ci(cloak): stop the optional cloak image from gating releases

- release job no longer needs build-and-push-cloak; the cloak job is
  continue-on-error. A ~200MB Chromium bake per arch (arm64 under QEMU)
  must not sit on the critical path of a GitHub Release, and a flake in
  an optional layer must not fail a release whose artifact is deva.sh
- cloak holds no agent CLIs and only changes when Dockerfile.cloak,
  cloak-entrypoint.sh or CLOAKBROWSER_WRAPPER_VERSION change -- never on
  a version bump. Nightly already skipped it for the same reason
- release notes: :cloak is the rolling tag, :vX.Y.Z-cloak may lag
- skill: goto(data:,{domcontentloaded}) not setContent() -- setContent
  hangs on a fresh daemon page waiting for a load event that never fires
- dev log records the live proofs that close the 07-21 unverified gap:
  RFB 003.008 on :5900, CDP on :9222, connectOverCDP drives the live
  browser and the daemon survives client disconnect

Refs #456

Author: lroolle

.github/workflows/ci.yml

@@ -169,6 +169,12 @@ jobs:
           set -euo pipefail
           ./scripts/test-install-agent-tooling.sh
 
+      - name: Smoke image/tag precedence
+        shell: bash
+        run: |
+          set -euo pipefail
+          ./scripts/test-image-precedence.sh
+
       - name: Smoke kimi auth wiring
         shell: bash
         run: |

.github/workflows/release.yml

@@ -217,10 +217,17 @@ jobs:
             RUST_DEFAULT_TOOLCHAIN=${{ needs.load-version-pins.outputs.rust_default_toolchain }}
             RUST_TARGETS=${{ needs.load-version-pins.outputs.rust_targets }}
 
+  # Optional, non-gating: the cloak layer bakes a ~200MB Chromium per arch
+  # (arm64 under QEMU), holds no agent CLIs, and changes only when
+  # Dockerfile.cloak / cloak-entrypoint.sh / CLOAKBROWSER_WRAPPER_VERSION move
+  # -- not on a deva.sh version bump. The GitHub Release must not be hostage to
+  # it, so `release` does not wait on this job and a failure here does not fail
+  # the release. Re-run this job alone to publish a missing -cloak tag.
   build-and-push-cloak:
     name: Build and Push Cloak Profile Image
     runs-on: ubuntu-latest
     needs: [prepare, load-version-pins, build-and-push-rust]
+    continue-on-error: true
     permissions:
       contents: read
       packages: write
@@ -270,7 +277,7 @@ jobs:
   release:
     name: Create GitHub Release
     runs-on: ubuntu-latest
-    needs: [prepare, build-and-push, build-and-push-rust, build-and-push-cloak]
+    needs: [prepare, build-and-push, build-and-push-rust]
     permissions:
       contents: write
     steps:
@@ -309,9 +316,9 @@ jobs:
           echo "- \`ghcr.io/${{ env.IMAGE_NAME }}:${RELEASE_TAG}-rust\`" >> release_notes.md
           echo "- \`ghcr.io/${{ env.IMAGE_NAME }}:rust\`" >> release_notes.md
           echo "" >> release_notes.md
-          echo "**Cloak Profile (CloakBrowser stealth Chromium, headed):**" >> release_notes.md
-          echo "- \`ghcr.io/${{ env.IMAGE_NAME }}:${RELEASE_TAG}-cloak\`" >> release_notes.md
+          echo "**Cloak Profile (CloakBrowser stealth Chromium, headed) - optional:**" >> release_notes.md
           echo "- \`ghcr.io/${{ env.IMAGE_NAME }}:cloak\`" >> release_notes.md
+          echo "- \`ghcr.io/${{ env.IMAGE_NAME }}:${RELEASE_TAG}-cloak\` (published when the non-gating cloak build finishes; it may lag this release)" >> release_notes.md
           echo "" >> release_notes.md
           echo "## Supported Architectures" >> release_notes.md
           echo "" >> release_notes.md

CHANGELOG.md

@@ -50,8 +50,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   in versions.env pins the wrapper and thereby Chromium. Ships the
   `deva-cloak` skill (keyed off `DEVA_CLOAK=1`), `make build-cloak` /
   `test-cloak` targets, a paths-filtered `cloak-image.yml` CI workflow,
-  and release pushes `:cloak` / `:vX.Y.Z-cloak` tags. Nightly skips cloak
-  on purpose — that layer contains no agent CLIs.
+  and release pushes `:cloak` / `:vX.Y.Z-cloak` tags. cloak is an auxiliary
+  image on its own cadence: nightly skips it (that layer holds no agent
+  CLIs) and the release cloak job is non-gating (`continue-on-error`, not
+  in the `release` job's `needs`) — a ~200MB Chromium bake per arch must
+  never hold the GitHub Release hostage.
 
