Skip to content
agentic-job
This text was generated by an LLM (how cgwalters uses LLMs). cgwalters has not reviewed it yet.

What is left

The sandbox, ACP harness, output checks and reusable workflow exist. Real-agent runs and calls from another repository have happened, as reported in the README. They are not evidence that every runner image or caller configuration works.

Deployment and cutover

The operator's caller in bootc-dev/cgwalters-devspace-sandbox has run on RHEL 10 (what has run, part of #589). Its research and implement runs show sandbox setup and checks on 4 and 16 cores, inference registration, request accounting and ending the registration, and a comment applied in that repository. They do not show a pull request applied from a fork, including into the cgwalters-forge midstream forks; the chat session on RHEL; a 64-core run; or homegit's run readers. Finish validating those. Compare representative tasks with the old runner before switching the default dispatch path. Keep the old path available for rollback; remove it only after the replacement has enough successful runs.

The parity tests still use cgwalters-devspace-sandbox at df1e867. That is a test fixture pin, not a claim that the old deployment is unchanged.

Open work

With a merge queue, restore hosted admission coverage for the event caller, the review verdict and dispatch's review profile: PRs skip E2E and merge groups exercise only the event caller's policy refusal instead. Use a trusted, human-approved execution path without granting unreviewed PR code write or OIDC authority. This is follow-up to queue rollout (#464), not coverage demonstrated by local tests.

Sandbox gaps (#21) left open: other local DNS stubs' upstreams, UDP listeners and bus services that ask polkit nothing, and a test of a whole setup on an image's user. Run gaps (#20) include why a file made under umask 077 came out 0664 on ubuntu-26.04, host probes that run repeats only when asked (before-agent), proxies for anything but the identity-token request, stalled request counts, and a test of run with an agent that holds the token. Streaming files through redaction and the upload gate (#899) is done, except that one line is still held in memory whole.

Apply checks (#17) need review against the base, file-list and rename checks already implemented. Setup performance (#108) still tracks feed-pin maintenance; source-attested releases exist, and the host-wide walk is gone, replaced by the access-time world-write policy.

Setup in Rust (#882): our setup code should be the binary's, with no package fetches beyond an agent's. Ranked by expected time saved and fetches removed (estimates from one hosted job's 61 s packages stage, not yet measured per slice): install agents from pinned, checksummed tarballs instead of a distribution's npm; remove the Python egress proxy (python3-venv and PyPI at setup), now that the Rust one is the default, keeping every egress test (#919); a prebuilt image or cached layer (#144). secure-host's root steps run no Node any more, which saved little time, since hosted images ship Node: sandbox timed replaced setup-timing.mjs --run, agentic-job secure-host replaced platform.mjs, apt.mjs and root's bpftool loader world-write.mjs, and the shell script binary.sh replaced binary.mjs, which gets the binary, and github.mjs, which prepared gh and retried GitHub throttling for it; agentic-job secure-host inference replaced inference-preflight.py.

Done from the gh-aw gaps: the agent reads GitHub with a read-only token (#112), a label starts a run and is consumed (#117), and the offline audit and cost summary exist (#122), and one remote MCP server is served with a credential the agent never holds (mcp.md, the first part of #120). The remaining gh-aw gaps have separate issues: more output types and bounds (#113), threat detection (#114), private repositories (#115), egress allowlists (#116), workflow-integrated run guards and organization bounds (#118), memory (#119: memory hand-back and check exist; store and restore remain), MCP integrations beyond one remote server (stdio servers, more secrets, Playwright; #120), a conclusion job and maintenance (#121). Per-author or per-window limits on admitted runs need a fresh design under #118: the unwired cooldown/max-runs-per-user history protocol was removed with the pull request review (#466). Until then review starts automatic reviews only for the owner, members, collaborators and bots the repository lists by id, and the broker's shared cap bounds spending.

workflows check runs in the required ingress vet job from base-branch code with base exemptions (#508). Callers can opt in with the documented pinned job and a required-check ruleset.

Pushing to a pull request's branch (#406) is off in every shipped bounds file. Before one turns it on, a scripted fix case in CI's end-to-end dispatch should push to a throwaway pull request from the applying account's fork: today the handler's configuration with head-repo, its patch lookup for a nested branch and its push to the fork, to another fork or to an accepting repository's own branch are covered only by unit tests and by reading gh-aw's code. That needs the same bot PAT as the fork case below. Dispatch refuses a scripted fix today: a push needs an apply environment, and a scripted run is given none, so that case needs one first.

Pull requests from a fork (#340) have run live from one caller, with a classic PAT that has the repo and workflow scopes; without workflow, a push to a fork that is behind in a workflow file is untried (#426). CI does not run them: it needs an end-to-end job that opens one from a fork again, with a bot PAT held in an environment that a fork's pull request cannot reach. The recommended credential is a classic repo PAT of a dedicated account; a fine-grained PAT for "All repositories" of an account that owns only its forks would be narrower, once the permissions it needs to fork, push, turn off the fork's Actions and open the pull request are known.

Interactive sessions

A session run waits for one operator's prompts after its task's turn, over the tailnet (session runs); the chat pane and writes during a session are not built. interactive.md keeps the rest of the design.

What needs the operator

Deployment policy, environment tokens, proxy admission and Tailscale SSH access belong to the operator. Per-run App tokens are deferred (tracker#403); an applier off GitHub is separate work (tracker#427). A caller's own agent job (the pieces) can be admitted by the broker only by repository, not by its workflow file, which widens admission (inference admission); naming a caller's own workflow file needs broker support, with the narrowing tracked in tracker#452.