main · last commit
13 days ago ·
7g0stsfu
ah-1qq Release infra: version stamping via ldflags + first tagged release
Rolling
bd close ah-1qq
bd update ah-1qq --status=open
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-07-20T00:10:40Z |
| Started | 2026-08-04T23:48:55Z |
| Updated | 2026-08-05T00:28:47Z |
The daemon hardcodes version = dev (cmd/agenthubd/main.go:44) and nothing stamps it: the repo has zero git tags and neither the justfile nor .build.yml passes -ldflags -X main.version. Live agent-1 therefore logs version=dev on every boot and there is no way to tell which build is deployed. Add ldflags stamping (git describe) to the justfile and the CI deploy lane, surface the version in the status API, and cut the first tag. Release-blocking for v0.1.0. Filed 2026-07-20.
STAMPING DONE in 1c96c00; deploy-lane hardening added in a4fac87 after an independent review of the series. Only the TAG itself remains, deliberately blocked on the rest of milestone v0.1.0 (a milestone is frozen at its tag). Landed: the justfile derives 'git describe --tags --always --dirty' and passes -X main.version to go build ./cmd/... — ONE flag stamps all three mains, because -X's 'main' resolves per link. --always degrades to a short sha before the first tag exists, --dirty marks a build from an uncommitted tree, '|| echo dev' covers a tree with no git. 'just show-version' prints what the tree would stamp. ahub-run gained a version var and a --version flag (answered before the required-flag check) since it is the binary running INSIDE the pane. GET /api/v1/status carries the build string via httpapi.Deps.Version, defaulting to 'dev' when empty so a test server never reports blank. Cover: TestStatusVersion, both arms. Verified end to end: just build produced binaries reporting f11ef03-dirty. CI hardening (a4fac87), both from review findings: - The version check was a PRINT, not an assertion. 'git describe --always' degrades to a short sha before the first tag, so 'dev' can only mean git itself failed (dubious ownership, no .git) — an unstamped binary would have deployed while the build looked green. Now 'test "$VERSION" != dev' fails the build and the smoke check greps for the expected string. - CONFIG PRE-FLIGHT added to the deploy task. This series tightened validation four times (ah-1cx.3, ah-1cx.6, ah-1jy, ah-w4r) and /etc/agent-hub/agenthub.yaml is hand-maintained, NOT CI-managed; agenthubd turns a load error into exit 1, so a restart into a rejected config is a crash loop with the previous binary already overwritten by the tar. The deploy now runs the NEW binary's 'ahub validate-config' against the LIVE file while the OLD daemon still serves. REMAINING: cut v0.1.0 once ah-1cx.8 and ah-ydx close, then confirm on agent-1 that the deployed binary reports the tag rather than a sha.
No outgoing dependencies.
Nothing depends on this issue.
| id | ah-1qq |
| content_hash | fc68d9a4ec58cc99b6f5568e9d07512e8df1edd1c60b9b1eeb5c8bfd074d38aa |
| title | Release infra: version stamping via ldflags + first tagged release |
| description | The daemon hardcodes version = dev (cmd/agenthubd/main.go:44) and nothing stamps it: the repo has zero git tags and neither the justfile nor .build.yml passes -ldflags -X main.version. Live agent-1 therefore logs version=dev on every boot and there is no way to tell which build is deployed. Add ldflags stamping (git describe) to the justfile and the CI deploy lane, surface the version in the status API, and cut the first tag. Release-blocking for v0.1.0. Filed 2026-07-20. |
| design | |
| acceptance_criteria | |
| notes | STAMPING DONE in 1c96c00; deploy-lane hardening added in a4fac87 after an independent review of the series. Only the TAG itself remains, deliberately blocked on the rest of milestone v0.1.0 (a milestone is frozen at its tag). Landed: the justfile derives 'git describe --tags --always --dirty' and passes -X main.version to go build ./cmd/... — ONE flag stamps all three mains, because -X's 'main' resolves per link. --always degrades to a short sha before the first tag exists, --dirty marks a build from an uncommitted tree, '|| echo dev' covers a tree with no git. 'just show-version' prints what the tree would stamp. ahub-run gained a version var and a --version flag (answered before the required-flag check) since it is the binary running INSIDE the pane. GET /api/v1/status carries the build string via httpapi.Deps.Version, defaulting to 'dev' when empty so a test server never reports blank. Cover: TestStatusVersion, both arms. Verified end to end: just build produced binaries reporting f11ef03-dirty. CI hardening (a4fac87), both from review findings: - The version check was a PRINT, not an assertion. 