[mogul]

🤖: AI agent (First Mate), AI-assisted change (OpenCode). Human review required before merge.

Summary

Bump PATTERNS_KIT_REF in acq.backends/common.sh from the Patterns v1.17.0 commit a1206c52ec82ae7ce080ad44a6e6ac6f951e6d20 to the immutable v1.18.0 release commit 7dd2ddc034b6597e97f450fa716e7d47c9a38287 (tag v1.18.0 and main both resolve to it). Update the dependent test assertions and doc examples, add a test proving adoption of the additive neutral-catalog capability fields, and refresh ADR-0037 prose.

Issues

• Closes chore(kits): bump PATTERNS_KIT_REF to the first Patterns release with readonly root startup scripts #649
• Addresses Consumers adopt the additive neutral-catalog capability fields agentic-coding-patterns#539 (consumer adoption of the additive reasoning / inputModalities fields)

Before / After

• Before: pin a1206c52 (v1.17.0). The released schema rejects reasoning / inputModalities on a neutral catalog model (additionalProperties: false).
• After: pin 7dd2ddc0 (v1.18.0). The released schema accepts them; acq validates and projects such a catalog unchanged.

Files: acq.backends/common.sh; test/bats/95-kit-ref-persistence.bats, test/bats/135-configure.bats (ref assertions); docs/BACKEND_GUIDE.md, docs/KNOWN_FAILURE_MODES.md (example --kit refs); new test in test/bats/147-provider-input-projection.bats; docs/adr/0037-sbx-trusted-startup-parity.md. Quickstart carries no copy of the neutral catalog schema; it is read from the pinned release.

What changed between Patterns v1.17.0 and v1.18.0 (a1206c52..7dd2ddc0)

45 files, +3188/-116. Commits: #533 five-minute stream idle gaps (opencode); #535 paseo-kit startup readiness and CLI discovery; #536 paseo pinned CLI 0.13.0; #542 reasoning and input-modality metadata in the neutral catalog; #543 oci-engine root startup scripts from the read-only host mount; #544 zizmor action bump; #550 devenv 2.4.0 from a pinned nixos-unstable rev; #534 release 1.18.0.

Under integrations/isolation/acq-kits/** and integrations/providers/** (34 files):

• oci-engine: spec.yaml marks the grant script and storage helper readonly: true; the root startup command takes them as trailing whole argv tokens and fails closed. Install and grant scripts, README and scripts/verify updated. First shipped kit to use readonly.
• opencode: render-provider-config.mjs and tests, README, new docs/synthetic-image-validation.md.
• paseo: paseo-agent-shim, paseo-start.sh, paseo-timing.sh, paseo-set-worktrees-root.mjs, spec.yaml, scripts/verify, README, a diagnostics timing spec, and four new test files.
• usai-provider: normalize-catalog.mjs and its test.
• zscaler-ca-certificate and opendesign: README and spec comments.
• validate-kits.py: +47 lines.
• providers/usai: catalog.schema.json (reasoning / inputModalities now enum-constrained, unique, minItems: 1), build-catalog.mjs, README, new tests/capabilities.test.mjs.

Outside those paths: integrations/isolation/schemas/acq-neutral-model-catalog.schema.json (+ optional reasoning boolean and inputModalities enum array; absent means unknown); schemas/kit-hybrid-v1.schema.json (+ optional files[].readonly); integrations/isolation/images/devenv VERSION 2.0.0 to 2.1.0 (Dockerfile, README); new Patterns ADR 0006; test and CHANGELOG changes; a zizmor workflow bump.

scripts/validate_provider_input_contract.py is unchanged between the releases. Committed snapshots remain capability-free.

Verification

Adoption evidence (real validator, jsonschema 4.26.0, PyYAML 6.0.3, same fixture catalog with reasoning / inputModalities on a model):

• Old pin a1206c52: rejects (Additional properties are not allowed ('inputModalities', 'reasoning' were unexpected), rc=1).
• New pin 7dd2ddc0: accepts (validated 1 bundle(s), rc=0).

New test pinned Patterns validator accepts and projects neutral catalog capability fields (147): old pin FAILS, new pin PASSES. It runs the real validator through acq_provider_input_prepare and asserts the projected snapshot keeps both fields. It skips locally without ACQ_TEST_PATTERNS_REPO / ACQ_TEST_PROVIDER_INPUT_PYTHON, as the sibling real-validator tests do; required CI provides both and the existing exact-pin test (control-plane checkout is pinned to the exact Patterns release) passes against the new SHA.

Offline bats in a scratch copy, with the pinned checkout and validator Python provided:

• 01 20 80 85 100 101 102 103 112: 93 ok; one failure in 103 (kit fetch lifecycle, signal case timeout under parallel load) passed when rerun alone.
• 30 55 90 95 135 146 147 148 149 150: 316 of 316 ok.
• A first combined run covering the above files plus 36, 73, 78, 79, 81 and others: 160 of 410 reported before the log stalled; no failures were reported.
• 101 grammar tests skipped (no sbx on this host).
• bash -n acq.backends/common.sh passes. The shellcheck runner was not run (no shellcheck on this host); no shell logic changed.

