feat(release): independent fleet-agent release train

[PeronGH]

Extracts the fleet-agent release infrastructure from the RUN-31 stack (#360) so it can land independently of the lifecycle and self-update work still under review.

What changes

• Independent release-please component: fleet/ now has its own version and release train, tagged as fleet-agent-vX.Y.Z. It is excluded from the root component, so main arcbox releases no longer bump the fleet agent and fleet-only releases do not trigger the main arcbox version update. The component is reseeded at 0.0.0 — fully decoupled from the main train's version — so its first release will be fleet-agent-v0.1.0.
• Dedicated fleet-agent release workflow: .github/workflows/release-fleet-agent.yml builds four platform assets:
  • signed darwin-arm64 on an Apple Silicon runner
  • signed darwin-amd64 on an Intel runner
  • static musl linux-arm64 on a native ARM runner
  • static musl linux-amd64 on a native x86 runner
• Tag-pinned builds: both tag pushes and manual dispatches resolve one release tag, and every build and publish checkout uses that tag. A manually dispatched release therefore cannot publish binaries from the dispatching branch under a different tag.
• Raw, stable asset layout: each binary is published as arcbox-fleet-agent-<os>-<arch> with a matching .sha256 sidecar. The release tag carries the version, while the platform registry can expose only the artifacts registered for a promoted release. Fleet releases use make_latest: false, preserving the main arcbox release as the repository's latest release.
• Main tarball permission fix: GitHub artifact round-trips strip executable bits, while the tar builder preserves the downloaded modes. Binaries are now explicitly staged as 0755; bundle metadata remains non-executable. A regression test checks the modes recorded in the generated archive.

Release behavior

The first fleet release provides real, signed artifacts for validating the platform release-registration and promotion flow in arcboxlabs/platform#114. The agent-version handshake and self-update executor remain in #360, so a later fleet release from that work will supersede the bootstrap release for end-to-end self-update testing.

Because there is no existing fleet-agent-v* tag, the first generated fleet changelog may include older fleet history. If so, the one-time bootstrap release PR should trim that history before merge.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pullfrog]

ℹ️ No critical issues — one scope question worth confirming.

Reviewed changes — extracts the fleet-agent release infrastructure into its own release-please component and workflow so fleet ships independently of the desktop release train.

• New fleet release-please component — release-please-config.json adds a fleet/-scoped package (component: fleet-agent, include-component-in-tag: true) tagging fleet-agent-v*, and gives the root . package exclude-paths: ["fleet"] so desktop releases stop bumping the agent version. Manifest seeds fleet at 0.4.17.
• Pinned fleet version — fleet/arcbox-fleet-agent/Cargo.toml moves from version.workspace = true to a pinned 0.4.17 # x-release-please-version; safe since nothing depends on the crate.
• New release-fleet-agent.yml — signed darwin-arm64 + musl linux amd64/arm64 builds, published as raw arcbox-fleet-agent-<os>-<arch> binaries plus .sha256 sidecars with make_latest: false.
• New xtask release fleet-asset — fleet_asset.rs stages a single binary as a versionless asset + shasum -c-compatible checksum, with a unit test on the layout.
• Exec-bit regression fix — stage_executable (in release.rs) copies then chmods 0755; package_tarball.rs routes binaries through it while bundle files stay 0644, with a test asserting tar entry modes. Drops the GITHUB_OUTPUT plumbing so release.yml globs *.tar.gz / *.tar.gz.sha256.

ℹ️ Fleet build matrix omits darwin-amd64

The release workflow builds darwin-arm64, linux-amd64, and linux-arm64, but not darwin-amd64. Since the gateway derives AgentUpdate.binary_url as a pure function of (tag, host_os, host_arch), an Intel-mac fleet host would resolve to arcbox-fleet-agent-darwin-amd64, which no release would carry — a 404 at self-update time.

This is very likely intentional (fleet hosts are arm64 macs + linux), and the root CLAUDE.md P1 "macOS Intel" target is about the desktop app rather than fleet runners. Flagging only to confirm the fleet host matrix deliberately excludes Intel macs.

