feat(kits)!: adopt pinned agent and capability kits

[mogul]

Context

AI-assisted implementation for the ADR-0030 migration: move from adapter-owned agent/tool installation toward a generic devenv-enabled base image plus explicit, pinned capability/agent kits from agentic-coding-patterns.

This PR now includes the work that was previously stacked above it:

• feat(kits)!: make oci-engine an opt-in catalog kit and retire the adapter auto-install #541 — oci-engine as an opt-in catalog kit and retirement of adapter-owned MSB OCI auto-install.
• chore(kits): stage patterns release pin placeholder #545 — patterns pin bump to v1.12.0.
• refactor(msb): remove native opencode fallback #546 — removal of the native MSB OpenCode npm fallback.

Discussion issue: #473
Related patterns release: GSA-TTS/agentic-coding-patterns v1.12.0 (56d1f5f49ef928f50e61aa64a93d618b3d21c415)

Closes: #478, #479, #480, #481, #482, #483, #484, #485, #505

#475 remains a separate resource-sizing track and is intentionally not closed by this PR.

BREAKING CHANGE

This PR changes default MSB provisioning behavior.

1. MSB no longer auto-installs podman/OCI tooling by default.
   Users who need docker run, docker compose, or rootless podman inside MSB sandboxes must opt into the oci-engine kit.

2. MSB no longer performs native OpenCode npm fallback installation.
   OpenCode is supplied by the pinned opencode agent kit from agentic-coding-patterns v1.12.0. If the kit is unavailable or invalid, acq fails closed instead of silently installing opencode-ai from npm.

3. Existing MSB sandboxes with adapter-installed podman are not migrated in place.
   Recreate affected sandboxes or add the oci-engine kit before relying on OCI behavior after stop/start.

Migration

For OCI/podman inside MSB sandboxes, choose one of:

acq configure

and select oci-engine, or pass the pinned kit for a one-off sandbox:

acq run opencode . --kit 'git+https://github.com/GSA-TTS/agentic-coding-patterns.git#ref=56d1f5f49ef928f50e61aa64a93d618b3d21c415&dir=integrations/isolation/acq-kits/oci-engine'

For OpenCode, no separate user action is intended for new sandboxes: the built-in opencode agent kit is selected by acq from the pinned patterns bundle.

Existing sandboxes should be recreated when their provisioned state must match the new defaults.

Summary

• Add ADR-0030 for agent kits on a devenv-enabled, agent-less base image.
• Pin PATTERNS_KIT_REF to agentic-coding-patterns v1.12.0 (56d1f5f49ef928f50e61aa64a93d618b3d21c415).
• Add built-in agent kit metadata/inference and migrate OpenCode install/config/startup knowledge into the pinned opencode kit.
• Remove the native MSB OpenCode npm fallback path.
• Split provider facts from agent config rendering and consume provider-facts/usai.env when present.
• Add the generic opt-in kit catalog path for oci-engine.
• Remove adapter-owned MSB OCI/podman auto-install, package knobs, short-name-mode plumbing, and unconditional OCI device grants.
• Add the neutral /home/agent/.rc.d/*.sh shell-snippet contract and bridge it for MSB/SBX.
• Preserve startup-barrier, grammar-guard, exec-bit self-healing, and live verifier hardening from the stack.
• Fix SBX USAi presence/rotation paths to honor provider-defined key env names.
• Improve non-enforcing BYO/devenv doctor diagnostics.

