Repin the current Drawing Board workflow

[raghubetina]

Summary

• pin exact published CLI 0.2.2 at source/tag 799a184cb2453ceadf5575f7b46ba975e084f192 and exact source-installed Skills 0a765f88d1cd500168e18ce1adda03802773f35e, whose compatibility contract requires CLI = 0.2.2
• preserve absent ./application as the beginner/default direct-Compile path while documenting CLI current-root adoption as an explicit user-selected alternative
• replace the custom OpenSSH entrypoint that failed to produce a Codespaces SSH banner with the maintained ghcr.io/devcontainers/features/sshd:1 lifecycle
• pin the exact published multi-platform workspace image and retain its source, workflow, platform, anonymous-access, and SSH-policy receipt
• strengthen the source, wrapper, and in-container contracts for the exact current tuple

Exact base: aaae92775e39a3e5a82802a8fdc093aee547499b (tree 56c73d227f36c23e15426579c9fb3bcffe47eced)

Exact candidate: 85d2035b68b254a2fcbf28be42ad5158422012e9 (tree 2e00ce06f8eb9b05dcad4fd8ae4a89846eb2a018)

Image and local verification

• candidate image workflow 33320822128 is terminal green at source 1488d6337847a0dfd7da9b7c11de895e81160421; build job 99282366552, verify job 99284135796
• immutable public image index sha256:06602be5cc829d5142c12b06c505dbf8353a3ade6751ca4bf01a785ea2c3e6e3; amd64 sha256:1c8a08347080623ce27daf13651327142eee2ac163907430614869435db2fdae; arm64 sha256:0d09a17e7618d69bc2fa1c57754cbb0453363a19f061686f517efceee59bde10
• credential-free GHCR request returned 200 with that exact index digest
• hosted amd64 verification proved the maintained SSH listener, key-only authentication, denied root login, default-command lifetime, and PostgreSQL 18.6 clients; arm64 metadata verification passed
• local script/check, current-source receipt checks, and true depth-one receipt checks pass at the exact candidate
• the exact published image completed a full Dev Container up, installed Claude 2.1.226, Codex 0.147.0, CLI 0.2.2, and Skills 0a765f88…, then passed script/devcontainer-smoke twice through the reviewed workspace PATH
• the task-owned containers, network, PostgreSQL volume, and agent/cache volumes were removed after proof
• source repair and the receipt/Compose descendant each received bounded independent review with no findings

Remaining qualification boundary

The earlier fresh non-prebuilt Codespace attempt on predecessor head 8664125 remains a failed immutable observation: GitHub made the API available, but the custom SSH entrypoint never produced a banner and the run was stopped. It is not relabeled as success.

The receipt intentionally keeps comparison_codespace at not_yet_observed. Before merge, run one new template-derived non-prebuilt Codespace on this exact repaired head. It must anonymously pull the pinned image, reach SSH through the maintained Feature, install the exact tuple, use one signed-in continuing agent and the approved Neighborhood Guide Plan, perform exactly one direct ./application Compile and zero Publications, initialize and fully smoke the nested app, verify a real state-changing POST through the ordinary forwarded URL without a local Rails patch, and have the same agent explain one retained decision and make/check one bounded source edit. Only that retained observation may move the receipt to passed.

No Service/CLI/Skills mutation, package publication, catalog or dist-tag move, deployment, root-output default change, merge, or release is included.