genesis: refresh seed (agents 0.7.3 + mcp 0.23.15) + seed GITOPS_REF override #56

Merged

plat merged 2 commits from feat/robust-seed-refresh into main

2026-07-01 18:21:10 +00:00

plat commented

2026-07-01 16:20:03 +00:00

Owner

Wave-1 ROBUSTNESS — the seed refresh so a fresh germination ships apps first-try.

Refreshed genesis/seed.tar.gz now carries:

agents v0.7.3: ssh-keyscan cold-start retry (#6) so SSH clones work first try; dev-env 403 treated as the benign no-overlay state; workflow-protection applied after the dispatcher’s admin prime-setup (removes the prime branch/PR setup failed fallback while keeping the #16 exfil property).
mcp v0.23.15: renders the per-app agent-dev-env-read Role/RoleBinding the agents SA needs (0.23.9 predated the dev overlay entirely → 403).
gitops squash pinned to both.

bin/seed: add GITOPS_REF (default HEAD) so a coordinated release can be seeded from a not-yet-merged gitops pin-bump branch (--mirror carries every ref). This seed was built with GITOPS_REF=feat/robust-devenv-pins; after plat/gitops#5 merges, a default re-seed (GITOPS_REF=HEAD) reproduces the same artifact.

Depends on: plat/agents#7 (v0.7.3 tag/image), plat/mcp v0.23.15 tag/image, plat/gitops#5 (pins). Merge order: agents+mcp tags build → gitops#5 → this.

Validation: germinated an isolated platform (CLUSTER=wb-robust) from this seed on vxrail; result in the PR thread / handoff.

Prime-protection decision: fix lives in the dispatcher (agents#7), not germinate — the dispatcher owns both the protection and the prime setup for new apps, so reordering there is self-contained and provably safe (deploy key is minted only in spawnBuilder, after the rule is applied). germinate’s seeded-repo protection (admin, migration path) is unchanged.

🤖 Generated with Claude Code

Wave-1 ROBUSTNESS — the seed refresh so a fresh germination ships apps first-try. **Refreshed `genesis/seed.tar.gz`** now carries: - agents **v0.7.3**: ssh-keyscan cold-start retry (#6) so SSH clones work first try; dev-env 403 treated as the benign no-overlay state; workflow-protection applied after the dispatcher’s admin prime-setup (removes the `prime branch/PR setup failed` fallback while keeping the #16 exfil property). - mcp **v0.23.15**: renders the per-app `agent-dev-env-read` Role/RoleBinding the agents SA needs (0.23.9 predated the dev overlay entirely → 403). - gitops squash pinned to both. **`bin/seed`: add `GITOPS_REF`** (default `HEAD`) so a coordinated release can be seeded from a not-yet-merged gitops pin-bump branch (`--mirror` carries every ref). This seed was built with `GITOPS_REF=feat/robust-devenv-pins`; after plat/gitops#5 merges, a default re-seed (`GITOPS_REF=HEAD`) reproduces the same artifact. **Depends on:** plat/agents#7 (v0.7.3 tag/image), plat/mcp v0.23.15 tag/image, plat/gitops#5 (pins). Merge order: agents+mcp tags build → gitops#5 → this. **Validation:** germinated an isolated platform (CLUSTER=wb-robust) from this seed on vxrail; result in the PR thread / handoff. **Prime-protection decision:** fix lives in the dispatcher (agents#7), not germinate — the dispatcher owns both the protection and the prime setup for new apps, so reordering there is self-contained and provably safe (deploy key is minted only in spawnBuilder, after the rule is applied). germinate’s seeded-repo protection (admin, migration path) is unchanged. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

plat added 1 commit

2026-07-01 16:20:03 +00:00

genesis: refresh seed (agents 0.7.3 + mcp 0.23.15) + seed GITOPS_REF override eaef40e435

Refresh genesis/seed.tar.gz so a fresh germination carries:
- agents v0.7.3 (ssh-keyscan cold-start retry -> SSH clone works first try;
  dev-env 403 treated as benign; workflow-protection applied after prime setup)
- mcp v0.23.15 (renders the per-app agent-dev-env-read RBAC the SA needs)
and gitops pinned to both.

bin/seed: add GITOPS_REF (default HEAD) so a coordinated release can be seeded
from a not-yet-merged gitops pin-bump branch (--mirror carries every ref); this
seed was built with GITOPS_REF=feat/robust-devenv-pins. After that gitops PR
merges, a default (GITOPS_REF=HEAD) re-seed reproduces the same artifact.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat added 1 commit

2026-07-01 17:33:04 +00:00

genesis: refresh seed — agents 0.7.4 (keyscan + dev-env fixes) + gitops 0.7.4 pins 70fa8a1bf5

Rebuilt via GITOPS_REF=feat/robust-devenv-pins so the seed's gitops squash pins
agents 0.7.4 (mcp stays 0.23.15) and the agents bundle carries the v0.7.4 tag at
the fixed dispatcher (was 0.7.3, which predated the fixes).

plat merged commit 6dd637e7b7 into main

2026-07-01 18:21:10 +00:00

plat referenced this pull request from a commit

2026-07-01 18:21:11 +00:00

Merge pull request 'genesis: refresh seed (agents 0.7.3 + mcp 0.23.15) + seed GITOPS_REF override' (#56) from feat/robust-seed-refresh into main

plat referenced this pull request

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this pull request

2026-07-02 02:35:39 +00:00

/goal /ultracode-workflows [SPINE-2] fix ci-builder cold-start KEDA/runner stall (#19) + validate seed refresh (#14 / PR #20) #22