Technical details

# Fleet build matrix omits darwin-amd64

## Affected sites
- .github/workflows/release-fleet-agent.yml — `build-macos-arm64` is the only darwin job; no `build-macos-amd64`.
- publish loop iterates `darwin-arm64 linux-amd64 linux-arm64` only.

## Required outcome
- Confirm the fleet host matrix intentionally excludes Intel macs. If Intel-mac fleet hosts are ever in scope, add a `darwin-amd64` build + publish entry so the gateway-constructed URL resolves.

## Open questions for the human
- Does the fleet gateway ever emit `(darwin, amd64)` for a host? If it can, this is a latent 404 rather than a non-issue.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[greptile-apps]

Greptile Summary

This PR splits fleet-agent releases from the desktop release train. The main changes are:

• A new fleet-agent-v* release workflow that builds and publishes four platform binaries.
• A separate release-please component for fleet/, with fleet changes excluded from root releases.
• Raw arcbox-fleet-agent-<os>-<arch> assets with matching .sha256 sidecars.
• Desktop tarball packaging now restores executable bits before archiving.

Confidence Score: 4/5

One contained release-versioning issue needs to be fixed before relying on the new fleet train.

The workflow and xtask changes are coherent, but the fleet release seed currently produces the wrong first independent release version.

.release-please-manifest.json and fleet/arcbox-fleet-agent/Cargo.toml.

T-Rex Logs

What T-Rex did

• The seed version calculation harness was reproduced against the release-please config and the current manifest seed to validate how the fleet version is derived.
• Swapping the seed to 0.4.17 caused the harness to compute the next feature release as 0.4.18, confirming the current seed would place the fleet on the wrong version line under the actual config.
• xtask release tests were executed and completed with exit code 0, and the test log was captured for review.
• The fleet asset smoke flow was run, generating the asset and its sidecar, and the subsequent checksum verification passed.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/release-fleet-agent.yml	Adds a dedicated fleet-agent release workflow with tag-pinned checkout, platform builds, signing, checksum staging, and release upload.
.release-please-manifest.json	Adds the fleet component manifest entry, but seeds it at 0.0.0 instead of the described 0.4.17 baseline.
fleet/arcbox-fleet-agent/Cargo.toml	Moves fleet-agent off the workspace version, but sets the independent package version to 0.0.0 contrary to the intended 0.4.17 seed.
release-please-config.json	Configures separate root and fleet release-please packages, excluding fleet changes from root releases and enabling component tags.
xtask/src/commands/release/fleet_asset.rs	Implements versionless raw fleet-agent asset staging and sha256 sidecar generation with coverage.
xtask/src/commands/release/package_tarball.rs	Restores executable modes for desktop binaries before archiving and adds a regression test for tar entry modes.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Dev as Tag push / workflow_dispatch
participant Version as version job
participant Mac as build-macos matrix
participant Linux as build-linux matrix
participant Publish as publish job
participant Release as GitHub Release

Dev->>Version: "Provide fleet-agent-v* tag"
Version-->>Mac: Resolved tag
Version-->>Linux: Resolved tag
Mac->>Mac: Checkout tag, build, codesign
Linux->>Linux: Checkout tag, build musl binary
Mac-->>Publish: darwin arm64/amd64 artifacts
Linux-->>Publish: linux amd64/arm64 artifacts
Publish->>Publish: Checkout same tag and run xtask fleet-asset
Publish->>Release: Upload raw binaries and .sha256 files

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Dev as Tag push / workflow_dispatch
participant Version as version job
participant Mac as build-macos matrix
participant Linux as build-linux matrix
participant Publish as publish job
participant Release as GitHub Release

Dev->>Version: "Provide fleet-agent-v* tag"
Version-->>Mac: Resolved tag
Version-->>Linux: Resolved tag
Mac->>Mac: Checkout tag, build, codesign
Linux->>Linux: Checkout tag, build musl binary
Mac-->>Publish: darwin arm64/amd64 artifacts
Linux-->>Publish: linux amd64/arm64 artifacts
Publish->>Publish: Checkout same tag and run xtask fleet-asset
Publish->>Release: Upload raw binaries and .sha256 files

Loading

_{Reviews (5): Last reviewed commit: "chore(release): reset fleet-agent versio..." | Re-trigger Greptile}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[PeronGH]

Re pullfrog's scope question (darwin-amd64 omitted): intentional — fleet runner hosts are Apple Silicon Macs and Linux boxes; Intel macOS is a desktop-app target (P1 in the root CLAUDE.md), not a fleet host target.

