@crvouga/dev-fleet 0.3.0 → 0.5.0

package/ansible/ubuntu/baseline.yml

@@ -7,15 +7,13 @@
   vars_files:
     - policy.json
   pre_tasks:
-    - name: Require the supported common release and an explicit non-root user
+    - ansible.builtin.import_tasks: tasks/release.yml
+    - name: Require an explicit non-root user
       ansible.builtin.assert:
         that:
-          - ansible_facts.distribution == 'Ubuntu'
-          - ansible_facts.distribution_version == release
-          - ansible_facts.architecture in ['x86_64', 'aarch64']
           - development_user is match('^[a-z_][a-z0-9_-]{0,31}$')
           - development_user != 'root'
-        fail_msg: Unsupported platform or user; no distribution upgrade is permitted.
+        fail_msg: Unsupported user; name the non-root developer account.
     - name: Read the designated existing account
       ansible.builtin.getent:
         database: passwd
@@ -25,6 +23,7 @@
         that:
           - ansible_facts.getent_passwd[development_user][1] | int == development_uid | int
           - ansible_facts.getent_passwd[development_user][4] == development_home
+    - ansible.builtin.import_tasks: tasks/dpkg.yml
     # Memory and disk safety must land even when the disk is nearly full.
     - ansible.builtin.import_tasks: tasks/resources.yml
     - name: Inspect capacity before package and service changes
@@ -55,32 +54,11 @@
         fail_msg: DOCKER_OWNER_CONFLICT; migrate the existing Docker owner explicitly before applying the Ubuntu-native baseline.
     - name: Inspect existing service ownership
       ansible.builtin.service_facts:
-    - name: Wait for legitimate package transactions before inspecting dpkg
-      ansible.builtin.command:
-        argv:
-          - /usr/bin/python3
-          - '-c'
-          - |
-            import fcntl
-            files = [open(path, 'a') for path in ['/var/lib/dpkg/lock-frontend', '/var/lib/dpkg/lock']]
-            for handle in files:
-                fcntl.lockf(handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
-      register: apt_idle
-      changed_when: false
-      retries: 24
-      delay: 5
-      until: apt_idle.rc == 0
-    - name: Inspect package database consistency
-      ansible.builtin.command: dpkg --audit
-      changed_when: false
-      register: dpkg_audit
-    - name: Require package database recovery before modifying packages
-      ansible.builtin.assert:
-        that: dpkg_audit.stdout | trim == ''
-        fail_msg: APT_STATE_BROKEN; inspect dpkg --audit and use reviewed package recovery. Never remove package lock files.
   tasks:
     - ansible.builtin.import_tasks: tasks/packages.yml
     - ansible.builtin.import_tasks: tasks/docker.yml
+    - ansible.builtin.import_tasks: tasks/browser.yml
+      when: "'web' in worker_tool_profiles | default([])"
     - ansible.builtin.import_tasks: tasks/services.yml
     - ansible.builtin.import_tasks: tasks/power.yml
     - ansible.builtin.import_tasks: tasks/user.yml

package/ansible/ubuntu/disk-gc.py

@@ -11,18 +11,31 @@ What it deletes:
     process is running inside it;
   * Docker images and build cache that no container uses and that are older
     than --docker-age-hours (never containers or volumes);
-  * the apt package cache.
-When a watched filesystem has less than --pressure-mib free, idle checkouts
+  * the apt package cache;
+  * agent worktrees under each --worktree-root that nobody has used for
+    --worktree-idle-days, only when Git says they hold no uncommitted,
+    untracked or unpushed work and no process runs in them (the branch is
+    kept);
+  * the oldest files of each --cache-cap DIR=MIB cache beyond its size;
+  * all but the newest N files of each --keep-newest DIR=N directory (the
+    downloaded T3 packages: the current one and the previous one);
+  * tool versions no mise configuration uses (--mise, run as --user).
+When a watched filesystem has less than --pressure-mib free, or less than
+--pressure-inode-percent of its inodes free, idle checkouts
 qualify after --pressure-idle-hours, Docker leftovers after
 --pressure-docker-age-hours, and aged entries of each --pressure-cache
 directory are removed too.
 
-It never deletes a checkout, a tracked file, uncommitted work, a container or
-a volume. Every decision is one JSON line on stdout.
+It never deletes a main checkout, a tracked file, uncommitted or unpushed
+work, a container or a volume. Every decision is one JSON line on stdout, and
+the last one says how many MiB were reclaimed.
 
