5.3: Per-stage container images (plan, execute, verify)

[savitharaghunathan]

5.3: Per-stage container images (plan, execute, verify)

Part of Stream 5: Harness → AgentPlaybookRun alignment

ADR-0001 defines a layered image architecture: base → runtime → language. The current images don't align with the per-stage model needed for AgentPlaybookRun, where each stage runs in its own Sandbox with exactly one skill baked into the image.

Tasks

• agent-base — UBI, harness binary, goose, git, empty /opt/skills/ directory (no pipeline-specific tools)
• agent-java-base — extends agent-base with JDK 21 + Maven
• agent-plan — extends agent-base with Python/graphify + COPY skills/plan/ /opt/skills/plan/
• agent-execute — extends agent-java-base + COPY skills/execute/ /opt/skills/execute/
• agent-verify — extends agent-java-base + COPY skills/verify/ /opt/skills/verify/
• Add Makefile targets for per-stage image builds with dependency chain (agent-base → agent-java-base → execute/verify, agent-base → plan)
• Clean up old images that don't fit this model (agent-base-goose-java)

Design Notes

Bundling goose directly in the base image (skipping the ADR's Layer 1.5 runtime separation) is acceptable for the POC. The runtime image split (agent-base-goose as a separate layer) is a future optimization tracked by #27.

Acceptance Criteria

• Each stage image contains exactly one skill at /opt/skills/{name}/SKILL.md
• Stage images extend the correct base (plan extends agent-base, execute/verify extend agent-java-base)
• migration-harness run works in each stage image (discovers the skill, launches goose, runs the stage)
• Makefile targets build the full image chain with correct dependencies

References

• ADR-0001 §Agent container image strategy (Layers 1–3)
• 4.2: Base image (agent-base) #26, 4.3: Runtime images #27, 4.4: Language images #28 (existing base image issues)
• PR ✨ Harness init #33

[savitharaghunathan]

Redesign: base + language images (replaces per-stage model)

Skills are delivered via SkillCards (OCI artifacts mounted as ImageVolumes at /opt/skills/) at runtime — no need to bake stages into images. This simplifies the image matrix from per-stage images to base + per-language images.

New image architecture

agent-base          UBI 10 + harness + goose + git + Python 3 + graphify + /opt/skills/
├── agent-java      + JDK 21 + Maven
├── agent-go        + Go toolchain
├── agent-csharp    + .NET SDK
└── agent-nodejs    + Node.js + npm

Updated tasks

• Update agent-base Containerfile — add Python 3 + graphify (absorbed from agent-plan)
• Rename agent-java-base → agent-java
• Add agent-go Containerfile
• Add agent-csharp Containerfile
• Add agent-nodejs Containerfile
• Delete old per-stage images: agent-plan, agent-execute-java, agent-verify-java
• Update Makefile — replace per-stage targets with per-language targets
• Update hack/harness-test/setup.sh — load agent-base + agent-java instead of old stage images
• Update hack/harness-test/playbook-resources.yaml — all agents use agent-java:dev
• Update images/README.md — new hierarchy diagram

Design notes

• Goose stays in agent-base — harness launches goose ACP directly
• ADR-0001 Layer 1.5 (runtime separation) deferred — only one runtime (goose) exists, tracked by 4.3: Runtime images #27
• CI workflow (images.yml) delegates to make agent-images-build/push, no structural changes needed
• controller-agent image is a separate concern (controller verification/e2e), untouched