coilyco-flight-deck/agentic-os

Watch

Retire or make the dev-base dependency planner fail closed #865

New issue

Closed

opened 2026-08-04 07:52:49 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-08-04 07:52:49 +00:00

Member

Evidence

On 2026-08-04, ward exec dep-bump -- plan --json failed TLS verification for every external resolver, failed both promoted internal resolvers, printed [], and exited successfully. That result is indistinguishable from a fully current inventory. The planner also has no resolver for AOS, OpenCode, Git LFS, Trunk, golangci-lint, or kdlfmt.

Decision needed

Either retire the scheduled planner in favor of an explicit periodic inventory, or make it a complete and fail-closed source of truth.

Acceptance for keeping it

Every mobile Dockerfile version pin has a resolver or a documented static exemption.
Resolver failures are represented in machine output and make scheduled inventory fail.
A total TLS or Forgejo resolver failure can never report an empty successful plan.
Each result identifies its invalidation domain: language payload or full surface.
Internal products resolve canonical promoted releases, including AOS.
Tests cover mixed drift, partial outage, total outage, and unmanaged-pin detection.
Documentation stops calling partial success a current inventory.

Boundary

This issue does not block agentic-os#864's manually verified pin refresh.

## Evidence On 2026-08-04, `ward exec dep-bump -- plan --json` failed TLS verification for every external resolver, failed both promoted internal resolvers, printed `[]`, and exited successfully. That result is indistinguishable from a fully current inventory. The planner also has no resolver for AOS, OpenCode, Git LFS, Trunk, golangci-lint, or kdlfmt. ## Decision needed Either retire the scheduled planner in favor of an explicit periodic inventory, or make it a complete and fail-closed source of truth. ## Acceptance for keeping it * Every mobile Dockerfile version pin has a resolver or a documented static exemption. * Resolver failures are represented in machine output and make scheduled inventory fail. * A total TLS or Forgejo resolver failure can never report an empty successful plan. * Each result identifies its invalidation domain: language payload or full surface. * Internal products resolve canonical promoted releases, including AOS. * Tests cover mixed drift, partial outage, total outage, and unmanaged-pin detection. * Documentation stops calling partial success a current inventory. ## Boundary This issue does not block agentic-os#864's manually verified pin refresh.

coilyco-ops commented

2026-08-04 07:56:31 +00:00

Author

Member

Additional inventory gap: not every mobile input is an ARG. The Dockerfiles intentionally or accidentally float ubuntu:24.04, the Rust stable channel, patch releases within uv-managed Python 3.13 and 3.12, pipenv, pre-commit, and apt packages. A retained planner needs to classify these as deliberate floating inputs or replace them with owned pins. It must not imply that scanning version ARG declarations is the whole dependency inventory.

Additional inventory gap: not every mobile input is an `ARG`. The Dockerfiles intentionally or accidentally float `ubuntu:24.04`, the Rust `stable` channel, patch releases within uv-managed Python `3.13` and `3.12`, `pipenv`, `pre-commit`, and apt packages. A retained planner needs to classify these as deliberate floating inputs or replace them with owned pins. It must not imply that scanning version `ARG` declarations is the whole dependency inventory.

coilyco-ops referenced this issue

2026-08-04 07:58:02 +00:00

Refactor dev-base into cached payloads and one released image #866

coilyco-ops referenced this issue

2026-08-04 18:54:56 +00:00

Make dev-base language images cached build-only payloads #863

coilyco-ops commented

2026-08-04 19:00:14 +00:00

Author

Member

2026-08-04 recommendation after the dev-base split:

Keep the recursive Dockerfile-tree reader. The split-path CI failure came from repo-test-gate bootstrap code, not from that reader, and PR #866 fixes the bootstrap owner.
Retire the scheduled auto-apply planner unless it becomes complete and fail-closed. Today every resolver may fail while plan still reports an empty successful result, so it cannot prove currency and should not gate releases.
If retained at all, present dep-bump as a partial lookup helper for known pins. Manual inventory remains authoritative for unmanaged mobile inputs such as Ubuntu tags, Rust stable, Python patch resolution, Pipenv, pre-commit, apt packages, Git LFS, Trunk, OpenCode, golangci-lint, and kdlfmt.

My preference is to remove the scheduled auto-push path and keep only an explicitly partial manual resolver until a complete owning inventory exists.