 Usage: disk-gc.py --home H [--path P ...] [--idle-days N] [--pressure-mib N]
-                  [--pressure-idle-hours N] [--docker-age-hours N]
+                  [--pressure-inode-percent N] [--pressure-idle-hours N] [--docker-age-hours N]
                   [--pressure-docker-age-hours N] [--pressure-cache DIR ...]
+                  [--worktree-root DIR ...] [--worktree-idle-days N]
+                  [--cache-cap DIR=MIB ...] [--keep-newest DIR=N ...]
+                  [--mise PATH] [--user NAME]
                   [--max-depth N] [--proc DIR] [--home-only] [--dry-run]
 
 --home-only skips the machine-wide Docker and apt steps.
@@ -61,6 +74,25 @@ def free_bytes(path):
     return st.f_bavail * st.f_frsize
 
 
+def free_inodes_percent(path):
+    """Free inodes as a percentage; None on a filesystem without a fixed count."""
+    st = os.statvfs(path)
+    if st.f_files <= 0:
+        return None
+    return st.f_favail * 100 / st.f_files
+
+
+def under_pressure(paths, pressure_bytes, inode_percent):
+    """Any watched filesystem short of free bytes or of free inodes."""
+    for path in paths:
+        if free_bytes(path) < pressure_bytes:
+            return True
+        inodes = free_inodes_percent(path)
+        if inodes is not None and inodes < inode_percent:
+            return True
+    return False
+
+
 def mtime(path):
     try:
         return os.lstat(path).st_mtime
@@ -277,6 +309,150 @@ def collect_cache(directory, age_seconds, now, dry_run):
     return freed
 
