Ralph/dep 001 docker zig 0152

[gHashTag]

Description

Specification

• Spec file: specs/tri/_____.vibee
• Generated: trinity/output/_____.zig

Golden Chain Checklist

• Created .vibee specification first
• Generated code with ./bin/vibee gen
• Tests pass: zig test trinity/output/_____.zig
• No forbidden files (.html, .css, .js, .ts, .jsx, .tsx)
• No manual edits to trinity/output/

Testing

• zig test passes
• Tested locally

🔥 TOXIC VERDICT

What was done:

What failed:

Metrics:

• Before: ___ | After: ___ | Δ = ___%

Self-criticism:

Score: __/10

🌳 TECH TREE SELECT

[A] Option 1

• Complexity: ★☆☆☆☆
• Potential: +__% to ___

[B] Option 2

• Complexity: ★★☆☆☆
• Potential: +__% to ___

[C] Option 3

• Complexity: ★★★☆☆
• Potential: +__% to ___

Recommendation: [A/B/C] because ___

Related Issues

Closes #

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
trinity	Error		Feb 21, 2026 7:04pm
trinity-site	Error		Feb 21, 2026 7:04pm
trinity-web	Error		Feb 21, 2026 7:04pm
website	Error		Feb 21, 2026 7:04pm

[claude]

PR Review: Ralph/dep-001 Docker + Zig 0.15.2

Summary

This PR adds AGENT MU v8.21 infrastructure (PAS Daemon, Docker, Kubernetes, CI/CD) and updates the VIBEE codegen. Several issues need attention.

---

Critical Issues

1. CLAUDE.md Violation - Hand-written code in src/

Both src/agent_mu/daemon/pas_daemon.zig and src/agent_mu/daemon/sacred_constants.zig are manually created Zig files. CLAUDE.md states clearly:

ALL APPLICATION CODE MUST BE GENERATED FROM .vibee SPECIFICATIONS

No corresponding .vibee spec was added for these files, and they live in src/ rather than trinity/output/. Either add a .vibee spec and regenerate, or move the files to the generated output directory.

2. Wrong Zig API - std.array_list.Managed

pas_daemon.zig uses std.array_list.Managed(AnalysisTask). In Zig 0.15.x the correct type is std.ArrayList(T). std.array_list.Managed does not exist and this will fail to compile.

3. Invalid free in TaskQueue.deinit()

allocator.destroy requires memory originally allocated with allocator.create. Here ctx is a pointer into the ArrayList backing buffer - calling destroy on it is an invalid free / potential double-free. Remove the allocator.destroy(ctx) call.

4. Stack-buffer overflow risk in writeBehaviorAliases

var camel_buf: [256]u8 = undefined; - behavior names longer than 256 characters will silently overflow this buffer. Use std.ArrayList(u8) with the allocator, or add a comptime/runtime bounds check.

---

Moderate Issues

5. Inverted cap logic in updateSacredBoost

On failure the intent is to increase the boost, but capping at max 0.1 means the boost decreases whenever new_boost > 0.1. The guard should be a lower-bound or the comparison should be < 0.1.

6. Vacuous generated tests

expect(true) always passes and gives zero test coverage. Generate a meaningful assertion, or at minimum emit a commented-out TODO placeholder without the expect(true) call.

7. O(n) priority-queue pop

TaskQueue.pop() scans all items to find the highest-priority task. With max_queue_size = 1000 this is tolerable, but using std.PriorityQueue would make the complexity and intent explicit.

8. PR template not filled in

All Golden Chain checklist boxes are unchecked and the spec file fields still show specs/tri/_____.vibee. Please fill these in for traceability, even though the PR is already merged.

---

Security / Ops Issues

9. Unpinned third-party Action

uses: aquasecurity/trivy-action@master - pinning to @master is a supply-chain risk. Use a specific SHA or semver tag (e.g., @0.18.0).

10. RUST_LOG env var for a Zig binary

This variable is only read by the Rust env_logger crate. It has no effect on a Zig binary. Remove it or replace with the correct log-level mechanism for AGENT MU.

11. kubeconfig left on disk after deploy

The decoded kubeconfig is written to the workspace and never deleted. Add a cleanup step using rm -f kubeconfig in an if: always() post-step, or write to a mktemp-generated path.

12. Hardcoded image tag in K8s manifest

image: ghcr.io/ghashtag/trinity/agent-mu:v8.21.0 - the CI deploy-production job uses this hardcoded tag instead of the tag built in CI. These will drift. Use kubectl set image or inject the tag via envsubst before applying.

---

Minor / Positive Notes

• Good: @floatToInt to @intFromFloat fixes in self_scale_agents.vibee are correct for Zig 0.13+.
• DaemonConfig::default() is redundant - Zig struct field defaults already allow .{} initialization.
• checkScaleCooldown lost its pool_id and action parameters - this is a breaking API change. Verify no callers relied on per-pool or per-action filtering.

---

Summary

Severity	Count	Items
Critical	4	Wrong Zig API (compile failure), invalid free, spec violation, buffer overflow
Moderate	4	Inverted boost logic, vacuous tests, O(n) queue, incomplete template
Security/Ops	4	Unpinned Action, wrong env var, kubeconfig leak, hardcoded image tag
Minor	3	Redundant default(), breaking API change, style

The Docker/K8s/CI structure is well-organised. The std.array_list.Managed compile error and the allocator.destroy memory bug are the most urgent items to fix.