Verification

Latest local verification after rebasing over #548 and collapsing the stack:

• PASS: bash -n acq acq.backends/*.sh scripts/test-acq-lib.sh scripts/test-acq-bats scripts/fix-exec-bits test/bats/helper.bash scripts/verify-backends
• PASS: ./scripts/fix-exec-bits --check
• PASS: git diff --check
• PASS: npm run lint:md
• PASS: focused dispatch regression: TMPDIR="$PWD/tmp" ./scripts/test-acq-bats test/bats/30-dispatch-routing.bats (55 ok)
• PASS: feat(kits)!: make oci-engine an opt-in catalog kit and retire the adapter auto-install #541/chore(kits): stage patterns release pin placeholder #545/refactor(msb): remove native opencode fallback #546 focused suites:
  • test/bats/36-agent-catalog.bats
  • test/bats/50-kit-list-completeness.bats
  • test/bats/55-version.bats
  • test/bats/72-msb-agent-user.bats
  • test/bats/80-kit-subcommands.bats
  • test/bats/85-kit-provenance.bats
  • test/bats/95-kit-ref-persistence.bats
  • test/bats/135-configure.bats
  • test/bats/140-opencode-migration-gate.bats
• PASS: host live verification previously run on this stack before the final collapse:
  • MSB: 15 passed, 0 failed, 1 skipped
  • SBX: 10 passed, 0 failed, 1 skipped

CI is the source of truth for full offline suite coverage on the collapsed PR.

Rollback

Revert this PR to restore the previous MSB adapter-owned podman auto-install path and native OpenCode npm fallback. Existing sandboxes are not migrated by rollback; recreate affected sandboxes if their provisioned state must match the restored adapter behavior.

Security Impact

Positive security impact with user-visible migration cost:

• MSB no longer grants OCI-related devices by default for every sandbox.
• OCI support becomes an explicit opt-in kit selection.
• OpenCode installation is pinned through the immutable patterns release SHA instead of resolving latest npm package state.
• Provider facts are parsed as data and fail closed when malformed.
• The live verifier no longer hides pipe/descriptor stalls or checkout exec-bit drift.

No secrets are introduced. Secret values are not placed on argv, in docs, or in test fixtures.

Review Focus

• Breaking-change migration text for OCI and OpenCode.
• MSB legacy sandbox behavior when adapter-installed podman existed before this change.
• Agent-kit inference and failure mode when the pinned opencode kit is unavailable or malformed.
• Provider-facts handling and SBX/MSB secret binding with provider-defined key env names.
• Live verifier changes, especially scripts/verify-backends capture behavior and exec-bit self-healing.

[basiliskus]

Support for option 3. The login.gov data team kit already lives in this model: since patterns#395 we consume the generic devenv image and install team tools through kit startup steps, so an agent-less base plus an agent kit is the next step rather than a change of course. Some points from that experience, mostly aimed at the open questions.

Agent install: pin by content, derive the image from the kit. The cost of installing the agent at create is once per sandbox (acq already skips on command -v and a marker), seconds to a minute through the proxy, and noise next to the image pull, the Nix store seed, and a first devenv build. The real risk is losing the pin: today acq's create-time fallback is npm install -g opencode-ai, which resolves to latest, and the only thing pinning OpenCode for us is that the image happens to bake it. On a devenv base the natural install is nix profile install github:NixOS/nixpkgs/<rev>#<agent>: pinned by nixpkgs rev, content-hashed, prebuilt from the Nix cache, identical on both arches, and the same line for every agent nixpkgs carries (the team kit installs fd/glab/jq this way already). Agents outside nixpkgs use the goose-server pattern, a sha256-pinned release binary. I would write that into the ADR as the agent-kit install contract, and make the published agent-populated image an artifact built by applying the kit, so image and kit cannot drift.

Activation: acq should not run it. direnv allow is a per-user trust decision on a content hash, and a first devenv build for identity-devops is a multi-core, tens-of-minutes job with 20G of scratch that we deliberately run under the user's eyes. devenv up is process-compose for services, not shell activation. The contract that has worked: the base image ships nix, devenv, direnv and the shell hook; the workspace owns .envrc; the human approves once; acq's job ends at giving exec and run a login shell in the primary repo.

