feat: no default agent, no latest tag — all images require explicit agent suffix

- _helpers.tpl: remove kiro special case, all agents use <tag>-<agent>
- image-tags.md: document no-default, no-latest policy
- helm unittest: update expected values (kiro → openab:<tag>-kiro)

Migration: openab:beta → openab:beta-kiro

Author: chaodu-agent

charts/openab/templates/_helpers.tpl

@@ -57,9 +57,8 @@ app.kubernetes.io/component: {{ .agent }}
 {{- end }}
 
 {{/* Resolve image: agent-level string override → unified default (repository:<tag>-<agent>).
-    When no per-agent image override is set, produces:
-      ghcr.io/openabdev/openab:<tag>-<agent>   (e.g. openab:beta-claude)
-      ghcr.io/openabdev/openab:<tag>            (for kiro, the default agent)
+    All agents use the same format: ghcr.io/openabdev/openab:<tag>-<agent>
+    There is no "default" agent — every agent must be explicitly identified in the tag.
     Per-agent image override (string with ":") is used verbatim for full backward compat.
     Call with: dict "ctx" $ "agent" $name "cfg" $cfg */}}
 {{- define "openab.agentImage" -}}
@@ -71,13 +70,9 @@ app.kubernetes.io/component: {{ .agent }}
 {{- end }}
 {{- else }}
 {{- $tag := default .ctx.Chart.AppVersion .ctx.Values.image.tag }}
-{{- if eq .agent "kiro" }}
-{{- printf "%s:%s" .ctx.Values.image.repository $tag }}
-{{- else }}
 {{- printf "%s:%s-%s" .ctx.Values.image.repository $tag .agent }}
 {{- end }}
 {{- end }}
-{{- end }}
 
 {{/* Resolve imagePullPolicy: global default (per-agent image string has no pullPolicy) */}}
 {{- define "openab.agentImagePullPolicy" -}}

charts/openab/tests/agent-image_test.yaml

@@ -1,13 +1,13 @@
-suite: agentImage unified tag format
+suite: agentImage unified tag format (no default agent)
 templates:
   - templates/deployment.yaml
 
 tests:
-  - it: kiro (default) resolves to openab:<appVersion> with no agent suffix
+  - it: kiro resolves to openab:<appVersion>-kiro (no bare tag)
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: "ghcr.io/openabdev/openab:0.9.0-beta.1"
+          value: "ghcr.io/openabdev/openab:0.9.0-beta.1-kiro"
 
   - it: non-kiro agent resolves to openab:<appVersion>-<agent>
     set:
@@ -18,13 +18,13 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "ghcr.io/openabdev/openab:0.9.0-beta.1-claude"
 
-  - it: image.tag override applies to kiro
+  - it: image.tag override applies to kiro with suffix
     set:
       image.tag: "beta"
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: "ghcr.io/openabdev/openab:beta"
+          value: "ghcr.io/openabdev/openab:beta-kiro"
 
   - it: image.tag override applies to non-kiro agent with suffix
     set:

docs/image-tags.md

@@ -2,47 +2,39 @@
 
 ## Unified Image Repository (`ghcr.io/openabdev/openab`)
 
-All agent variants are published under a single image repository using tag-based variants:
+All agent variants are published under a single image repository using tag-based variants.
+**There is no default agent** — every image tag must explicitly specify the agent:
 
 ```
-ghcr.io/openabdev/openab:<version>-<agent>   # per-agent variant
-ghcr.io/openabdev/openab:<version>           # default (kiro)
+ghcr.io/openabdev/openab:<version>-<agent>
 ```
 
-### Default (kiro) tags
+### Tag format
 
-| Tag | Points to | Updated when |
-|-----|-----------|--------------|
-| `0.9.0-beta.1` | Exact pre-release build | Pre-release tag pushed |
-| `beta` | Latest pre-release | Every pre-release build |
-| `0.9.0` | Promoted stable build | Stable tag pushed |
-| `0.9` | Latest patch in minor | Stable promotion |
-| `stable` | Latest stable | Stable promotion |
-| `latest` | Latest stable (= `stable`) | Stable promotion |
-
-### Per-agent variant tags
-
-Agent variants use the format `<version>-<agent>`:
+| Tag | Example | Points to | Updated when |
+|-----|---------|-----------|--------------|
+| `<version>-<agent>` | `0.9.0-beta.1-kiro` | Exact pre-release build | Pre-release tag pushed |
+| `beta-<agent>` | `beta-claude` | Latest pre-release | Every pre-release build |
+| `<version>-<agent>` | `0.9.0-codex` | Promoted stable build | Stable tag pushed |
+| `<major.minor>-<agent>` | `0.9-gemini` | Latest patch in minor | Stable promotion |
+| `stable-<agent>` | `stable-grok` | Latest stable | Stable promotion |
 
