docs/Development-Plan.md

@@ -39,8 +39,8 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
 | **D1–D2** Workflow | partial | On the new loop: issue intake, restatement and go-ahead (M2.1), labels (M2.3); no documents in the repo |
 | **D3–D4** Workspace, git | partial | Idempotent publishing; no fresh workspace (#62), `git add -A` (#80) |
 | **D5** Review | partial | PR conversation comments only (#69), watch stall (#70) |
-| **D7–D8** Deployment, projects | partial | Runs from a venv as a systemd unit on this box; project entries in config (M1.4); egress not enforced |
+| **D7–D8** Deployment, projects | partial | Bring-up runs `nisse-dev`'s image under systemd on this box, `nisse-review` from a venv; project entries in config (M1.4); egress not enforced |
-| **O**, **X** | none | No container image yet |
+| **O**, **X** | partial | `nisse-dev` has its image (M1.5); `nisse-review` doesn't yet (M7.6); nothing runs on the agent host |
 | `specs/` | done for now | `loop.qnt` (the architecture, #91); `orchestrator.qnt` went with `control.py` (M2.8) |
 
 ---
@@ -86,6 +86,11 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
   (`-k`) or diagnosed (`--lf`); `scripts/e2e.sh` reports what a run spent. Manual
   live runs are for the new loop's first runs and phase ends. Findings are filed as
   issues and either fixed before moving on or deliberately deferred.
+- **Every agent is its own container image** (X1), since that's how each one
+  runs on the agent host: built from the repository's `Dockerfile`, published by
+  `release.yml` to `gitea.dongar.net/dev/<agent>`, and tested over the image the
+  way `nisse-dev`'s is (M1.5). A new agent's phase includes its image, before the
+  agent host is ready for it, and its bring-up runs from that image.
 - **The Quint model moves with the loop:** `loop.qnt` models the architecture,
   and its properties are tests (the property walk), changed in the same PR as a
   rule they cover.
@@ -541,7 +546,8 @@ Terraform isn't running; the operator is planning both, Terraform with
 hand (Ubuntu 24 now, 26 soon), with `vm ready` for a rebuilt one's host key.
 
 **M6.1 The agent host.** *Needs discussion.* Containers, volumes, snapshots,
-per-agent networks (X1, X2, X4).
+per-agent networks (X1, X2, X4). Each agent runs there from its own published
+image (§3).
 
 **M6.2 Build VMs by Terraform.** *Needs discussion.* The template, VLAN and egress
 (D7, X2), collection when idle.
@@ -718,9 +724,18 @@ of earlier points, replies on threads, the round cap and its reset, `stop` and
   L6 above. Each cut fitting still makes is logged (`context.trimmed`).
   Tests: `test_compact.py` in nisse-core.
 
-**M7.6 Deployment.** *Waits for the agent host (Phase 6).* Its image, container,
+**M7.6 `nisse-review`'s image.** *Pre-approved.* Doesn't wait for the agent
-Gitea account and secrets (R5). The image needs `git`, and `scratch/` a
+host. Its own image, as `nisse-dev`'s (M1.5, §3): a `nisse-review` target in the
-persistent volume, so clones outlive a restart.
+`Dockerfile`, running as its own user, with state in a volume, configuration
+mounted read-only and secrets as environment variables. The image needs `git`,
+and `scratch/` a persistent volume, so clones outlive a restart. `release.yml`
+publishes `gitea.dongar.net/dev/nisse-review` beside `nisse-dev`, and
+`review-bringup.sh` runs the image instead of a virtualenv.
+- Acceptance: a release publishes both images, and the review end-to-end tests
+  run over the published `nisse-review` image.
+
+**M7.7 Deployment.** *Waits for the agent host (Phase 6).* Its container on the
+agent host, Gitea account and secrets (R5).
 
 ### Phase 8 — `nisse-ops`
 
@@ -729,8 +744,9 @@ credentials (L12), with masking what an API returns as #144; search-then-dispatc
 meta-tools are avoided, not ruled out (X3). **M8.2 Approved step sequences** (O2).
 **M8.3 Ops intake and duties** from the infrastructure repository (O5), taking over
 the Terraform the operator is writing now. **M8.4 The ops tool VM and deployment**
-(O6). **M8.5 Requests between agents:** `nisse-dev` asking for build VMs (L1, O5).
+(O6); its own image comes with its first slice, as every agent's does (§3).
-All *needs discussion*.
+**M8.5 Requests between agents:** `nisse-dev` asking for build VMs (L1, O5). All
+*needs discussion*.
 
 ### Not yet scheduled
 

nisse-dev/src/nisse_dev/loop/agent.py

@@ -3056,7 +3056,7 @@ class LoopAgent:
         """Block a build VM (D3): every project on it waits until it is
         recovered. Said once at top level, and in each waiting item's thread.
         The recovery is the operator's for now, or the VM's coming back;
-        nisse-ops' later (M7.6)."""
+        nisse-ops' later (M8.5)."""
         if host in self._store.vm_blocks():
             return  # already said
         self._store.block_vm(

scripts/review-bringup.sh

@@ -2,8 +2,8 @@
 # Bring-up runs of nisse-review on this development VM (Development Plan M7.3).
 #
 # It runs from the exported code under test, in a virtualenv of its own, as a
-# transient systemd unit, so it outlives the shell that started it. Its
+# transient systemd unit, so it outlives the shell that started it. It runs
-# container comes with M7.6.
+# from its image after M7.6, and on the agent host after M7.7.
 #
 #   scripts/review-bringup.sh start [REF]   export REF (default HEAD), install
 #                                           it, and start the reviewer