chore: repin harness images to the v0.37.0 release builds (ship the xai-vertex pi extension)

[waynesun09]

Why

The seven harness image: pins point at builds from the aborted first v0.37.0 attempt (2026-08-23, fullsend rev 1f027be5 — they even carry the 0.37.0 OCI version label). The v0.37.0 that actually shipped on 2026-08-25 is fullsend 84c8bbbb, the merge of fullsend#6572, which vendors the pi-xai-vertex extension into the sandbox image. The registry's 0.37.0 tags now point at that build, but these pins were never moved, so the pinned images have no /usr/local/share/pi-extensions/xai-vertex and any agent selecting an xai-vertex/... model on pi fails at startup:

Error: Failed to load extension "/usr/local/share/pi-extensions/xai-vertex": Extension path does not exist
Error: Model "xai-vertex/xai/grok-4.6" not found. Use --list-models to see available models.

First seen on fullsend-ai/pi-xai-vertex triage run https://github.com/fullsend-ai/pi-xai-vertex/actions/runs/32880776870 — that repo's .fullsend/config.yaml (fullsend-ai/pi-xai-vertex#1) puts triage/review on xai-vertex/xai/grok-4.6 via the per-agent agents: settings from fullsend#6583. Selection itself worked (Model: xai-vertex/xai/grok-4.6 (from … agents.triage), Runtime: pi); only the image content is stale.

What

Seven image: pins → the digests behind the registry's 0.37.0 tags (rev 84c8bbbb). No other change.

image	old (aborted 08-23 build, rev 1f027be5)	new (:0.37.0, rev 84c8bbbb)
fullsend-sandbox (triage, retro, prioritize, scribe)	9af3fba…	46adf184…
fullsend-code (code, review, fix)	9743bc7b…	7b2bcbdb…

review is included because pi-xai-vertex runs review on Grok too.

Convention: pins reference release-tagged digests, not main :latest. A fullsend release tags agents main as-is (resolveAgentsRef() makes release CLI builds fetch agents@tags/<version>), so whatever sits here ships to that version's users; a :latest pin would silently ship whatever the last main image build changed. The design has an inherent one-release lag (an agents tag can't reference its own release's images) — that's the pin-design item already tracked on the release-gate page, not addressed here.

Verification

podman run --rm --pull=always --entrypoint ls <image> /usr/local/share/pi-extensions:

• fullsend-sandbox@sha256:46adf184… → anthropic-vertex xai-vertex
• fullsend-code@sha256:7b2bcbdb… → anthropic-vertex xai-vertex
• old 9af3fba… / 9743bc7b… → anthropic-vertex only

skopeo inspect docker://ghcr.io/fullsend-ai/fullsend-{sandbox,code}:0.37.0 → org.opencontainers.image.revision: 84c8bbbb…, created 2026-08-25 01:27/01:38 UTC.

Neither .fullsend/config.yaml nor a new fullsend release changes the image a CI run uses (FULLSEND_SANDBOX_IMAGE is local-dev only), so this pin is the lever. Per-repo consumers on fullsend main resolve fullsend-ai/agents@main, so it takes effect on merge.

[qodo-code-review]

PR Summary by Qodo

Bump harness images for xAI Vertex pi support

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Pin all harnesses to images containing the pi xAI Vertex extension.
• Restore startup for pi agents configured with xai-vertex models.

Diagram

graph TD
  H["Harness configs"] --> S["Sandbox image"] --> E["xAI Vertex extension"] --> M["xAI models"]
  H --> C["Code image"] --> E

Loading

High-Level Assessment

Updating the immutable digests is the appropriate approach because CI consumers resolve these harness definitions directly and cannot override the selected image. Mutable tags would reduce reproducibility, while repository-level model configuration or a fullsend release cannot add the missing extension to stale images.

