feat(deps): base-image build recipe + wired-image drift guard - #71
Open
WayforthOfficial wants to merge 1 commit into
Open
feat(deps): base-image build recipe + wired-image drift guard#71WayforthOfficial wants to merge 1 commit into
WayforthOfficial wants to merge 1 commit into
Conversation
Closes the process gap the egress flip-readiness check found: the base image was baked by an uncommitted manual step, so nothing tied the WIRED image to BASE_DEPS — a future BASE_DEPS change would silently leave a stale image (the 'lock engaged on the wrong image' failure mode, one step removed). - services/agent_deps.py: base_deps_lock() (hashed closure lock), base_deps_pinned(), diff_against_base_deps()/base_deps_match() — single source of truth = BASE_DEPS. - scripts/build_base_image.py (NEW, gated BUILD_BASE_IMAGE=1): bakes the base image FROM base_deps_lock(), ASSERTS the built pip-freeze == BASE_DEPS before snapshotting, prints the ref. Does NOT set AGENT_BASE_IMAGE, does NOT flip. - scripts/deps_live_proof.py: builds from the shared base_deps_lock(); ADDS a wired-image assertion — if AGENT_BASE_IMAGE is set, boots it and fails closed unless its pip-freeze equals BASE_DEPS. This ties 'proof passed' to 'wired image correct'. - 6 unit tests incl. the ACTUAL current-template freeze matching BASE_DEPS (assertion would pass on today's image) + drift detection (missing/mismatch/extra → fail). Suite 632. Both scripts are gated no-ops without their env flags. Nothing wired, nothing flipped. Wiring sequence (separate, manual): set AGENT_BASE_IMAGE -> run deps_live_proof green (now also asserts wired==BASE_DEPS) -> flip AGENT_GATEWAY_EGRESS_ENABLED. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
🚅 Deployed to the wayforth-pr-71 environment in wayforth
8 services not affected by this PR
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the ⚠ process gap from the egress flip-readiness check: the base image was baked by an uncommitted manual step, so nothing tied the wired image to
BASE_DEPS. A futureBASE_DEPSchange would silently leave a stale wired image — the "lock engaged on the wrong image" failure mode, one step removed. No wiring, no flip — recipe + assertion only.What's here
base_deps_lock()/diff_against_base_deps()/base_deps_match()inagent_deps.py— one source of truth (BASE_DEPS) for both the bake and the check.scripts/build_base_image.py(NEW, gatedBUILD_BASE_IMAGE=1) — bakes the base image frombase_deps_lock(), asserts the builtpip freeze==BASE_DEPSbefore snapshotting, prints the ref. Reproducible, committed — no more manual bake.scripts/deps_live_proof.py— now builds from the sharedbase_deps_lock(), and adds the wired-image assertion: ifAGENT_BASE_IMAGEis set, it boots that image and fails closed unless itspip freezeequalsBASE_DEPS. This is what makes "proof passed" ⟹ "wired image correct" — a stale/hand-built image can't slip through.Proven
test_current_template_matches_base_deps— the actualpip freezeI captured from the livewayforth-agent-base-v1matchesBASE_DEPS, so the assertion passes on today's image — and missing/mismatch/extra cases prove it fails on a drifted one.This PR changes nothing operationally
AGENT_BASE_IMAGE, does not run the build, does not flip any flag.AGENT_BASE_IMAGE→ rundeps_live_proofgreen (now also asserts wired ==BASE_DEPS) → flipAGENT_GATEWAY_EGRESS_ENABLED.🤖 Generated with Claude Code