Read-only adversarial review: no blockers. It replayed the oci-engine v1.18.0 kit through acq's kit_validate, kit_spec_files, kit_spec_commands and kit_translate_to_sbx: valid, readonly flagged on exactly the two files, startup tokens preserved.

Review follow-up (basiliskus, CHANGES_REQUESTED at df898ac): commit 499d68d adds the visible SBX warning required by the ADR-0037 transition gate (_acq_sbx_warn_readonly_files, called from _acq_sbx_translate_kit in acq.backends/sbx.sh). One stderr warning per kit translation names the kit and each readonly: true guest path and states they are guest copies with no integrity guarantee against a sudo guest; the kit still applies, and kits without readonly files stay silent. Translating the real Patterns v1.18.0 oci-engine spec now prints the warning naming both /home/agent/... paths. New test/bats/91-sbx-readonly-warning.bats (2 tests): with the pre-change sbx.sh the positive test FAILS (no warning), with the change both pass. Scratch-copy bats 01 30 79 83 84 90 91 95 100 101 146 147 148 149: 377 ok, 0 not ok (101 grammar tests skip without sbx; 79/83/84 msb readonly tests unchanged and passing). Read-only adversarial review: no blockers. Option B (read-only mount) is deliberately not implemented; ADR-0037 stays proposed.

CI: the bash 3.2 jobs take 15 to 25 minutes; see the PR checks.

Merge Guard

Draft. The First Mate marks it ready after human review. Do not merge before CI is green, including the pinned-validator and bash 3.2 jobs. Not merged by the author.

Rollback

Revert this commit. It restores PATTERNS_KIT_REF to a1206c52ec82ae7ce080ad44a6e6ac6f951e6d20 and the dependent assertions and docs together. Existing sandboxes are re-evaluated by the provenance check as stale or current from the pin change.

Security Impact

Supply chain: the pin is a full 40-char commit SHA, not a tag. The release content changes kit code that acq applies, notably oci-engine (root startup, now with readonly files). On msb those files run from the host read-only mount. On sbx the translator ignores readonly and the kit's startup command takes its legacy branch, running the root-owned copies published at create. ADR-0037 is updated to say the SBX gap is no longer latent for that one opt-in kit. No credentials, auth flows or network allowlists change in acq itself; no secrets in the diff.

Non-blocking follow-ups noticed (not filed by this PR): the devenv image moves to 2.1.0 while docs/BACKEND_GUIDE.md:575 and acq.backends/agents.sh:14 still cite devenv-shell:2.0.0; ADR-0037 Option D and the Decision Outcome still assume no shipped kit opts in to readonly.

[basiliskus]

Verdict: request changes — df898ac8836329811f967234321b883537e46904

Major — acq.backends/common.sh:41: This pin activates the first shipped kit with readonly: true root startup code, but SBX still silently copies those files into the guest and replays the /home/agent/... paths. Translating the exact v1.18.0 oci-engine spec produced no warning and retained both guest paths.

That violates the transition gate in docs/adr/0037-sbx-trusted-startup-parity.md:161-163, which requires the first opt-in kit to receive Option B or a visible warning. Please add the warning/refusal or implement the trusted mount before advancing the pin, with a regression test covering the SBX path.

Assisted-by: OpenCode [gpt-5.6-sol-latest-guardrails-defaultv2] skill:change-review

[mogul]

🤖: AI agent (First Mate), posting on behalf of @mogul. Reply to the review at df898ac8.

Addressed in 499d68d6. The SBX path now emits a visible stderr warning (_acq_sbx_warn_readonly_files, called from _acq_sbx_translate_kit) whenever a kit has readonly: true files. It names the kit and each guest path, says they are guest-resident copies with no integrity guarantee against a sudo guest, and cites docs/adr/0037-sbx-trusted-startup-parity.md (the documented interim state). The kit still applies. Translating the real v1.18.0 oci-engine spec now warns for both /home/agent/... paths. Regression tests are in test/bats/91-sbx-readonly-warning.bats: the positive case fails on the previous code, and the negative case covers kits without readonly files. I did not implement the read-only mount (Option B): it stays gated on live sbx validation, and ADR-0037 remains proposed (the doc change only records that the warning is implemented, plus a new known-failure-modes entry 50). Known limitation: a future built-in kit with readonly files would warn on every heal, since translation is not gated on needs-apply; no such kit exists today.

[basiliskus]

Verdict: approve — 499d68d6fb8539ee318cdcd9cf14e982c6b90a5e

The prior major finding on acq.backends/common.sh:41 is resolved in 499d68d6: translating the exact Patterns v1.18.0 OCI kit now warns on stderr for both readonly guest paths without changing the translated spec. No new blocking findings.

Nit — docs/adr/0037-sbx-trusted-startup-parity.md:150: replace “because no shipped kit opts in” with “while Option B awaits live validation; opted-in kits emit the warning below.”

Not verified: live SBX/MSB provisioning and restart integrity; real SBX grammar tests skip in CI. Required CI is green at this head, including the capability-projection and warning regressions under bash 3.2.

Assisted-by: OpenCode [gpt-6.1-sol-latest-guardrails-defaultv2] skill:change-review