@crvouga/dev-fleet 0.8.0 → 0.9.0

package/bootstrap/release-notes.ts

@@ -0,0 +1,88 @@
+/**
+ * The notes of a release, from the Conventional Commits since the last
+ * release tag. A commit whose change restarts T3 on the workers, and so ends
+ * the agent turns running there, says so in a footer:
+ *
+ *   Worker-Restart: the T3 desktop app is replaced
+ *
+ * and the notes put it first, so whoever installs the release knows to wait
+ * for the agents to finish.
+ *
+ *   bun bootstrap/release-notes.ts > notes.md
+ */
+import { spawnSync } from 'node:child_process';
+import type { Git } from './release-version';
+
+const SUBJECT = /^(\w+)(?:\(([^)]*)\))?(!)?:\s*(.+)$/;
+const BREAKING_FOOTER = /^BREAKING[ -]CHANGE:\s*(.+)$/m;
+const RESTART_FOOTER = /^Worker-Restart:\s*(.+)$/m;
+
+const SECTIONS: [string, (type: string) => boolean][] = [
+  ['Features', (type) => type === 'feat'],
+  ['Fixes', (type) => type === 'fix'],
+  ['Other changes', () => true],
+];
+
+export function releaseNotes(messages: string[]): string {
+  const restarts: string[] = [];
+  const breaking: string[] = [];
+  const sections = new Map<string, string[]>(
+    SECTIONS.map(([title]) => [title, []])
+  );
+  for (const message of messages) {
+    const subject = message.split('\n', 1)[0]!.trim();
+    // A merge commit only joins commits already listed.
+    if (/^Merge (pull request|branch) /.test(subject)) continue;
+    const parsed = SUBJECT.exec(subject);
+    const type = parsed?.[1] ?? '';
+    const scope = parsed?.[2];
+    const text = parsed?.[4] ?? subject;
+    const entry = scope ? `**${scope}:** ${text}` : text;
+    const restart = RESTART_FOOTER.exec(message)?.[1];
+    if (restart) restarts.push(`${entry} (${restart.trim()})`);
+    const footer = BREAKING_FOOTER.exec(message)?.[1];
+    if (parsed?.[3] || footer)
+      breaking.push(footer ? `${entry}: ${footer.trim()}` : entry);
+    const [title] = SECTIONS.find(([, matches]) => matches(type))!;
+    sections.get(title)!.push(entry);
+  }
+  const blocks: string[] = [];
+  const block = (title: string, entries: string[]) => {
+    if (entries.length)
+      blocks.push(
+        `## ${title}\n\n${entries.map((entry) => `- ${entry}`).join('\n')}`
+      );
+  };
+  block('Requires a worker restart (ends agent turns)', restarts);
+  block('Breaking changes', breaking);
+  for (const [title] of SECTIONS) block(title, sections.get(title)!);
+  return blocks.length ? `${blocks.join('\n\n')}\n` : 'No changes.\n';
+}
+
+/** The messages of the commits since the newest release tag, newest first. */
+export function messagesSinceRelease(git: Git): string[] {
+  // A hand-pushed tag releases HEAD itself: the last release is the one before.
+  const tags = (git(['tag', '--list', 'v*', '--sort=-v:refname']) ?? '')
+    .split('\n')
+    .map((tag) => tag.trim())
+    .filter((tag) => /^v\d+\.\d+\.\d+$/.test(tag));
+  const tag =
+    tags.find(
+      (candidate) =>
+        git(['merge-base', '--is-ancestor', 'HEAD', candidate]) === null
+    ) ?? null;
+  const log =
+    git(['log', '--format=%B%x00', tag ? `${tag}..HEAD` : 'HEAD']) ?? '';
+  return log
+    .split('\0')
+    .map((message) => message.trim())
+    .filter(Boolean);
+}
+
+if (import.meta.main) {
+  const git: Git = (args) => {
+    const result = spawnSync('git', args, { encoding: 'utf8' });
+    return result.status === 0 ? (result.stdout ?? '') : null;
+  };
+  process.stdout.write(releaseNotes(messagesSinceRelease(git)));
+}

