chore(deps): bring the four internal pins current and re-lock onto umbra v0.142.0 #1066

Merged

coilysiren merged 1 commit from aos/claude/wy58-internals-bump into main

2026-08-15 20:59:20 +00:00

coilyco-ops commented

2026-08-15 16:36:47 +00:00

Member

Closes #1044.

The four internal pins

docker/dev-base/full/Dockerfile pins four Coilyco-owned tools, and all four had drifted behind their releases:

WARD_VERSION           0.879.0 -> 0.884.0
SPECGEN_VERSION        0.139.0 -> 0.142.0   (released from umbra)
AOS_VERSION            0.190.0 -> 0.202.0
AGENT_COMPOSE_VERSION  2.20.0  -> 2.22.0

Those are the four tests/test_dev_base_image.py names as the internal tool surface. The other ARGs in that file are third-party and untouched.

The lock, and the page it retires

.specgen/guardfiles/specverb.lock re-locks onto umbra v0.142.0. That is not an arbitrary bump: docs/aosguard-raw-response-defect.md was written waiting for exactly this release, and its own "Removing this page" section gives the procedure - re-lock, confirm the leaf returns log bytes, delete the page and its pointer in docs/forgejo-actions-logs.md. This does all four steps.

v0.142.0 carries umbra#291, confirmed from the release notes rather than assumed from the version bump.

Verified against the defect, not the release notes

Installed aosguard, still on the v0.139.0 lock:

$ aosguard ops forgejo action-job logs coilyco-gaming sirens-echo 33942
aosguard: invalid character `-` after top-level value
$ aosguard ops forgejo action-run logs coilyco-gaming sirens-echo 20603
aosguard: invalid character `P` looking for beginning of value

Rebuilt from the v0.142.0 lock, same two commands: the first returns timestamped log lines, the second returns a ZIP whose first bytes are 504b 0304. Both failure strings match the ones the defect page recorded, so this is that defect and not a lookalike.

Verification

just repo-test-gate green - 532 pytest and the full pre-commit suite.

specgen was upgraded through the Homebrew tap (0.140.0 -> 0.142.0) rather than by side-loading a binary, so the host and the lock agree on the engine that produced it. That needed brew trust coilyco-flight-deck/tap first, which is a reversible local trust on your own tap - flagging it since it changes host state beyond this repo.

Not in this change

agent/bundles-style consumer pins elsewhere in the fleet. This is the aos-side pin set only.

🤖 Generated with Claude Code

Closes #1044. ## The four internal pins `docker/dev-base/full/Dockerfile` pins four Coilyco-owned tools, and all four had drifted behind their releases: ``` WARD_VERSION 0.879.0 -> 0.884.0 SPECGEN_VERSION 0.139.0 -> 0.142.0 (released from umbra) AOS_VERSION 0.190.0 -> 0.202.0 AGENT_COMPOSE_VERSION 2.20.0 -> 2.22.0 ``` Those are the four `tests/test_dev_base_image.py` names as the internal tool surface. The other ARGs in that file are third-party and untouched. ## The lock, and the page it retires `.specgen/guardfiles/specverb.lock` re-locks onto umbra v0.142.0. That is not an arbitrary bump: `docs/aosguard-raw-response-defect.md` was written waiting for exactly this release, and its own "Removing this page" section gives the procedure - re-lock, confirm the leaf returns log bytes, delete the page and its pointer in `docs/forgejo-actions-logs.md`. This does all four steps. v0.142.0 carries umbra#291, confirmed from the release notes rather than assumed from the version bump. ## Verified against the defect, not the release notes Installed aosguard, still on the v0.139.0 lock: ``` $ aosguard ops forgejo action-job logs coilyco-gaming sirens-echo 33942 aosguard: invalid character `-` after top-level value $ aosguard ops forgejo action-run logs coilyco-gaming sirens-echo 20603 aosguard: invalid character `P` looking for beginning of value ``` Rebuilt from the v0.142.0 lock, same two commands: the first returns timestamped log lines, the second returns a ZIP whose first bytes are `504b 0304`. Both failure strings match the ones the defect page recorded, so this is that defect and not a lookalike. ## Verification `just repo-test-gate` green - 532 pytest and the full pre-commit suite. specgen was upgraded through the Homebrew tap (0.140.0 -> 0.142.0) rather than by side-loading a binary, so the host and the lock agree on the engine that produced it. That needed `brew trust coilyco-flight-deck/tap` first, which is a reversible local trust on your own tap - flagging it since it changes host state beyond this repo. ## Not in this change `agent/bundles`-style consumer pins elsewhere in the fleet. This is the aos-side pin set only. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 1 commit

2026-08-15 16:36:48 +00:00

chore(deps): bring the four internal pins current and re-lock onto umbra v0.142.0

ci / ward-doctor (pull_request) Successful in 14s

Details

ci / aos-cli-tests (pull_request) Successful in 21s

Details

ci / gate (pull_request) Successful in 1m3s

Details

dev-base-pr / build (pull_request) Successful in 19m34s

Details

9f1280fe96

The dev-base full image pins four Coilyco-owned tools, and all four had drifted
behind their releases:

    WARD_VERSION           0.879.0 -> 0.884.0
    SPECGEN_VERSION        0.139.0 -> 0.142.0   (umbra)
    AOS_VERSION            0.190.0 -> 0.202.0
    AGENT_COMPOSE_VERSION  2.20.0  -> 2.22.0

`.specgen/guardfiles/specverb.lock` re-locks onto umbra v0.142.0, which is the
release docs/aosguard-raw-response-defect.md was waiting for. That page said to
re-lock, confirm the leaf returns log bytes, then delete it and its pointer, so
that is what this does.

The raw-response defect is fixed, checked against the same job rather than
inferred from the release notes. Installed aosguard on the v0.139.0 lock:

    $ aosguard ops forgejo action-job logs coilyco-gaming sirens-echo 33942
    aosguard: invalid character '-' after top-level value
    $ aosguard ops forgejo action-run logs coilyco-gaming sirens-echo 20603
    aosguard: invalid character 'P' looking for beginning of value

Rebuilt from the v0.142.0 lock, the first returns timestamped log lines and the
second returns a ZIP whose first bytes are PK\x03\x04. Both failure strings match
the ones the defect page recorded, so this is the documented defect and not a
lookalike.

`just repo-test-gate` green: 532 pytest and the full pre-commit suite.

Closes #1044

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-15 16:36:48 +00:00