 
+def linked_worktrees(root, max_depth=3):
+    """Linked worktrees (a .git file, never a repository) under root."""
+    found = []
+
+    def walk(directory, depth):
+        dot_git = os.path.join(directory, '.git')
+        if os.path.lexists(dot_git):
+            if not is_real_dir(dot_git) and not os.path.islink(dot_git):
+                found.append(directory)
+            return
+        if depth >= max_depth:
+            return
+        try:
+            entries = list(os.scandir(directory))
+        except OSError:
+            return
+        for entry in entries:
+            if entry.is_dir(follow_symlinks=False) and entry.name not in REGENERABLE:
+                walk(entry.path, depth + 1)
+
+    walk(root, 0)
+    return sorted(found)
+
+
+def unsaved_work(worktree):
+    """Why Git cannot vouch for a worktree, or None when everything in it is
+    committed and every commit is on a remote."""
+    status = run_git(worktree, ['status', '--porcelain=v1', '-z', '--untracked-files=all'])
+    if status is None or status.returncode != 0:
+        return 'git_status_failed'
+    if status.stdout.strip(b'\0'):
+        return 'uncommitted'
+    unpushed = run_git(worktree, ['rev-list', '-n', '1', 'HEAD', '--not', '--remotes'])
+    if unpushed is None or unpushed.returncode != 0:
+        return 'git_rev_list_failed'
+    if unpushed.stdout.strip():
+        return 'unpushed'
+    return None
+
+
+def collect_worktrees(root, idle_seconds, proc, now, dry_run):
+    roots = busy_roots(proc)
+    freed = 0
+    for worktree in linked_worktrees(root):
+        gdir = git_dir(worktree)
+        if gdir is None or in_use(worktree, roots):
+            continue
+        if now - git_activity(worktree, gdir) < idle_seconds:
+            continue
+        latest = last_activity(worktree, gdir, [])
+        if latest is None or now - latest < idle_seconds:
+            continue
+        reason = unsaved_work(worktree)
+        if reason:
+            log(event='worktree_kept', worktree=worktree, reason=reason)
+            continue
+        size = size_of(worktree)
+        if not dry_run:
+            common = run_git(worktree, ['rev-parse', '--path-format=absolute', '--git-common-dir'])
+            if common is None or common.returncode != 0:
+                continue
+            out = subprocess.run(
+                GIT + ['--git-dir', common.stdout.decode().strip(), 'worktree', 'remove', '--force', worktree],
+                capture_output=True, timeout=600)
+            if out.returncode != 0 or os.path.lexists(worktree):
+                log(event='worktree_kept', worktree=worktree, reason='git_worktree_remove_failed')
+                continue
+        freed += size
+        log(event='worktree_removed', worktree=worktree, mib=size // MIB, dry_run=dry_run)
+    return freed
+
+
+def files_under(directory):
+    """Every regular file under directory, never through a link."""
+    found = []
+    for current, dirs, files in os.walk(directory):
+        dirs[:] = [d for d in dirs if not os.path.islink(os.path.join(current, d))]
+        for name in files:
+            path = os.path.join(current, name)
+            try:
+                st = os.lstat(path)
+            except OSError:
+                continue
+            if stat.S_ISREG(st.st_mode):
+                found.append((st.st_mtime, st.st_blocks * 512, path))
+    return found
+
+
+def unlink(path, dry_run):
+    if dry_run:
+        return True
+    try:
+        os.unlink(path)
+        return True
+    except OSError:
+        return False
+
+
+def cap_cache(directory, cap_bytes, dry_run):
+    """Removes the oldest files of a cache until it fits its cap."""
+    entries = sorted(files_under(directory))
+    total = sum(size for _, size, _ in entries)
+    freed = 0
+    for _, size, path in entries:
+        if total - freed <= cap_bytes:
+            break
+        if unlink(path, dry_run):
+            freed += size
+    if not dry_run:
+        for current, dirs, files in os.walk(directory, topdown=False):
+            if current != directory and not dirs and not files:
+                try:
+                    os.rmdir(current)
+                except OSError:
+                    pass
+    if freed:
+        log(event='cache_capped', cache=directory, mib=freed // MIB,
+            cap_mib=cap_bytes // MIB, dry_run=dry_run)
+    return freed
+
+
+def keep_newest(directory, count, dry_run):
+    """Removes all but the newest count files directly in directory."""
+    try:
+        entries = [e for e in os.scandir(directory) if e.is_file(follow_symlinks=False)]
+    except OSError:
+        return 0
+    entries.sort(key=lambda e: e.stat(follow_symlinks=False).st_mtime, reverse=True)
+    freed = 0
+    for entry in entries[count:]:
+        size = entry.stat(follow_symlinks=False).st_blocks * 512
+        if unlink(entry.path, dry_run):
+            freed += size
+            log(event='superseded_removed', path=entry.path, mib=size // MIB, dry_run=dry_run)
+    return freed
+
+
+def pair(text, kind):
+    name, _, value = text.rpartition('=')
+    if not name:
+        raise argparse.ArgumentTypeError(f'expected DIR={kind}')
+    return name, int(value)
+
+
 def command(argv, dry_run, name):
     if shutil.which(argv[0]) is None:
         return
@@ -296,10 +472,19 @@ def main(argv):
     parser.add_argument('--path', action='append', default=[])
     parser.add_argument('--idle-days', type=float, default=7)
     parser.add_argument('--pressure-mib', type=int, default=15360)
+    parser.add_argument('--pressure-inode-percent', type=float, default=0)
     parser.add_argument('--pressure-idle-hours', type=float, default=12)
     parser.add_argument('--docker-age-hours', type=int, default=168)
     parser.add_argument('--pressure-docker-age-hours', type=int, default=24)
     parser.add_argument('--pressure-cache', action='append', default=[])
+    parser.add_argument('--worktree-root', action='append', default=[])
+    parser.add_argument('--worktree-idle-days', type=float, default=30)
+    parser.add_argument('--cache-cap', action='append', default=[],
+                        type=lambda text: pair(text, 'MIB'))
+    parser.add_argument('--keep-newest', action='append', default=[],
+                        type=lambda text: pair(text, 'N'))
+    parser.add_argument('--mise')
+    parser.add_argument('--user')
     parser.add_argument('--max-depth', type=int, default=4)
     parser.add_argument('--proc', default='/proc')
     parser.add_argument('--home-only', action='store_true')
@@ -309,7 +494,8 @@ def main(argv):
     paths = args.path or ['/', home]
     now = time.time()
     before = {p: free_bytes(p) for p in paths}
-    pressure = min(before.values()) < args.pressure_mib * MIB
+    pressure = under_pressure(paths, args.pressure_mib * MIB,
+                              args.pressure_inode_percent)
     idle = args.pressure_idle_hours * HOUR if pressure else args.idle_days * 24 * HOUR
     docker_age = args.pressure_docker_age_hours if pressure else args.docker_age_hours
     log(event='started', pressure=pressure, idle_hours=idle / HOUR,
@@ -320,6 +506,23 @@ def main(argv):
     if pressure:
         for cache in args.pressure_cache:
             freed += collect_cache(os.path.join(home, cache), idle, now, args.dry_run)
+    reclaimed = freed
+    for root in args.worktree_root:
+        reclaimed += collect_worktrees(os.path.join(home, root),
+                                       args.worktree_idle_days * 24 * HOUR,
+                                       args.proc, now, args.dry_run)
+    for cache, cap_mib in args.cache_cap:
+        reclaimed += cap_cache(os.path.join(home, cache), cap_mib * MIB, args.dry_run)
+    for directory, count in args.keep_newest:
+        reclaimed += keep_newest(os.path.join(home, directory), count, args.dry_run)
+    if args.mise:
+        installs = os.path.join(home, '.local', 'share', 'mise', 'installs')
+        before_mise = size_of(installs)
+        prune = [args.mise, 'prune', '--yes']
+        if args.user:
+            prune = ['runuser', '-u', args.user, '--', 'env', f'HOME={home}'] + prune
+        command(prune, args.dry_run, 'mise_prune')
+        reclaimed += max(0, before_mise - size_of(installs))
     if not args.home_only:
         command(['docker', 'image', 'prune', '--all', '--force', '--filter',
                  f'until={docker_age}h'], args.dry_run, 'docker_images')
@@ -328,7 +531,8 @@ def main(argv):
         command(['apt-get', 'clean'], args.dry_run, 'apt_cache')
 
