chore(deps): docker: bump the all-docker group across 1 directory with 3 updates

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the all-docker group with 3 updates in the /agent directory: jdxcode/mise, golang and python.

Updates jdxcode/mise from b229777 to df5adf5

Updates golang from 1.26.4-bookworm to 1.27.1-bookworm

Updates python from 3.13-slim to 3.14-slim

[scottschreckengaust]

1. Verdict — Request changes

Split this PR. The jdxcode/mise digest refresh and golang 1.26.4 → 1.27.0 bump are clean and I verified them at the registry. The third change — python:3.13-slim → python:3.14-slim — is an agent-runtime interpreter upgrade that this repo already tracks deliberately as issue #105, and it ships here without the other four changes #105 itself lists as required and without any of the five validations #105 lists as required. Merged as-is, the production agent container would run CPython 3.14 while every quality gate in the repo (ruff, ty, pytest via agent/mise.toml) keeps running 3.13.

Note: this PR is behind origin/main. I reasoned from merge-base 780161b9; the only main-side agent/ changes since then are one-line edits to clarification_tool.py and hooks.py, so nothing on main invalidates this diff (and mergeable: MERGEABLE).

2. Vision alignment

• Bounded blast radius (partially served) — digest-pinned base images and a self-built gh on a current Go toolchain are exactly the supply-chain currency the file's own preamble argues for. The mise + golang halves advance this.
• Reliable, improvable control plane (works against it) — the agent container is the production runtime. Swapping its interpreter minor version while the test/lint/typecheck matrix stays on the old one means we would be shipping an interpreter we never execute a single test against. That is the opposite of "inspectable, validated outcomes."
• No ADR/tenet trade is being made explicitly; #105 is the intended vehicle and it is still open and unlabelled approved.

3. Blocking issues

B1 — agent/Dockerfile:29: the Python bump lands 1 of the 4 changes its own backing issue requires.
Issue #105 ("chore(agent): upgrade Python 3.13 → 3.14", state open, labels enhancement, tooling, agent-runtime — no approved label) enumerates:

1. agent/Dockerfile base → python:3.14-slim ← only this one is done
2. agent/pyproject.toml:107 [tool.ruff] target-version = "py313" → "py314"
3. agent/pyproject.toml:184 [tool.ty.environment] python-version = "3.13" → "3.14"
4. Re-lock (uv lock)

And I found two more the issue itself omits, which are the ones that actually decide what CI executes:

5. agent/mise.toml:4 — python = "3.13". This is the interpreter mise run build → //agent:quality (ruff, ty, pytest, vulture) uses. Leave it at 3.13 and the unit suite permanently tests an interpreter we no longer ship.
6. agent/.python_version — 3.13.

Risk: 3.13 was chosen coherently across all six declarations since the initial commit. This PR moves one and leaves five, so "test what you ship" silently stops holding, and ty (pinned to the 3.13 environment, with deprecated = "ignore" at agent/pyproject.toml:179) is structurally unable to see any 3.14 deprecation or removal.

Fix: land the interpreter bump through #105 as a coordinated PR touching items 1–6 plus the docs in B3, and get approved on #105 first (ADR-003). Then let Dependabot keep only the mise/golang half of this group.

B2 — nothing in this PR's checks builds the image or runs the runtime on 3.14; all-green here is not evidence.
I grepped .github/ — there is no docker build in any workflow. build.yml runs mise run build, whose DAG is //agent:quality → //cdk:build → //cli:build → //docs:build (mise.toml:255-264); //cdk:build is Jest with bundling disabled, so the DockerImageAsset at cdk/src/stacks/agent.ts:887-890 is never realised. The only thing that actually builds this Dockerfile is //agent:security:image (agent/mise.toml), reachable solely from mise run security (mise.toml:211) in security.yml, which is schedule: cron "0 12 * * 1" + workflow_dispatch only — and build.yml:65 additionally sets MISE_DISABLE_TOOLS: "aqua:aquasecurity/trivy,…".