Create-time vs run-time needs a stated rule, and resources belongs in it. Create-time is anything the backend must know before boot (egress, volumes, ports); run-time is files, env, and startup steps. Missing from the vocabulary today: CPU and memory. acq sizes msb guests at 2 vCPU / 4G from an environment variable only, and a kit cannot say "my builds need 4 / 8G". This bit us this week (terraform from source, OOM territory at 4G, 4x slower than the sbx template). A neutral resources: field, max-merged across kits, is the same two-halves pattern as volumes:.

Supervision: two models are now in flight. This ADR asks whether devenv's process supervision replaces ad hoc loops; #472 runs services outside the sandbox as gateways; goose-server runs an in-guest supervisor via background: true. Worth deciding one story for in-guest services and one for out-of-guest before the vocabulary grows three ways to run a daemon.

usai-provider: split facts from rendering. The provider facts (endpoint, key env var, model catalog) are one thing; the config format is each agent's. One agent-aware kit that emits every agent's format is the coupling this ADR removes from acq, relocated into a kit. Have usai-provider export the facts and each agent kit render them. Related: acq should never merge agent config files; the team kit relies on OpenCode's own project-layer deep-merge for its permission gate, and that semantic belongs to the agent.

Bring-your-own image contract must say where the Nix store lives. The team kit's /nix volume seed assumes a store baked at /nix and shadows it at boot. A contract that only says "has nix, devenv, direnv" breaks that silently.

Egress merge: union only, and visible. "Later wins" is right for env and files and wrong for network. A personal kit widening egress without a trace is the concrete AC-6 case the ADR gestures at.

Team impact if adopted is small: ACQ_IMAGE points at the agent-less image, OpenCode arrives from the built-in agent kit at create, one TROUBLESHOOTING entry changes. Volumes, tools, skills, and injection steps are untouched.

[mogul]

Great feedback, thank you.

Supervision: two models are now in flight. This ADR asks whether devenv's process supervision replaces ad hoc loops; #472 runs services outside the sandbox as gateways; goose-server runs an in-guest supervisor via background: true. Worth deciding one story for in-guest services and one for out-of-guest before the vocabulary grows three ways to run a daemon.

I've pretty much already settled on leveraging podman-compose for the host side since it's cross-platform between Mac/Linux/Windows, already incorporates dependencies, health-checks, restart policies, etc. (I briefly considered also using devenv for the host side, but then realized that while it works in Mac and Linux, it does not work in Windows.)

[mogul]

Pushed commits to this branch. They renumber the ADR to 0030 (0028 and 0029 are claimed by other in-flight work), add a Devenv Baseline and Upstream Impact section recording that the patterns devenv image currently ships devenv 1.11.2 on nixos-25.05 while devenv 2.x first appears in nixos-26.05 / nixpkgs-unstable, and fold in the review feedback: a content-pinned agent-install contract; human-owned activation with an explicit ACQ_ opt-in for non-interactive use; a create-time versus run-time rule; the native devenv process manager as the general in-guest supervisor with podman-compose on the host side; usai-provider exporting facts and each agent kit rendering them; a /nix-anchored bring-your-own-image contract; union-only, visible egress; a personal kit plus a neutral ~/.rc.d hook with documented use-cases; built-in-bundle-only agent kit inference; an optional OCI engine kit; privileged capabilities declared and off by default under passwordless sudo; and SecretSpec confined to in-sandbox usage — leaving three follow-ups open (merge semantics beyond egress, the minimum image contract, and migration sequencing).

A scoped follow-up for updating the devenv image itself based on research into 2.x is tracked at GSA-TTS/agentic-coding-patterns#418.

[mogul]

Update pushed: 59d10f0 (feat(kits): wire neutral rc snippets).

What changed:

• Fast-forwarded this branch through a59a4a4 and preserved/reconciled the neutral rc-snippet docs from docs(kits): document neutral rc snippets #511.
• Added a shared acq_login_profile_rc_block used by both backend adapters.
• Wired msb to consume the shared rc.d bridge in its login-profile setup.
• Added sbx create-time bridge installation through post-create sbx exec, with an exec-readiness wait and without using a startup-bearing kit.
• Added focused Bats coverage for msb/sbx rc.d behavior, including an executable check that the generated block sources snippets in byte order.
• Updated docs to describe the implemented bash ~/.profile bridge and shell-specific constraints accurately.