     after = {p: free_bytes(p) for p in paths}
-    log(event='finished', checkout_mib=freed // MIB, dry_run=args.dry_run,
+    log(event='finished', checkout_mib=freed // MIB,
+        reclaimed_mib=reclaimed // MIB, dry_run=args.dry_run,
         free_mib={p: v // MIB for p, v in after.items()})
 
 

package/ansible/ubuntu/disk-guard.py

@@ -3,14 +3,15 @@
 
 Managed by personal fleet-sync (tasks/resources.yml) as
 personal-fleet-disk-guard.service. Every interval it measures free space on the
-watched filesystems and the bytes each leaf cgroup under user.slice wrote. When
-any watched filesystem is below the floor, it kills only the single cgroup that
+watched filesystems (bytes and inodes) and the bytes each leaf cgroup under user.slice wrote. When
+any watched filesystem is below the floor of free bytes or of free inodes, it
+kills only the single cgroup that
 wrote the most during the last interval, and only if that is at least the write
 threshold. It never deletes files, never touches system services and never
 kills idle work. Free space must be recovered by a person.
 
-Usage: disk-guard.py --path / --path /home/me [--floor-mib N] [--write-mib N]
-                     [--interval S] [--cgroup-root DIR] [--dry-run]
+Usage: disk-guard.py --path / --path /home/me [--floor-mib N]
+                     [--inode-floor-percent N] [--write-mib N] [--interval S] [--cgroup-root DIR] [--dry-run]
 """
 import argparse
 import json
@@ -61,6 +62,21 @@ def free_bytes(path):
     return st.f_bavail * st.f_frsize
 
 
+def free_inodes_percent(path):
+    """Free inodes as a percentage; None on a filesystem without a fixed count."""
+    st = os.statvfs(path)
+    if st.f_files <= 0:
+        return None
+    return st.f_favail * 100 / st.f_files
+
+
+def low_paths(free, inodes, floor, inode_floor):
+    """The watched paths below either floor: bytes, or free inodes in percent."""
+    return [path for path in free
+            if free[path] < floor
+            or (inodes.get(path) is not None and inodes[path] < inode_floor)]
+
+
 def log(**event):
     print(json.dumps(event, sort_keys=True), flush=True)
 
@@ -69,6 +85,7 @@ def main(argv):
     parser = argparse.ArgumentParser()
     parser.add_argument('--path', action='append', required=True)
     parser.add_argument('--floor-mib', type=int, default=3072)
+    parser.add_argument('--inode-floor-percent', type=float, default=2)
     parser.add_argument('--write-mib', type=int, default=32)
     parser.add_argument('--interval', type=float, default=5.0)
     parser.add_argument('--cgroup-root', default='/sys/fs/cgroup/user.slice')
@@ -76,6 +93,7 @@ def main(argv):
     args = parser.parse_args(argv)
     floor, threshold = args.floor_mib * MIB, args.write_mib * MIB
     log(event='started', paths=args.path, floor_mib=args.floor_mib,
+        inode_floor_percent=args.inode_floor_percent,
         write_mib=args.write_mib, interval=args.interval, dry_run=args.dry_run)
     previous = leaf_writes(args.cgroup_root)
     while True:
@@ -83,7 +101,8 @@ def main(argv):
         try:
             current = leaf_writes(args.cgroup_root)
             free = {path: free_bytes(path) for path in args.path}
-            low = [path for path, value in free.items() if value < floor]
+            inodes = {path: free_inodes_percent(path) for path in args.path}
+            low = low_paths(free, inodes, floor, args.inode_floor_percent)
             victim = choose_victim(previous, current, bool(low), threshold)
             previous = current
             if victim is None:

