Weekly notes: week ending 2026-10-25

2026-10-25T00:00:00+00:00

Releases

containers-image-proxy-rs: v0.11.2 (#159) adds ImageProxy::open_varlink_socket (#158). With newer skopeo, it hands out a varlink socket for an opened image, so layers already on disk can be passed as file descriptors instead of being copied through the proxy.

Highlights

Per-role GitHub Apps. Agents are moving from one shared identity toward one GitHub App per role. agent-board has the design (agent-board#170) and an apps create command that registers a role's app through the manifest flow (agent-board#171). The actions repository can now mint and re-mint per-role tokens (actions#84). Comments from the status app are now admitted by app id rather than by login text (agent-board#172).

Spend in dollars. The credential broker meters list-price spend per operator over a trailing week in /usage (praxis-credential-broker#38, #39). agentic-job reports each run's cost in dollars (agentic-job#1888). The scheduler's pass now holds new runs at a weekly dollar budget (agent-board#317), which tracker turns on (tracker#909).

Riding out outages. An agentic-job run now keeps its change through a provider outage, waits out overload and falls back (agentic-job#1887). After a broker restart, the scheduler's pass can now start one run on a pool that lost its usage reading, so the reading comes back instead of the pool staying held until someone starts a run by hand. The probe is opt-in through the caller's pass config, and it only fires when the broker reports no requests for that pool and no run for it is in flight (agent-board#316).

Tighter workflow checks. The shared actions now run actionlint and zizmor by digest (actions#99) and pin agentic-job's reusable workflows by commit (actions#117). The workflows check refuses changes that would hide workflows from the linters or alter the job that calls it (actions#119, actions#120). The review treats dependency manifest and lockfile changes as supply chain (actions#93).

bootc. sysusers rejects empty mandatory entry types (bootc#2574). Chunking keeps its prior packing when names repeat (bootc#2579). A new DISABLE_DOCS build option skips the man pages (bootc#2582).

Lowlights

Idle scheduler. Early on 23 October, every scheduler pass found all eight slots free, and nothing started. Capacity was not the problem. Every ready item was waiting on a design answer, an operator decision or another pull request. For example, two [rescue] draft pull requests were holding back implement runs (tracker#885). Every status update in the material, from 20 October on, marked the board at risk until the last one on the 25th.

Gaps in the status updates. No update was posted from early on 23 October until the evening of the 24th. The supervisor workflow that wrote them was disabled at 18:10 on the 23rd, and as of the 24th the question of re-enabling it was waiting on the operator. The supervisor's daily pass is now required to post an update every time it runs (agent-board#321).

Merge queue hiccup. A transient GitHub API error in agentic-job's scratch-cleanup step knocked a pull request out of the merge queue (agentic-job#1441). The step now retries transient API failures and checks the cleanup afterward, failing when the scratch pull request or its branch remains or when it cannot tell (agentic-job#1442).

The weekly notes start here