2026-08-04 recommendation after the dev-base split: * Keep the recursive Dockerfile-tree reader. The split-path CI failure came from repo-test-gate bootstrap code, not from that reader, and PR #866 fixes the bootstrap owner. * Retire the scheduled auto-apply planner unless it becomes complete and fail-closed. Today every resolver may fail while plan still reports an empty successful result, so it cannot prove currency and should not gate releases. * If retained at all, present dep-bump as a partial lookup helper for known pins. Manual inventory remains authoritative for unmanaged mobile inputs such as Ubuntu tags, Rust stable, Python patch resolution, Pipenv, pre-commit, apt packages, Git LFS, Trunk, OpenCode, golangci-lint, and kdlfmt. My preference is to remove the scheduled auto-push path and keep only an explicitly partial manual resolver until a complete owning inventory exists.

coilysiren referenced this issue from a commit

2026-08-04 19:03:41 +00:00

Refactor dev-base into cached payloads and one released image (#866)

coilyco-ops added the

priority

autonomy

async-consult

labels

2026-08-05 10:25:48 +00:00

coilyco-ops added

and removed

labels

2026-08-17 02:36:54 +00:00

coilyco-ops commented

2026-08-17 02:56:02 +00:00

Author

Member

Retired, which was this issue's first option. Closing. Darren (director seat), 2026-08-17. Kai flagged it and she is right.

This issue offered two paths: retire the scheduled planner in favour of an explicit periodic inventory, or make it complete and fail-closed. The retire path was taken, eleven days ago.

a795177f, 2026-08-06 19:21:03 -0700, "chore: remove the scheduled dev-base dependency auto-bump (#966)":

 .forgejo/workflows/dep-bump.yml      |  72 ------
 .ward/ward.yaml                      |   3 -
 docs/dev-base-auto-bump.md           |  74 -------
 scripts/ci/dep-bump.sh               |  27 ---
 scripts/dep-bump.py                  | 411 -----------------------------
 scripts/rotate-dep-bump-token.sh     |  75 -------
 tests/test_dep_bump.py               | 302 -------------------------
 10 files changed, 6 insertions(+), 971 deletions(-)

#966 is closed. A git grep for dep-bump, dep_bump, dependency planner, and depbump across the tracked tree returns nothing, and ward exec dep-bump no longer resolves because the verb left .ward/ward.yaml in the same commit.

So the evidence in the body - ward exec dep-bump -- plan --json failing every resolver, printing [], exiting 0 - describes a program that does not exist.

What does not close with it

The issue's acceptance-for-keeping list named a real gap that retirement sidesteps rather than answers: there is no periodic inventory of Dockerfile version pins. #813 is the manual version of that work, refreshing the shared pins by hand, and it is priority/P2 autonomy/headless. If a recurring inventory is still wanted, it wants its own issue rather than this one reopened, because the thing being asked for is now "build an inventory" rather than "fix or retire the planner".

Correcting my own use of it

I cited this issue an hour ago as a live instance of a defect pattern - tools reporting success for work they did not do. It was a real instance and it is no longer live. The pattern still holds on #1032, #988, #1047, and #985, plus coilyco-flight-deck/umbra#301.

**Retired, which was this issue's first option. Closing. Darren (director seat), 2026-08-17. Kai flagged it and she is right.** This issue offered two paths: retire the scheduled planner in favour of an explicit periodic inventory, or make it complete and fail-closed. **The retire path was taken**, eleven days ago. `a795177f`, 2026-08-06 19:21:03 -0700, *"chore: remove the scheduled dev-base dependency auto-bump (#966)"*: ``` .forgejo/workflows/dep-bump.yml | 72 ------ .ward/ward.yaml | 3 - docs/dev-base-auto-bump.md | 74 ------- scripts/ci/dep-bump.sh | 27 --- scripts/dep-bump.py | 411 ----------------------------- scripts/rotate-dep-bump-token.sh | 75 ------- tests/test_dep_bump.py | 302 ------------------------- 10 files changed, 6 insertions(+), 971 deletions(-) ``` `#966` is closed. A `git grep` for `dep-bump`, `dep_bump`, `dependency planner`, and `depbump` across the tracked tree returns nothing, and `ward exec dep-bump` no longer resolves because the verb left `.ward/ward.yaml` in the same commit. So the evidence in the body - `ward exec dep-bump -- plan --json` failing every resolver, printing `[]`, exiting 0 - describes a program that does not exist. ## What does not close with it The issue's acceptance-for-keeping list named a real gap that retirement sidesteps rather than answers: **there is no periodic inventory of Dockerfile version pins**. `#813` is the manual version of that work, refreshing the shared pins by hand, and it is `priority/P2` `autonomy/headless`. If a recurring inventory is still wanted, it wants its own issue rather than this one reopened, because the thing being asked for is now "build an inventory" rather than "fix or retire the planner". ## Correcting my own use of it I cited this issue an hour ago as a live instance of a defect pattern - tools reporting success for work they did not do. It was a real instance and it is no longer live. The pattern still holds on `#1032`, `#988`, `#1047`, and `#985`, plus `coilyco-flight-deck/umbra#301`.

coilyco-ops closed this issue

2026-08-17 02:56:22 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#865

No description provided.

Rows
Columns