Verification:

• PASS: ./scripts/test-acq-bats test/bats/72-msb-agent-user.bats test/bats/90-sbx-startup-kit.bats (61/61)
• PASS: printf '%s\n' acq.backends/common.sh acq.backends/msb.sh acq.backends/sbx.sh | xargs -r -n8 shellcheck --severity=warning
• PASS: git diff --check
• PASS: npm run lint:md (0 issues)
• PASS: adversarial AI code review completed; actionable findings addressed before push

Also updated the PR summary with a fully qualified Closes: line for the implementation-increment issues expected to close when this PR merges.

[mogul]

Reviewer orientation

AI-assisted (OpenCode). Independently re-verified at head 668e920 against main @ 33c83c5 before flipping out of draft; the transcript below is my own run, not the authoring session's.

Deliberately dormant — not oversights

Two things a reviewer will reasonably flag as incomplete are intentional, because the producing artifacts are not in the pinned patterns release:

• ACQ_MSB_OPENCODE_PKG="opencode-ai" and the unpinned npm install -g are still live in acq.backends/msb.sh. The opencode agent kit (feat(acq-kits): add opencode agent-harness kit (SHA-pinned release binary) agentic-coding-patterns#455) is unmerged and absent from v1.10.0, so acq_agent_builtin_kit_enabled returns false for every agent. That is the current path, untouched on purpose.
• provider-facts/usai.env has a consumer but no producer. acq_provider_facts_load_from_kit reads it; the artifact is absent from v1.10.0 and from feat(usai-provider): normalize and vendor USAi model catalog agentic-coding-patterns#436's branch, so the loader always returns rc=2 and falls through to acq_provider_facts_use_fallback.

Closes: was trimmed accordingly — #481 and #485 are not closed by this PR, with unblock triggers recorded in the description.

OCI is live but opt-in, default-off

v1.10.0 contains the oci-engine kit, so ACQ_ENABLE_OCI_KIT=1 now genuinely selects it and _oci_kit_selected suppresses the msb adapter's _acq_msb_ensure_oci. Measured gate matrix at the new pin:

ACQ_ENABLE_OCI_KIT=__unset -> selected=no  kitcount=4
ACQ_ENABLE_OCI_KIT=0       -> selected=no  kitcount=4
ACQ_ENABLE_OCI_KIT=false   -> selected=no  kitcount=4
ACQ_ENABLE_OCI_KIT=no      -> selected=no  kitcount=4
ACQ_ENABLE_OCI_KIT=off     -> selected=no  kitcount=4
ACQ_ENABLE_OCI_KIT=1       -> selected=yes kitcount=5

Unset means byte-identical behavior to today.

ADR-0030's open questions are tracked, not unresolved

• Migration sequencing is answered, not open. Moved out of Open Questions into the decision body, citing docs/BACKEND_GUIDE.md §"ADR-0030 migration sequencing: agent-kit/devenv model" (Increments 0→4, each with explicit verification commands) and test/bats/140-opencode-migration-gate.bats, which implements and passes the Increment 0 freeze.
• Merge semantics beyond egress — still open, now tracked by Track ADR-0030 stacked-kit merge semantics beyond egress #533. Trigger: feat(isolation): add the scope-layers pattern and a team-kit template agentic-coding-patterns#441 / feat(isolation): add personal-kit template for the scope-layers pattern agentic-coding-patterns#442 (scope-layer kit templates) are the first real stacked-kit consumers that force a volume/startup-step conflict rule.
• Minimum BYO image contract — still open, tracked by feat(images): define and verify the devenv BYO image contract #484. This PR ships only the non-enforcing acq doctor NAME diagnostic.

