Pin Pages deployment to canonical agentctl commit

.github/workflows/pages.yml

@@ -15,6 +15,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  AGENTCTL_COMMIT: "f3181f93afac7546f01923491f77dabdf26b5ace"
   NODE_VERSION: "24.4.1"
   PNPM_VERSION: "11.9.0"
   RUST_TOOLCHAIN: "1.88.0"
@@ -36,6 +37,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: opensourceops/agentctl
+          ref: ${{ env.AGENTCTL_COMMIT }}
           path: agentctl
 
       - name: Install pinned Node.js

public/meta/agentctl-source.json

@@ -2,7 +2,7 @@
   "product": "agentctl",
   "version": "0.2.0",
   "workflowApi": "agentctl.dev/v1alpha1",
-  "commit": "a1ebcadcc2557136cb82633862c50854223981fa",
+  "commit": "f3181f93afac7546f01923491f77dabdf26b5ace",
   "dirty": false,
   "sourceRepository": "https://github.com/opensourceops/agentctl",
   "importedFiles": 56

src/content/docs/_generated/architecture/decisions/0001.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 The graph, policy, state machine, persistence decisions, and recorded replay remain model-independent. Provider, tool, filesystem, process, MCP, A2A, internal-state mutation, clock, and ID behavior cross injected interfaces and receive durable effect identity when externally observable.
 
 This keeps models replaceable and tests credential-free. It requires more records and conservative uncertain states, but avoids hidden calls during replay. Dynamic model-owned orchestration is rejected.
-> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/architecture/decisions/0002.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 Workflows use `apiVersion`, `kind`, `metadata`, and `spec`. The envelope is adopted because identity/version and evolution need unambiguous locations, not because another system uses it. All typed objects deny unknown fields and a generated JSON Schema is checked in.
 
 A narrow legacy translator provides actionable migration. General aliases and silent coercion are rejected because they make security review and durable reproduction ambiguous.
-> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/architecture/decisions/0003.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 One versioned SQLite database is the local correctness store. Transactional task transitions/checkpoints/audits and a request-before-start effect ledger support resume and no-effect replay. Confirmed results are reused; started unconfirmed work becomes uncertain.
 
 No exactly-once claim is made. Automatic retry of ambiguous external effects is rejected. Fork is the explicit operation for fresh effects. Distributed history services are outside this release.
-> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/architecture/decisions/0004.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 OpenAI Responses, Azure OpenAI Responses, Anthropic Messages, Google Gemini generateContent, and a scripted fake implement one provider-neutral internal interface. Capabilities are negotiated before execution; provider SDK/HTTP shapes never enter durable core state.
 
 “OpenAI-compatible” shims are rejected as a support claim because they hide native tool, continuation, reasoning, error, and usage differences. Every provider requires mock protocol coverage; live credentials are optional evidence only.
-> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/architecture/decisions/0005.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 V1alpha1 schedules a sequential DAG in declaration order and integrates typed actions/tools, local packs, MCP 2025-11-25, and A2A 1.0. `maxConcurrency` greater than one is rejected.
 
 Parallel groups, loops, routing, sub-workflows, teams/handoffs, automatic reconnection/resubmission, executable plugin ABIs, and registries are deferred. Each needs deterministic merge, cancellation, policy, version, and recovery semantics before it can enter the stable contract.
-> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/architecture/decisions/0006.md

@@ -16,4 +16,4 @@ Machine output is one `agentctl.dev/cli/v1` final envelope. Inputs come from JSO
 ## Consequences
 
 Cron, systemd, Kubernetes, and CI can use normal process semantics without hidden terminal waits. The product avoids an eventing/distributed-control-plane surface. A future schedule-run key may improve deduplication, but it cannot replace external overlap controls or effect idempotency.
-> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/architecture/decisions/0007.md

@@ -14,4 +14,4 @@ The image entrypoint is `agentctl`. Callers supply ordinary CLI arguments and on
 ## Consequences
 
 No vendor-specific plugin API is required. Platforms without direct entrypoint/argument support can invoke `docker run` from their normal shell step. Distroless reduces runtime surface but deliberately has no shell; debugging uses the public CLI or a separate diagnostic image, not mutation of production images.
-> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/architecture/diagrams.md

