chore(pm-agent): take the dispatcher out of dry run (operator-approved), config-generation 4 #98

2026-10-31T16:49:15Z

gitea-admin commented

2026-10-31 16:49:15 +00:00

Turns pm-agent out of dry run. The operator approved this after reading the dispatcher's dry-run triage of #97.

Changes

platform/pm-agent/configmap.yaml: PM_DRY_RUN: "false". PM_REQUIRE_LABEL: agent, the worker caps (2 active, 1 new per cycle) and the worker digest are unchanged. The comments that said dry run was the only mode that worked are rewritten, because the run-383 digest pinned in #96 bakes imagePullSecrets: pm-agent-registry.
platform/pm-agent/deployment.yaml: config-generation 3 -> 4. Without this bump the process keeps its startup config.
README and plan follow-up 3: the dry-run status text is updated. The runbook needed no change.
decisions/2026-10-31-pm-agent-go-live.md.

Pre-flight checks (read-only, k3s-prod, Flux at main@1126740)

pm-agent-job-shape: Ready=True, Enforce
SA pm-agent/pm-agent-worker, Role and RoleBinding pm-agent are present. can-i create jobs returns yes and can-i delete jobs returns no.
pm-agent-registry (.dockerconfigjson) and pm-agent-credentials (claude-code-oauth-token, gitea-token) exist. Only key names were checked.
default-deny, pm-agent-allow-egress and pm-agent-worker-allow-egress exist, and both CNPs report Valid=True.

Approval policy: no path matches sensitive_paths, so this PR merges on the gate alone.

Local toolbox gate: rc 3 (UNDETERMINED). Only gitea-settings did not run (no token outside CI). All other stages are green, including spec-immutability.

Not verified: that a real worker Job is admitted, pulls its image, reaches Gitea and the model, and opens a PR. Only the first labelled start decision after merge will show that.

🤖 Generated with Claude Code

Turns pm-agent out of dry run. The operator approved this after reading the dispatcher's dry-run triage of #97. **Changes** - `platform/pm-agent/configmap.yaml`: `PM_DRY_RUN: "false"`. `PM_REQUIRE_LABEL: agent`, the worker caps (2 active, 1 new per cycle) and the worker digest are unchanged. The comments that said dry run was the only mode that worked are rewritten, because the run-383 digest pinned in #96 bakes `imagePullSecrets: pm-agent-registry`. - `platform/pm-agent/deployment.yaml`: `config-generation` 3 -> 4. Without this bump the process keeps its startup config. - README and plan follow-up 3: the dry-run status text is updated. The runbook needed no change. - `decisions/2026-10-31-pm-agent-go-live.md`. **Pre-flight checks (read-only, k3s-prod, Flux at main@1126740)** - `pm-agent-job-shape`: Ready=True, Enforce - SA `pm-agent`/`pm-agent-worker`, Role and RoleBinding `pm-agent` are present. `can-i create jobs` returns yes and `can-i delete jobs` returns no. - `pm-agent-registry` (`.dockerconfigjson`) and `pm-agent-credentials` (`claude-code-oauth-token`, `gitea-token`) exist. Only key names were checked. - `default-deny`, `pm-agent-allow-egress` and `pm-agent-worker-allow-egress` exist, and both CNPs report Valid=True. **Approval policy:** no path matches `sensitive_paths`, so this PR merges on the gate alone. **Local toolbox gate:** rc 3 (UNDETERMINED). Only `gitea-settings` did not run (no token outside CI). All other stages are green, including spec-immutability. **Not verified:** that a real worker Job is admitted, pulls its image, reaches Gitea and the model, and opens a PR. Only the first labelled `start` decision after merge will show that. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-10-31 16:49:15 +00:00

chore(pm-agent): turn PM_DRY_RUN off (operator-approved), bump config-generation to 4

gate / gate (pull_request) Successful in 2m58s

Details

gate / conformance (pull_request) Has been skipped

Details

0d3e51acc4

The run-383 worker image (df36d9b, pinned in #96) bakes imagePullSecrets: pm-agent-registry,
which admission requires, and the dispatcher's dry-run triage of #97 was read and approved.
PM_REQUIRE_LABEL=agent and the worker caps are unchanged. The dry-run status text in the
configmap comments, the README and the plan's follow-up 3 is updated to match.

Pre-flight (read-only, k3s-prod): pm-agent-job-shape Ready+Enforce; SA/Role/RoleBinding
present and can-i create jobs = yes; pm-agent-registry and pm-agent-credentials exist; both
egress CNPs Valid.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jakman85 approved these changes

2026-10-31 16:49:56 +00:00

jakman85 scheduled this pull request to auto merge when all checks succeed 2026-10-31 16:50:03 +00:00

jakman85 merged commit 95e08da2f0 into main

2026-10-31 16:52:17 +00:00

jakman85 referenced this issue from a commit

2026-10-31 16:52:18 +00:00

Merge pull request 'chore(pm-agent): take the dispatcher out of dry run (operator-approved), config-generation 4' (#98) from chore/pm-agent-go-live into main

gitea-admin referenced this pull request

2026-10-31 17:07:39 +00:00

fix(pm-agent): log the CLI's stdout envelope when triage fails; add PM_DECISION_MAX_TURNS #99

Sign in to join this conversation.