Review focus

1. acq_provenance_write in acq.backends/common.sh — the one place a silent defect could hide. This branch and main both added a workspace parameter by different mechanisms (positional $4 here; a workspace_source=host marker on main), and common.sh does not textually conflict — so a naive merge yields two workspace derivations and two printf 'workspace=%s' lines, writing a duplicate key. Resolution kept main's marker-gated path and dropped the positional fallback. test/bats/125-github-scope.bats → "gh-record: provenance refresh preserves only host-marked workspace" is the canary; it passes.
2. sbx startup barrier × the rc.d bridge. _acq_sbx_wait_for_startup_barrier (from fix(sbx): wait for startup barrier before attach #512) and _acq_sbx_ensure_rc_bridge both run after a successful sbx create; the bridge is installed via post-create sbx exec, deliberately not a startup-bearing kit, to avoid the sbx ≥ 0.38 live-extend refusal.
3. OCI kit boundary — whether the adapter auto-install suppression can misfire for a user who never sets ACQ_ENABLE_OCI_KIT.
4. 668e920 (fix(sbx): honor provider key env in usai checks) replaces hardcoded USAI_API_KEY with $USAI_PROVIDER_KEY_ENV through the sbx rotate/secret paths — worth a look given rotation's interrupted-state recovery messaging.

Verification (my independent re-run at 668e920)

PASS  git merge-tree origin/main <head>                 -> no conflicts (MERGEABLE)
PASS  ACQ_BATS_JOBS=4 ./scripts/test-acq-bats           -> 1..632, 632 ok, 0 failures
PASS  ./scripts/test-acq-bats test/bats/125-github-scope.bats -> 14/14 (merge-trap canary)
PASS  ./scripts/test-acq-bats test/bats/66-oci-engine-kit.bats -> 14/14
PASS  bash -n acq acq.backends/*.sh scripts/* test/bats/helper.bash
PASS  shellcheck --severity=warning (acq, adapters, lib, all bats, verify-backends)
PASS  git diff --check
PASS  git ls-remote ... refs/tags/v1.10.0 -> 2dd2ad6ad5f63b842d732424bed5ba9aebeed676
PASS  git grep '6c6753c' / 'v1.9.0' -> no stale pin references outside CHANGELOG
PASS  offline fail-soft: GIT_ALLOW_PROTOCOL=none acq ls -> exit 0
      (rm/ports/secret ls also clean; no provider-facts hard failure)
PASS  pinned-kit probes: oci_ready=yes  provider_facts_rc=2  source=fallback
                         acq_agent_builtin_kit_enabled opencode=false
PASS  npx markdownlint-cli2 (ADR in scope -- verified by probe: 51 files, catches an injected error)

Correction to an earlier claim in this thread: I had reported npm run lint:md as a vacuous signal for ADR changes (#525). That is stale — #527 already unified file selection to globs: ["**/*.md"], so docs/adr/ is linted. I confirmed by injecting a deliberate MD018 violation into docs/adr/: the file count goes 50→51 and the error is caught. 0 issues in 0 files means zero offending files, not zero scanned. #525 is open but appears already fixed in substance.

Merge-order note for maintainers

This PR conflicts with most other open PRs in acq.backends/{msb,sbx}.sh by co-location, not dependency — it consumes no symbol introduced by any of them. Whoever merges second rebases; there is no required ordering. ADR numbering is now collision-free: 0030 (#474), 0031 (#500), 0032 (#510), 0033 (#519), 0034 (#526), 0035 (#504), 0036 (#507). 0037 is next free.

Per AGENTS.md §8.2, this AI-assisted change requires human review before it is relied on; nothing here is self-approved.

[basiliskus]

Reviewed at 486cdf4ef91ae7cfcff176a2b223d879a54b9b56.

