Promote main → prod (b4a4652)

.github/workflows/build.yml

@@ -690,7 +690,6 @@ jobs:
           # Same cache ref as the candidate: every layer is a hit, so the push
           # is a re-tag of the smoke-tested bytes rather than a recompile.
           cache-from: type=registry,ref=${{ env.CACHE_IMAGE }}:stack-${{ github.ref_name }}
-          cache-to: type=registry,ref=${{ env.CACHE_IMAGE }}:stack-${{ github.ref_name }},mode=max
 
       - uses: sigstore/cosign-installer@v3
 

.github/workflows/deploy-dev.yml

@@ -45,6 +45,13 @@ jobs:
 
       - uses: sigstore/cosign-installer@v3
 
+      - name: authenticate to the dev registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: resolve and verify the signed dev image
         id: image
         env:

.github/workflows/release.yml

@@ -652,6 +652,26 @@ jobs:
           jq empty release-assets/final/vogt-release-manifest.json
           jq -r . release-assets/final/vogt-release-manifest.json > release-assets/release-notes.json
 
+      - name: install GitHub CLI
+        run: |
+          set -euo pipefail
+          command -v gh >/dev/null 2>&1 && exit 0
+          if command -v apt-get >/dev/null 2>&1; then
+            if [ "$(id -u)" -eq 0 ]; then
+              apt-get update
+              apt-get install -y --no-install-recommends gh
+            else
+              sudo apt-get update
+              sudo apt-get install -y --no-install-recommends gh
+            fi
+          elif command -v apk >/dev/null 2>&1; then
+            apk add --no-cache github-cli
+          else
+            echo "GitHub CLI is required on the release runner" >&2
+            exit 1
+          fi
+          command -v gh >/dev/null 2>&1
+
       - name: create or update the GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
@@ -662,7 +682,7 @@ jobs:
           notes="$(mktemp)"
           trap 'rm -f "$notes"' EXIT
           {
-            echo "Release metadata (machine-readable copy is attached as \\`vogt-release-manifest.json\\`):"
+            echo 'Release metadata (machine-readable copy is attached as `vogt-release-manifest.json`):'
             echo
             echo '```json'
             cat release-assets/release-notes.json

engine/server/src/pty.rs

@@ -440,6 +440,15 @@ fn spawn_exit_waiter(
         let new_state = compute_activity(&session, code != 0);
         update_activity_if_changed(&session, new_state, &bus);
         wake_activity_watcher(&session);
+
+        // The child can exit before the PTY reader has consumed the final
+        // bytes.  Publish the terminal event only after that reader has
+        // drained its stream; agent-task conclusions inspect scrollback when
+        // they receive `SessionKilled` (including VOGT_SKIP and VOGT_COST
+        // sentinels printed immediately before exit).
+        while !session.reader_done.load(Ordering::Acquire) {
+            std::thread::sleep(std::time::Duration::from_millis(1));
+        }
         bus.publish(ServerEvent::SessionKilled {
             id: session.id,
             exit_code: Some(code),

tests/test_deploy.py

@@ -1255,6 +1255,8 @@ def test_github_release_collects_and_publishes_the_complete_release() -> None:
     assert "CORE_DIGEST" in job and "STACK_DIGEST" in job
     assert "vogt-release-manifest.json" in job
     assert "production_deployment_handoff" in job
+    assert "name: install GitHub CLI" in job
+    assert "command -v gh" in job
     assert "gh release upload" in job
     assert "--clobber" in job