Repository navigation
Onboard Agent Forge itself and provide safe self-upgrade #44
Description
Specification ready. Reviewed product decisions are resolved. Implementation remains subject to roadmap ordering, an explicit claim, review, and acceptance evidence.
Parent roadmap: #35
Problem
Agent Forge should be developed through its own supported Gate lifecycle, but a running Gate must not replace/restart itself from inside the job that produced its candidate.
Proposed boundary
- Register
0k-lab/agent-forgeas a normal project. - Gate/Worker produce and merge exact candidates through the standard path.
- A separate stable updater/deployer owns staging binaries, atomic install, service restart, readiness verification, and rollback.
- Running version, source SHA, schema version, and last upgrade result are observable.
Dependencies
Depends on accepted authorization/SSH transport, installable releases, and local deployment/update mechanics.
Reviewed decisions
- Automatic self-upgrade consumes immutable stable releases, not every merge to
main. - A stable updater/service, separate from the running Gate and coding Worker, stages activation, readiness, and rollback.
- Database backup precedes migration; rollback is permitted only when the previous binary supports the resulting schema/state.
- Upgrade drain uses a configurable timeout, initially 30 minutes. Gate stops new leases, lets bounded in-flight work complete, fences/requeues safe unfinished work after timeout, upgrades, verifies readiness, and resumes. Remote Workers may be upgraded one at a time.
Remaining questions before Ready
None.
Acceptance
- Agent Forge changes use the same supported project submission and automatic PR/CI/exact merge as other projects.
- An exact released build upgrades the persistent deployment without one-off helpers.
- Failed readiness restores the previous binaries/config-compatible state.
- Active/persisted lifecycle state remains valid across the upgrade.
Activity
kricha-lab-dev-worker commentedon Sep 6, 2026
Claimed for implementation after #45 privileged CI proved schema-migration rollback is a prerequisite.
Starting with a bounded fail-closed database snapshot/restore transaction contract for schema-changing upgrades. No self-download or release-channel automation in the first increment; exact install identity, service readiness, immutable rollback compatibility, and cleanup residue remain mandatory.
kricha-lab-dev-worker commentedon Sep 6, 2026
First bounded #44 rollback-safety prerequisite merged via #80.
Exact evidence:
771d2b1b84cd1e190aa5e4c26048add48584af57ea76dcc4952c47cd242319626dee0152f8fa63cc333a8ef38761de0a2815d729772c9567main:0d5498286f75614101809467cf935b3940950afeNo restore/exchange, updater, installer, service, schema bump, API, or Worker wiring was added. Next bounded prerequisite is atomic validated restore with compensation-safe failure behavior before any cross-schema installer checks are relaxed. #44 remains open.
kricha-lab-dev-worker commentedon Sep 7, 2026
Second bounded #44 rollback-safety prerequisite merged via #81.
Exact evidence:
64255c2f8dd702de66aba6de1638f700d0d9ff7c2976093e6826238b0bdc7adb4ad9f1dc5b4f97177411965e35319cfa60fbaa8391ca8cd89534ec100d34a485e4e425110ffae0e7fd49dc51main:135e753d410d7dc79a95e7b6b61bd3411881ee7eScope adds existing-destination atomic snapshot restore with explicit AppliedDurable/NotAppliedDurable/Indeterminate outcomes and recovery residue. Installer/updater/service/schema wiring and compatibility-check relaxation remain intentionally absent. Next increment must bind this primitive into a durable upgrade transaction before cross-schema rollback is allowed. #44 remains open.
kricha-lab-dev-worker commentedon Sep 7, 2026
Third bounded #44 rollback-safety prerequisite merged via #82.
Exact evidence:
50031aa848d75bff9af239061f337abafac5b7b1f694953f3a0cba2b92781daa1eee818a58e97b590b30a48a0695a1d030aaa04620b352e08cbea76490f101a86f6a216a60d7b4fb149f3c9bmain:d7158c157a002995b31bb3e1137731a5fbb040f4Scope is canonical transaction-journal value/codec and fail-closed transition graph only. Filesystem persistence, privilege-dropped snapshot execution, receipt/schema-gate changes, and installer/service wiring remain absent. #44 remains open.
kricha-lab-dev-worker commentedon Sep 7, 2026
Upgrade-journal create/read persistence merged through PR #83.
01172c77f51e9a6931b1379287f6a34e308df276810480340e57f2b4b1d2b53cf052609785bde8bc54cf190c2cc3b4ef4d9d1e8763b22fdf3ccc39a9b6d8fedd0752486b89ec5dc60930029785de5971uninstall-acceptancefailed before tests inactions/setup-goduesum.golang.orgHTTP/2INTERNAL_ERRORNo compatibility tests were weakened. Library-only scope; no installer/service/schema execution wiring yet.
kricha-lab-dev-worker commentedon Sep 7, 2026
Durable upgrade-journal CAS transition persistence merged through PR #86.
030a95f20e83a65789634e435832c0f8586555472eff0fb08d221840edf23f4b8be9d0851be425131cce5b3ecd01e897d1d25fedb750ac9ed3b52e103bd1bab40f374c3a29fa428a5dc0548b1da9643f3dbb2c91ffc08555c9f681a628fc73ec6e6d000d3196eef6ea5606786ec5e804f2ac6f9fonline-install-acceptancezero-state failure, tracked with exact evidence in CI: setup-go intermittently fails on sum.golang.org HTTP/2 errors #85CAS is fail-closed: predecessor inode witness, pinned O_TMPFILE next generation, no-replace links, RENAME_EXCHANGE, no unlink/cleanup, and Indeterminate after any exchange uncertainty. This remains library-only; installer/service/snapshot/restore/schema wiring is deferred.