'git describe --always' degrades to a short sha before the first tag, so 'dev' can only mean git itself failed (dubious ownership, no .git) — an unstamped binary would have deployed while the build looked green. Now 'test "$VERSION" != dev' fails the build and the smoke check greps for the expected string. - CONFIG PRE-FLIGHT added to the deploy task. This series tightened validation four times (ah-1cx.3, ah-1cx.6, ah-1jy, ah-w4r) and /etc/agent-hub/agenthub.yaml is hand-maintained, NOT CI-managed; agenthubd turns a load error into exit 1, so a restart into a rejected config is a crash loop with the previous binary already overwritten by the tar. The deploy now runs the NEW binary's 'ahub validate-config' against the LIVE file while the OLD daemon still serves. REMAINING: cut v0.1.0 once ah-1cx.8 and ah-ydx close, then confirm on agent-1 that the deployed binary reports the tag rather than a sha. |
| status | in_progress |
| priority | 2 |
| issue_type | task |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-07-20T00:10:40Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-05T00:28:47Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | 2026-08-04T23:48:55Z |
| is_blocked | 0 |
| issue_id | ah-1qq |
| label | milestone:v0.1.0 |
| id | 019f7cdc-4def-728c-89a7-505d6c87b0dd |
| issue_id | ah-1qq |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-07-20T03:10:40Z |
| id | 019f7cdc-faf0-7071-b129-302598e2fcdb |
| issue_id | ah-1qq |
| event_type | label_added |
| actor | Eugene Blikh |
| old_value | NULL |
| new_value | NULL |
| comment | Added label: milestone:v0.1.0 |
| created_at | 2026-07-20T03:11:24Z |
| id | 019fcf2e-2259-7a48-b50e-9281afb2489e |
| issue_id | ah-1qq |
| event_type | status_changed |
| actor | Eugene Blikh |
| old_value | {"id":"ah-1qq","title":"Release infra: version stamping via ldflags + first tagged release","description":"The daemon hardcodes version = dev (cmd/agenthubd/main.go:44) and nothing stamps it: the repo has zero git tags and neither the justfile nor .build.yml passes -ldflags -X main.version. Live agent-1 therefore logs version=dev on every boot and there is no way to tell which build is deployed. Add ldflags stamping (git describe) to the justfile and the CI deploy lane, surface the version in the status API, and cut the first tag. Release-blocking for v0.1.0. Filed 2026-07-20.","status":"open","priority":2,"issue_type":"task","owner":"bigbes@gmail.com","created_at":"2026-07-20T00:10:40Z","created_by":"Eugene Blikh","updated_at":"2026-07-20T00:10:40Z","labels":["milestone:v0.1.0"]} |
| new_value | {"notes":"STAMPING DONE in 1c96c00; only the tag itself remains, and it is deliberately blocked on the rest of milestone v0.1.0 (a milestone is frozen at its tag, so nothing may be added after).\n\nWhat landed: the justfile derives 'git describe --tags --always --dirty' into a version variable and passes -X main.version to go build ./cmd/... — ONE flag stamps all three mains, because -X's 'main' resolves per link. --always degrades to a short sha before the first tag exists, --dirty marks a build made from an uncommitted tree so a hand-built binary can never be mistaken for a release, and a '|| echo dev' arm covers a tree with no git at all. 'just show-version' prints what the tree would stamp. .build.yml does the same and then runs 'ahub version' as a build-time assertion that the stamp actually landed — so a broken stamp fails CI instead of silently deploying a 'dev' binary.\n\nahub-run gained a version var and a --version flag (answered before the required-flag check, since it is a question about the binary not a request to supervise anything): it is the binary that runs INSIDE the pane, so that is how a human attached to a keep-pane shell identifies the build that supervised the run in front of them.\n\nGET /api/v1/status now carries the build string via httpapi.Deps.Version, which defaults to 'dev' when empty so a test server or unstamped build never reports blank — a blank version reads as a serialization bug rather than as 'nobody stamped this'. The boot log line is invisible once the journal has rotated, and status is the one surface an operator can reach without shell access to the box. Cover: TestStatusVersion, both arms.\n\nVerified end to end locally: just build produced binaries reporting f11ef03-dirty.\n\nREMAINING: cut v0.1.0 once the milestone's other beads close, then confirm on agent-1 that the deployed binary reports the tag rather than a sha.","status":"in_progress"} |
| comment | NULL |
| created_at | 2026-08-05T02:48:55Z |
| id | 019fcf52-a329-705d-8f02-18479994e488 |
| issue_id | ah-1qq |
| event_type | updated |
| actor | Eugene Blikh |
