Skip to content

feat(kits): pin agentic-coding-patterns v1.15.0 - #595

Merged
mogul merged 5 commits into
mainfrom
feat/patterns-v1.14.0
Oct 21, 2026
Merged

mogul merged 5 commits into
mainfrom
feat/patterns-v1.14.0

Conversation

@basiliskus

@basiliskus basiliskus commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Moves PATTERNS_KIT_REF from v1.12.0 (56d1f5f) to agentic-coding-patterns v1.15.0 (f3c6acb), so the built-in kit bundle picks up:

Also v1.13.0: usai-provider's host-side catalog normalizer (#436), the paseo identity-gate script (#453), and the team-kit and personal-kit templates under acq-kits/examples/. None changes what acq applies by default beyond the two kits above.

Also v1.15.0: refreshed usai-provider model catalog (GSA-TTS/agentic-coding-patterns#519, GSA-TTS/agentic-coding-patterns#484), the OpenDesign opt-in kit (GSA-TTS/agentic-coding-patterns#438), and the provider-neutral input contract (GSA-TTS/agentic-coding-patterns#518). acq's provider-facts loader reads provider-facts/usai.env, which v1.15.0 does not change.

The doc examples and Bats assertions that spell the pin move with it. KNOWN_FAILURE_MODES §9 now names 2.0.30 as the version the kit installs and notes its 15-minute default chunkTimeout (the timeout message and retry limits are unchanged from 2.0.22).

Verification

On the v1.15.0 pin:

  • Focused Bats: 135-configure, 95-kit-ref-persistence, 36-agent-catalog, 50-kit-list-completeness (63/63)
  • markdownlint on the changed docs

On the earlier v1.14.0 pin (not re-run for v1.15.0):

  • npm run lint:md
  • RUN_ACQ=1 scripts/verify-backends --only msb on macOS, msb 0.7.8: 16 passed, 1 skipped (playbook fetch, no gh login), run with TMPDIR set to its resolved /private/var/... path to get past an unrelated create failure that also hits main (msb: create fails when the provenance dir is reached through a symlink (verify-backends broken on macOS) #594)
  • Downstream, with this pin on msb 0.7.8 and ACQ_IMAGE=devenv-shell:1.0.0: a team kit's end-to-end verify passed 71/71 (OpenCode 2.0.30 runs and loads instructions); with the paseo kit added, Paseo 0.12.0 drove an OpenCode 2.0.30 agent that received the team instructions, and its sessions survived a backup, acq rm, recreate and restore

Rollback

Revert this PR to restore the v1.12.0 bundle.

Moves PATTERNS_KIT_REF from v1.12.0 (56d1f5f) to v1.14.0 (89e87f9): the
opencode kit installs OpenCode 2.0.30, which honors config instructions,
and the paseo kit installs Paseo 0.12.0. KNOWN_FAILURE_MODES section 9
names 2.0.30 and its 15-minute default chunkTimeout.
@basiliskus
basiliskus requested a review from a team as a code owner October 20, 2026 22:19
@basiliskus

Copy link
Copy Markdown
Contributor Author

The failing Markdown Lint check isn't caused by this PR. It fails at the job's npm audit --audit-level=high step on .github/linters/, before any markdown is linted. The overrides there pin markdown-it 14.3.1, which is hit by the high-severity GHSA-r7fv-28h4-cvq7 and GHSA-vfgh-jcmw-g37q, both published 2026-10-20. Older advisories on smol-toml and katex also show up. Any PR that runs the check now fails the same way. This PR doesn't touch .github/linters/, and npm run lint:md passes locally on this branch. The fix is to raise the overrides to the patched versions (markdown-it 14.3.3, smol-toml 1.9.0, katex 0.18.2); with those, npm audit reports 0 vulnerabilities. I have that ready as a separate PR and can open it.

@basiliskus
basiliskus requested review from mogul and wz-gsa October 21, 2026 13:56
Moves PATTERNS_KIT_REF from v1.14.0 (89e87f9) to v1.15.0 (f3c6acb), picking up the
refreshed usai-provider model catalog. Also corrects the stale version comment
above the pin.
@basiliskus basiliskus changed the title feat(kits): pin agentic-coding-patterns v1.14.0 feat(kits): pin agentic-coding-patterns v1.15.0 Oct 21, 2026

@mogul mogul left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

Adversarial review found no actionable blockers. The full 40-character SHA is the GitHub-verified, signed agentic-coding-patterns v1.15.0 tag target, and it is applied consistently in the built-in bundle, opt-in examples, and direct persistence/configuration assertions. The upstream v1.15.0 kit metadata supports the documented OpenCode 2.0.30 behavior, including the 15-minute default chunk timeout; the USAi kit continues to set the explicit two-minute override.

Verification reviewed:

  • GitHub CI is green: pre-commit, Markdown lint, link check, conventional-title validation, and the Bash 3.2 offline suite.
  • Focused local Bats after initializing the repository-pinned submodules: 65/65 passed across 135-configure, 95-kit-ref-persistence, 36-agent-catalog, and 50-kit-list-completeness.
  • Diff check and targeted secret-pattern scan: clean.

Residual boundary: this review did not independently provision a live SBX/MSB sandbox from the new remote kit bundle or recompute every upstream platform-artifact checksum. The signed release/tag verification, upstream kit validation, focused local assertions, and green CI provide appropriate coverage for this pin-only change.

AI-assisted review; human review and merge remain required.

@mogul
mogul merged commit 1e9ef27 into main Oct 21, 2026
7 checks passed
@mogul
mogul deleted the feat/patterns-v1.14.0 branch October 21, 2026 18:29
mogul pushed a commit that referenced this pull request Oct 22, 2026
🤖 I have created a release *beep* *boop*
---


##
[4.1.0](v4.0.2...v4.1.0)
(2026-10-22)


### Features

* **kits:** pin agentic-coding-patterns v1.15.0
([#595](#595))
([1e9ef27](1e9ef27))
* **kits:** pin agentic-coding-patterns v1.16.1
([#609](#609))
([20d6bab](20d6bab))
* **opencode:** use generic devenv base by default
([#584](#584))
([cefd6f2](cefd6f2))


### Bug Fixes

* **ci:** bump markdown-it to 14.3.3 and smol-toml to 1.9.0 overrides
([#599](#599))
([5ab74b8](5ab74b8))
* **msb:** stop false "no ssh-agent route" warnings from grep sigpipe
([#598](#598))
([24c8493](24c8493))
* **provider-facts:** preserve caller-visible assignments through
wrapper subshell
([#603](#603))
([2361b11](2361b11))
* **provider-facts:** preserve unset caller IFS
([#605](#605))
([3fe3150](3fe3150))
* **rc.d:** list ~/.rc.d with command ls in the login bridge
([#588](#588))
([d7dbeb6](d7dbeb6))
* **verify:** make provider backend verification fail closed
([#602](#602))
([f67041a](f67041a))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants