Pins the pm-agent dispatcher and worker to the agent-runner image that CI built from PR #99's merge commit (466f63e). That build includes the CLI failure envelope in triage errors and the PM_DECISION_MAX_TURNS knob.
platform/pm-agent/deployment.yaml: dispatcher image: changes from sha256:df36d9b7… to sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2. config-generation goes from "4" to "5".
platform/pm-agent/configmap.yaml: PM_WORKER_IMAGE gets the same digest, plus one provenance comment.
No other values change. PM_DRY_RUN stays "false". No *.sops.yaml files are touched.
Provenance. This digest is the publish from images run 394 (task 643, push, success) on 466f63ec3c3d. I read it with a registry manifest HEAD (OCI and Docker Accept headers). agent-runner:sha-466f63ec3c3d and agent-runner:main both return docker-content-digest: sha256:14a42ba8…1bb2.
Toolbox gate, run from the worktree with all three workarounds: rc 3, UNDETERMINED. The only stage that did not run is gitea-settings, because there is no SETTINGS_API_TOKEN locally. spec-immutability passed. L0 had 25 cases and L1 had 3, with 0 failures and 0 skips. This is not a green result.
Approval policy:platform/pm-agent/*.yaml should not be a sensitive path. CI's approval-policy stage is the authority on that.
Pins the pm-agent dispatcher and worker to the `agent-runner` image that CI built from PR #99's merge commit (`466f63e`). That build includes the CLI failure envelope in triage errors and the `PM_DECISION_MAX_TURNS` knob.
- `platform/pm-agent/deployment.yaml`: dispatcher `image:` changes from `sha256:df36d9b7…` to `sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2`. `config-generation` goes from "4" to "5".
- `platform/pm-agent/configmap.yaml`: `PM_WORKER_IMAGE` gets the same digest, plus one provenance comment.
- No other values change. `PM_DRY_RUN` stays "false". No `*.sops.yaml` files are touched.
**Provenance.** This digest is the publish from `images` run 394 (task 643, push, success) on `466f63ec3c3d`. I read it with a registry manifest HEAD (OCI and Docker Accept headers). `agent-runner:sha-466f63ec3c3d` and `agent-runner:main` both return `docker-content-digest: sha256:14a42ba8…1bb2`.
**Toolbox gate, run from the worktree with all three workarounds:** rc **3**, UNDETERMINED. The only stage that did not run is `gitea-settings`, because there is no `SETTINGS_API_TOKEN` locally. `spec-immutability` passed. L0 had 25 cases and L1 had 3, with 0 failures and 0 skips. This is not a green result.
**Approval policy:** `platform/pm-agent/*.yaml` should not be a sensitive path. CI's approval-policy stage is the authority on that.
Handoff: `decisions/2026-10-31-pm-agent-digest-99.md`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Dispatcher image and PM_WORKER_IMAGE both move to
sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2, the digest the
registry returns for agent-runner:sha-466f63ec3c3d and :main. config-generation 4 -> 5.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Pins the pm-agent dispatcher and worker to the
agent-runnerimage that CI built from PR #99's merge commit (466f63e). That build includes the CLI failure envelope in triage errors and thePM_DECISION_MAX_TURNSknob.platform/pm-agent/deployment.yaml: dispatcherimage:changes fromsha256:df36d9b7…tosha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2.config-generationgoes from "4" to "5".platform/pm-agent/configmap.yaml:PM_WORKER_IMAGEgets the same digest, plus one provenance comment.PM_DRY_RUNstays "false". No*.sops.yamlfiles are touched.Provenance. This digest is the publish from
imagesrun 394 (task 643, push, success) on466f63ec3c3d. I read it with a registry manifest HEAD (OCI and Docker Accept headers).agent-runner:sha-466f63ec3c3dandagent-runner:mainboth returndocker-content-digest: sha256:14a42ba8…1bb2.Toolbox gate, run from the worktree with all three workarounds: rc 3, UNDETERMINED. The only stage that did not run is
gitea-settings, because there is noSETTINGS_API_TOKENlocally.spec-immutabilitypassed. L0 had 25 cases and L1 had 3, with 0 failures and 0 skips. This is not a green result.Approval policy:
platform/pm-agent/*.yamlshould not be a sensitive path. CI's approval-policy stage is the authority on that.Handoff:
decisions/2026-10-31-pm-agent-digest-99.md.🤖 Generated with Claude Code
466f63e, PR #99), bump config-generation