deploy(vera): core 0.145.0 → 0.163.0, github-plugin → v0.7.0, pr-reviewer → v0.38.0

Dockerfile

@@ -9,7 +9,7 @@
 # protoAgent core forward on the same image roll — core and member bumps are
 # decoupled. Bump this deliberately (and re-verify), keeping it in step with the
 # manifest's `verified_against`. Tag format is bare semver (no `v` prefix).
-FROM ghcr.io/protolabsai/protoagent:0.145.0
+FROM ghcr.io/protolabsai/protoagent:0.163.0
 
 USER root
 
@@ -27,11 +27,11 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 # Bake the bundle members at their RELEASE TAGS (both public — no build secrets).
 # The tags mirror protoagent.bundle.yaml's pins; bump both together (the manifest
 # is the source of truth, this bake is its image form).
-ARG GITHUB_PLUGIN_REF=v0.5.0
+ARG GITHUB_PLUGIN_REF=v0.7.0
 RUN git clone --depth 1 --branch "${GITHUB_PLUGIN_REF}" \
       https://github.com/protoLabsAI/github-plugin.git /opt/protoagent/plugins/github \
     && rm -rf /opt/protoagent/plugins/github/.git
-ARG PR_REVIEWER_PLUGIN_REF=v0.36.0
+ARG PR_REVIEWER_PLUGIN_REF=v0.38.0
 RUN git clone --depth 1 --branch "${PR_REVIEWER_PLUGIN_REF}" \
       https://github.com/protoLabsAI/pr-reviewer-plugin.git /opt/protoagent/plugins/pr-reviewer \
     && rm -rf /opt/protoagent/plugins/pr-reviewer/.git

README.md

@@ -14,8 +14,8 @@ python -m server plugin install https://github.com/protoLabsAI/qaEngineer
 | Member | Pin | Role |
 |---|---|---|
 | `workflows` (builtin) | core | the recipe engine the review panels run on |
-| [github-plugin](https://github.com/protoLabsAI/github-plugin) | v0.5.0 | the verdict surface — formal Review API tools with CI-terminal + self-review guards inside the tools |
-| [pr-reviewer-plugin](https://github.com/protoLabsAI/pr-reviewer-plugin) | v0.36.0 | the machinery — webhook chokepoint, structural trigger, panel dispatch, evidence grounding, convergence, approve-on-green sweep, the `QA panel` check run, on-demand summon, telemetry + eval |
+| [github-plugin](https://github.com/protoLabsAI/github-plugin) | v0.7.0 | the verdict surface — formal Review API tools with CI-terminal + self-review guards inside the tools |
+| [pr-reviewer-plugin](https://github.com/protoLabsAI/pr-reviewer-plugin) | v0.38.0 | the machinery — webhook chokepoint, structural trigger, panel dispatch, evidence grounding, convergence, approve-on-green sweep, the `QA panel` check run, on-demand summon, telemetry + eval |
 
 Persona: [`SOUL.md`](./SOUL.md) (Vera — verdict system, three-layer verification, 80% bar,
 self-restriction), also inlined in the manifest's `archetype.soul` so the new-agent picker
@@ -119,10 +119,19 @@ event (ADR 0039). The inference script is therefore scheduled for deletion — b
 yet, and the distinction matters: **pinning a version is not running it.** Vera rolls on
 watchtower after a merge, so between the pin landing and the roll completing she is on
 the old core with no event at all. Retire the script once the running instance reports
-0.145.0 *and* the event has been seen firing; deleting the inference before its
+the pinned core *and* the event has been seen firing; deleting the inference before its
 replacement is observed working would leave the silent-degrade window covered by
 neither.
 
+**#2995 is FIXED in core 0.148.0** (carried since): the observable failover above only
+ever wired onto the *lead* agent — every panel finder runs as a subagent via
+`_run_subagent()`, which built its own middleware stack and omitted
+`routing.fallback_models` entirely. A rate-limited primary therefore killed the whole
+panel instead of failing over (this is what actually happened on 2026-08-23: the
+gateway fallback counter sat unchanged across two rate-limit incidents while panels
+exhausted). The subagent stack now mirrors the lead's, so `fallback_models` finally
+protects reviews, not just conversational turns.
+
 **Reviews are not cheap.** One structural review is nine LLM steps and 5–9 minutes of
 wall clock. On a hosted frontier model that's roughly $0.12–0.15 each; on local inference
 it's free but occupies the box.
@@ -201,7 +210,7 @@ from the payload):
 ## Deploying Vera (the reference host)
 
