Skip to content

fix(kits): land collapsed kit stack implementation - #549

Merged
mogul merged 8 commits into
mainfrom
fix/land-collapsed-kit-stack
Oct 6, 2026
Merged

fix(kits): land collapsed kit stack implementation#549
mogul merged 8 commits into
mainfrom
fix/land-collapsed-kit-stack

Conversation

@mogul

@mogul mogul commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Summary

Corrective PR after #474 was squash-merged with release notes that describe the full collapsed stack, but the final branch contents only included the lower #474 layer.

This lands the implementation that the merged #474 commit message already announces as breaking:

  • add oci-engine to the opt-in kit catalog;
  • retire MSB adapter-owned OCI/podman auto-install and unconditional device grants;
  • pin PATTERNS_KIT_REF to agentic-coding-patterns v1.12.0 (56d1f5f49ef928f50e61aa64a93d618b3d21c415);
  • remove the native MSB OpenCode npm fallback so OpenCode is supplied by the pinned opencode agent kit.

Why This Is Separate

The merge commit for #474 already contains the correct release-please BREAKING CHANGE: footers and migration notes, but the code still had the old v1.10.0 patterns pin plus the old adapter-owned OCI/OpenCode paths. This PR makes shipped behavior match the already-merged release notes before the release PR is merged.

Verification

  • bash -n acq acq.backends/*.sh scripts/test-acq-lib.sh scripts/test-acq-bats scripts/fix-exec-bits test/bats/helper.bash scripts/verify-backends passed.
  • ./scripts/fix-exec-bits --check passed.
  • git diff --check passed.
  • npm run lint:md passed.
  • npm audit --prefix .github/linters --audit-level=high passed.
  • ShellCheck batch passed.
  • Focused Bats passed: TMPDIR="$PWD/tmp" ./scripts/test-acq-bats test/bats/36-agent-catalog.bats test/bats/50-kit-list-completeness.bats test/bats/72-msb-agent-user.bats test/bats/95-kit-ref-persistence.bats test/bats/135-configure.bats test/bats/140-opencode-migration-gate.bats (109 ok).

Rollback

Revert this PR to restore the implementation currently on main; note that doing so would again make the code disagree with the already-merged #474 breaking-change release notes.

Security Impact

Positive security impact consistent with #474's release notes: OCI device exposure is opt-in through the oci-engine kit, and OpenCode installation comes from the pinned patterns release instead of native npm fallback.

AI-assisted. Human review required.

mogul added 8 commits October 6, 2026 00:22
@mogul
feat(kits): add oci-engine to the opt-in catalog
70600f8 
Expose the functional oci-engine kit through the generic configure catalog and cover catalog-name expansion to the pinned patterns ref.

Co-authored-by: OpenCode [gpt-5.5] <bret.mogilefsky@gsa.gov>
@mogul
feat(msb)!: retire oci adapter auto-install
2ffeb87 
Remove the msb-owned podman installation, short-name-mode knob, and unconditional OCI device grants. OCI support now belongs to the opt-in oci-engine catalog kit instead of the adapter default.

BREAKING CHANGE: New msb sandboxes no longer install podman automatically. Users who need docker run or docker compose inside the sandbox must select oci-engine with acq configure, or pass the pinned oci-engine kit ref through ACQ_EXTRA_KITS or --kit.

Closes: #505

Co-authored-by: OpenCode [gpt-5.5] <bret.mogilefsky@gsa.gov>
@mogul
docs(kits): document oci-engine catalog migration
b8a44b8 
Update the live verifier to exercise oci-engine through the generic kit path and document the breaking migration away from msb adapter provisioning.

Co-authored-by: OpenCode [gpt-5.5] <bret.mogilefsky@gsa.gov>
@mogul
chore(kits): pin patterns v1.11.0
b7e4d81 
Move the built-in patterns bundle from v1.10.0
(2dd2ad6ad5f63b842d732424bed5ba9aebeed676) to v1.11.0
(f2227413df78dc5ef6580b5e29c59542dfe1f66a).