Thanks for the orientation comment — it made this reviewable, and it held up: I checked all five of your numbered claims and four verify cleanly. Two findings, both in the same family: a gate that fails open rather than closed. Neither is live at the current pin, which is why I'd take them as follow-ups rather than a block, but the second one activates on the next pin bump and that is exactly when you want it loud.

1. Minor, confirmed by reproduction: the OCI opt-in normalizes whitespace-padded off values to on.
   acq.backends/common.sh:91-93

   The parser lowercases but does not trim, and treats everything outside the exact off-list as enabled:

   case "$(printf '%s' "$ACQ_ENABLE_OCI_KIT" | tr '[:upper:]' '[:lower:]')" in
     ""|0|false|no|off) ACQ_ENABLE_OCI_KIT="" ;;
     *)                 ACQ_ENABLE_OCI_KIT="1" ;;
   esac

   Traced past the flag to actual kit selection, counting oci-engine refs out of _acq_selected_support_kit_refs:

   unset     -> disabled, 0 refs
   0         -> disabled, 0 refs
   0␣        -> ENABLED,  1 ref
   ␣false␣   -> ENABLED,  1 ref
   true      -> ENABLED,  1 ref
   1         -> ENABLED,  1 ref
   

   Concrete failure: a .env line or a quoted export with a stray trailing space — ACQ_ENABLE_OCI_KIT="0 " — silently selects a create-time capability kit and suppresses the adapter's own podman provisioning at acq.backends/msb.sh:3285. The user believes they opted out.

   I rate this minor rather than major because the trigger is narrow and the fix is one tr -d '[:space:]' in the pipeline. But the direction is the wrong one for an opt-in: your gate-matrix comment covers the exact values and they are all correct, so this is specifically the untested whitespace case.

   Worth saying the behaviour is deliberate, not accidental — test/bats/66-oci-engine-kit.bats:235 explicitly asserts "any other value" enables, with 1 true yes on YES enabled anything, and :224 covers "" 0 false no off FALSE No OFF. So the design choice is permissive-on, and the gap is that permissive-on plus no trimming means a typo enables. If permissive-on is intentional, trimming is the minimal fix; if you would rather be strict, an explicit on-list would also close it.

2. Major, confirmed by trace: an invalid provider-facts artifact is indistinguishable from an absent one, and its diagnostic is suppressed.
   acq.backends/common.sh:338-341

   The loader is careful to separate the two cases — common.sh:320-322 returns 2 for absent and 1 for invalid, with echo "acq: invalid provider facts artifact: $facts" >&2. The wrapper that every dispatch path actually calls throws both away, and redirects the diagnostic to /dev/null:

   acq_provider_facts_load_from_kit_or_fallback() {
     if acq_provider_facts_load_from_kit "$@" 2>/dev/null; then
       :
     else
       acq_provider_facts_use_fallback
       acq_debug "provider facts unavailable from kit; using transitional fallback defaults"
     fi

   Seven dispatch call sites use the wrapper: acq:1004, :1016, :1075, :1410, :1432, :1471, :1549. acq_debug is off by default, so on a malformed artifact the user sees nothing at all and gets fallback USAi defaults.

   You are right that this is dormant today — I confirmed the artifact 404s at the pin, so rc=2 is the only reachable path and the fallback is correct behaviour. The problem is the bump that adds the artifact: a malformed or version-skewed usai.env would then create sandboxes on fallback endpoint/key assumptions while reporting success, which is the half-wired provider migration this PR is explicitly trying to sequence safely. test/bats/50-kit-list-completeness.bats:139 proves the loader rejects invalid data; nothing proves the dispatch path surfaces it.

   Cheapest fix is to let rc=1 through: fall back on 2, fail closed (or at minimum print the diagnostic) on 1.

