coilyco-flight-deck/agentic-os
Watch
2
0
Code Issues 67 Pull requests Projects Releases 586 Packages 1 Activity Actions 1

chore(aosguard): pin specgen and umbra to v0.173.0 #1316

Merged
coilysiren merged 2 commits from aos/1105-pin-specgen-0172 into main 2026-08-27 04:38:14 +00:00
Conversation 0 Commits 2 Files changed 2 +5 -5
coilyco-ops commented 2026-08-27 04:12:52 +00:00
Owner
Copy link

Prerequisite for #1105, split out so it can land on its own. Supersedes the first shape of #1311.

Why this is separate

#1105 needs matches on an action input, which umbra ships in v0.172.0 (umbra#322) with its alternation fix in v0.173.0 (umbra#324). The guardfile that uses it cannot build in CI until the image carries a specgen that can parse it.

scripts/ci/repo-test-gate.sh bootstraps the pinned specgen only when none is on PATH, and the :release container the gate job runs in bakes one in at ARG SPECGEN_VERSION. Measured on the first attempt, where the image's specgen 0.167.0 met the new syntax:

FAILED tests/test_aos_cli_release.py::test_specgen_pin_is_owned_by_the_dependency_lock
ERROR  tests/test_aosguard.py::... - subprocess.CalledProcessError:
       Command '['specgen', '--project-root', '.../.specgen/guardfiles', 'build', ...]'
       returned non-zero exit status 1.
1 failed, 710 passed, 2 skipped, 11 errors

So the pin lands first and republishes the image, then the guardfile change goes green against it. Two landings rather than one red merge.

Why v0.173.0 and not v0.172.0

The branch first pinned v0.172.0 and went green there. umbra#324 landed while it sat: matches now takes alternative globs, which #1105's guardfile needs so it can enumerate the label vocabulary rather than wildcard it. Wildcarding is unsafe here - the labels endpoint drops an unknown name silently with a 200, so priority/* would accept priority/p2, let the write through, and apply nothing.

Moving the pin now means one image republish instead of two.

Why both files move together

test_specgen_pin_is_owned_by_the_dependency_lock asserts the Dockerfile's ARG SPECGEN_VERSION equals the lock's cliGuard, so the lock bump and the ARG bump are one change by construction.

Scope

No behaviour change. The guardfiles are untouched, so this is the dependency bump alone. The lock was regenerated with just aosguard-lock using the released specgen 0.173.0 from the tap, not a local build.

Prerequisite for #1105, split out so it can land on its own. Supersedes the first shape of #1311. ## Why this is separate #1105 needs `matches` on an action input, which umbra ships in **v0.172.0** (umbra#322) with its alternation fix in **v0.173.0** (umbra#324). The guardfile that uses it cannot build in CI until the image carries a specgen that can parse it. `scripts/ci/repo-test-gate.sh` bootstraps the pinned specgen **only when none is on PATH**, and the `:release` container the `gate` job runs in bakes one in at `ARG SPECGEN_VERSION`. Measured on the first attempt, where the image's specgen 0.167.0 met the new syntax: ``` FAILED tests/test_aos_cli_release.py::test_specgen_pin_is_owned_by_the_dependency_lock ERROR tests/test_aosguard.py::... - subprocess.CalledProcessError: Command '['specgen', '--project-root', '.../.specgen/guardfiles', 'build', ...]' returned non-zero exit status 1. 1 failed, 710 passed, 2 skipped, 11 errors ``` So the pin lands first and republishes the image, then the guardfile change goes green against it. Two landings rather than one red merge. ## Why v0.173.0 and not v0.172.0 The branch first pinned v0.172.0 and went green there. umbra#324 landed while it sat: `matches` now takes alternative globs, which #1105's guardfile needs so it can enumerate the label vocabulary rather than wildcard it. Wildcarding is unsafe here - the labels endpoint drops an unknown name silently with a 200, so `priority/*` would accept `priority/p2`, let the write through, and apply nothing. Moving the pin now means **one** image republish instead of two. ## Why both files move together `test_specgen_pin_is_owned_by_the_dependency_lock` asserts the Dockerfile's `ARG SPECGEN_VERSION` equals the lock's `cliGuard`, so the lock bump and the ARG bump are one change by construction. ## Scope No behaviour change. The guardfiles are untouched, so this is the dependency bump alone. The lock was regenerated with `just aosguard-lock` using the released specgen 0.173.0 from the tap, not a local build.
chore(aosguard): pin specgen and umbra to v0.172.0
All checks were successful
ci / aos-eval-tests (pull_request) Successful in 8s
Details
ci / ward-doctor (pull_request) Successful in 9s
Details
ci / aos-cli-tests (pull_request) Successful in 32s
Details
ci / gate (pull_request) Successful in 1m0s
Details
dev-base-pr / build (pull_request) Successful in 7m34s
Details
8ffba425cf
 