package/ansible/ubuntu/policy.json

@@ -1,7 +1,12 @@
 {
   "version": 1,
-  "release": "26.04",
-  "architectures": ["amd64", "arm64"],
+  "releases": [
+    {
+      "release": "26.04",
+      "codename": "resolute",
+      "architectures": ["amd64", "arm64"]
+    }
+  ],
   "snapshot": "20261101T000000Z",
   "packages": {
     "sudo": "1.9.17p2-1ubuntu3.2",
@@ -17,7 +22,8 @@
     "python3": "3.14.3-0ubuntu2",
     "unzip": "6.0-29ubuntu1",
     "xz-utils": "5.8.3-1ubuntu0.1",
-    "ansible-core": "2.20.1-1"
+    "ansible-core": "2.20.1-1",
+    "systemd-oomd": "259.9-0ubuntu0.1"
   },
   "tailscale": {
     "version": "1.104.5",
@@ -47,7 +53,65 @@
     "diskGcDockerAgeHours": 168,
     "diskGcPressureDockerAgeHours": 24,
     "diskGcPressureCaches": [".bun/install/cache"],
+    "diskGcWorktreeRoots": [".t3/worktrees"],
+    "diskGcWorktreeIdleDays": 30,
+    "diskGcCacheCapsMiB": {
+      ".bun/install/cache": 4096,
+      ".npm/_cacache": 2048,
+      ".cache/uv": 4096,
+      ".cache/pip": 1024
+    },
+    "diskGcPackagesKept": 2,
     "dockerLogMaxSize": "50m",
-    "dockerLogMaxFiles": "3"
+    "dockerLogMaxFiles": "3",
+    "inodeWarnFreePercent": 10,
+    "inodeFailFreePercent": 2
+  },
+  "clock": {
+    "warnOffsetSeconds": 2,
+    "failOffsetSeconds": 30
+  },
+  "rebootPendingFailDays": 14,
+  "dockerSmokeTest": {
+    "image": "busybox:1.37.0@sha256:a7dbc319b1438115a207e11930dc4bb3e643dcb3ec0bdd694bb36cd8fad289ec",
+    "timeoutSeconds": 60
+  },
+  "browser": {
+    "packages": {
+      "fonts-liberation": "1:2.1.5-3build1",
+      "libasound2t64": "1.2.15.3-1ubuntu1.1",
+      "libatk-bridge2.0-0t64": "2.60.4-0ubuntu0.1",
+      "libatk1.0-0t64": "2.60.4-0ubuntu0.1",
+      "libatspi2.0-0t64": "2.60.4-0ubuntu0.1",
+      "libcairo2": "1.18.4-3",
+      "libcups2t64": "2.4.16-1ubuntu1.3",
+      "libdbus-1-3": "1.16.2-2ubuntu4",
+      "libdrm2": "2.4.131-1",
+      "libgbm1": "26.0.8-1ubuntu0.3",
+      "libglib2.0-0t64": "2.88.0-1ubuntu0.1",
+      "libnspr4": "2:4.38.2-1ubuntu1",
+      "libnss3": "2:3.120-1ubuntu2.2",
+      "libpango-1.0-0": "1.57.0-1",
+      "libx11-6": "2:1.8.13-1ubuntu0.1",
+      "libxcb1": "1.17.0-2ubuntu1",
+      "libxcomposite1": "1:0.4.6-1build1",
+      "libxdamage1": "1:1.1.7-1",
+      "libxext6": "2:1.3.4-1build3",
+      "libxfixes3": "1:6.0.0-2build2",
+      "libxkbcommon0": "1.13.1-1",
+      "libxrandr2": "2:1.5.4-1build1"
+    },
+    "headlessShell": {
+      "version": "158.0.8127.18",
+      "amd64": {
+        "archive": "linux64/chrome-headless-shell-linux64",
+        "sha256": "18352d22cb0cdf520cbff2ad8c41391f0e02a72886cb53b0fde4bdfc4bd075d6"
+      },
+      "arm64": {
+        "archive": "linux-arm64/chrome-headless-shell-linux-arm64",
+        "sha256": "b136462898353d94c7fab50f9cdaa6d8f0d4c190153916936aa0a03353a26bf2"
+      }
+    },
+    "launchTimeoutSeconds": 60
   }
 }