-| Tag | Example | Points to |
-|-----|---------|-----------|
-| `<version>-<agent>` | `0.9.0-beta.1-claude` | Exact pre-release build for claude |
-| `beta-<agent>` | `beta-codex` | Latest pre-release for codex |
-| `<version>-<agent>` | `0.9.0-gemini` | Promoted stable for gemini |
-| `stable-<agent>` | `stable-grok` | Latest stable for grok |
+> **No `latest` tag.** Use `beta-<agent>` or `stable-<agent>` for floating tags,
+> or pin to an exact version like `0.9.0-beta.1-kiro`.
 
 Available agents: `kiro`, `claude`, `codex`, `copilot`, `cursor`, `gemini`, `grok`, `hermes`, `mimocode`, `opencode`, `antigravity`, `pi`, `native`, `agentcore`
 
 ### Migration from per-repo images (deprecated)
 
 Previously, each agent had its own image repository (`ghcr.io/openabdev/openab-codex:beta`).
-These are now replaced by the unified tag format (`ghcr.io/openabdev/openab:beta-codex`).
+These are now replaced by the unified tag format.
 
 | Old (deprecated) | New |
 |------------------|-----|
+| `ghcr.io/openabdev/openab:beta` | `ghcr.io/openabdev/openab:beta-kiro` |
+| `ghcr.io/openabdev/openab:latest` | `ghcr.io/openabdev/openab:stable-kiro` (no more `latest`) |
 | `ghcr.io/openabdev/openab-claude:beta` | `ghcr.io/openabdev/openab:beta-claude` |
 | `ghcr.io/openabdev/openab-codex:0.8.5-beta.13` | `ghcr.io/openabdev/openab:0.8.5-beta.13-codex` |
-| `ghcr.io/openabdev/openab:beta` | `ghcr.io/openabdev/openab:beta` (unchanged, kiro is default) |
 
 ## Gateway (`ghcr.io/openabdev/openab-gateway`)
 
@@ -57,9 +49,9 @@ These are now replaced by the unified tag format (`ghcr.io/openabdev/openab:beta
 | Use case | Recommended tag |
 |----------|----------------|
 | Production (pinned) | Exact version (`0.9.0-beta.1-claude`) |
-| Helm chart default | `stable` or `beta` (channel-based) — chart auto-appends `-<agent>` |
-| Local dev / quick test | `beta` or `beta-<agent>` |
-| CI | Exact version or SHA |
+| Helm chart default | `beta` or `stable` — chart auto-appends `-<agent>` |
+| Local dev / quick test | `beta-<agent>` |
+| CI | Exact version or `<sha>-<agent>` |
 
 ## Release flow
 
@@ -72,10 +64,10 @@ release PR merged → tag-on-merge → v0.9.0-beta.1
                               ┌──────────┴──────────┐
                               │ is_prerelease=true   │
                               ▼                      │
-                    openab:0.9.0-beta.1              │
+                    openab:0.9.0-beta.1-kiro         │
                     openab:0.9.0-beta.1-claude       │
                     openab:0.9.0-beta.1-codex        │
-                    openab:beta                      │
+                    openab:beta-kiro                 │
                     openab:beta-claude               │
                     openab:beta-codex                │
                     ... (all agents)                 │
@@ -84,12 +76,11 @@ release PR merged → tag-on-merge → v0.9.0-beta.1
                               │ is_prerelease=false (stable)
                               ▼
                     promote latest beta images →
-                    openab:0.9.0
+                    openab:0.9.0-kiro
                     openab:0.9.0-claude
-                    openab:0.9
+                    openab:0.9-kiro
                     openab:0.9-claude
-                    openab:stable
+                    openab:stable-kiro
                     openab:stable-claude
-                    openab:latest
-                    ... (all agents)
+                    ... (all agents, no `latest`)
 ```