package/bootstrap/release-version.ts

@@ -12,6 +12,10 @@
  *   `feat:`                         minor
  *   anything else                   patch
  *
+ * A `HEAD` that already carries its release tag is released again when that
+ * tag has no GitHub Release: a run that pushed the tag and then failed is
+ * finished by any re-run of it, not only by re-running its failed jobs.
+ *
  * Exits 1 when nothing can be released because publishing was never set up
  * (no tag and nothing on npm), so the Release workflow does not report a
  * skipped release as a success.
@@ -62,13 +66,16 @@ export function bumpVersion(tag: string, bump: Bump): string {
   return `${major}.${minor + 1}.0`;
 }
 
+function releaseTags(listed: string | null): string[] {
+  return (listed ?? '')
+    .split('\n')
+    .map((tag) => tag.trim())
+    .filter((tag) => TAG.test(tag));
+}
+
 export function latestTag(git: Git): string | null {
-  const tags = git(['tag', '--list', 'v*', '--sort=-v:refname']) ?? '';
   return (
-    tags
-      .split('\n')
-      .map((tag) => tag.trim())
-      .find((tag) => TAG.test(tag)) ?? null
+    releaseTags(git(['tag', '--list', 'v*', '--sort=-v:refname']))[0] ?? null
   );
 }
 
@@ -81,11 +88,30 @@ export function newestPublished(versions: string[]): string | null {
   return stable[0]?.join('.') ?? null;
 }
 
+/** Whether the release tag has its GitHub Release. */
+export type Finished = (tag: string) => boolean;
+
 /**
  * `published` is the newest stable version on npm, or null when the package
  * is not there.
  */
-export function decide(git: Git, published: string | null = null): Decision {
+export function decide(
+  git: Git,
+  published: string | null = null,
+  finished: Finished = () => true
+): Decision {
+  const unfinished = releaseTags(
+    git(['tag', '--list', 'v*', '--points-at', 'HEAD', '--sort=-v:refname'])
+  ).find((tag) => !finished(tag));
+  if (unfinished)
+    return {
+      release: true,
+      version: unfinished.slice(1),
+      previous:
+        releaseTags(git(['tag', '--list', 'v*', '--sort=-v:refname'])).find(
+          (tag) => tag !== unfinished
+        ) ?? unfinished,
+    };
   const tag = latestTag(git);
   if (!tag && !published)
     return {
@@ -136,8 +162,16 @@ function npmVersions(): string[] {
       : [];
 }
 
+/** Whether the tag has a GitHub Release, as `gh` sees it with the run's token. */
+const hasGitHubRelease: Finished = (tag) =>
+  spawnSync('gh', ['release', 'view', tag], { stdio: 'ignore' }).status === 0;
+
 if (import.meta.main) {
-  const decision = decide(system, newestPublished(npmVersions()));
+  const decision = decide(
+    system,
+    newestPublished(npmVersions()),
+    hasGitHubRelease
+  );
   const summary = process.env['GITHUB_STEP_SUMMARY'];
   const note = (line: string) => {
     if (summary) appendFileSync(summary, `${line}\n`);