package/ansible/ubuntu/t3-desktop.yml

@@ -4,8 +4,8 @@
 # unit starts the app with the graphical session, so the UI is on screen and the
 # server is up after every boot. Starting or migrating is left to fleet-sync.
 #
-# The upstream .deb declares libxss1, which Ubuntu 26.04 no longer ships and the
-# binary does not link. Instead of patching the package or leaving apt with an
+# The upstream .deb declares libxss1, which current Ubuntu releases no longer
+# ship and the binary does not link. Instead of patching the package or leaving apt with an
 # unmet dependency, the verified package payload is unpacked to its own path and
 # its real runtime libraries and bundled AppArmor profile are installed.
 - name: Install the pinned T3 Code desktop app and start it with the session

package/ansible/ubuntu/tailscale.yml

@@ -8,17 +8,28 @@
   vars_files:
     - policy.json
   tasks:
-    - name: Require supported Ubuntu
-      ansible.builtin.assert:
-        that:
-          - ansible_facts.distribution == 'Ubuntu'
-          - ansible_facts.distribution_version == release
+    - ansible.builtin.import_tasks: tasks/release.yml
     - name: Inspect installed packages before possible network interruption
       ansible.builtin.package_facts:
         manager: apt
-    - name: Require maintenance for an installed version change
+    # The pin is a minimum: a newer Tailscale is kept and reported as a
+    # warning by the worker checks; an older one needs a maintenance window.
+    - name: Compare the installed Tailscale with its pin
+      ansible.builtin.command:
+        argv:
+          - dpkg
+          - --compare-versions
+          - '{{ ansible_facts.packages.tailscale[0].version }}'
+          - ge
+          - '{{ tailscale.version }}'
+      register: tailscale_pin
+      changed_when: false
+      failed_when: tailscale_pin.rc not in [0, 1]
+      check_mode: false
+      when: "'tailscale' in ansible_facts.packages"
+    - name: Require maintenance for an upgrade to the pin
       ansible.builtin.assert:
-        that: "'tailscale' not in ansible_facts.packages or ansible_facts.packages.tailscale[0].version == tailscale.version"
+        that: "'tailscale' not in ansible_facts.packages or tailscale_pin.rc == 0"
         fail_msg: TAILSCALE_UPGRADE_PENDING; upgrading an active VPN can disconnect SSH. Review an explicit maintenance operation.
     - name: Inspect existing package-source ownership before writing
       ansible.builtin.find:
@@ -35,7 +46,7 @@
         fail_msg: TAILSCALE_SOURCE_OWNER_CONFLICT; review the existing signed source and its migration before creating another repository entry.
     - name: Install pinned upstream signing key
       ansible.builtin.get_url:
-        url: https://pkgs.tailscale.com/stable/ubuntu/resolute.noarmor.gpg
+        url: https://pkgs.tailscale.com/stable/ubuntu/{{ ubuntu_release.codename }}.noarmor.gpg
         dest: /usr/share/keyrings/tailscale-archive-keyring.gpg
         checksum: 'sha256:{{ tailscale.keySha256 }}'
         owner: root
@@ -44,7 +55,7 @@
         timeout: 30
     - name: Declare the signed upstream package source
       ansible.builtin.apt_repository:
-        repo: deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu resolute main
+        repo: deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu {{ ubuntu_release.codename }} main
         filename: tailscale
         state: present
         update_cache: false

