wip: improve agent runtime cycle times

[zreigz]

Test Plan

Test environment: https://console.your-env.onplural.sh/

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[linear]

PROD-5216

[soffi-ai]

Soffi AI Summary

This PR improves agent runtime cycle times by introducing two major enhancements to the AI agent harness infrastructure: mise-based tool version management and a repository pre-bake pipeline that pre-compiles dependencies to eliminate cold-start overhead.

Mise integration (AgentRuntime CRD + pod builder): The AgentRuntime spec gains a mise field where operators can supply a config.toml. When set, the deployment operator mounts this config as a ConfigMap into the agent pod, sets the MISE_GLOBAL_CONFIG_FILE and MISE_DATA_DIR environment variables, and (when the root filesystem is not read-only) triggers a mise bootstrap step inside the harness. This lets AI agent pods automatically install the correct tool versions (Node, Python, Go, etc.) on startup rather than relying on pre-baked images alone.

Read-only root filesystem support: runtimeReadOnlyRootFilesystem is now detected from the AgentRuntime spec or its pod template, and the ensureDefaultContainerSecurityContext helper is updated to respect this setting rather than always defaulting to false. Mise bootstrap is automatically skipped when the root filesystem is read-only.

Repository pre-bake pipeline (repository-prebake/): A new set of shell scripts (prebake.sh, precompile.sh), a compile.Dockerfile, and a GitHub Actions workflow (repository-prebake-console.yaml) implement an offline pre-compilation step. The workflow clones configured repositories, runs language-specific dependency installation (npm, yarn, pip, cargo, go mod, etc.) and compilation, and bakes the results into a cached Docker image. Agent pods can then mount this pre-baked image as an init container, dramatically reducing the time spent on dependency installation at agent-run start.

Harness hooks (controller_hooks.go): New pre/post cycle hook infrastructure is added to the agent-run harness controller, with a specific mise hook implementation that bootstraps mise inside the running container when the configuration is present and the environment supports it.

The changes are accompanied by new unit tests for pod construction (mise config, read-only filesystem combinations) and harness hook logic, updated CRD YAML and deep-copy generated files, and documentation updates for the AgentRuntime API and the configure-agent guide.

Changes

Mise tool version management and repository pre-bake for agent runtimes

• Introduces mise-based tool version management for AI agent pods: adds a mise field to the AgentRuntime CRD spec, mounts the mise config as a ConfigMap, sets MISE_GLOBAL_CONFIG_FILE/MISE_DATA_DIR env vars, and gates bootstrap on read-only filesystem detection. Also adds controller_hooks.go with pre/post cycle hook infrastructure and a mise-specific bootstrap hook. (9bd2627)
• Merge from master to incorporate upstream changes before landing the agent runtime improvements. (f203edd)
• Fixes the precompile job step in the repository pre-bake GitHub Actions workflow. (7d02df1)
• Adds the pre-bake output artifact directory to .gitignore to prevent generated pre-compiled images from being committed. (2aabe9d)
• Additional fix to the precompile job configuration in the repository pre-bake workflow. (87bc04c)

---

Updated: 2026-09-15 14:40 UTC

Deploy in Soffi

[greptile-apps]

Confidence Score: 1/5

This PR is not safe to merge until read-only runtime handling, DinD compatibility, and mise installer integrity are corrected.

Findings

1.  Partial context bypasses read-only ▶
2.  Read-only DinD cannot start ▶
3.   Installer response executes unchecked ▶
4.  Local Go cache is tracked ▶

Summary

This PR adds repository precompilation and mise-based runtime bootstrapping to reduce agent startup time, including a new prebake workflow and AgentRuntime configuration.

• Builds and publishes precompiled Console repository images.
• Adds mise and readOnlyRootFilesystem runtime fields, ConfigMap mounting, and harness bootstrap behavior.
• Updates agent pod security-context handling, examples, tests, CRDs, and documentation.
• The current implementation has blocking read-only/DinD behavior, partial-security-context handling, and installer-integrity concerns.

_{Reviews (1) · Last reviewed commit: "Merge remote-tracking branch 'origin/mas..."}

[greptile-apps]

Partial context bypasses read-only

When spec.readOnlyRootFilesystem is true but the template supplies a partial securityContext without that field, this helper returns the template unchanged. Kubernetes defaults the omitted field to false, so the container remains writable while mise bootstrap is disabled based on the runtime-level value. Apply the computed value when a partial context omits this field.

Suggested change

	func ensureDefaultContainerSecurityContext(sc *corev1.SecurityContext, readOnlyRootFilesystem bool) *corev1.SecurityContext {
	if sc != nil {
	return sc
	}
	func ensureDefaultContainerSecurityContext(sc *corev1.SecurityContext, readOnlyRootFilesystem bool) *corev1.SecurityContext {
	if sc != nil {
	if sc.ReadOnlyRootFilesystem == nil {
	sc.ReadOnlyRootFilesystem = lo.ToPtr(readOnlyRootFilesystem)
	}
	return sc
	}

Knowledge Base Used: Deployment operator

[greptile-apps]

Installer response executes unchecked

When a custom agent image lacks mise, this fallback pipes a mutable network response directly into sh. The process inherits the agent-run environment, including the run Secret, so compromise of the installer endpoint can execute arbitrary code and expose provider or Git credentials. Install a repository-pinned artifact with checksum or signature verification instead. The same unchecked installer pattern also appears in the agent-harness and repository-prebake Dockerfiles.

How this was verified: The reachable fallback executes the HTTPS response as shell input in the default container after that container imports the run Secret through envFrom.