Automate qualified source-workspace plugin pin promotions

[AntoineToussaint]

Production incident

Mind’s live Pytest campaign found and fixed a real test-command derivation bug in Codefly Core, then released Python agent v0.0.50. Default agent inventory reported v0.0.50 as globally resolvable, but the production source workspace correctly continued launching python__0.0.48 because CLI v0.1.130 pins source-workspace agents independently. The fix therefore required a second manual CLI pin/release before any Mind session could consume it.

The pin is necessary for reproducibility. The invisible/manual promotion chain is the hole.

Desired contract

• Keep source workspaces pinned; never float to “latest”.
• Maintain one machine-readable source-workspace compatibility roster consumed by selection, diagnostics, and release tooling.
• A released language agent can open or generate a bounded CLI promotion change after its own qualification succeeds.
• The promotion proof loads the exact pinned artifact through codefly test source for every marker family owned by that plugin and asserts the Runtime/Code/Tooling capability handshake.
• codefly agent versions or doctor must distinguish “latest available” from “version this CLI will launch for an arbitrary source checkout”, including a stale-pin warning when a newer qualified candidate awaits promotion.
• Promotion remains reviewable and deterministic; agent release must not silently mutate the CLI contract.

Acceptance

1. Release a fixture agent version newer than the CLI pin.
2. Observe an explicit promotion candidate and stale-pin diagnostic.
3. Merge the generated pin change after exact artifact qualification.
4. Build the CLI and prove a source workspace launches the promoted version.
5. No Mind-side version override or repository-specific execution knowledge is introduced.

Evidence

• Mind production rerun launched v0.0.48 after Python v0.0.50 was released/resolvable.
• CLI PR chore(agents): pin Python v0.0.50 #407 advances the source-workspace pin and directly proves the exact Pytest checkout derives pytest/JUnit under v0.0.50.
• CLI PR chore: release CLI v0.1.131 #408 prepares the release manifest/Core dependency needed for the signed v0.1.131 release.