@@ -291,4 +291,4 @@ flowchart TD
 ```
 
 `agentctl-core` has no dependency on HTTP, SQLite, CLI parsing, or concrete executor types. `xtask` drives the built CLI for generation and acceptance.
-> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/architecture/index.md

@@ -37,4 +37,4 @@ The workspace uses Rust edition 2024, pins Rust 1.88 as the MSRV, forbids unsafe
 The OCI build is multi-stage: only the optimized Rust binary enters a maintained distroless runtime with CA roots and a non-root identity. `/config` is workflow configuration, `/workspace` is the read-only working tree, `/state` holds SQLite, and `/artifacts` receives declared outputs. State must be mounted again for inspect/resume/replay. The root filesystem may be read-only. See [Container contract](/agentctl/guides/container/) and ADR 0007.
 
 See the [architecture diagrams](/agentctl/architecture/diagrams/), [ADRs](https://github.com/opensourceops/agentctl/blob/main/docs/adr/), and [Durable execution](/agentctl/durable-execution/) for failure semantics.
-> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/concepts/memory.md

@@ -11,4 +11,4 @@ Four mechanisms remain intentionally separate:
 - Provider prompt cache is an optional performance optimization. Cache keys/options and usage counts are provider metadata, never correctness or memory.
 
 Long-term retrieval is exact namespace/key lookup in this release. Vector search and automatic promotion are not implemented. A workflow promotes a value explicitly by reading long-term memory and then writing working memory. Retention is applied by expiration/GC, not by replay.
-> Canonical source: [`docs/memory.md`](https://github.com/opensourceops/agentctl/blob/main/docs/memory.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/memory.md`](https://github.com/opensourceops/agentctl/blob/main/docs/memory.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/concepts/packs.md

@@ -8,4 +8,4 @@ A pack is reviewed reusable YAML content, not executable plugin code. Its manife
 `agentctl packs inspect` strictly parses the manifest, validates the API version, name, versions, and compatibility with the running binary. `agentctl packs verify` compares a `sha256:` integrity digest for a local manifest or archive. Workflow pack references carry name, version, local path, and integrity. The CLI verifies a referenced manifest, keeps it beneath the workflow directory, and loads actions, agents, and tools as `<pack-name>.<item-name>` before compilation.
 
 Dependency resolution, transitive lockfile generation, Git fetching, reusable sub-workflows, policy-default merging, a hosted registry, native dynamic libraries, and pack processes are not implemented. A checked-in pack reference is therefore an integrity/provenance contract for local content, not a package manager. Manifest policy defaults are inspectable metadata and never weaken the invoking workflow’s policy.
-> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/concepts/policies.md

@@ -12,4 +12,4 @@ Tool visibility, tool/capability authorization, resource checks, effect risk, an
 An approval stores the run/trace/task/agent, tool, capability, risk, redacted input, expected effect, reason, and resolution actor/reason. The associated task waits durably. Use `approvals list`, `approve`, or `reject`, then `resume`. Resolution and effect status are auditable.
 
 Provider, MCP, A2A, filesystem, process, and environment allowlists are necessary controls, not a containment boundary. Run untrusted executors inside an external OS/container sandbox.
-> Canonical source: [`docs/policies.md`](https://github.com/opensourceops/agentctl/blob/main/docs/policies.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/policies.md`](https://github.com/opensourceops/agentctl/blob/main/docs/policies.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/concepts/product.md

@@ -37,4 +37,4 @@ Version 0.2 is a production-oriented alpha with executable evidence for the stat
 This is not a chat-agent or multi-agent conversation framework: workflows, not conversations, own control flow. It is not CI/CD: it can run inside CI but does not manage runners or deployment environments. It borrows idempotence and check/diff vocabulary from Ansible without becoming configuration management. It borrows plan/effect separation from Terraform without owning infrastructure state. It is not a hosted orchestrator or general scripting language: one local process, SQLite, constrained templates, typed actions, and explicit remote effects are intentional boundaries.
 
 The differentiator is the combination of deterministic compilation, honest predictability, durable effect identity, recorded no-effect replay, native provider portability, and policy decisions made outside the model.
-> Canonical source: [`docs/PRODUCT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PRODUCT.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/PRODUCT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PRODUCT.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/concepts/tools.md

@@ -12,4 +12,4 @@ Built-in model-callable tools are workspace read, workspace write, and echo. The
 Built-in actions are assign, assert, file read/write, direct process execution, run working-memory read/write, SQLite long-term-memory read/write, MCP call, and A2A delegation. File writes use a temporary file plus rename and return before/after/diff. Shell execution uses a direct executable and argv, never an implicit shell, clears inherited environment, applies allowlisted variables, and is not an OS sandbox.
 
 Check mode executes pure/internal simulation and observation needed for dataflow but never filesystem, process, remote, or model mutation. Results say fully predictable, partially predictable, or requires execution; unknown external work is never reported as predicted.
-> Canonical source: [`docs/TOOLS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TOOLS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/TOOLS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TOOLS.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/concepts/workflow-model.md

@@ -18,4 +18,4 @@ The compiler validates missing references, duplicate tasks, cycles, task-aware t
 The parser translates a limited unversioned `playbook:` document and emits a migration warning. Use `agentctl migrate old.yaml --write new.yaml`. Legacy pack-backed, MCP, A2A, provider-specific, and broad module configurations need manual migration; see [Migrating from TypeScript](/agentctl/reference/migration/).
 
 Not implemented in v1alpha1: `foreach`, matrix expansion, parallel groups, routers, loops, sub-workflows, `finally`, handlers, event triggers, or compensation execution. They remain excluded until their deterministic state, merge, and recovery semantics are specified.
-> Canonical source: [`docs/DSL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DSL.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/DSL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DSL.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/contributing/add-action.md

@@ -42,4 +42,4 @@ cargo xtask generate
 cargo xtask docs-verify
 cargo xtask verify
 ```
-> Canonical source: [`docs/development/ADD_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_ACTION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/development/ADD_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_ACTION.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/contributing/add-migration.md