Consequence: #105's "Testing Required" checklist (docker image builds / uv sync --frozen / agent unit tests / trivy scan / smoke test) is 0/5 satisfied by the green checks on this PR. The first automated build of this Dockerfile would be next Monday's cron, or a deploy. Fix: run MISE_EXPERIMENTAL=1 mise //agent:security:image and //agent:quality locally on 3.14 and paste the evidence into #105, or split the python bump out.

B3 — documentation/comment drift introduced by this diff (Stage 4 is a blocking bar on this repo).

• agent/Dockerfile:44 — the apt-upgrade rationale still reads "transitive system-library CVEs … ride the base python:3.13-slim tag". After line 29 changes, the comment contradicts the code four lines below it.
• agent/README.md:434 — "Dockerfile Python 3.13 + Node.js 20 …". The Python half becomes wrong with this PR. (The "Node.js 20" half is already stale on main — the Dockerfile installs Node 24 — worth fixing in the same touch.)
• agent/scripts/diagnostics/test_subprocess_threading.py:11 — repro command still docker run … python:3.13-slim (minor, same sweep).

No docs/guides/ or docs/design/ source changed, so no Starlight mirror regeneration is owed.

4. Non-blocking suggestions / nits

1. Ungroup python from all-docker. .github/dependabot.yml:18-31 groups patterns: ["*"], which is what couples two safe digest refreshes to an interpreter upgrade and forces the whole PR to be rejected. The repo already has exactly this precedent for a lockstep-sensitive dependency — the cedarpy / @cedar-policy/cedar-wasm ignore blocks at .github/dependabot.yml:47-56 and :75-84. Add the same for dependency-name: "python" on version-update:semver-minor/major, referencing #105. Historically PR #173 was the same 3.13→3.14 bump; it closed on 2026-06-06 — but for accuracy, it was auto-closed by Dependabot ("updatable in another way"), not human-rejected, which is precisely why the bump keeps coming back.
2. agent/src/pipeline.py:1232 is now vestigial and carries a 3.14-deprecated API. The asyncio.get_event_loop_policy() uvloop-detection warning cannot fire: uvloop is not in agent/uv.lock and CMD already passes --loop asyncio (agent/Dockerfile:157). Same API at agent/src/server.py:239 for a boot log line. Both are diagnostic-only, so 3.14 does not break them — but 3.14 deprecates the call (removal in 3.16) and [tool.ty.rules] deprecated = "ignore" will keep hiding it. Deleting the pipeline.py branch and replacing the server.py line with asyncio.get_event_loop_policy-free diagnostics is a cleaner outcome than carrying it forward.
3. golang:1.27.0-bookworm is a .0. The stated reason for building gh from source ("upstream packages can lag Go CVE fixes", line 24) is served, but a .0 minor has no patch releases behind it and — per B2 — nothing in CI compiles gh v2.93.0 against it. Consider waiting for 1.27.1, or at minimum note that this build path is only exercised weekly.
4. The mise bump is version-opaque. Dependabot reports dependency-version: latest; the digest moved with no changelog to review. The header comment already concedes mise:latest is "a tag with no version at all" — pinning jdxcode/mise:<release-tag>@sha256:… would make future bumps reviewable rather than a leap of faith.
5. Update #105's own checklist to add agent/mise.toml:4 and agent/.python_version, and drop its "do this separately from the Debian trixie upgrade (#106)" note — see below, that concern is already moot.

5. Verified clean — do not re-litigate these

I checked the four things a base-image bump most often gets wrong, at the Docker Hub registry API (read-only), and they all pass:

Check	Result
Digest pinning	All three images pinned by digest with the tag alongside, per the file's own convention. No tag-only regression.
Digest ↔ tag consistency	golang:1.27.0-bookworm resolves to exactly sha256:ded31c68… (the pinned value). The pinned python digest sha256:cae66f2e… has image config PYTHON_VERSION=3.14.7, built from debian.sh --arch 'arm64' … 'trixie' — it really is a 3.14-slim. The python/mise tags have since moved (expected; that is what pinning is for).
linux/arm64 (the header comment's promise, and Platform.LINUX_ARM64 at cdk/src/stacks/agent.ts:890)	All three pinned digests are multi-platform indices containing a linux/arm64 entry.
Debian base change	None. python:3.13-slim and python:3.14-slim both resolve to the same digest as their -trixie variants today, so the apt layer, NodeSource setup_24.x, and build-essential behaviour are unchanged — and #105's worry about entangling this with the trixie upgrade (#106, closed) no longer applies.
Claude CLI ↔ SDK lockstep (#215)	Untouched, no drift introduced. agent/Dockerfile:96 stays @anthropic-ai/claude-code@2.1.191; agent/pyproject.toml:20 stays claude-agent-sdk==0.2.110, whose comment says it bundles CLI 2.1.191. Consistent.
Will uv sync --frozen --no-dev install on 3.14/arm64?	Statically, yes. I queried PyPI metadata for all 129 third-party packages in agent/uv.lock: zero declare a requires_python upper bound excluding 3.14. Every non-pure-Python package has a cp314 or abi3 linux-aarch64 wheel already recorded in the lock — including cedarpy-4.8.4-cp314-cp314-manylinux_2_17_aarch64…whl, pydantic-core (30 cp314 wheels), rpds-py, grpcio, pyyaml, cryptography (abi3), protobuf (abi3). The only gap is pywin32 (Windows-only, marker-excluded). So the uv lock re-lock in #105 item 4 is likely a no-op, and B1 is about coherence and validation, not about a predicted install failure.
3.14 stdlib removals in agent/src/	None hit. No child-watcher APIs (get_child_watcher/AbstractChildWatcher, removed in 3.14) and no bare asyncio.get_event_loop(). Only the three deprecated-but-present get_event_loop_policy() calls in nit 2.
Cedar parity / bootstrap IAM	Not applicable — no cedarpy/cedar-wasm pin moved, no CDK construct, stack, handler, or new CFN resource type in the diff, so cdk/src/bootstrap/*, BOOTSTRAP_VERSION, resource-action-map.ts, and DEPLOYMENT_ROLES.md are correctly untouched.

6. Tests & CI

• No tests added or changed — correct in the narrow sense (this repo has no Dockerfile-content assertion test to update), but see B2: the practical coverage for a base-image change here is zero at PR time, and this is the change class where that matters most.
• Check status: all green — build (agentcore) SUCCESS, Secrets, deps, and workflow scan SUCCESS, dead-code advisory SUCCESS, Validate PR title SUCCESS, CodeQL NEUTRAL. mergeStateStatus: BLOCKED (awaiting review). None of these green checks builds the image or runs Python 3.14.
• Bootstrap synth-coverage: not applicable (no CDK changes).
• Honesty note: I ran no build or test suite. mise run build, jest, pytest, tsc, cdk synth, and docker build were all out of bounds in this review environment (no node_modules/, no agent/.venv/). Everything above is static reasoning over the diff plus read-only queries against the Docker Hub registry API and PyPI's JSON API. Specifically unverified: that the image actually builds; that aws-opentelemetry-distro==0.18.0's opentelemetry-instrument bootstrap behaves identically under 3.14; that the Claude Agent SDK's subprocess/SIGCHLD handling is unaffected; that gh v2.93.0 compiles clean on Go 1.27.0.

7. Review agents run

Nested agent dispatch was unavailable in this run — this review executes as a subagent inside a batch fan-out, which cannot spawn the pr-review-toolkit agents Stage 3 names. I did not invoke any agent. Instead I applied each rubric dimension inline, one at a time:

• code-reviewer (guidelines/style/conventions) — applied inline. The diff honours the file's digest-plus-tag convention; the failure is convention coverage, not style: six in-repo declarations of "Python 3.13", one moved (B1).
• silent-failure-hunter (error handling, swallowed exceptions, plausible-default fallbacks) — applied inline. No error-handling code in the diff, but I checked the failure surface the bump exposes: the two get_event_loop_policy() sites (agent/src/server.py:239, agent/src/pipeline.py:1232) degrade to a DeprecationWarning rather than an exception, and the pipeline.py uvloop guard is a warning that can never fire (nit 2). The genuine silent failure in the vicinity is B2 — a green PR that asserts nothing about the artifact it changed.
• comment-analyzer (comment accuracy vs code) — applied inline; this is where the diff actually fails. agent/Dockerfile:44 and agent/README.md:434 now contradict the code (B3), and agent/pyproject.toml:180 ("deprecated in 3.14+; still valid on 3.13") is premised on a runtime that this PR retires.
• pr-test-analyzer (coverage of failure paths) — applied inline. See B2 and §6: 0/5 of #105's required validations are exercised by any PR check.
• type-design-analyzer (new types, encapsulation, invariants) — genuinely out of scope. The diff introduces no types, functions, or data structures; it changes three FROM lines.
• security-review skill — not invoked; scope not triggered. The diff touches no IAM, Cedar policy, network config, secret, or input-validation path. It is a supply-chain change, so in lieu of the skill I did the provenance work by hand at the registry: digest↔tag identity, image-config provenance (PYTHON_VERSION, debian.sh … trixie), multi-arch/arm64 presence for all three pins, and a full requires_python/wheel-availability sweep of all 129 locked dependencies (§5).

8. Human heuristics

• Proportionality — pass. Three changed lines for three dependency bumps. No accreted abstraction.
• Coherence — concern (agent/Dockerfile:29). The repo states its agent Python version in six places (agent/Dockerfile:29, agent/mise.toml:4, agent/.python_version, agent/pyproject.toml:107, agent/pyproject.toml:184, agent/README.md:434). One moved. Same concept must carry the same value across the repo, and #105 exists precisely to move them together.
• Clarity — concern (agent/Dockerfile:44). A comment fifteen lines below the change now names the old base tag as the thing being worked around. Anyone reading top-to-bottom gets a contradiction.
• Appropriateness — concern. The migration is owned by #105 with a five-item testing checklist and an unmet approved gate; a grouped Dependabot PR structurally cannot execute either. The right shape is: merge the mise/golang half, add a python ignore rule mirroring the cedarpy precedent, and land 3.14 via #105 with build + trivy + smoke evidence attached.

[scottschreckengaust]

Blocking (B1/B3). This is the agent runtime's interpreter, and the bump lands 1 of the 4 changes its own backing issue #105 lists — plus two that issue omits:

• agent/pyproject.toml:107 [tool.ruff] target-version = "py313" → "py314"
• agent/pyproject.toml:184 [tool.ty.environment] python-version = "3.13" → "3.14"
• re-lock (uv lock) — likely a no-op: I checked all 129 packages in agent/uv.lock and every non-pure-Python one already has a cp314/abi3 linux-aarch64 wheel (cedarpy-4.8.4-cp314-cp314-manylinux_2_17_aarch64…whl included), and no dep's requires_python excludes 3.14
• agent/mise.toml:4 python = "3.13" — this is the interpreter mise run build → //agent:quality runs ruff/ty/pytest under. Leaving it at 3.13 means the unit suite permanently tests an interpreter we no longer ship.
• agent/.python_version — 3.13.

Also, line 44 below still says the base is python:3.13-slim — the comment contradicts this line once it merges. agent/README.md:434 ("Python 3.13 + Node.js 20") and agent/scripts/diagnostics/test_subprocess_threading.py:11 need the same sweep.

The digest itself is fine — I verified sha256:cae66f2e… has PYTHON_VERSION=3.14.7, is Debian trixie (same as 3.13-slim today, so no base-OS change), and its index contains linux/arm64 as the header comment promises.

Suggested path: land the mise/golang half, add a dependency-name: "python" ignore for version-update:semver-minor/major to .github/dependabot.yml mirroring the existing cedarpy precedent, and do 3.14 via #105 once that issue is approved — with mise //agent:security:image and //agent:quality evidence, since no workflow in .github/ runs docker build and #105's 5-item testing checklist is 0/5 satisfied by the green checks here.