feat: Rebuild the factory image on every merge to main

[anthonyshew]

What

Agents in apps/factory booted from vercel/eve:latest plus a shallow clone. The sandbox had no Rust toolchain, protoc, Cap'n Proto, Zig, LLD, pnpm 10.28.0, node_modules, or performance tooling, and its Eve revalidationKey was hardcoded to "turborepo-main-v1", so the template never rotated. .devcontainer/Dockerfile had most of that toolchain but was unused and had drifted three Rust nightlies, two Node majors, and two pnpm majors behind.

This adds the factory image: one specification for what an agent's sandbox contains, a snapshot rebuilt by the application on every merge to main, and both agent paths booting from it.

One specification

apps/factory/agent/lib/factory-image.ts owns the image. It pins versions to the values the repository and CI already use, emits idempotent provisioning phases, and fingerprints the whole thing so a changed pin rebuilds every image.

Tool	Version	Source of truth
Rust	nightly-2026-05-22 + rustfmt, clippy	rust-toolchain.toml
Node.js	24	root package.json engines
pnpm	10.28.0	root package.json packageManager
protoc	26.1	.github/actions/setup-protoc
Cap'n Proto	1.1.0	.github/actions/setup-capnproto
Zig	0.15.2	.github/actions/setup-zig

Plus build-essential, pkg-config, LLD (.cargo/config.toml links with -fuse-ld=lld), OpenSSL headers, jq, zstd, the workspace node_modules, a warm Cargo registry, and hyperfine, cargo-bloat, and twiggy for the performance skill. A final phase verifies every required tool, warns about missing optional ones, and writes a version manifest.

.devcontainer/Dockerfile was rewritten against the same pins, and a test fails when either drifts from rust-toolchain.toml, the root package.json, or the CI actions — so the local dev container and the agents' sandbox stay on one toolchain.

Rebuilt on every merge, without GitHub Actions

A push to main reaches POST /api/github/push, which verifies the GitHub HMAC signature and starts a Workflow run. The workflow creates a build sandbox, detaches the provisioning script inside it, polls the markers the script writes, snapshots the result, and publishes the snapshot id to a Blob-backed ledger. No step holds a function invocation open for the length of a build. When a published image already exists for the same toolchain the build boots from it, so a merge build only fast-forwards the checkout, refreshes dependencies, and recompiles.

Rapid merges

Resolved in the ledger rather than by racing:

• Claiming a build cancels every build still in flight, records which build replaced it, stops its workflow run, and deletes its sandbox.
• Every step re-reads the ledger before acting; a build that has lost can neither report progress nor publish a pointer.
• Redelivered webhooks deduplicate onto the live build, a revision that is already published is skipped, and a build that stops reporting progress for 15 minutes is replaced instead of wedging its revision.

Consumers

• Eve (agent/sandbox.ts) provisions its template from the same phases and boots from the published snapshot when one matches. Eve freezes revalidationKey at build time, so the template rotates when the fingerprint changes or a newer image is published; each session then fast-forwards its checkout to the current main.
• Harness (agent/lib/harness-agent.ts) uses the snapshot as its sandbox source instead of a stock node24 runtime plus a clone, rotates its template with the image, and falls back to cloning when no image matches this deployment's toolchain.
• The operator page shows the published snapshot, the toolchain fingerprint, warnings, and recent builds, and can rebuild from the current main head.

Validation

Every provisioning phase was run against a real vercel/eve:latest sandbox. All eleven phases pass through verification in about two minutes, with no warnings:

system-packages 10s · node 1s · pnpm 2s · rust 11s · protoc <1s · zig 5s
checkout 2s · node-modules 12s · cargo-registry 7s · performance-tools 45s · verify 1s

{"capnp":"Cap'n Proto version 1.1.0","node":"v24.17.0","pnpm":"10.28.0",
 "protoc":"libprotoc 26.1","rustc":"rustc 1.97.0-nightly (e96c36b6f 2026-05-21)",
 "zig":"0.15.2"}

That run also confirmed the image is Ubuntu 26.04 with apt, that commands run as root, and that ld.lld, hyperfine, cargo-bloat, and twiggy all land on PATH.

45 unit tests pass (pnpm test), covering the pinned versions against the files they mirror, the phase list and generated script, revision validation, progress parsing, the fingerprint, the ledger's supersede and publish rules, and webhook signature and event filtering. eve build, next build, tsc --noEmit, oxlint --deny-warnings, and oxfmt --check are clean.

Deployment notes

• Requires the private Vercel Blob store the run registry already uses.
• Set FACTORY_IMAGE_WEBHOOK_SECRET (falls back to GITHUB_WEBHOOK_SECRET) and deliver push to /api/github/push. Deployment Protection covers that path, so append the automation bypass token as a query parameter; the HMAC signature authenticates the delivery.
• The first build after a toolchain change provisions the Eve template during the Vercel build, because Eve prewarms templates there. The phases that compile Rust are wrapped in timeouts so one bad upstream release cannot hold a deployment build open, and only the merge webhook asks for the warm cargo build.
• Performance-tool installation failures are recorded as warnings rather than failing a build, so a broken upstream crate cannot stop an otherwise complete image from publishing. The warnings surface on the operator page.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
examples-basic-web	Ready	Preview	Aug 20, 2026 1:09pm
examples-designsystem-docs	Ready	Preview	Aug 20, 2026 1:09pm
examples-gatsby-web	Ready	Preview	Aug 20, 2026 1:09pm
examples-kitchensink-blog	Ready	Preview	Aug 20, 2026 1:09pm
examples-nonmonorepo	Ready	Preview	Aug 20, 2026 1:09pm
examples-svelte-web	Ready	Preview	Aug 20, 2026 1:09pm
examples-tailwind-web	Ready	Preview	Aug 20, 2026 1:09pm
examples-vite-web	Ready	Preview	Aug 20, 2026 1:09pm
turbo-site	Ready	Preview	Aug 20, 2026 1:09pm
turborepo-factory	Ready	Preview	Aug 20, 2026 1:09pm