feat(cloud-agent): publish immutable runtime releases after trusted CI

[eshurakov]

Cloud Agent runtime releases now have a separate publisher after successful main-push CI. Admission verifies repository and CI metadata before credentials, then checks out the exact tested SHA. Publication requires the explicit enablement variable and approved infrastructure provisioning.

The existing release command packages content-addressed payloads, verifies stored bytes and publishes the descriptor last. It caches the runtime-free base by recipe/platform inputs, verifies its immutable registry digest, runs the real CLI probe and wrapper handshake, then retains an exact-SHA handoff in R2. Runtime-only and Worker-only changes reuse the base.

Downloaded deployment preparation verifies the exact source checkout, handoff, base inputs, target bucket/account/image and both payloads before Wrangler or its custom build runs. Preinstalled deployments do not read publication storage. The publisher and deployment use separate concurrency groups; unrelated deployment matrix jobs do not cancel on one target failure.

Validation: 25 focused runtime tests, 19 admission/workflow tests, seven existing change-filter tests, five existing deployment-workflow tests, typecheck, service lint and full repository formatting passed. Publication matrix tests observe command/cache effects using local CLI emulators. A locally built runtime-free image passed the actual packaged Kilo version probe and wrapper hello/shutdown; a real CLI version mismatch was rejected.

Review fixes preserve real image build variables, validate configuration before waiting, reject missing buckets, and bound compatibility cleanup. A workflow-command regression also preserves deployment of older tested commits.

No remote R2 publication, registry push, credential provisioning or deployment ran. This PR preserves the preinstalled/all-in-one target configuration. This task did not enable the publisher. Infrastructure setup and the explicit enablement gate are in services/cloud-agent-next/docs/runtime-publication.md.

Stack: #7915 → #7917 → #7919 → this PR. Base: eshurakov/ca-runtime-downloaded-startup.

The final mixed-image regression failed before the PR4 fix. The guard now rejects the invalid configuration before publication waits. Nineteen focused CI-tooling tests, type checks, changed-file lint and formatting passed after that correction.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental change tightens the all-in-one image guard so a configured image is rejected alongside a mismatched dockerfile, and adds a regression test asserting rejection before base verification; the change is consistent with every real SandboxContainers.images.app block in wrangler.jsonc and introduces no new issues.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Previous Findings Re-verified

• All-in-one guard ignoring a configured image - fixed in 1b1ecad36a: the guard at prepare-runtime-deploy.ts:78-82 now throws when configured.image !== undefined in addition to the dockerfile check, making the all-in-one branch symmetric with the runtime-free branch. Both real SandboxContainers.images.app blocks (wrangler.jsonc:287-292 and 637-642) declare only dockerfile + build_vars, so the tightened guard does not reject the shipped configuration. The new test rejects mixed all-in-one image fields before base verification covers the mixed case and asserts verifyBase is not reached.
• runtime-targets.json operand in deploy-workers.yml:88 - not a defect: the author explains the operand is intentional forward compatibility for child feat(cloud-agent): render runtime rollout targets and enforce the image gate #7921 (which adds runtime-targets.json as the target catalog) and that older tested checkouts legitimately predate the preparer. The workflow fixture covers catalog-present/preparer-missing and propagates the failure, so the finding is dropped.

Files Reviewed (2 files)

• services/cloud-agent-next/scripts/prepare-runtime-deploy.ts - previous SUGGESTION fixed in changed lines
• services/cloud-agent-next/scripts/runtime-handoff.test.ts - new regression test, no issues

Not verified: no commands or tests were executed (read-only review); findings are based on static reading of the incremental diff f83ae66bdc..1b1ecad36a and the current files.

Previous Review Summaries (2 snapshots, latest commit f83ae66)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit f83ae66)

Status: 2 Issues Found | Recommendation: Merge with minor follow-ups

Executive Summary

Both prior WARNINGs are resolved - the image schema now accepts the real build_vars, and the compatibility probe starts listening inside the cleanup scope with a SIGKILL-bounded, promise-settling Docker client - leaving two low-severity guard gaps: the all-in-one image check still ignores a configured image, and the new deploy guard's runtime-targets.json operand can never match.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	2

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/cloud-agent-next/scripts/prepare-runtime-deploy.ts	78	The all-in-one branch checks only configured.dockerfile, so a target that also sets image passes the "image configuration changed" guard and is carried into the generated config unchecked.
.github/workflows/deploy-workers.yml	88	runtime-targets.json exists nowhere in the repository, so the guard reduces to "does the prep script exist?" and the documented catalog safeguard cannot fire.