Files changed (7) +7 / -7

Other (7) +7 / -7

code.yamlPin code agent to the xAI-enabled code image +1/-1

Pin code agent to the xAI-enabled code image

• Replaces the code harness image digest with the fullsend-code build containing the pi xAI Vertex extension.

harness/code.yaml

fix.yamlPin fix agent to the xAI-enabled code image +1/-1

Pin fix agent to the xAI-enabled code image

• Replaces the fix harness image digest with the fullsend-code build containing the pi xAI Vertex extension.

harness/fix.yaml

prioritize.yamlPin prioritize agent to the xAI-enabled sandbox image +1/-1

Pin prioritize agent to the xAI-enabled sandbox image

• Replaces the prioritize harness image digest with the fullsend-sandbox build containing the pi xAI Vertex extension.

harness/prioritize.yaml

retro.yamlPin retro agent to the xAI-enabled sandbox image +1/-1

Pin retro agent to the xAI-enabled sandbox image

• Replaces the retro harness image digest with the fullsend-sandbox build containing the pi xAI Vertex extension.

harness/retro.yaml

review.yamlPin review agent to the xAI-enabled code image +1/-1

Pin review agent to the xAI-enabled code image

• Replaces the review harness image digest with the fullsend-code build containing the pi xAI Vertex extension, enabling Grok-based reviews.

harness/review.yaml

scribe.yamlPin scribe agent to the xAI-enabled sandbox image +1/-1

Pin scribe agent to the xAI-enabled sandbox image

• Replaces the scribe harness image digest with the fullsend-sandbox build containing the pi xAI Vertex extension.

harness/scribe.yaml

triage.yamlPin triage agent to the xAI-enabled sandbox image +1/-1

Pin triage agent to the xAI-enabled sandbox image

• Replaces the triage harness image digest with the fullsend-sandbox build containing the pi xAI Vertex extension, preventing xai-vertex startup failures.

harness/triage.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Harness pins require human approval ✗ Dismissed 📜 Skill insight § Compliance

Description

This PR modifies protected harness/ infrastructure files, so it must receive human review and must
not be auto-approved. The PR description provides a specific operational justification, but that
does not remove the protected-path review requirement.

Code

harness/code.yaml[23]

+image: ghcr.io/fullsend-ai/fullsend-code@sha256:b71d0b934b2e17ac97550450a4ae57e901db8ff925a906277feeeee1f52d3e46

Relevance

●●● Strong

Protected-path governance findings are applicable; harness changes require human review regardless
of operational justification.

PR-#573

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 1538392 explicitly designates harness/ as a protected path and requires a finding
whenever it is modified; the cited added line changes the pinned execution image under that path.

harness/code.yaml[23-23]
Skill: pr-review

---

Context sources

✅ Compliance rules (platform): 56 rules

✅ Skills: 4 invoked

  code-review

  code-implementation

  pr-review

  docs-review

Review mode: ⚖️ Balanced

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 6:11 PM UTC · Ended 6:18 PM UTC

Commit: cac8b3f · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:19 PM UTC · Completed 6:35 PM UTC

Commit: 01d4242 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.16

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Low-risk config-only change repinning 7 harness image tags to v0.37.0; Tier 1 is low (1.88) due to minimal line changes and no security/CI/dependency impact, but Tier 2 is elevated (3.50) because these harness files are high-churn, multi-author hotspots with frequent fix commits - composite rounds to moderate.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] harness/code.yaml (and 6 other harness/ files) — All 7 changed files are under the harness/ protected path. The PR references cross-repo issues (fullsend#6572, chore: install fullsend per-repo scaffold on main with per-agent runtime/model in config pi-xai-vertex#1) and provides detailed rationale for repinning image digests to the v0.37.0 release builds that include the xai-vertex pi extension. Human approval is always required for protected-path changes, regardless of context.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 7:30 PM UTC · Completed 7:40 PM UTC

Commit: 01d4242 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.35

[fullsend-ai-retro]

PR #1025 was a human-authored fix for stale harness image pins that were blocking xai-vertex model use on the pi runtime. The seven harness image: pins pointed at builds from the aborted first v0.37.0 attempt instead of the actual v0.37.0 release. The author (waynesun09) manually repinned all seven digests. The first commit contained incorrect digests; the author caught this and force-pushed an amendment within 8 minutes, cancelling the first review agent run (~7 min wasted compute). The second review completed at $3.16 (opus/high effort), correctly flagging the harness/ protected-path policy requirement. A human reviewer approved and the PR merged cleanly via merge queue in ~1h20m. The workflow was well-executed with no significant quality issues. The systemic root cause — manual image repin after each fullsend release — is comprehensively tracked by fullsend-ai/fullsend#6607, which was filed by the same author alongside this PR. No improvement proposals are warranted that are not already covered by existing open issues.