic. Ops action: correlate the registry and reverse-proxy logs for dev-base-publish run 2250, identify the 60-second upload termination source, and repair that live timeout or storage failure. Then an authorized Ops run should invoke the established publisher retry path without a repository probe commit. Expected return evidence: a large blob upload remains open past 60 seconds, publish-full succeeds, and the immutable draft manifest for commit dc37f74d resolves successfully.

coilyco-ops commented

2026-07-28 08:19:32 +00:00

Author

Owner

Completed the full release recovery.

Commit dc37f74d repaired the repository-local CI gate. Repository CI, promotion, mirror, and native AOS CLI release are green.
Infrastructure commit 9fcef40 raised the Traefik websecure request-body timeout to a bounded 300 seconds and preserved the operator-local load-balancer setting. AOS dev-base-publish run 2251 then published the draft multi-architecture image and registry cache successfully. Two large cache layers remained open for 140.0 seconds each with no 499, 500, unexpected EOF, or offset mismatch.
Manual release run 2252 completed plan-release, retag-full, and release successfully. It promoted the draft to v0.258.0, :release, and :latest, then created the public Forgejo v0.258.0 release on dc37f74d.
The exact default smoke aos --role engineer acompose -- codex --version pulled :release with no image override, executed the AOS entrypoint and agent-compose path, verified the composed engineer bundle, and returned codex-cli 0.144.1.
docs/release.md and the workflow headers already document the intended boundary: branch promotion and draft publication are automatic, while release alias promotion is the established manual retry stage.

The issue completion criteria are satisfied.

Completed the full release recovery. * Commit dc37f74d repaired the repository-local CI gate. Repository CI, promotion, mirror, and native AOS CLI release are green. * Infrastructure commit 9fcef40 raised the Traefik websecure request-body timeout to a bounded 300 seconds and preserved the operator-local load-balancer setting. AOS dev-base-publish run 2251 then published the draft multi-architecture image and registry cache successfully. Two large cache layers remained open for 140.0 seconds each with no 499, 500, unexpected EOF, or offset mismatch. * Manual release run 2252 completed plan-release, retag-full, and release successfully. It promoted the draft to v0.258.0, :release, and :latest, then created the public Forgejo v0.258.0 release on dc37f74d. * The exact default smoke `aos --role engineer acompose -- codex --version` pulled :release with no image override, executed the AOS entrypoint and agent-compose path, verified the composed engineer bundle, and returned codex-cli 0.144.1. * docs/release.md and the workflow headers already document the intended boundary: branch promotion and draft publication are automatic, while release alias promotion is the established manual retry stage. The issue completion criteria are satisfied.

coilyco-ops closed this issue

2026-07-28 08:19:34 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#721

No description provided.

Rows
Columns