package/bootstrap/worker-features.ts

@@ -0,0 +1,114 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+/** How a worker runs T3: `desktop`, the pinned desktop app in an auto-login
+ * graphical session, or `headless`, the pinned native server as a lingering
+ * user service with no display manager (docs/worker-contract.md).
+ */
+export const SESSIONS = ['desktop', 'headless'] as const;
+export type Session = (typeof SESSIONS)[number];
+
+/** What a worker is built with beyond the base that every worker has. */
+export interface WorkerFeatures {
+  /** Docker: its packages, service, group membership, CLI and clean-up. */
+  containers: boolean;
+  session: Session;
+}
+
+/** A fleet that names no feature gets exactly what every worker had before
+ * features existed. */
+export const DEFAULT_FEATURES: WorkerFeatures = {
+  containers: true,
+  session: 'desktop',
+};
+
+/** Named sets of features. `editing` is a worker for remote code editing by
+ * agents: no containers, no desktop, and only the base tools (it adds no
+ * tool profile).
+ */
+export const PRESETS = {
+  editing: { containers: false, session: 'headless' },
+} as const satisfies Record<string, WorkerFeatures>;
+export type Preset = keyof typeof PRESETS;
+
+const record = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);
+
+/** The first field of a `features` block that breaks its rule, with what
+ * it expects; null when the block is valid. */
+export function featuresFault(
+  value: unknown
+): { field: string; expected: string } | null {
+  if (!record(value)) return { field: '', expected: 'an object' };
+  const expected: Record<string, string> = {
+    preset: `one of ${Object.keys(PRESETS).join(', ')}`,
+    containers: 'true or false',
+    session: `one of ${SESSIONS.join(', ')}`,
+  };
+  const unknown = Object.keys(value).find((key) => !(key in expected));
+  if (unknown !== undefined)
+    return { field: unknown, expected: 'preset, containers or session' };
+  const valid: Record<string, (item: unknown) => boolean> = {
+    preset: (item) => typeof item === 'string' && Object.hasOwn(PRESETS, item),
+    containers: (item) => typeof item === 'boolean',
+    session: (item) => SESSIONS.includes(item as Session),
+  };
+  const field = Object.keys(value).find((key) => !valid[key]!(value[key]));
+  return field === undefined ? null : { field, expected: expected[field]! };
+}
+
+/** One block over the features before it: its preset, then its own fields. */
+function over(base: WorkerFeatures, block: unknown): WorkerFeatures {
+  if (!record(block)) return base;
+  const preset =
+    typeof block['preset'] === 'string' &&
+    Object.hasOwn(PRESETS, block['preset'])
+      ? PRESETS[block['preset'] as Preset]
+      : {};
+  return {
+    ...base,
+    ...preset,
+    ...(typeof block['containers'] === 'boolean'
+      ? { containers: block['containers'] }
+      : {}),
+    ...(SESSIONS.includes(block['session'] as Session)
+      ? { session: block['session'] as Session }
+      : {}),
+  };
+}
+
+/** The features of one worker: the defaults, then the fleet-wide
+ * `worker.features`, then the worker's own `features`, each with its preset
+ * first. Read from the plain document, so the bootstrap needs no fleet code.
+ */
+export function workerFeatures(
+  definition: unknown,
+  node?: string
+): WorkerFeatures {
+  if (!record(definition)) return DEFAULT_FEATURES;
+  const policy = record(definition['worker']) ? definition['worker'] : {};
+  const workers: unknown[] = Array.isArray(definition['workers'])
+    ? definition['workers']
+    : [];
+  const own = workers
+    .filter(record)
+    .find((entry) => node !== undefined && entry['id'] === node);
+  return over(over(DEFAULT_FEATURES, policy['features']), own?.['features']);
+}
+
+/** The features of this worker in the fleet configuration fleet-sync
+ * installed; the defaults when there is none yet.
+ */
+export function installedFeatures(
+  node: string | undefined,
+  home: string = homedir()
+): WorkerFeatures {
+  const path = join(home, '.config/dev-fleet/fleet.json');
+  if (!existsSync(path)) return DEFAULT_FEATURES;
+  try {
+    return workerFeatures(JSON.parse(readFileSync(path, 'utf8')), node);
+  } catch {
+    return DEFAULT_FEATURES;
+  }
+}

package/bootstrap/worker-seed.yaml

@@ -2,9 +2,12 @@
 # fleet-node-seed fills each ${NAME} with a value of the worker it seeds:
 # values from fleet.json, the manager's public key, a host key generated for
 # the machine, the Tailscale version and key digest ansible/ubuntu/policy.json
-# pins, and a short-lived single-use auth key that is deleted once the machine
-# has joined. The sudoers fragment is the one ansible/ubuntu/authorize-sudo.sh
-# writes: its path and marker are already on running machines.
+# pins, the login server of the fleet's control plane, and a short-lived
+# single-use auth key that is deleted once the machine has joined: one minted
+# for this worker through the tailnet control plane fleet.json declares, or
+# else the secret tailnet-auth-key. The sudoers fragment is the one
+# ansible/ubuntu/authorize-sudo.sh writes: its path and marker are already on
+# running machines.
 hostname: '${HOSTNAME}'
 users:
   - name: '${USER}'
@@ -56,6 +59,7 @@ runcmd:
       up,
       '--auth-key=file:/run/devfleet/tailnet-auth-key',
       '--hostname=${HOSTNAME}',
+      '--login-server=${LOGIN_SERVER}',
       '--ssh=false',
     ]
   - [rm, -f, /run/devfleet/tailnet-auth-key]