package/ansible/ubuntu/tasks/browser.yml

@@ -0,0 +1,56 @@
+---
+# Headless Chromium for browser tests (Playwright, Storybook, end-to-end
+# suites): the system libraries it loads, at the snapshot's exact versions,
+# and one pinned Chrome Headless Shell build. Applied to workers that select
+# the web tool profile; the launch below backs worker:browser.
+- name: Install the exact libraries headless Chromium loads
+  ansible.builtin.apt:
+    name: '{{ item.key }}={{ item.value }}'
+    state: present
+    lock_timeout: '{{ aptLockTimeoutSeconds }}'
+    allow_downgrade: false
+    allow_unauthenticated: false
+    fail_on_autoremove: true
+    policy_rc_d: 101
+  environment:
+    APT_CONFIG: /etc/personal-fleet/apt.conf
+  loop: '{{ browser.packages | dict2items }}'
+- name: Name the headless shell build of this architecture
+  ansible.builtin.set_fact:
+    browser_build: "{{ browser.headlessShell['arm64' if ansible_facts.architecture == 'aarch64' else 'amd64'] }}"
+    browser_root: '/opt/personal-fleet/browser/{{ browser.headlessShell.version }}'
+- name: Create the package cache and the browser directory
+  ansible.builtin.file:
+    path: '{{ item }}'
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  loop:
+    - /var/cache/personal-fleet
+    - '{{ browser_root }}'
+- name: Download the pinned headless shell
+  ansible.builtin.get_url:
+    url: 'https://cdn.playwright.dev/builds/cft/{{ browser.headlessShell.version }}/{{ browser_build.archive }}.zip'
+    dest: '/var/cache/personal-fleet/chrome-headless-shell-{{ browser.headlessShell.version }}-{{ browser_build.archive | basename }}.zip'
+    checksum: 'sha256:{{ browser_build.sha256 }}'
+    mode: '0644'
+    timeout: 300
+- name: Unpack the verified headless shell
+  ansible.builtin.unarchive:
+    src: '/var/cache/personal-fleet/chrome-headless-shell-{{ browser.headlessShell.version }}-{{ browser_build.archive | basename }}.zip'
+    dest: '{{ browser_root }}'
+    remote_src: true
+    creates: '{{ browser_root }}/{{ browser_build.archive | basename }}/chrome-headless-shell'
+- name: Launch headless as the developer, load a blank page and exit (BROWSER_LAUNCH_FAILED)
+  ansible.builtin.command:
+    argv:
+      - '{{ browser_root }}/{{ browser_build.archive | basename }}/chrome-headless-shell'
+      - --headless
+      - --no-sandbox
+      - --disable-gpu
+      - --dump-dom
+      - about:blank
+  become_user: '{{ development_user }}'
+  timeout: '{{ browser.launchTimeoutSeconds }}'
+  changed_when: false

package/ansible/ubuntu/tasks/docker.yml

@@ -29,3 +29,55 @@
     - [docker, compose, version]
     - [docker, buildx, version]
   changed_when: false
+# The engine answering is not proof that an agent can use it: run a pinned
+# image and build a one-line image as the developer, in a fresh session that
+# reads the docker group from scratch. The image is cached here so the same
+# test works offline in worker:docker-run.
+- name: Look for the cached smoke-test image
+  ansible.builtin.command:
+    argv:
+      [
+        docker,
+        image,
+        inspect,
+        --format,
+        '{{ "{{.Id}}" }}',
+        '{{ dockerSmokeTest.image }}',
+      ]
+  become_user: '{{ development_user }}'
+  check_mode: false
+  changed_when: false
+  failed_when: false
+  register: docker_smoke_image
+- name: Cache the pinned smoke-test image
+  ansible.builtin.command:
+    argv: [docker, pull, --quiet, '{{ dockerSmokeTest.image }}']
+  become_user: '{{ development_user }}'
+  when: docker_smoke_image.rc | default(0) != 0
+  changed_when: true
+- name: Run a container as the developer, offline (DOCKER_RUN_FAILED)
+  ansible.builtin.command:
+    argv:
+      [
+        docker,
+        run,
+        --rm,
+        --network,
+        none,
+        --pull,
+        never,
+        '{{ dockerSmokeTest.image }}',
+        'true',
+      ]
+  become_user: '{{ development_user }}'
+  timeout: '{{ dockerSmokeTest.timeoutSeconds }}'
+  changed_when: false
+- name: Build a one-line image as the developer, offline (DOCKER_BUILD_FAILED)
+  ansible.builtin.command:
+    argv: [docker, build, --quiet, --pull=false, --network, none, '-']
+    stdin: |
+      FROM {{ dockerSmokeTest.image }}
+      RUN true
+  become_user: '{{ development_user }}'
+  timeout: '{{ dockerSmokeTest.timeoutSeconds }}'
+  changed_when: false