The "latent 404 at self-update time" mechanism doesn't apply, though: the gateway never fabricates a URL from (tag, os, arch). It resolves AgentUpdate.binary_url from the registered artifacts of the promoted release (arcboxlabs/platform#114, pin.rs::build_update) — a host platform with no matching artifact gets an empty binary_url, and the agent parks on the expected version instead of downloading anything. So an Intel-mac host (which would have to be running a self-built binary anyway, since no release carries one) degrades to a visible park, not a 404 loop. If Intel fleet hosts ever enter scope, it's one matrix entry + the release re-registering with a fourth artifact.

CodeQL's three permissions findings and greptile's dispatch-ref mismatch are fixed in 9e99c78.

[pullfrog]

✅ No new issues found.

Reviewed changes — the new commit pins the fleet-agent release workflow's checkouts to the tag being released, so a workflow_dispatch from master builds the tag's tree rather than master.

• Tag-ref checkout discipline — all three checkout steps (build-macos-arm64, build-linux, publish) now use ref: ${{ needs.version.outputs.tag }}, and needs: version was added to the two build jobs so the dependency is real. The version job resolves the tag from inputs.tag (dispatch) or the stripped GITHUB_REF (push tag), which is correct for both triggers.
• Least-privilege token — added a top-level permissions: contents: read; the publish job continues to re-declare contents: write for asset upload.

The tag-ref fix is correct and the reasoning captured in the workflow comments matches the behavior. The prior informational note about the fleet build matrix omitting darwin-amd64 is unrelated to this commit and remains a scope question for the human.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pullfrog]

✅ No new issues found.

Reviewed changes — the new commit adds Intel macOS to the fleet-agent build matrix, resolving the prior review's open scope question about darwin-amd64 coverage.

• Intel macOS build — build-macos-arm64 becomes a build-macos matrix over {arm64: macos-26, amd64: macos-26-intel}, so both Apple Silicon and Intel binaries are produced. macos-26-intel is a GA GitHub-hosted runner label.
• Per-arch cache and artifacts — the cargo cache key and restore-keys now include ${{ matrix.arch }} (avoiding cross-arch cache collisions), and the uploaded artifact is named fleet-agent-binary-darwin-${{ matrix.arch }}.
• Publish wiring — publish needs the renamed build-macos job, and the fleet-asset staging loop now iterates darwin-arm64 darwin-amd64 linux-amd64 linux-arm64, so all four (host_os, host_arch) URLs the gateway can construct now resolve.

The darwin-amd64 platform slug flows through xtask release fleet-asset unchanged — fleet_asset.rs treats --platform as an opaque asset-name component with no allowlist, so no code change was needed there. The prior informational note is now fully addressed.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pullfrog]

✅ No new issues found.

Reviewed changes — the new commit reseeds the fleet-agent release train to 0.0.0, fully decoupling its version from the main arcbox train so the first release lands as fleet-agent-v0.1.0.

• Version reseed to 0.0.0 — .release-please-manifest.json fleet seed drops from 0.4.17 to 0.0.0, with matching updates to fleet/arcbox-fleet-agent/Cargo.toml (version = "0.0.0" # x-release-please-version) and Cargo.lock. The root . package stays at 0.4.17, so the main train is untouched.
• Workflow doc alignment — release-fleet-agent.yml header comment and the workflow_dispatch tag input example were edited to match ("desktop" → "main arcbox" train, fleet-agent-v0.5.0 → fleet-agent-v0.1.0).

All three version sites are consistent and the change matches the updated PR body. The author-acknowledged caveat still stands — because no fleet-agent-v* tag exists yet, the first generated fleet changelog may include older fleet history and should be trimmed in the bootstrap release PR before merge.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}