| old_value | {"id":"ah-1qq","title":"Release infra: version stamping via ldflags + first tagged release","description":"The daemon hardcodes version = dev (cmd/agenthubd/main.go:44) and nothing stamps it: the repo has zero git tags and neither the justfile nor .build.yml passes -ldflags -X main.version. Live agent-1 therefore logs version=dev on every boot and there is no way to tell which build is deployed. Add ldflags stamping (git describe) to the justfile and the CI deploy lane, surface the version in the status API, and cut the first tag. Release-blocking for v0.1.0. Filed 2026-07-20.","notes":"STAMPING DONE in 1c96c00; only the tag itself remains, and it is deliberately blocked on the rest of milestone v0.1.0 (a milestone is frozen at its tag, so nothing may be added after).\n\nWhat landed: the justfile derives 'git describe --tags --always --dirty' into a version variable and passes -X main.version to go build ./cmd/... — ONE flag stamps all three mains, because -X's 'main' resolves per link. --always degrades to a short sha before the first tag exists, --dirty marks a build made from an uncommitted tree so a hand-built binary can never be mistaken for a release, and a '|| echo dev' arm covers a tree with no git at all. 'just show-version' prints what the tree would stamp. .build.yml does the same and then runs 'ahub version' as a build-time assertion that the stamp actually landed — so a broken stamp fails CI instead of silently deploying a 'dev' binary.\n\nahub-run gained a version var and a --version flag (answered before the required-flag check, since it is a question about the binary not a request to supervise anything): it is the binary that runs INSIDE the pane, so that is how a human attached to a keep-pane shell identifies the build that supervised the run in front of them.\n\nGET /api/v1/status now carries the build string via httpapi.Deps.Version, which defaults to 'dev' when empty so a test server or unstamped build never reports blank — a blank version reads as a serialization bug rather than as 'nobody stamped this'. The boot log line is invisible once the journal has rotated, and status is the one surface an operator can reach without shell access to the box. Cover: TestStatusVersion, both arms.\n\nVerified end to end locally: just build produced binaries reporting f11ef03-dirty.\n\nREMAINING: cut v0.1.0 once the milestone's other beads close, then confirm on agent-1 that the deployed binary reports the tag rather than a sha.","status":"in_progress","priority":2,"issue_type":"task","owner":"bigbes@gmail.com","created_at":"2026-07-20T00:10:40Z","created_by":"Eugene Blikh","updated_at":"2026-08-04T23:48:55Z","started_at":"2026-08-04T23:48:55Z","labels":["milestone:v0.1.0"]} |
| new_value | {"notes":"STAMPING DONE in 1c96c00; deploy-lane hardening added in a4fac87 after an independent review of the series. Only the TAG itself remains, deliberately blocked on the rest of milestone v0.1.0 (a milestone is frozen at its tag).\n\nLanded: the justfile derives 'git describe --tags --always --dirty' and passes -X main.version to go build ./cmd/... — ONE flag stamps all three mains, because -X's 'main' resolves per link. --always degrades to a short sha before the first tag exists, --dirty marks a build from an uncommitted tree, '|| echo dev' covers a tree with no git. 'just show-version' prints what the tree would stamp. ahub-run gained a version var and a --version flag (answered before the required-flag check) since it is the binary running INSIDE the pane. GET /api/v1/status carries the build string via httpapi.Deps.Version, defaulting to 'dev' when empty so a test server never reports blank. Cover: TestStatusVersion, both arms. Verified end to end: just build produced binaries reporting f11ef03-dirty.\n\nCI hardening (a4fac87), both from review findings:\n- The version check was a PRINT, not an assertion. 'git describe --always' degrades to a short sha before the first tag, so 'dev' can only mean git itself failed (dubious ownership, no .git) — an unstamped binary would have deployed while the build looked green. Now 'test \"$VERSION\" != dev' fails the build and the smoke check greps for the expected string.\n- CONFIG PRE-FLIGHT added to the deploy task. This series tightened validation four times (ah-1cx.3, ah-1cx.6, ah-1jy, ah-w4r) and /etc/agent-hub/agenthub.yaml is hand-maintained, NOT CI-managed; agenthubd turns a load error into exit 1, so a restart into a rejected config is a crash loop with the previous binary already overwritten by the tar. The deploy now runs the NEW binary's 'ahub validate-config' against the LIVE file while the OLD daemon still serves.\n\nREMAINING: cut v0.1.0 once ah-1cx.8 and ah-ydx close, then confirm on agent-1 that the deployed binary reports the tag rather than a sha."} |
| comment | NULL |
| created_at | 2026-08-05T03:28:47Z |
No comments.