Description
render.py, bundle and image-tag changes replace the agent host, resetting the gateway Postgres ledger and Claude Code sign-ins (about 30 minutes before Claude dashboards fill). The maintainer chose one coordinated rollout on the same host. Consumers can pin a release only after its images exist.
Acceptance Criteria
- #1 One release carries all Codex and pi changes, its images are published to ghcr before the module ref is bumped, and the apply replaces the host exactly once
- #2 After apply, docker compose ps shows Claude Code, Codex and pi developers healthy, and all three appear in the Coding agents view within an hour
- #3 Claude Code traffic, guards and the Claude Code and gateway dashboards behave as before the rollout
Definition of Done
- #1 just check
Implementation Plan
Publish the reviewed code and all required multiarchitecture images, consume an immutable module revision, inspect a saved plan and apply with traffic paused, then run bounded live checks before enabling continuous traffic. Current remote state is empty, so this is one fresh host creation rather than a replacement; do not invent a prior ledger or replacement count.
Implementation Notes
First image publication blocked by scanner findings. Local gateway scan reproduced seven high/critical advisories in perl-base 5.36.0-7+deb12u3, fixed by available deb12u4; final image now upgrades base packages before installing runtime tools. CI additionally exposed the TERM-resistant child test failing on Linux; production timeout supervisor correction is required before deployment.
Prerequisite targeted apply created 16 model/profile/IAM/token resources, followed by 11 evaluator/guard resources (4 then 7 after readback and serial retry). No host, pods or continuous workload created. Throwaway image spikes prove real clients, not full rollout. Actual published developer image versions: Codex 0.162.1, pi 1.2.0, agento11y 0.49.0.
Repaired gateway and dev-workstation images passed both architecture builds/scans at e5672d7fa48e501c282f84917c00fc1d1cdc6531. Agents image remains blocked only by CVE-2026-93687. Full deployment cannot proceed without the maintainer disposition tracked in AIO-0007 (unpatched braces dependency advisory). Existing prerequisite resources remain in the separate demo state; no host or continuous workload was created.
Resume only after maintainer selects the braces advisory disposition, then publish the agents image, create/consume one immutable release with matching image digests, and run a fresh serial full plan/apply with traffic paused. Enable traffic after host health, Claude login and all-agent live checks. No host exists yet; prerequisites are already in state and must not be duplicated.
Maintainer authorized the dated braces exception and full deployment. Reconcile existing 27 prerequisite resources; publish release/images, then serial full apply with traffic paused and live checks before enabling traffic.
Release v0.5.0 is immutable at 6f5af7b08ba9b4c7d5215f30fa48370b882ef0af and local gate passes. Main image publication has cleared both agents scans; release publication waits behind the existing publisher. Do not consume tag until its six images are verified.
All six v0.5.0 image indexes have both architectures and exact release revision; cosign verifies each expected workflow identity/issuer. Full saved paused plan:149 adds/0 changes/0 destroys, one instance and one Helm release. Applying serially now, reusing existing prerequisites.
Release publication run38797356153 completed success at6f5af7b; release CI38797355101 success. Private consumer full just check and pre-commit/pre-push checks passed; release/digest roster pins committed on private main. Full paused apply still active, with no duplicate apply.
Full paused apply complete:149 added/0 changed/0 destroyed; exactly one host creation. All in-cluster Deployments ready; loadgen zero and CronJobs suspended. Host online via SSM, cloud-init still installing/bootstrap. Consumer exact commit d0e2540 CI run38798557552 succeeded. Site health endpoint returns200.
Paused full apply succeeded. Site real API request returns200 with orchestrator/news usage and both generations read back from Agent Observability. All Kubernetes services ready; loadgen0 and both CronJobs suspended. One new EC2 host online, cloud-init bootstrap active; bounded wait on original host, no replacement.
First host startup found root-owned /home/node/.local inherited into new non-Claude home volumes. Before traffic, corrected only those two volume parents and created uid1000 state dirs; image Dockerfile now explicitly creates parents with node ownership. Exact installed-image reproduction and writable-as-node check validate fix. No host replacement or credential change; review of durable image fix running.
Host checks pass after narrow home-volume ownership correction: all seven developer services running, native credentials400/uid1000, Codex/pi cloud doctor ok; all five Claude personas loggedIn=true via gateway, Postgres/gateway healthy. Applying saved traffic-enable plan now: only secret version replacement and Helm update, no EC2 change.
Deployment complete and traffic enabled on v0.5.0. Full refreshed serial plan exits0: No changes. Same single new host retained throughout (no prior host existed, so zero replacements). All seven services running; five Claude identities authenticated. Deployed Codex/pi/Claude corpus generations ingested under expected identities. Claude native metrics and Codex124 metric families observed; gateway ledger has15 spend rows. Kubernetes deployments ready, loadgen1 and CronJobs unsuspended. AC1 literal replacement wording differs from fresh-create reality; AC2 browser portion remains explicitly deferred.
v0.5.0 remains the consumed immutable release. Its two initially root-owned home-volume parents were corrected in place and persist across restarts. The durable image change is a follow-up on main for future fresh volumes; no second host creation/replacement was needed. Separate macOS cleanup-race fix does not change Linux deployment behavior.
Operational deployment is complete. Remaining unchecked acceptance is only the original literal host-replacement wording (actual deployment was one fresh creation) and explicitly deferred browser proof. Resume for visual side-by-side validation when a browser is connected; no further deployment action is blocked by braces.
Final deployment evidence: module release6f5af7b/v0.5.0, private consumerd0e2540, release CI38797355101, image publication38797356153, consumer CI38798557552 all successful. Final drift plan exit0. Live conversations observed from deployed pi.avery, codex.riley and jordan.lee; gateway spend15 rows and Claude/Codex native metrics. One running host verified. No pending apply or traffic change.
Subsequent user-authorized roster expansion validated a clean replacement host using the fixed immutable workstation image from0608be3. All11developer containers ran, all6non-Claude developers across3teams completed successful sessions and their telemetry landed. AIO-0010 (expand coding-agent roster and tear down demo) records this proof and the subsequent authorized teardown. This does not satisfy the separate literal one-release/single-replacement wording or built-in Coding agents visual criterion; those remain distinct.