@@ -24,4 +24,4 @@ Create the previous schema in a temporary database, insert representative durabl
 ## 5. Document operator impact
 
 Update the database reference, compatibility policy, release notes or status evidence, and backup guidance. Explain whether downgrade remains possible. Run the complete store tests and `cargo xtask verify`.
-> Canonical source: [`docs/development/ADD_MIGRATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_MIGRATION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/development/ADD_MIGRATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_MIGRATION.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/contributing/add-provider.md

@@ -36,4 +36,4 @@ Add local mock-protocol tests for request mapping, authentication, headers, redi
 ## Documentation claims
 
 Update the provider guide and matrix with the exact level: implemented, mock-protocol tested, retained live evidence, or deferred. Add an example that passes `check` without resolving a secret. Run `cargo xtask generate`, `cargo xtask docs-verify`, and `cargo xtask verify`.
-> Canonical source: [`docs/development/ADD_PROVIDER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_PROVIDER.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/development/ADD_PROVIDER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_PROVIDER.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.

src/content/docs/_generated/contributing/developer-guide.md

@@ -64,4 +64,4 @@ Provider adapters implement the neutral model contract and publish typed capabil
 Run `cargo xtask generate` whenever CLI help or the DSL changes. Run `cargo xtask docs-verify` for public content and examples. Update the Pages site's content manifest when adding a new canonical public page. Release decisions depend on hosted evidence for the exact candidate commit; local success alone does not approve an RC.
 
 Related guides: [Add an action](/agentctl/contributing/add-action/), [Add a provider](/agentctl/contributing/add-provider/), [Add a store migration](/agentctl/contributing/add-migration/), [Write documentation](/agentctl/contributing/documentation/), [Testing](/agentctl/contributing/testing/), and [Release process](/agentctl/contributing/release/).
-> Canonical source: [`docs/development/REPOSITORY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/REPOSITORY.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
+> Canonical source: [`docs/development/REPOSITORY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/REPOSITORY.md). Verified against agentctl commit `f3181f93afac7546f01923491f77dabdf26b5ace`.