server-base.txt

# Base image for Dockerfile.server: upstream's published omnigent server image with
# the kubernetes extra, ghcr.io/omnigent-ai/omnigent-server-kubernetes.
# omnigent-ai/omnigent's oss-publish-images.yml builds it from deploy/docker/Dockerfile
# with OMNIGENT_EXTRAS=kubernetes for every release tag. Dockerfile.server adds the
# kms extra.
#
# Read by ecr-server.yml and verify-agent-bundles.yml. Pinned as tag@digest, like
# runner-base.txt, and to the SAME release as runner-base.txt.
#
# Platform's vendored Kustomize tree (clusters/dev/seigent/vendor) MUST come from the
# same release. The launcher's RBAC lives in that tree and its API calls live in this
# image, so a split between them fails every sandbox launch with a 403 while the
# server reports healthy.
#
# MIGRATIONS run at server boot, and an older image refuses a newer schema with
# "Omnigent database schema is newer than this version of Omnigent". Before a bump:
#   1. List the revisions it crosses:
#        git diff --name-status <old> <new> -- omnigent/db/migrations/versions
#   2. Rehearse upgrade, downgrade and re-upgrade on postgres:16-alpine with the NEW
#      image, run from /build with OMNIGENT_DB_URL set:
#        docker run --rm -w /build -e OMNIGENT_DB_URL=postgresql+psycopg://... \
#          <new image> alembic -c omnigent/db/alembic.ini upgrade head
#      alembic reads OMNIGENT_DB_URL only. With DATABASE_URL alone it migrates a
#      local SQLite file and reports success.
#   3. Record below what the new revisions do and the revision to roll back to.
#
# ROLLBACK. Reverting the digest alone crash-loops. Any new-image server pod that
# starts after the downgrade upgrades the schema again at boot, so no server pod
# may run from the downgrade until the old image is applied:
#   1. Stop Flux and the server, in that order:
#        flux suspend kustomization seigent -n flux-system
#        kubectl -n seigent scale deploy/omnigent --replicas=0
#        kubectl -n seigent wait --for=delete pod -l app=omnigent --timeout=180s
#   2. Downgrade from a one-off pod of the NEW image, which the Deployment still
#      names while Flux is suspended:
#        IMG=$(kubectl -n seigent get deploy omnigent -o jsonpath='{.spec.template.spec.containers[?(@.name=="omnigent")].image}')
#        kubectl -n seigent run omnigent-downgrade --rm -i --restart=Never --image="$IMG" --overrides='{"spec":{"securityContext":{"runAsNonRoot":true,"runAsUser":1000,"runAsGroup":1000},"containers":[{"name":"omnigent-downgrade","image":"'"$IMG"'","envFrom":[{"secretRef":{"name":"omnigent-secrets"}}],"command":["sh","-c",": \"${DATABASE_URL:?}\"; cd /build && u=\"$DATABASE_URL\"; case \"$u\" in postgres://*) u=\"postgresql://${u#postgres://}\";; esac; export OMNIGENT_DB_URL=\"$u\"; alembic -c omnigent/db/alembic.ini current && alembic -c omnigent/db/alembic.ini downgrade <revision> && alembic -c omnigent/db/alembic.ini current"]}]}}'
#   3. Merge the revert of the digest change in platform.
#   4. Fetch it, and confirm the source revision is the revert commit before
#      resuming. Resume reconciles from the revision Flux already holds, so a
#      stale one re-applies the new image:
#        flux reconcile source git flux-system -n flux-system
#        kubectl -n flux-system get gitrepository flux-system -o jsonpath='{.status.artifact.revision}'
#   5. flux resume kustomization seigent -n flux-system
#      Flux applies the old image and restores one replica.
#
# Current: v0.17.0 (2026-10-06), the multi-arch index; ecr-server.yml builds its
# amd64 variant. Alembic head mm1a2b3c4d5e. Its one revision over the previous
# deployment (upstream main 63231a044, head ll1a2b3c4d5e) builds the index
# ix_agents_kind_owner_created with CREATE INDEX CONCURRENTLY, outside a transaction,
# so writes to `agents` continue during the build. Its downgrade is a plain DROP
# INDEX, which holds an ACCESS EXCLUSIVE lock on `agents` briefly. Rehearsed on
# postgres:16-alpine with 200,006 agents rows: upgrade 224 ms, downgrade 1.7 ms,
# re-upgrade 233 ms, rows unchanged, and the server booted and migrated itself.
# Rollback revision: ll1a2b3c4d5e. Neither direction discards data.
ghcr.io/omnigent-ai/omnigent-server-kubernetes:v0.17.0@sha256:31c83f122e2a2c0854997235ea5163596598933bc4faa4c12f619b3d9407cd4b