Included patterns commits:

- 36038a6 feat(acq-kits): add opencode agent-harness kit (SHA-pinned release
  binary) (GSA-TTS/agentic-coding-patterns#455)
- 73606d7 fix(usai-provider): make the catalog drift check report real drift
  (GSA-TTS/agentic-coding-patterns#459)
- 56500ba fix(usai-provider): drop embedding models from the chat-model catalog
  (GSA-TTS/agentic-coding-patterns#462)

The oci-engine kit this PR adds to the opt-in catalog is still present at the
new ref, so catalog selection is unchanged.

The opencode agent kit becomes fetchable at this pin for the first time, but it
stays dormant: acq_agent_builtin_kit_enabled returns false for every agent, so
_build_kit_list still yields four built-in kits and no agent kit is applied.
Enabling it is separate work tracked by
#485.

provider-facts/usai.env remains absent at v1.11.0, so the provider-facts loader
still returns 2 (artifact absent, tolerated) and the transitional fallback
defaults remain the only reachable path. #481
is unaffected.

Behavior change riding along with the bump: the usai-provider kit applies to
every sandbox, and its model catalog no longer advertises the
cohere_english_v3 embedding model (13 lines removed from
files/home/usai-config/opencode.jsonc), with 7 lines added to
scripts/sync-usai-models.mjs so the drift check reports real drift.

Co-authored-by: OpenCode [claude-opus-5] <bret.mogilefsky@gsa.gov>
@mogul
test(kits): align oci catalog checks with v1.11.0
3b0fd96 
Update documentation examples and bats assertions to match the patterns v1.11.0 pin.

Refs: #505

Co-authored-by: OpenCode [gpt-5.5] <bret.mogilefsky@gsa.gov>
@mogul
chore(kits): stage patterns release pin placeholder
ebae149
@mogul
chore(kits): pin patterns v1.12.0
41c36e3
@mogul
refactor(msb): remove native opencode fallback
97019cf
@mogul
mogul requested a review from a team as a code owner October 6, 2026 00:25
@mogul mogul mentioned this pull request Oct 6, 2026
Merged
@mogul

mogul commented Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

This appears to have been necessary because GitHub broke its reporting on the PR stack... It indicated (in the API and the UI) that the upper layers were merged into 474, but that apparently wasn't the case...!

@mogul
mogul merged commit bcd5b9c into main Oct 6, 2026
7 checks passed
@mogul
mogul deleted the fix/land-collapsed-kit-stack branch October 6, 2026 00:32
mogul added a commit that referenced this pull request Oct 6, 2026
@github-actions @mogul
chore(main): release 4.0.0 (#445)
af9814d 
🤖 I have created a release *beep* *boop*
---


##
[4.0.0](v3.1.0...v4.0.0)
(2026-10-06)


### ⚠ BREAKING CHANGES

* **kits:** acq no longer installs podman/OCI tooling by default. Users who need docker, docker compose, or rootless podman when the base image doesn't provide it must opt into the oci-engine kit with `acq configure`, `--kit`, or `ACQ_EXTRA_KITS`.
* **kits:** acq no longer performs native OpenCode npm fallback installation. OpenCode is supplied by the pinned opencode agent kit from agentic-coding-patterns v1.12.0, currently delivering OpenCode v2.0.22. If the kit is unavailable or invalid, acq fails closed instead of installing opencode-ai from npm.
* **kits:** existing acq sandboxes with adapter-installed podman are not migrated in place. Recreate affected sandboxes or add the oci-engine kit before relying on OCI behavior after stop/start.