 ### Fixed
 - `--trace` launch killed by `cp: cannot create regular file

DEV-LOGS.md

@@ -13,6 +13,14 @@
 - Minimal markdown markers, no unnecessary formatting, minimal emojis.
 - Reference issue numbers in the format `#<issue-number>` for easy linking.
 
+# [2026-07-27] Dev Log: cloak release policy + closing the unverified VNC/daemon gap #456
+- Why: two loose ends before shipping. (1) The 2026-07-21 entry left "x11vnc serving RFB and a live daemon inside the built image" unverified — that env couldn't apt-install. (2) release.yml made the GitHub Release `needs` the cloak build, so a ~200MB Chromium bake per arch (arm64 under QEMU) sat on the critical path of every release, including patch releases that touch nothing in that layer.
+- What:
+  - Live verification against the built `:cloak` image (wrapper 0.5.2, Chrome 146.0.7680.177): x11vnc answers the RFB handshake on :5900 with `RFB 003.008`; cloak-browserd serves CDP on 127.0.0.1:9222; a separate playwright-core client `connectOverCDP`s, drives a page, and the daemon survives that client's `close()`. Stealth confirmed live: UA spoofs `Windows NT 10.0`, `navigator.webdriver === false`. First probe raced the daemons — both are up ~4s after boot, so poll the ports, don't poll only the display.
+  - Agent-facing footgun found while proving it: `page.setContent()` on a fresh daemon page hangs waiting for a `load` event that never fires. `goto('data:text/html,...', {waitUntil:'domcontentloaded'})` is the working equivalent — documented in the skill.
+  - Release policy: cloak is an auxiliary image on its own cadence, NOT a general releasable profile. It holds no agent CLIs, and its content only moves when Dockerfile.cloak / cloak-entrypoint.sh / CLOAKBROWSER_WRAPPER_VERSION move — never on a deva.sh version bump. So the cloak job is now `continue-on-error: true` and is OUT of the `release` job's `needs`; release notes present `:cloak` as the rolling tag and mark `:vX.Y.Z-cloak` as possibly lagging. Nightly already skipped cloak for the same reason.
+- Result: all four live proofs pass; `make test-cloak` green. The structural point: an optional 200MB capability layer must never be able to fail the mandatory release artifact. Follow-up filed for the profile registry — profile identity is currently duplicated across deva.sh, Makefile, and three workflows.
+
 # [2026-07-21] Dev Log: cloak always-on browser + VNC + persistent profile #456
 - Why: three asks for auth sites in the cloak browser — (1) VNC auto-secured with a password, (2) an always-on browser the agent can drive freely, (3) mount what preserves the whole session to the host. Verified the load-bearing assumption first in a throwaway cloak container: a persistent CloakBrowser launched with `--remote-debugging-port` exposes a CDP endpoint a SEPARATE Playwright client reaches via connectOverCDP, drives, and the browser survives that client disconnecting. So one daemon can back both the human (VNC) and the agent (CDP).
 - What:

skills/deva-cloak/SKILL.md

@@ -164,6 +164,10 @@ await b.close();                           // detaches; the daemon browser stays
 absence means there is no daemon and you should launch your own browser as
 above.
 
+Use `goto()`, not `setContent()`: on a fresh daemon page `setContent` waits for
+a `load` event that never fires and times out. `page.goto('data:text/html,...',
+{waitUntil: 'domcontentloaded'})` is the working equivalent for injected markup.
+
 **Persistence / what to mount.** `--cloak-vnc` (and `--cloak-browser`)
 auto-mounts `~/.config/deva/cloak-profile` (host) to the Chromium `userDataDir`
 `/home/deva/.cloak-profile`. That one dir is the whole session -- cookies,