package/bootstrap/worker-tools.ts

@@ -1,11 +1,15 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import policy from '../ansible/ubuntu/policy.json';
+import { workerFeatures } from './worker-features';
 
 /** A worker installs only this declared subset; every version still comes from mise.lock. */
 export function workerTools<T>(
   tools: Record<string, T>,
-  selected: unknown
+  selected: unknown,
+  /** False on a worker without containers: docker-cli is then not required. */
+  containers = true
 ): Record<string, T> {
   if (typeof selected === 'string') selected = selected.split(',');
   if (
@@ -15,9 +19,15 @@ export function workerTools<T>(
     !selected.every(
       (key) => typeof key === 'string' && Object.hasOwn(tools, key)
     ) ||
-    !['bun', 'node', 'gh', 'python', 'uv', 'docker-cli', 'vault'].every((key) =>
-      selected.includes(key)
-    )
+    ![
+      'bun',
+      'node',
+      'gh',
+      'python',
+      'uv',
+      ...(containers ? ['docker-cli'] : []),
+      'vault',
+    ].every((key) => selected.includes(key))
   )
     throw new Error(
       'Invalid worker tool profile: all required tools need authoritative mise pins.'
@@ -40,6 +50,9 @@ export type ToolProfile = (typeof TOOL_PROFILES)[number];
 export interface ToolSelection {
   profiles: string[];
   tools: string[];
+  /** False when the worker's `containers` feature is off: the base tools
+   * then leave out the Docker CLI. Absent means on. */
+  containers?: boolean;
 }
 export const NO_SELECTION: ToolSelection = { profiles: [], tools: [] };
 
@@ -68,9 +81,11 @@ export function workerSelection(
     .filter(record)
     .filter((entry) => node !== undefined && entry['id'] === node)
     .flatMap((entry) => list(entry['toolProfiles']));
+  const containers = workerFeatures(definition, node).containers;
   return {
     profiles: [...new Set([...list(policy['toolProfiles']), ...own])],
     tools: [...new Set(list(policy['tools']))],
+    ...(containers ? {} : { containers }),
   };
 }
 
@@ -101,7 +116,11 @@ export function workerToolset<T>(
 ): Record<string, T> {
   const names = (value: unknown) =>
     typeof value === 'string' ? value.split(',').filter(Boolean) : [];
-  const base = names(vars['worker_tools']);
+  const containers = selection.containers !== false;
+  // Without containers the Docker CLI is not a base tool (CONTAINER_TOOLS).
+  const base = names(vars['worker_tools']).filter(
+    (tool) => containers || !CONTAINER_TOOLS.includes(tool)
+  );
   const added = selection.profiles.flatMap((profile) => {
     const declared = vars[`worker_profile_${profile}`];
     if (typeof declared !== 'string' || !declared)
@@ -115,11 +134,17 @@ export function workerToolset<T>(
       throw new Error(
         `The worker tool "${tool}" has no pin in dev-fleet's mise.toml. Ask for it in an issue.`
       );
-  return workerTools(tools, [
-    ...new Set([...base, ...added, ...selection.tools]),
-  ]);
+  return workerTools(
+    tools,
+    [...new Set([...base, ...added, ...selection.tools])],
+    containers
+  );
 }
 
