image builds in main are broken #758

New issue

Closed

opened 2026-07-26 06:11:37 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-07-26 06:11:37 +00:00

Owner

::notice::retrying inspect manifest forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:draft-cbd2bb701721c77e1fe9e16fb0ae6b5d13e1f8aa after attempt 1/3 failed; sleeping 1s
::notice::retrying inspect manifest forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:draft-cbd2bb701721c77e1fe9e16fb0ae6b5d13e1f8aa after attempt 2/3 failed; sleeping 2s

``` ::notice::retrying inspect manifest forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:draft-cbd2bb701721c77e1fe9e16fb0ae6b5d13e1f8aa after attempt 1/3 failed; sleeping 1s ::notice::retrying inspect manifest forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:draft-cbd2bb701721c77e1fe9e16fb0ae6b5d13e1f8aa after attempt 2/3 failed; sleeping 2s ```

coilyco-ops referenced this issue

2026-07-27 04:41:52 +00:00

Close released AOS composition gaps for inbox#267 #763

coilyco-ops added the

autonomy

live-collab

label

2026-07-28 07:01:49 +00:00

coilyco-ops commented

2026-07-28 07:01:52 +00:00

Member

Diagnostic handoff (2026-07-28)

The aos acompose --role qa --agent codex -- codex failure is a host/image AOS protocol mismatch caused by the stalled dev-base publication path.

Evidence

The host binary is aos-v0.101.0. Its dry run forwards --composed _container-acompose into the image.
The current :release image contains an older dev-base AOS CLI. Its help does not define --composed, --guarded, or --warded. Argument parsing therefore fails before agent-compose or Codex starts.
The image build predates feat: compose agent launch capabilities, which introduced the forwarded capability flags.
Forgejo Actions run 2241 passed plan-draft and built the current full image for both architectures. publish-full then failed while pushing a registry blob.
The registry upload ended after 60.1 seconds with 499 Client Closed Request. The draft tag was not published, so the moving :release alias remained on the older image.
Global flags appearing after acompose are not the cause. The host correctly resolved role qa, layout codex, and the Codex auth mount.

Likely fault boundary

The exact 60-second cutoff points to the registry ingress or reverse-proxy upload timeout. The Go build, multi-architecture image build, and composition stages succeeded.

Operator verification

The Ops agent correlates run 2241 with registry, ingress, and proxy logs at the failed blob commit.
The Ops agent identifies and corrects the 60-second upload cutoff without using another repository push as a live probe.
The authorized agent reruns dev-base-publish for the current release revision.
The agent verifies the draft manifest exists and /usr/local/bin/aos --help in that image lists --composed, --guarded, and --warded.
The agent verifies aos acompose --role qa --agent codex -- codex reaches Codex instead of failing in container argument parsing.

Follow-up hardening

AOS should expose a host-container protocol/version check so future release skew reports an incompatible image directly instead of surfacing an opaque unknown-flag error.

## Diagnostic handoff (2026-07-28) The `aos acompose --role qa --agent codex -- codex` failure is a host/image AOS protocol mismatch caused by the stalled dev-base publication path. ### Evidence * The host binary is `aos-v0.101.0`. Its dry run forwards `--composed _container-acompose` into the image. * The current `:release` image contains an older `dev-base` AOS CLI. Its help does not define `--composed`, `--guarded`, or `--warded`. Argument parsing therefore fails before agent-compose or Codex starts. * The image build predates `feat: compose agent launch capabilities`, which introduced the forwarded capability flags. * Forgejo Actions run 2241 passed `plan-draft` and built the current full image for both architectures. `publish-full` then failed while pushing a registry blob. * The registry upload ended after 60.1 seconds with `499 Client Closed Request`. The draft tag was not published, so the moving `:release` alias remained on the older image. * Global flags appearing after `acompose` are not the cause. The host correctly resolved role `qa`, layout `codex`, and the Codex auth mount. ### Likely fault boundary The exact 60-second cutoff points to the registry ingress or reverse-proxy upload timeout. The Go build, multi-architecture image build, and composition stages succeeded. ### Operator verification 1. The Ops agent correlates run 2241 with registry, ingress, and proxy logs at the failed blob commit. 2. The Ops agent identifies and corrects the 60-second upload cutoff without using another repository push as a live probe. 3. The authorized agent reruns `dev-base-publish` for the current release revision. 4. The agent verifies the draft manifest exists and `/usr/local/bin/aos --help` in that image lists `--composed`, `--guarded`, and `--warded`. 5. The agent verifies `aos acompose --role qa --agent codex -- codex` reaches Codex instead of failing in container argument parsing. ### Follow-up hardening AOS should expose a host-container protocol/version check so future release skew reports an incompatible image directly instead of surfacing an opaque unknown-flag error.

coilyco-ops added the

priority

label

2026-07-29 03:45:21 +00:00

coilyco-ops added

and removed