### Features

* **acq:** choose the host port per sandbox, and let --publish pin it
([#526](#526))
([410f332](410f332))
* **acq:** export ACQ_WORKSPACE and ACQ_CLONE into the guest on both
backends
([#457](#457))
([e0b9a3b](e0b9a3b))
* **acq:** interactive `acq configure` UI for extra kits + token-scoping
defaults
([#500](#500))
([13d9d3a](13d9d3a))
* **kits:** adopt pinned agent and capability kits
([#474](#474))
([6a67063](6a67063))
* **secrets:** add Windows-native DPAPI secret backend
([#464](#464))
([907f404](907f404))
* **windows:** add acq preview install path
([#463](#463))
([d6d76f4](d6d76f4))


### Bug Fixes

* **acq:** use sandbox workspace for github scoping
([#476](#476))
([1610835](1610835))
* **ci:** bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS
advisory
([#454](#454))
([3217b49](3217b49))
* **ci:** bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory
([#459](#459))
([c2291bf](c2291bf))
* **ci:** centralize markdownlint coverage
([#548](#548))
([a27c31e](a27c31e))
* **ci:** pin markdownlint-cli2 once, clear GHSA-253c, unify file
selection
([#527](#527))
([e712685](e712685))
* **ci:** unblock unrelated PRs from the bash32 required-check deadlock
([#513](#513))
([187aa57](187aa57))
* **install:** keep curl | sh stdin intact and tap msb formula first
([#462](#462))
([c808d74](c808d74))
* **install:** trust the microsandbox-acq dependency before brew install
([#534](#534))
([ffac0fa](ffac0fa))
* **kits:** land collapsed kit stack implementation
([#549](#549))
([bcd5b9c](bcd5b9c))
* **msb:** allow Playwright browser downloads
([#477](#477))
([0c399c5](0c399c5))
* **msb:** block unsafe 0.7 migration versions
([#510](#510))
([3634046](3634046))
* **msb:** carry every origin URL, keep the scratch private, fail closed
on a copy miss
([#488](#488))
([babcd49](babcd49))
* **msb:** carry the source checkout's git identity into the --clone
scratch
([#443](#443))
([320d784](320d784))
* **msb:** follow the host resolvers and disable DNS rebind protection
in the guest
([#444](#444))
([d2f4bdc](d2f4bdc))
* **msb:** point the --clone scratch's origin at the source checkout's
remote
([#455](#455))
([7f48b94](7f48b94))
* **msb:** refresh ssh authorization for port publish
([#446](#446))
([72a6bd5](72a6bd5))
* **msb:** session parity for exec/attach/shell (cwd, terminal identity,
login shell)
([#427](#427))
([6261eda](6261eda))
* **msb:** skip the recursive home chown when the image baked the agent
user
([#432](#432))
([d8f66a4](d8f66a4))
* **msb:** thread the merged kit env onto kit lifecycle commands
([#519](#519))
([2248a92](2248a92))
* **msb:** translate kit wildcard network rules
([#451](#451))
([e22bbc3](e22bbc3))
* **msb:** verify post-hoc port forward listener
([#530](#530))
([8ca50e1](8ca50e1))
* **msb:** warn on broadened kit wildcard rules
([#460](#460))
([6ded3ce](6ded3ce))
* **msb:** warn when ssh-agent route is missing
([#448](#448))
([3a767a4](3a767a4))
* **sbx:** emit valid setup.install shape for the git-identity mixin
([#492](#492))
([8e6160c](8e6160c))
* **sbx:** raise the version floor to 0.39.0, where sbx create --env
first exists
([#491](#491))
([30f9ecf](30f9ecf))
* **sbx:** wait for startup barrier before attach
([#512](#512))
([33c83c5](33c83c5))
* **secret:** reject multiline test secret values
([#447](#447))
([f2da950](f2da950))
* **secrets:** propagate rotation across backends
([#509](#509))
([9641958](9641958))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Bret Mogilefsky <bret.mogilefsky@gsa.gov>
This was referenced Oct 6, 2026
Merged
Merged
Merged
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mogul