+/** The base tools that belong to the `containers` feature
+ * (`features.containers.tools` in ansible/ubuntu/policy.json). */
+export const CONTAINER_TOOLS: string[] = policy.features.containers.tools;
+
 /** `--profiles web,go --tools fd` for the doctor and the setup. */
 export function selectionArguments(selection: ToolSelection): string[] {
   return [
@@ -127,6 +152,7 @@ export function selectionArguments(selection: ToolSelection): string[] {
       ? ['--profiles', selection.profiles.join(',')]
       : []),
     ...(selection.tools.length ? ['--tools', selection.tools.join(',')] : []),
+    ...(selection.containers === false ? ['--no-containers'] : []),
   ];
 }
 
@@ -138,5 +164,9 @@ export function parseSelectionArguments(argv: string[]): ToolSelection {
       ? []
       : (argv[index + 1] ?? '').split(',').filter((item) => item.length > 0);
   };
-  return { profiles: value('--profiles'), tools: value('--tools') };
+  return {
+    profiles: value('--profiles'),
+    tools: value('--tools'),
+    ...(argv.includes('--no-containers') ? { containers: false } : {}),
+  };
 }

package/cliproxy/README.md

@@ -199,7 +199,7 @@ On the manager (or a replacement manager), prepare the tracked installation, log
 
 ## Off-machine checks and offline recovery
 
-The `CLI proxy health` GitHub Actions workflow runs at minutes 7, 22, 37 and 52 of each hour and supports manual dispatch. It uses the existing read-only GitHub OIDC Vault role, with a short-lived token rather than a stored workstation/admin credential. From a GitHub-hosted runner it checks public endpoint authentication, available models, dashboard availability, a cloud checkpoint no more than 45 minutes old, and the last successful GC no more than nine days old. GC status is included in subsequent encrypted checkpoints. A failed workflow is visible independently of this workstation and uses GitHub's existing notification settings; it is not a guaranteed paging service, and schedules can be delayed by GitHub.
+The `CLI proxy health` GitHub Actions workflow is the reusable workflow `.github/workflows/cliproxy-health.yml`. The repository that holds your `fleet.json` enables it with one `uses:` line: copy [`docs/health-workflow.example.yml`](docs/health-workflow.example.yml) into its `.github/workflows/` and name the dev-fleet release tag your `package.json` pins. It needs no stored secret: the Vault address and the endpoint come from your `fleet.json`, and the checks from that exact release. The example runs it at minutes 7, 22, 37 and 52 of each hour and supports manual dispatch. It uses the existing read-only GitHub OIDC Vault role (`vault-role`, `github-actions` by default), with a short-lived token rather than a stored workstation/admin credential. From a GitHub-hosted runner it checks public endpoint authentication, available models, dashboard availability, a cloud checkpoint no more than 45 minutes old, and the last successful GC no more than nine days old. GC status is included in subsequent encrypted checkpoints. A failed workflow is visible independently of this workstation and uses GitHub's existing notification settings; it is not a guaranteed paging service, and schedules can be delayed by GitHub.
 
 The `CLI proxy health` workflow also runs the declarative model checks described in [Model validation and health checks](docs/model-health.md): a free readiness check every 15 minutes, a light two-request-per-model inference check hourly, a comprehensive nightly suite and an offline pull-request contract job, with per-model status, capability coverage, JSON/Markdown reports, an agent brief and a tracking issue. The local five-minute monitor does not run inference, attempt management logins, access provider credential files, prune storage, change cloud infrastructure, or restart the workstation. Management authorization remains covered by explicit verification; repeated failed management logins can trigger upstream IP bans, so they are excluded from scheduled monitoring. Its Restic client permits only read operations and uses no remote locks, so a killed runner cannot leave a lock blocking backups. Concurrent pruning can cause a transient read failure; subsequent scheduled runs retry. HTTPS redirects are rejected to prevent forwarding credentials to another origin.
 

