[deployment] vogt-prod lifecycle bootstrap hook is not mounted or executing #467

Summary

Follow-up to #384. The generic Vogt lifecycle-hook runner is present and active in vogt-prod, but the deployment currently has no lifecycle hook bundle mounted. As a result, the deployment-owned workspace bootstrap (agent-workspace-config/bootstrap/deploy.sh) is not run during startup.

This leaves the agent workspace dependent on stale/persisted state and does not ensure that Claude Code and Codex receive the intended workspace bootstrap assets and operating guidance. The per-session MCP registration helper still runs, but agent sessions can remain unaware of, or reluctant to use, the Vogt and Cadastre MCPs unless explicitly directed.

Expected behavior

The private vogt-prod deployment should mount and execute a deployment-owned bootstrap hook during the Vogt lifecycle, for example a post-start.d hook that invokes the workspace bootstrap repository's bootstrap/deploy.sh. The hook should be idempotent, observable in deployment logs, and fail startup when required bootstrap/verification fails.

The public Vogt image and base Compose files should remain estate-neutral; this should be wired by the private deployment overlay using the lifecycle contract introduced by #384.

Actual behavior

In the running production engine:

• PID 1 is /usr/local/bin/vogt-lifecycle /usr/local/bin/mydevenv2-entrypoint.
• /run/vogt/hooks is not mounted and contains no hook bundle.
• No VOGT_LIFECYCLE_* or VOGT_HOOKS_REQUIRED environment is configured in the container; lifecycle state falls back to /tmp/vogt-lifecycle.
• There is no startup log showing agent-workspace-config/bootstrap/deploy.sh or an equivalent workspace bootstrap hook.
• mydevenv2-mcp-bootstrap does run from mydevenv2-agent-auth launches and writes client registrations, but this is separate from the workspace bootstrap and does not provide a behavioral instruction to use the MCPs.

Evidence

Environment inspected on 2026-08-29 (secrets and private hostnames omitted):

Entrypoint: ["/usr/local/bin/vogt-lifecycle"]
Command:    ["/usr/local/bin/mydevenv2-entrypoint"]

Mounts included workspace/home/data volumes, but no /run/vogt/hooks mount.

/tmp/vogt-lifecycle/started exists; no hook execution output was present.

The documented lifecycle contract says that hooks are supplied from a deployment-owned read-only mount at /run/vogt/hooks; the runner does not discover scripts from the image or workspace automatically.

Impact

• Recreated or refreshed production workspaces are not guaranteed to receive the bootstrap repository's shared Claude/Codex assets.
• Existing sessions may not know that Vogt and Cadastre are available or may not proactively select their tools.
• The deployment can appear healthy while the intended workspace bootstrap has silently been omitted.

Proposed fix

1. Add a private deployment-owned executable hook under post-start.d that invokes agent-workspace-config/bootstrap/deploy.sh with an explicit WORKSPACE_ROOT.
2. Mount the hook bundle at /run/vogt/hooks:ro, configure a persistent lifecycle state directory, and set VOGT_HOOKS_REQUIRED=true if bootstrap is mandatory.
3. Keep dirty-checkout handling explicit; do not silently use --allow-dirty for production updates.
4. Add deployment verification that proves the hook ran and that the expected workspace assets are present.
5. After a successful deployment, restart existing Claude Code and Codex sessions so they reload the materialized client configuration and instructions.

Related

• feat(deploy): support deployment-owned lifecycle hook scripts outside images #384 — generic deployment-owned lifecycle hooks (implemented)
• docs/DEPLOYMENT.md — deployment-owned lifecycle hooks
• agent-workspace-config/bootstrap/deploy.sh — workspace bootstrap entry point

Implementation plan (private estate deployment)

This must be implemented in the private deployment repository/overlay, not the public Vogt image.

1. Add an executable deployment-owned hook under post-start.d that invokes the workspace bootstrap with an explicit workspace root.
2. Mount the hook bundle at /run/vogt/hooks:ro, configure persistent lifecycle state, and set VOGT_HOOKS_REQUIRED=true.
3. Make dirty-checkout handling explicit; do not silently use --allow-dirty.
4. Verify expected Claude/Codex/Vogt/MCP assets after startup and include hook evidence in the deployment receipt.
5. Restart or refresh existing sessions after a successful bootstrap.

The public image only supplies the generic lifecycle hook contract.