Previous Findings Re-verified

• .strict() image schema rejecting build_vars - fixed: the schema now declares build_vars, and prepare-runtime-deploy.ts:152 validates the real all-in-one config before the publication wait.
• HTTP server / WebSocketServer leak on early throw - fixed: listen and descriptor rendering now run inside the try, and the finally still closes connections, sockets and the server.
• Watchdog never settling its promise - fixed: runCompatibilityProcess sends SIGKILL, unrefs, and resolves null; the final docker rm -f also uses a SIGKILL-bounded timeout.
• Wait loop running before config validation - fixed: startup mode, image configuration and the bucket binding are validated in main() (lines 150-160) before the handoff wait loop, and a missing bucket now throws NoSuchBucket immediately.

Files Reviewed (12 files)

• .github/workflows/ci.yml
• .github/workflows/deploy-workers.yml - 1 issue
• services/cloud-agent-next/docs/control-plane.md
• services/cloud-agent-next/docs/runtime-publication.md
• services/cloud-agent-next/scripts/prepare-runtime-deploy.ts - 1 issue
• services/cloud-agent-next/scripts/runtime-compatibility.ts
• services/cloud-agent-next/scripts/runtime-compatibility.test.ts
• services/cloud-agent-next/scripts/runtime-handoff.test.ts
• services/cloud-agent-next/scripts/runtime-publish-store.ts
• services/cloud-agent-next/scripts/runtime-publish-store.test.ts
• services/cloud-agent-next/scripts/runtime-workflow.test.mjs

Also read for context (PR-wide, unchanged since the previous review): cloud-agent-runtime-publish.yml, runtime-ci-admission.mjs, runtime-base.ts, runtime-handoff.ts, runtime-publication.ts, publish-runtime.ts, Dockerfile.containers.runtime-free, wrangler.jsonc, package.json.

Not verified: no commands or tests were executed (read-only review); findings are based on static reading of the diff and current files. The incremental range 501eff28..HEAD is not a linear delta (that commit is not an ancestor of HEAD after the rebase), so the current gh pr diff was used as the authoritative scope.

Fix these issues in Kilo Cloud

Previous review (commit 501eff2)

Status: 4 Issues Found | Recommendation: Address before merge

Executive Summary

The downloaded-runtime deploy path is unusable with the repository's real container config because a .strict() image schema rejects build_vars, and the compatibility probe has resource/hang gaps on its early-throw and watchdog paths.

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/scripts/prepare-runtime-deploy.ts	96	.strict() image schema rejects build_vars, which both SandboxContainers.images.app blocks in wrangler.jsonc (lines 290, 640) carry, so any RUNTIME_STARTUP_MODE=downloaded target fails to parse before the dockerfile checks run.
services/cloud-agent-next/scripts/runtime-compatibility.ts	87	HTTP server and WebSocketServer are created before the try; cleanup exists only in finally, so a throw from renderRuntimeBootstrap or the bind guard leaks a listening server and can hang the publisher.

SUGGESTION

File	Line	Issue
services/cloud-agent-next/scripts/runtime-compatibility.ts	123	The 200 s watchdog runs docker rm -f and SIGTERM but never resolves its promise, so a docker client that does not emit close blocks the probe indefinitely.
services/cloud-agent-next/scripts/prepare-runtime-deploy.ts	146	The handoff wait loop runs before any config validation and treats every 404 (including a wrong bucket) and an invalid RUNTIME_STARTUP_MODE as "publication pending", stalling 45 minutes before a misleading error.

Files Reviewed (21 files)

• .github/workflows/ci.yml
• .github/workflows/cloud-agent-runtime-publish.yml (new)
• .github/workflows/deploy-workers.yml
• services/cloud-agent-next/.gitignore
• services/cloud-agent-next/Dockerfile.containers.runtime-free (new)
• services/cloud-agent-next/docs/control-plane.md
• services/cloud-agent-next/docs/runtime-publication.md (new)
• services/cloud-agent-next/package.json
• services/cloud-agent-next/scripts/prepare-runtime-deploy.ts (new) - 2 issues
• services/cloud-agent-next/scripts/publish-runtime.ts
• services/cloud-agent-next/scripts/runtime-base.ts (new)
• services/cloud-agent-next/scripts/runtime-base.test.ts (new)
• services/cloud-agent-next/scripts/runtime-ci-admission.mjs (new)
• services/cloud-agent-next/scripts/runtime-ci-admission.test.mjs (new)
• services/cloud-agent-next/scripts/runtime-compatibility.ts (new) - 2 issues
• services/cloud-agent-next/scripts/runtime-handoff.ts (new)
• services/cloud-agent-next/scripts/runtime-handoff.test.ts (new)
• services/cloud-agent-next/scripts/runtime-publication.ts (new)
• services/cloud-agent-next/scripts/runtime-source.ts (new)
• services/cloud-agent-next/scripts/runtime-source.test.ts (new)
• services/cloud-agent-next/scripts/runtime-workflow.test.mjs (new)

Not verified: no commands or tests were executed (read-only review); findings are based on static reading of the diff and current files.

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 46.1K · Output: 6.6K · Cached: 359K}

_{Review guidance: REVIEW.md from base branch eshurakov/ca-runtime-downloaded-startup}