package/cliproxy/docs/health-workflow.example.yml

@@ -1,19 +1,21 @@
 name: CLI proxy health
-# One workflow, five entry points, deliberately cheap by default:
+# Copy this file into .github/workflows/ of the repository that holds your
+# fleet.json, and name the dev-fleet release your package.json pins in the
+# `uses:` line (RELEASE_TAG, such as v1.4.0). The checks are the reusable workflow
+# .github/workflows/cliproxy-health.yml of dev-fleet; this file only says
+# when they run. One workflow, five entry points, deliberately cheap by
+# default:
 #   every 15 min  readiness: free (no inference) + cloud checkpoint freshness
 #   hourly        light: 2 tiny requests per model (about 200 requests a day)
 #   03:41 nightly comprehensive suite (bounded by models.json budgets)
-#   pull request  contract: offline, no credentials, no inference
 #   manual        any profile, one model or one check, optional force-probe
+# The offline contract (no credentials, no inference) runs in dev-fleet's own
+# CI, not here.
 on:
   schedule:
     - cron: '7,22,37,52 * * * *'
     - cron: '17 * * * *'
     - cron: '41 3 * * *'
-  pull_request:
-    paths:
-      - cliproxy/**
-      - .github/workflows/cliproxy-health.yml
   workflow_dispatch:
     inputs:
       profile:
@@ -42,144 +44,19 @@ on:
         description: Probe models even if they were rate limited recently (normally paused to protect quota).
         type: boolean
         default: false
+# A short-lived Vault token from GitHub's OIDC token, and one tracking issue.
 permissions:
   contents: read
-concurrency:
-  group: cliproxy-model-health-${{ github.event_name == 'pull_request' && format('pr-{0}', github.ref) || github.event_name == 'workflow_dispatch' && inputs.profile || github.event.schedule }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-env:
-  PROFILE: ${{ github.event_name == 'workflow_dispatch' && inputs.profile || github.event.schedule == '41 3 * * *' && 'nightly' || github.event.schedule == '17 * * * *' && 'light' || 'readiness' }}
+  id-token: write
+  issues: write
 jobs:
-  contract:
-    # Pull requests: deterministic protocol, routing and report contracts. No credentials, no inference.
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install PyYAML for the validate-config contract
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends python3-yaml
-      - name: Lint models.json and run the offline contract tests
-        run: |
-          python3 -B cliproxy/scripts/check.py
-          python3 -B -m unittest discover -s cliproxy/tests -p "test_model_*.py"
-      - name: Run the full declarative suite against the local emulator
-        run: |
-          set +e
-          python3 -B cliproxy/scripts/model_health.py model-suite --target mock --profile manual \
-            --fail-on degraded --output model-health-report --seed 1 > /dev/null
-          code=$?
-          if [ -f model-health-report/model-health.md ]; then cat model-health-report/model-health.md >> "$GITHUB_STEP_SUMMARY"; fi
-          exit $code
-      - name: Keep structured report
-        if: ${{ always() && hashFiles('model-health-report/model-health.json') != '' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: model-health-contract-${{ github.run_id }}
-          path: model-health-report
-          retention-days: 14
   health:
-    if: github.event_name != 'pull_request' && github.repository == 'crvouga/dev-fleet' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    permissions:
-      contents: read
-      id-token: write
-      issues: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install read-only backup client
-        if: env.PROFILE == 'readiness'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends restic
-      - name: Read-only Vault login using GitHub OIDC
-        uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4.0.0
-        with:
-          url: https://vault.example.com
-          method: jwt
-          path: jwt
-          role: github-actions
-          jwtGithubAudience: https://vault.example.com
-          exportToken: true
-      - name: Verify endpoint and cloud recovery freshness
-        if: env.PROFILE == 'readiness'
-        run: python3 -B cliproxy/scripts/external-health.py
-      - name: Restore last-success and rate-limit state
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: model-health-state.json
-          key: cliproxy-model-health-state-${{ github.run_id }}
-          restore-keys: cliproxy-model-health-state-
-      - name: Validate every required model
