Merge main into agent-host-vault

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Development-Plan.md

@@ -39,8 +39,8 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
 | **D1–D2** Workflow | partial | On the new loop: issue intake, restatement and go-ahead (M2.1), labels (M2.3); no documents in the repo |
 | **D3–D4** Workspace, git | partial | Idempotent publishing; no fresh workspace (#62), `git add -A` (#80) |
 | **D5** Review | partial | PR conversation comments only (#69), watch stall (#70) |
-| **D7–D8** Deployment, projects | partial | Runs from a venv as a systemd unit on this box; project entries in config (M1.4); egress not enforced |
-| **O**, **X** | none | No container image yet |
+| **D7–D8** Deployment, projects | partial | Bring-up runs `nisse-dev`'s image under systemd on this box, `nisse-review` from a venv; project entries in config (M1.4); egress not enforced |
+| **O**, **X** | partial | `nisse-dev` has its image (M1.5); `nisse-review` doesn't yet (M7.6); nothing runs on the agent host |
 | `specs/` | done for now | `loop.qnt` (the architecture, #91); `orchestrator.qnt` went with `control.py` (M2.8) |
 
 ---
@@ -86,6 +86,11 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
   (`-k`) or diagnosed (`--lf`); `scripts/e2e.sh` reports what a run spent. Manual
   live runs are for the new loop's first runs and phase ends. Findings are filed as
   issues and either fixed before moving on or deliberately deferred.
+- **Every agent is its own container image** (X1), since that's how each one
+  runs on the agent host: built from the repository's `Dockerfile`, published by
+  `release.yml` to `gitea.dongar.net/dev/<agent>`, and tested over the image the
+  way `nisse-dev`'s is (M1.5). A new agent's phase includes its image, before the
+  agent host is ready for it, and its bring-up runs from that image.
 - **The Quint model moves with the loop:** `loop.qnt` models the architecture,
   and its properties are tests (the property walk), changed in the same PR as a
   rule they cover.
@@ -556,10 +561,12 @@ SilverBullet so far (M5.4). Until M6.2, the build VMs stay made by hand, with
 `vm ready` for a rebuilt one's host key.
 
 **M6.1 The agent host.** *Needs discussion.* Containers, volumes, snapshots,
-per-agent networks (X1, X2, X4). The host exists: `nisse` (infra/tofu#77,
-2026-10-18, as `nisse-host`; 2 cores, 4 GB, 100 GB, on VLAN 1, nightly Proxmox
-backups), requested through nisse-dev's own quota to test that path; the operator
-has since renamed it and moved it out of the quota. It holds only the vault and SilverBullet so far (M5.4).
+per-agent networks (X1, X2, X4). Each agent runs there from its own published
+image (§3). The host exists: `nisse` (infra/tofu#77, 2026-10-18, as
+`nisse-host`; 2 cores, 4 GB, 100 GB, on VLAN 1, nightly Proxmox backups),
+requested through nisse-dev's own quota to test that path; the operator has
+since renamed it and moved it out of the quota. It holds only the vault and
+SilverBullet so far (M5.4).
 
 **M6.2 Build VMs by Terraform.** *Needs discussion.* The template, VLAN and egress
 (D7, X2), collection when idle.
@@ -695,8 +702,11 @@ of earlier points, replies on threads, the round cap and its reset, `stop` and
   can't be listed, and its earlier points with what was said on their lines.
 - **Replies:** `reply` answers a point where it was made (inline on its line,
   else quoting it), `skip` leaves it with a reason, `done` ends; every point is
-  answered or skipped before a run may end. Each reply carries its point's key,
-  so a run re-done after a crash answers nothing twice.
+  answered or skipped before a run may end. An ending call refused for that is
+  held, and goes ahead as soon as the last point is settled, rather than left
+  to the model to make again (on #166 it didn't, and looped to the turn cap).
+  Each reply carries its point's key, so a run re-done after a crash answers
+  nothing twice.
 - **Sign-off:** `sign_off` posts a short review when there is nothing to raise;
   while it stays happy, a later review offers `still_happy`, which posts nothing
   (operator: no repeated LGTMs).
@@ -736,9 +746,18 @@ of earlier points, replies on threads, the round cap and its reset, `stop` and
   L6 above. Each cut fitting still makes is logged (`context.trimmed`).
   Tests: `test_compact.py` in nisse-core.
 
-**M7.6 Deployment.** *Waits for the agent host (Phase 6).* Its image, container,
-Gitea account and secrets (R5). The image needs `git`, and `scratch/` a
-persistent volume, so clones outlive a restart.
+**M7.6 `nisse-review`'s image.** *Pre-approved.* Doesn't wait for the agent
+host. Its own image, as `nisse-dev`'s (M1.5, §3): a `nisse-review` target in the
+`Dockerfile`, running as its own user, with state in a volume, configuration
+mounted read-only and secrets as environment variables. The image needs `git`,
+and `scratch/` a persistent volume, so clones outlive a restart. `release.yml`
+publishes `gitea.dongar.net/dev/nisse-review` beside `nisse-dev`, and
+`review-bringup.sh` runs the image instead of a virtualenv.
+- Acceptance: a release publishes both images, and the review end-to-end tests
+  run over the published `nisse-review` image.
+
+**M7.7 Deployment.** *Waits for the agent host (Phase 6).* Its container on the
+agent host, Gitea account and secrets (R5).
 
 ### Phase 8 — `nisse-ops`
 
@@ -747,8 +766,9 @@ credentials (L12), with masking what an API returns as #144; search-then-dispatc
 meta-tools are avoided, not ruled out (X3). **M8.2 Approved step sequences** (O2).
 **M8.3 Ops intake and duties** from the infrastructure repository (O5), taking over
 the Terraform the operator is writing now. **M8.4 The ops tool VM and deployment**
-(O6). **M8.5 Requests between agents:** `nisse-dev` asking for build VMs (L1, O5).
-All *needs discussion*.
+(O6); its own image comes with its first slice, as every agent's does (§3).
+**M8.5 Requests between agents:** `nisse-dev` asking for build VMs (L1, O5). All
+*needs discussion*.
 
 ### Not yet scheduled