[antoinetoussaint-byte]

Why

At main (core v0.3.4) the agent can't be loaded by the current CLI (0.1.199):

admit agent codefly.dev/s3:0.0.21: incompatible agent contract:
agent does not declare a CLI-agent protocol version; host requires version 1

So a throwaway MinIO can't be composed under codefly run as a service dependency. That is the local loop codefly-dev/service-object-storage#111 (per-call bucket binding, #108) and codefly-dev/module-saas-starter#1211 rely on. There is also no published release to install (codefly agent install s3:0.0.21 returns 404).

What changes

codefly agent deps --pin v0.19.4 (go.mod/go.sum), plus the two call sites that no longer exist at that version. Each replacement follows core's own guidance:

1. resources.VisibilityExternal → resources.VisibilityInternal on the tcp endpoint. Core had already deprecated external at v0.3.4: "External is a location, not a permission: use Location = LocationExternal alongside a real visibility." This agent allocates a port and runs MinIO itself, so it isn't an external location (a managed resource resolved by DNS). internal is core's "reachable across modules, from within the workspace: any module of the composition may declare a dependency on it", which is what a composed MinIO is. public would make it reachable from outside the workspace, which a dev store with root credentials shouldn't be.
2. services.IsRestrictedOutputProfile(p) → services.ParseOutputProfile(p) then .Restricted(), returning the parse error. Core moved profile judgement into OutputProfile. PROMOTABLE_GITOPS_V1, which the old helper also counted as restricted, no longer exists in the contract. Core judges the profile (judgeKubernetesDeployment) before Prepare runs, so an unknown or unspecified profile is refused upstream and the new error branch is defensive only.

Fix or hack

A fix, at the owner. The agent is brought up to the core contract the CLI enforces, using core's documented replacements. There's no compatibility shim and no change to the agent's runtime behaviour.

Evidence

• go build ./..., go vet ./..., go mod tidy -diff: clean.
• go test -count=1 -v ./...: 12 PASS, 1 SKIP. The skip is TestManifestGuardRender, which needs the guard's environment.
• TestManifestGuardRender run with CODEFLY_MANIFEST_DESTINATION, _ENVIRONMENT=staging and _NAMESPACE=s3-test: PASS for both profiles.
  • RESTRICTED_PORTABLE_V1 renders stateful-set, service, kustomization and the overlay, with no inline Secret (the restricted path).
  • EPHEMERAL_LOCAL_APPLY_V1 additionally renders namespace.yaml and the overlay's inline secret.yaml.
• Live: built with codefly agent build into an isolated codefly home. It loads in CLI 0.1.199 (Will run 2 service(s): sos108/tenant@0.0.0 via codefly.dev/s3:0.0.21; …).
  • Composed as a kind: runtime service-dependency of a codefly.dev/object-storage service, MinIO came up through the agent's nix runtime and answered /minio/health/live.
  • The dependent gateway read a bucket on it through its per-call binding (List/Stat/Get), as recorded in feat: a per-call bucket binding on Stat/Get/List/Capabilities, with the public-destination guard owned here (#108) service-object-storage#111.

Not verified

• The docker runtime path: the live run took the nix runtime.
• A real Kubernetes apply of the rendered manifests.
• codefly agent ci, and the shared manifest-guard workflow itself (only its render test was run locally).

Notes

• Supersedes chore: bump core to v0.3.8 (Go 1.27) (#452) #23 (bump to core v0.3.8), which still predates the protocol declaration.
• This repository was archived on 2026-08-23 and has been unarchived for this change.
• No release or tag.

🤖 Generated with Claude Code

[antoinetoussaint-byte]

Closing: not needed, and the premise was wrong.

This port was opened so that a local composed run could have an S3-style store to read, for the per-call bucket binding in codefly-dev/service-object-storage#111. That service already runs a store locally itself: its runsLocalMinIO() is asserted in its own composition tests ("empty backend should run local minio", "minio backend should run local minio", "s3 backend must not run local minio"), and its builder records that local runs default to MinIO while a deployment never starts one.

So a tenant store for a local proof is a second instance of codefly.dev/object-storage with no backend set, composed as a service-dependency. That is one agent instead of two, and the binding's composed-dependency guard exception admits exactly that resolved endpoint.

The port commit stays on its branch if this agent is ever wanted again. Nothing here was published or released.