agent-v1.7.0 — Failure diagnosis and isolated repair proposals

Shared agents 1.6.0 → 1.7.0 (MINOR): opt-in failure diagnosis and optional isolated repair consumers; both agent images share this version. Existing supported workflows, CLI contracts and historical task results remain compatible.

Diagnosis uses only a configured failed upstream stage, bounded redacted logs and exact-commit source. The launcher claims the failure durably before the model call. Read-only analysis has a read-only selected-source mount and no validation tool. Optional fixes reuse the isolated editor/credential-free validator, protect tests and quality gates, and never make the original CI build pass. No automatic commits, pushes, PRs or deployment of model changes.

GPT-5.6 Sol, Claude Sonnet 5 and Gemini 3.7 Flash each have separate read-only/fix profiles; all six remain pending exact live verification. OpenCode stays pinned to 1.18.20. API delivery failure survives as a separate local error; uncertain claims are not retried. See agent/DIAGNOSIS-SUPPORT.md for narrow v1 repair paths and operator setup.

Verified in PR #46: full fake PostgreSQL suite 1,157 passed / 40 skipped; complete agent suite 290 passed, final diagnosis regressions 39 passed; 29 real offline container checks, six network-disabled pinned profile checks and actual launcher package/Git/Docker CLI smoke checks. No paid calls, runtime activation or deployment.

Published linux/amd64 images (anonymous pull and OCI revision/version verified):

• ghcr.io/steve-droid/driftplain-agent:1.7.0: sha256:90e10d31022e8f214d6a61d8d389b770307ba9db20d5e9876cd5c6cc82f6ef46
• ghcr.io/steve-droid/driftplain-agent-security:1.7.0: sha256:0eee9e8142befd7dcbbe447fe4f09d5c01d1aa9d1a1fffe9d28986e210ad8e3e