feat(cloud-agent): build and install immutable runtime releases

[eshurakov]

Summary

Add immutable paired CLI/control releases and an in-container bootstrap. Payloads use content hashes and Zstd archives. The publisher rebuilds wrapper output before packaging, writes payloads create-only, verifies stored bytes, and publishes the complete descriptor last.

The bootstrap verifies cached archives, extracts fresh generations, changes the active link atomically, updates only the platform alias allowlist, removes the artifact grant, probes the selected absolute CLI path, and execs the stable supervisor. A failure sends one authenticated report and exits. The setup lock remains held through supervisor exec; cleanup preserves active files.

PR 2 of the runtime stack. Parent: #7915. No Worker startup caller, selection, route, binding or deployment change is introduced here.

Verification

Local Docker process tests ran against an image built from Dockerfile.containers. They observed fixture runtime A-to-B replacement, user file/configuration/dependency preservation, archive and symlink rejection, fresh extraction, interrupted install recovery, concurrent exclusion, active-process protection, bounded caches, post-handoff grant cleanup, and specific failure reports.

The real publisher also built fresh wrapper output and verified Kilo 7.8.1 before writing a complete release to a local directory. A second fresh wrapper build reused the identical payload and descriptor bytes.

Visual Changes

N/A

Reviewer Notes

Automated checks: 18 process scenarios passed with no skips; 494 focused unit tests and eight packaging/schema tests passed; Worker/wrapper typecheck includes the process harness; strict changed-file lint, formatting and diff checks passed.

Final local artifact identities:

• CLI: e52b6bd88d0300caeeb25a8806389a85f638a589d59214b75fc7cf62c6ddefb3 (61,547,988 bytes).
• Control: 7636556032fdfcf3d6c150d18f9186440916eda036c19713fcf0613eadac0908 (347,374 bytes).
• Descriptor: e4c11f45fec3e734348ff2057b67cf448c7a32cfbc7f121c2bc5cb3fbccbbeef (57,866 bytes).

These tests prove local installer and packaging behavior. PR 3 owns full local Worker/wrapper E2E. Real Cloudflare restore semantics, restricted egress, minimum-instance timing, provider metadata retention and production R2 publication remain unverified and require the authorized qualification steps.

The existing Node/Bun/host-tool contract is retained. The signing helper is a development dependency from the existing catalog. No production dependency was added.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Carried Forward (author-accepted scope), No New Issues | Recommendation: Merge

Executive Summary

Incremental review of the fixes in 9fecc5300b found the three prior code findings correctly resolved, no regressions, and no new issues; the remaining artifact-grant argv exposure is the one item the author explicitly accepted as Revision 5 scope.

Overview

Severity	Count
CRITICAL	0
WARNING	1 (carried forward, accepted)
SUGGESTION	0

Issue Details (click to expand)

WARNING (carried forward — author replied it is accepted scope, so no action is requested here)

File	Line	Issue
services/cloud-agent-next/src/sandbox-control/runtime-bootstrap.ts	369	The launch config carrying the artifact grant is still inlined into PID 1's /bin/sh -c script, readable from /proc/1/cmdline during setup. The author replied that Revision 5 explicitly accepts this and the test was renamed to scope its assertion to post-handoff cleanup. Kept in the summary only as a record of residual risk.

Verified fixes in this increment

• services/cloud-agent-next/src/sandbox-control/runtime-bootstrap.ts: active is now linked to the complete release before any alias is rewritten, so aliases cannot dangle on a first install; the new container test forces a first-install alias failure and confirms installed aliases resolve to a complete release.
• services/cloud-agent-next/src/sandbox-control/runtime-archive.ts: paxPath now parses record lengths and offsets in bytes over the raw buffer with strict length, terminator, and safety checks; the regression test places non-ASCII metadata before the path record.
• services/cloud-agent-next/scripts/publish-runtime.ts: writeTarEntries rejects names over 100 UTF-8 bytes and writeOctal rejects unsafe, negative, or overflowing values instead of truncating; all three overflow regressions are covered.

Files Reviewed (5 files)

• services/cloud-agent-next/scripts/publish-runtime.test.ts
• services/cloud-agent-next/scripts/publish-runtime.ts
• services/cloud-agent-next/src/sandbox-control/runtime-archive.ts
• services/cloud-agent-next/src/sandbox-control/runtime-bootstrap.ts
• services/cloud-agent-next/test/runtime-installer/runtime-installer.test.ts

Fix these issues in Kilo Cloud

Previous Review Summary (commit b4f4917)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit b4f4917)

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/src/sandbox-control/runtime-bootstrap.ts	368	Launch config (including the artifact grant) is inlined into the /bin/sh -c script, exposing it in PID 1's argv (/proc/1/cmdline) for the whole setup window, contradicting the installer test's grant-containment assertion.
services/cloud-agent-next/src/sandbox-control/runtime-bootstrap.ts	275	Aliases are created before active is switched; on a first install the image's real /usr/local/bin and /opt/kilo-cloud/kilo-git-credential entry points become dangling symlinks, and a failure in that window leaves no runnable runtime.

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/sandbox-control/runtime-archive.ts	60	paxPath advances by PAX byte length while indexing a UTF-16 string, so non-ASCII pax records desynchronize and a valid archive is rejected or given a wrong path.
services/cloud-agent-next/scripts/publish-runtime.ts	133	writeTarEntries silently truncates names over 100 bytes with no ustar prefix/pax fallback and no error; writeOctal similarly drops low-order digits on overflow.

Files Reviewed (16 files)

• pnpm-lock.yaml
• services/cloud-agent-next/package.json
• services/cloud-agent-next/scripts/publish-runtime.test.ts
• services/cloud-agent-next/scripts/publish-runtime.ts - 1 issue
• services/cloud-agent-next/scripts/runtime-cli-artifact.ts
• services/cloud-agent-next/scripts/runtime-publish-store.ts
• services/cloud-agent-next/src/sandbox-control/runtime-archive.ts - 1 issue
• services/cloud-agent-next/src/sandbox-control/runtime-artifact-keys.ts
• services/cloud-agent-next/src/sandbox-control/runtime-bootstrap.ts - 2 issues
• services/cloud-agent-next/src/sandbox-control/runtime-release.test.ts
• services/cloud-agent-next/src/sandbox-control/runtime-release.ts
• services/cloud-agent-next/src/sandbox-control/startup-failure.ts
• services/cloud-agent-next/src/shared/runtime-distribution.ts
• services/cloud-agent-next/test/runtime-installer/fixtures.ts
• services/cloud-agent-next/test/runtime-installer/runtime-installer.test.ts
• services/cloud-agent-next/tsconfig.json

No CRITICAL issues found. Verified in the changed code: tar checksum/magic/field widths, sha256/sha512 integrity and redirect: 'error', object-store HEAD/PUT If-None-Match semantics, retry loop, byte caps, store-root escape and key validation, reader/body cancellation (no memory leaks), the descriptor↔bootstrap inventory/count/size agreement, and the STARTUP_FAILURES exit-code mapping. The Docker/process installer suite is intentionally not wired into pnpm test/CI (it is Docker-gated like the fake-LLM harness).

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 54.4K · Output: 15.4K · Cached: 532K}

_{Review guidance: REVIEW.md from base branch eshurakov/sleek-magnolia}