-        # Bounded spend: the profile's request/token budget, concurrency and timeouts come from models.json;
-        # inference is never retried; a model rate limited recently is not probed again until its pause ends.
-        # The client key is read in-process from Vault and never printed.
-        if: ${{ !cancelled() }}
-        env:
-          MODEL: ${{ inputs.model }}
-          CHECK: ${{ inputs.check }}
-          MAX_REQUESTS: ${{ inputs.max_requests }}
-          SUITE: ${{ inputs.suite || 'all' }}
-          FORCE_PROBE: ${{ inputs.force_probe }}
-        run: |
-          command=model-health
-          fail_on=unhealthy
-          case "$PROFILE" in nightly | manual) command=model-suite; fail_on=degraded ;; esac
-          args=(--profile "$PROFILE" --suite "$SUITE" --fail-on "$fail_on"
-            --output model-health-report --state model-health-state.json)
-          if [ -n "$MODEL" ]; then args+=(--model "$MODEL"); fi
-          if [ -n "$CHECK" ]; then args+=(--check "$CHECK"); fi
-          if [ -n "$MAX_REQUESTS" ]; then args+=(--max-requests "$MAX_REQUESTS"); fi
-          if [ "$FORCE_PROBE" = "true" ]; then args+=(--force-probe); fi
-          set +e
-          python3 -B cliproxy/scripts/model_health.py "$command" "${args[@]}" > /dev/null
-          code=$?
-          if [ -f model-health-report/agent-brief.md ]; then cat model-health-report/agent-brief.md >> "$GITHUB_STEP_SUMMARY"; fi
-          if [ -f model-health-report/model-health.md ]; then cat model-health-report/model-health.md >> "$GITHUB_STEP_SUMMARY"; fi
-          exit $code
-      - name: Save last-success and rate-limit state
-        if: ${{ always() && hashFiles('model-health-state.json') != '' }}
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: model-health-state.json
-          key: cliproxy-model-health-state-${{ github.run_id }}
-      - name: Keep structured report
-        if: ${{ always() && hashFiles('model-health-report/model-health.json') != '' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: model-health-${{ env.PROFILE }}-${{ github.run_id }}
-          path: model-health-report
-          retention-days: 30
-      - name: Track findings in one issue per scope
-        # Opens or updates a single tracking issue when the findings change, and closes it when a full
-        # run is healthy. The body is the redacted agent brief: structure and numbers, no prompts or keys.
-        if: ${{ always() && hashFiles('model-health-report/model-health.json') != '' && inputs.model == '' && inputs.check == '' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          scope=live
-          case "$PROFILE" in nightly | manual) scope=nightly ;; esac
-          title="[ops] CLI proxy model health ($scope)"
-          report=model-health-report/model-health.json
-          status=$(jq -r .summary.status "$report")
-          fingerprint=$(jq -r .summary.findings.fingerprint "$report")
-          number=$(gh issue list --state open --search "\"$title\" in:title" --json number,title \
-            --jq "map(select(.title==\"$title\"))[0].number // empty")
-          if [ "$status" = unhealthy ] || [ "$status" = degraded ]; then
-            {
-              head -c 58000 model-health-report/agent-brief.md
-              printf '\n\nRun: %s (artifact model-health-%s-%s)\n<!-- fingerprint: %s -->\n' "$RUN_URL" "$PROFILE" "$GITHUB_RUN_ID" "$fingerprint"
-            } > model-health-report/issue.md
-            if [ -z "$number" ]; then
-              gh issue create --title "$title" --body-file model-health-report/issue.md
-            elif ! gh issue view "$number" --json body --jq .body | grep -q "fingerprint: $fingerprint"; then
-              gh issue edit "$number" --body-file model-health-report/issue.md
-              gh issue comment "$number" --body "Findings changed: $RUN_URL"
-            fi
-          elif [ "$status" = healthy ] && [ -n "$number" ]; then
-            gh issue close "$number" --comment "Healthy again: $RUN_URL"
-          fi
+    uses: crvouga/dev-fleet/.github/workflows/cliproxy-health.yml@RELEASE_TAG
+    with:
+      # Inference only on the hourly schedule; the 15-minute one is free.
+      profile: ${{ github.event_name == 'workflow_dispatch' && inputs.profile || github.event.schedule == '41 3 * * *' && 'nightly' || github.event.schedule == '17 * * * *' && 'light' || 'readiness' }}
+      suite: ${{ inputs.suite || 'all' }}
+      model: ${{ inputs.model || '' }}
+      check: ${{ inputs.check || '' }}
+      max-requests: ${{ inputs.max_requests || '' }}
+      force-probe: ${{ inputs.force_probe == true }}