 This repo doubles as Vera's image source: `Dockerfile` = stock protoAgent (**pinned
-base** — `protoagent:0.145.0`, in step with the manifest's `verified_against`; bump
+base** — `protoagent:0.163.0`, in step with the manifest's `verified_against`; bump
 deliberately so a member-pin bump can't drag the core forward on the same roll) +
 node/`clawpatch` + the bundle members baked at their manifest pins +
 `deploy/vera.langgraph-config.yaml` (seed, not force) + `SOUL.md`.
@@ -241,7 +250,6 @@ exit 2 = unreachable kept as distinct alarms). Every one of them exists because
 | `drift` | `check_card_drift.py` | does the live card still match the seed? |
 | `fallback` | `check_model_fallback.py` | did she silently answer from her fallback model? (gateway-metrics inference — protoAgent#2956) |
 | `oauth` | `check_oauth_health.py` | is the subscription credential still signed in, refreshable, and coherent with `model.name`? (a no-op on a gateway lane) |
-| `prune` | `prune_checkout_cache.py` | **stopgap** — bound the checkout cache, since the plugin's own `prune()` is never called (pr-reviewer-plugin#87) |
 
 The wrapper runs **installed copies** in `~/.local/bin`, not `scripts/*.py` — this repo is
 also the deploy source, so a branch switch would silently disarm a guard that lived inside

protoagent.bundle.yaml

@@ -25,12 +25,12 @@ description: >-
   own work; never posts a blocking verdict against pending CI.
 
 # The core version this pin set was last verified against (ADR 0049 rule 2).
-verified_against: 0.145.0
+verified_against: 0.163.0
 
 plugins:
   - { id: workflows, builtin: true }   # the recipe engine (code-review panels run through it)
-  - { id: github, url: https://github.com/protoLabsAI/github-plugin, ref: v0.5.0 }
-  - { id: pr-reviewer, url: https://github.com/protoLabsAI/pr-reviewer-plugin, ref: v0.36.0 }
+  - { id: github, url: https://github.com/protoLabsAI/github-plugin, ref: v0.7.0 }
+  - { id: pr-reviewer, url: https://github.com/protoLabsAI/pr-reviewer-plugin, ref: v0.38.0 }
 
 enabled: [workflows, github, pr-reviewer]   # suggested turn-on list (applied to plugins.enabled)
 

scripts/vera-watchdog.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Runner + alerter for Vera's watchdogs — health, drift, fallback, oauth, prune
+# Runner + alerter for Vera's watchdogs — health, drift, fallback, oauth
 # (qaEngineer#37 shipped the first two; the model-lane pair arrived with the move to a
 # native Claude subscription).
 #
@@ -18,7 +18,6 @@
 # live inside the thing it watches. Refresh these copies when the repo version changes:
 #
 #     install -m 644 ~/dev/qaEngineer/scripts/vera_api.py             ~/.local/bin/vera_api.py
-#     install -m 755 ~/dev/qaEngineer/scripts/prune_checkout_cache.py ~/.local/bin/vera-prune-cache.py
 #     install -m 755 ~/dev/qaEngineer/scripts/check_review_health.py   ~/.local/bin/vera-review-health.py
 #     install -m 755 ~/dev/qaEngineer/scripts/check_card_drift.py      ~/.local/bin/vera-card-drift.py
 #     install -m 755 ~/dev/qaEngineer/scripts/check_model_fallback.py  ~/.local/bin/vera-model-fallback.py
@@ -33,7 +32,7 @@
 # agent) are deliberately different alerts — the scripts draw that line on purpose, and
 # collapsing it would let an outage read as a clean gate.
 #
-# Usage:  vera-watchdog.sh health|drift|fallback|oauth|prune [extra args passed to the check]
+# Usage:  vera-watchdog.sh health|drift|fallback|oauth [extra args passed to the check]
 # Exit:   passes the underlying check's exit code through (0 ok, 1 verdict, 2 unreachable)
 
 set -uo pipefail
@@ -113,16 +112,8 @@ case "$MODE" in
     # outlive its refresh token with no traffic to reveal it.
     out="$("$BIN/vera-oauth-health.py" --container vera "$@" 2>&1)"; rc=$?
     ;;
-  prune)
-    # STOPGAP, not a watchdog: bound the checkout cache, because pr-reviewer's own
-    # CheckoutCache.prune() is defined, documented, unit-tested and never called
-    # (pr-reviewer-plugin#87). It reached 43 GiB / 1248 entries against its own
-    # 5 GiB / 50-entry caps and took ava to 92% disk. Delete this mode when #87 ships.
-    # Runs with --apply here; the underlying script dry-runs by default.
-    out="$("$BIN/vera-prune-cache.py" --container vera --apply "$@" 2>&1)"; rc=$?
-    ;;
   *)
-    echo "usage: $(basename "$0") health|drift|fallback|oauth|prune" >&2; exit 64 ;;
+    echo "usage: $(basename "$0") health|drift|fallback|oauth" >&2; exit 64 ;;
 esac
 
 echo "$out"