Your five claims, verified:

1. Both paths dormant — verified. integrations/isolation/acq-kits/opencode/spec.yaml and .../usai-provider/provider-facts/usai.env both 404 at the v1.10.0 tag, oci-engine/spec.yaml is present, and acq.backends/agents.sh:100 returns false for opencode. The unpinned npm install -g is genuinely unreachable at this pin.
2. OCI opt-in, default-off — partially. Exact values behave as you reported, including unset. Whitespace does not; see finding 1.
3. acq_provenance_write merge trap — verified resolved. This was the right thing to point a reviewer at. There are two printf 'workspace=%s' lines in common.sh, at :1801 and :1853, which looks like the duplicate-key symptom until you check the function boundaries: :1801 is inside acq_provenance_write (:1764) and :1853 inside acq_workspace_record_write (:1828) — two different records, one key each. Both are workspace_source=host marker-gated, with no positional $4 fallback surviving. The canary gh-record: provenance refresh preserves only host-marked workspace (test/bats/125-github-scope.bats:151) passes.
4. sbx barrier × rc.d bridge — no finding.
5. 668e920 provider key env — no finding; the USAI_PROVIDER_KEY_ENV substitution is consistent through the sbx rotate and secret paths, including the interrupted-state recovery guidance.

Below the bar:

• acq doctor NAME is genuinely non-enforcing, as claimed — acq_print_image_contract_doctor is reachable only from the doctor) dispatch arm (acq:915), and acq_image_contract_doctor_script is executed only inside that path on each adapter (msb.sh:5786, sbx.sh:1930). Nothing in create or provision calls it, so it cannot fail a create.
• ADR-0030 is uncontested: no 003x file exists on main, and your numbering map (0031 feat(acq): interactive acq configure UI for extra kits + token-scoping defaults #500, 0032 fix(msb): block unsafe 0.7 migration versions #510, 0033 fix(msb): thread the merged kit env onto kit lifecycle commands #519, 0034 feat(acq): choose the host port per sandbox, and let --publish pin it #526, 0035 docs(adr): add ADR-0035 host-authoritative sandbox configuration #504, 0036 feat(acq): add msb native snapshot restore #507) matches what I see across the open PRs.
• Your correction about npm run lint:md and ADRs is right, and I can confirm it independently: since fix(ci): pin markdownlint-cli2 once, clear GHSA-253c, unify file selection #527 unified globs, docs/adr/ is in scope.

Validation. Ran: full suite ./scripts/test-acq-bats → 633 ok / 0 not ok / 5 skips (you reported 632; the extra is the main merge). Skips are 2 pwsh not available, 3 sbx not on PATH — grammar acceptance UNVERIFIED, 1 msb authorize. Also: the OCI gate matrix above through real kit selection, not just the flag; the provenance duplicate-key check with function-boundary confirmation; the canary test in isolation; acq doctor reachability trace; v1.10.0 artifact presence via the GitHub API; bash -n over acq, the adapters and scripts; the repo ShellCheck batch per AGENTS.md (clean — shellcheck is present in my environment, so that is a real pass); npm run lint:md → 0 issues; gh pr checks 474 all passing.

Not run, and worth naming explicitly given the size of this change. I did not run the new and modified tests against the merge-base ffac0fa, so I cannot tell you whether the 14 new assertions across 140-opencode-migration-gate.bats, 65-doctor-image-contract.bats, 66-oci-engine-kit.bats and the 11 touched files would fail without this change. For a 3200-line change across three adapters that is the check I would most want, and this repo has a specific history here — 71a19cd exists because 116-clone-option.bats's negative assertions could not fail. 66-oci-engine-kit.bats:224/:235 are exactly that shape: both would pass if the gate were deleted entirely and the variable simply never set. I am not asserting they are vacuous; I am saying I have not established that they are not.

Also not run: ./scripts/verify-backends needs a sandbox-capable host, so real create/attach on either backend is unverified by me — and this PR changes provisioning on both. The devenv base image, the rc.d bridge landing in a live guest, and the agent-kit install path are untested by anything I did.