Prerequisite for #1105, split out so it can land on its own.

#1105 needs `matches` on an action input, which umbra v0.172.0 ships
(umbra#322). The guardfile that uses it cannot build until the CI image carries
a specgen that can parse it: `scripts/ci/repo-test-gate.sh` only bootstraps the
pinned specgen when none is on PATH, and the `:release` image bakes one in at
`ARG SPECGEN_VERSION`. So the pin has to land and republish the image before the
guardfile change can go green.

Both halves of the pin move together because
`test_specgen_pin_is_owned_by_the_dependency_lock` asserts the Dockerfile ARG
equals the lock's `cliGuard`.

No behaviour change: the guardfiles are untouched, so this is the dependency
bump alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform
chore(aosguard): move the pin to specgen and umbra v0.173.0
All checks were successful
ci / ward-doctor (pull_request) Successful in 7s
Details
ci / aos-eval-tests (pull_request) Successful in 7s
Details
ci / aos-cli-tests (pull_request) Successful in 26s
Details
ci / gate (pull_request) Successful in 48s
Details
dev-base-pr / build (pull_request) Successful in 4m59s
Details
502e367bce
 
umbra#324 landed after this branch was opened, making a `matches` constraint
carry alternative globs. #1105's guardfile needs that form, so the pin moves to
v0.173.0 rather than republishing the dev-base image twice.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform
coilyco-ops changed title from chore(aosguard): pin specgen and umbra to v0.172.0 to chore(aosguard): pin specgen and umbra to v0.173.0 2026-08-27 04:27:40 +00:00
coilysiren deleted branch aos/1105-pin-specgen-0172 2026-08-27 04:38:15 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
burndown-2026-06
Backlog burndown June 2026

  
burndown-2026-08
Closed in the 2026-08-26 backlog burn-down. Reopen freely: state:closed label:burndown-2026-08 recovers the whole set.

  
autonomy
async-consult
 A human needs to consult on the issue to upgrade it to headless

  
autonomy
epic
 This issue has many units of sub work - its size makes it meaningfully exclusive with other autonomy types

  
autonomy
headless
 The agent can perform the work on its own

  
autonomy
live-collab
 The agent and the human need to work together in realtime

  
coherence-core
Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  
priority
P0
 priority tier

  
priority
P1
 priority tier

  
priority
P2
 priority tier

  
priority
P3
 priority tier

  
priority
P4
 priority tier

  
qa-fixture
Disposable issue admitted to the bounded Ward QA verification lane.

  
role/advocate
requires work from the Developer Advocate seat

  
role/director
requires work from the Portfolio Director seat

  
role/exec
requires work from the exec role

  
role/frontend
requires work from the Frontend Engineer seat

  
role/gamedev
requires work from the Game Developer seat

  
role/human
requires a person, and specifically not an agent seat

  
role/platform
requires work from the Platform Engineer seat

  
role/qa
requires work from the QA role

  
role/science
requires work from the Applied Scientist seat

  
role/sysadmin
requires work from the Systems Administrator seat

  
state
ambient
 ambient and ephemeral work, held as a maintained document rather than a queue

No labels
burndown-2026-06
burndown-2026-08
autonomy
async-consult
autonomy
epic
autonomy
headless
autonomy
live-collab
coherence-core
priority
P0
priority
P1
priority
P2
priority
P3
priority
P4
qa-fixture
role/advocate
role/director
role/exec
role/frontend
role/gamedev
role/human
role/platform
role/qa
role/science
role/sysadmin
state
ambient
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
coilyco-flight-deck/agentic-os!1316
No description provided.