Sidecar defaults to the latest stackql release (crate 0.2.0); re-pin to v0.10.601 - #2
Open
jeffreyaven wants to merge 4 commits into
Open
Sidecar defaults to the latest stackql release (crate 0.2.0); re-pin to v0.10.601#2jeffreyaven wants to merge 4 commits into
jeffreyaven wants to merge 4 commits into
Conversation
stackql-agent: a Rust-native agent over the cloud estate, for the meetup talk. Embeds stackql-mcp and wires the 13 StackQL MCP tools into a rig 0.38 agent (rmcp 1.7, claude-opus-4-8). One binary, three personas (platform engineering, SRE, audit) that differ only by system prompt; the embedded backend and read-only contract are identical. Streaming REPL prints each tool call live; one-shot (-p) and --check pre-flight modes included. Default github null_auth runs with zero credentials; --auth points the same agent at credentialed providers (IGA, CSPM, FinOps, AWS/Google/Azure). Vendored single-binary build verified (~123 MB, no runtime downloads). The integration seam is ~10 lines: server.list_all_tools() + server.peer() feed straight into rig's rmcp_tools(). Verified at runtime via --check (server starts, self-heals the cache, exposes 13 tools); the LLM loop needs the caller's ANTHROPIC_API_KEY. bundle: make extraction self-healing. A non-empty but invalid cache dir (left by an interrupted run, or a stale layout) previously caused the atomic rename to fail with ENOTEMPTY and bricked the binary until the cache was cleared by hand. Now such a dir is replaced (or adopted if a concurrent extractor produced a valid one). Regression test added. This surfaced live while building the agent and is a fix for the published crate (0.1.1 material). talk.md: presentation kit - slide-by-slide content (intro StackQL, the MCP server, agentic use cases, embedded/vendored primitives in Rust, the demo, the ask) with speaker notes, plus a demo runbook with exact per-persona commands, the live-vs-credentialed framing, and a fallback plan for wifi/rate-limit/API failure. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The v0.10.500 release assets were re-published upstream, so the sha256 pins baked into 0.1.0 no longer verify (conformance test fails with ChecksumMismatch on all platforms). Re-pin to v0.10.601; all four pins match the published .mcpb.sha256 assets. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The sidecar now resolves github.com/stackql/stackql/releases/latest at
start-up and verifies the download against that release's published
.mcpb.sha256 asset, so the crate no longer needs a re-pin every time a
new server ships (or, as with v0.10.500, when release assets are
re-published).
- BundleVersion { Latest (default), Pinned, Exact(v) } via
Builder::version() or STACKQL_MCP_VERSION=latest|pinned|<version>
- Pinned keeps the baked sha256 pins (offline verification) and is the
last-resort fallback; if the latest release cannot be resolved
(offline) the newest cached release is used first
- fetch_bundle() follows the same selection; fetch_bundle_with() picks
explicitly
- no-default-features build is now clippy-clean too
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
jeffreyaven
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the conformance failure on main (run 32084386378): the v0.10.500 .mcpb release assets were re-published upstream, so the baked sha256 pins no longer verified (ChecksumMismatch on all three OSes).
Two commits on top of the already-pushed stackql-agent demo work:
releases/latestat start-up (redirect -> tag, no GitHub API) and verifies the download against that release's published.mcpb.sha256asset, so a new server release or re-published assets no longer break the crate.BundleVersion { Latest (default), Pinned, Exact(v) }viaBuilder::version()orSTACKQL_MCP_VERSION=latest|pinned|<version>Pinnedkeeps the baked pins (offline verification) and is the last-resort fallback; if latest cannot be resolved (offline) the newest cached release is used firstfetch_bundle()follows the same selection;fetch_bundle_with()picks explicitlyVerified locally on linux: conformance test (latest),
STACKQL_MCP_VERSION=pinned,=0.10.500(verifies against the re-published sha), and offline fallback (https_proxyto a dead port -> "using cached 0.10.601").🤖 Generated with Claude Code