Verdict: comment, not request-changes. Nothing here is live-broken at the current pin, your dormancy analysis is accurate, and the merge trap you flagged is genuinely resolved. I would want finding 2 fixed before the pin bump that lands provider-facts/usai.env — it is a few lines and it is the difference between a loud and a silent failure during the migration this ADR sequences. Finding 1 whenever convenient.

Before merging I would want a human to run ./scripts/verify-backends on a sandbox-capable host and do one real acq create plus attach on each backend, since this changes how both provision and nothing I ran touches a live sandbox.

Assisted-by: OpenCode [gpt_5_5_default_v2] change-review

[basiliskus]

Closing the base-comparison gap I flagged in my previous comment, since an open question like that reads as doubt and it should not sit there unresolved.

I copied the three new test files plus scripts/test-acq-lib.sh onto merge-base ffac0fa in a scratch worktree and ran them:

140-opencode-migration-gate.bats    16 tests, 10 fail at base
65-doctor-image-contract.bats        9 tests,  9 fail at base
66-oci-engine-kit.bats              14 tests, 11 fail at base
TOTAL                               39 tests, 30 fail at base

That includes both 66-oci-engine-kit.bats assertions I singled out as the shape that could pass vacuously. They fail at base for exactly the right reason — ffac0fa has no normalizer at all (grep -c ACQ_ENABLE_OCI_KIT acq.backends/common.sh is 0), so the raw value passes through untouched:

test 13 "off-ish values as off"      expected "EMPTY", actual "0"
test 14 "any other value as on"      expected "1",     actual "true"

So those tests assert the normalization itself, not merely the absence of a value. My concern was wrong and I withdraw it.

On the 9 that do pass at base: they are mostly assert_failure cases such as oci-kit: readiness FALSE for a wrong-name spec, and they pass because acq_oci_engine_kit_ready does not exist at base — bats run on a missing function returns non-zero, which satisfies the assertion. That is the unavoidable form of vacuous pass; you cannot write a negative test against a function that does not exist yet. Each is paired with a positive counterpart (tests 9 and 10, readiness TRUE ...) that does fail at base, so the file discriminates as a whole. No action needed.

The other two gaps from that comment stand unchanged: ./scripts/verify-backends still needs a sandbox-capable host, so real create/attach on either backend is unverified by me, and the two findings are unchanged — finding 2 (silent fallback on an invalid provider-facts artifact) is the one worth closing before the pin bump that lands provider-facts/usai.env.

Verdict unchanged: comment, not request-changes.

Assisted-by: OpenCode [gpt_5_5_default_v2] change-review

[mogul]

Release-note / release-please warning for merge:

Please preserve the breaking-change and migration details in the squash commit body. release-please reads the Conventional Commit on main; it will not reliably carry the PR description into the changelog.

Suggested squash commit message:

feat(kits)!: adopt pinned agent and capability kits

Moves agent/tool installation from adapter-owned fallback paths to pinned
patterns kits. 
- Pin updated to agentic-coding-patterns to v1.12.0
(56d1f5f49ef928f50e61aa64a93d618b3d21c415)
- Uses the opencode agent kit for OpenCode
- Makes OCI support an explicit opt-in via the oci-engine kit.

BREAKING CHANGE: acq no longer installs podman/OCI tooling by default. Users
who need docker, docker compose, or rootless podman when the base image doesn't 
provide it must opt into the oci-engine kit with `acq configure`, `--kit`, or
`ACQ_EXTRA_KITS`.

BREAKING CHANGE: acq no longer performs native OpenCode npm fallback
installation. OpenCode is supplied by the pinned opencode agent kit from
agentic-coding-patterns v1.12.0, currently delivering OpenCode v2.0.22. If the 
kit is unavailable or invalid, acq fails closed instead of installing opencode-ai 
from npm.

BREAKING CHANGE: Existing acq sandboxes with adapter-installed podman are not
migrated in place. Recreate affected sandboxes or add the oci-engine kit
before relying on OCI behavior after stop/start.

[mogul]

I reverified on the host just in case... All tests pass. Merging!