[freeqaz]

Problem

Two follow-ups to #2851, which added REVISION_IMAGE_PULL_FAILED:

• Finding 1881 (Create Agent): a full Pod quota stands alone on Create Agent in place of the provisioning line (finding 1617). An image the nodes can't pull also needs an administrator, but it is not in NAMED_DEPLOYMENT_WAITS, so it gets different treatment:

  • The sentence shows only once the provisioning job names it, appended as Provisioning Agent… Kubernetes cannot pull….
  • A fresh deployment read that already reports the pull is ignored while the job still names an older wait.
  • The sentence isn't kept through a cancelled or unavailable read (finding 1637).

  (The finding said the page showed the bare provisioning line. Since finding 1690 it adds the job's wait, so it's the treatment above, not a bare line.)

• Finding 1880 (test gap): two mutants of the Kubernetes Compute pending-reason precedence pass the whole conformance file:

  • dropping the skip for a Pod being deleted (index.ts:9659);
  • reporting the image pull before the Pod quota check (index.ts:5503-5507).

Change

• console/agents/create.mjs: adds REVISION_IMAGE_PULL_FAILED to NAMED_DEPLOYMENT_WAITS. Its fixed sentence, which asks an administrator to check the runtime image reference and the nodes' registry access, now stands alone and follows the same rules as the quota wait. No new copy.
• Browser test (console-agents-2, the finding 1690 test): two polls added, with a quota poll between them so each one changes the line.
  • The deployment read reports the pull while the job still names the runtime wait: the pull sentence leads, alone.
  • The job names the pull while the read is unavailable (503): it still stands alone.
• Conformance (kubernetes-compute): the fixture can mark a role's Pod as being deleted.
  • The image pull test now checks that a Pod being deleted names no wait. That covers its pull, its placement, and a terminating unschedulable Pod in front of a live pulling one.
  • The quota test checks that a full Pod quota leads a pulling container.
• Storybook: new Pages/Create Agent → Initial deployment cannot pull its image story.

Verification

• Mutants of index.ts, each run against --test-name-pattern="pending dedicated deploy|quota": all 6 killed, including the 2 that survived on main (no deletion skip; pull before quota). The other 4 (no init containers, early pull return, ImagePullBackOff only, pull before the deletion skip) are killed too.
• Browser test against main's create.mjs: it fails, because the page writes Provisioning Agent… Kubernetes cannot pull… where the test expects the sentence alone. It also fails when only the job's wait stands alone (the code removed from the read-first set). It passes with this change.
• node --test tests/conformance/kubernetes-compute.test.mjs: 375/375.
• node --test tests/browser/console-agents-2.test.mjs: 22/22.
• Pinned at 2 CPUs (taskset -c 0,1), 20/20 each: the two conformance tests and the browser test.
• eslint --max-warnings 0 and prettier --check on the touched files: clean.
• No docs change: no page describes Create Agent's wait lines.
• Internal review: no high or medium findings. Applied its low (the two pull polls were adjacent, so a page that named the pull only from the job gave the same lines) and two test nits.

Media

These screenshots and recordings show the real console against simulated Storybook reads, captured in headless Chromium. They prove the UI only; the browser test above covers the polling rules. "Before" uses main's console sources (c359d6cac) with the same story. Media commit: 3d970740c. A later commit removes it before the squash.

Story: Pages/Create Agent → Initial deployment cannot pull its image. The status line after Create Agent is selected:

	Before (main)	After (this PR)
Lines written	Provisioning queued…, Provisioning Agent…, Provisioning Agent… Kubernetes cannot pull…	Provisioning queued…, Provisioning Agent…, Kubernetes cannot pull…

Before (main), 390 px	After (this PR), 390 px

Desktop (1280 px): before, after. Walkthroughs: 390 px before, after; 1280 px before, after.

Risks

Low. This is a console display change for one more code, plus test-only changes. A member who can't read the deployment still sees only the job's own PROVISIONING_DEPLOYMENT_PENDING, as before.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[freeqaz-openai]

Free’s clanker here. The Create Agent UI and polling change look good at c3fd9078. I verified the hosted Storybook artifact, opened the actual published story in sandboxed Chromium, and saw the image-pull explanation stand on its own. The hosted browser result also includes the revised test: 22/22 in its file, 339/339 in its lane.

I separately controlled the story’s deployment reads while the job reported only “pending”: a successful read showed the explanation; a temporary 503 retained it; a 403 cleared it; and a later 503 did not bring the detail back. These are UI observations with synthetic responses, not a real cluster image-pull test. I did not review the separate Kubernetes conformance change.

Native media for the Verification section, from the unmodified story at 420 px. The video is cropped to the real status region, not reconstructed from screenshots.

image-pull-status.webm

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR makes image-pull failures stand alone during Agent creation and strengthens tests for Kubernetes pending-reason precedence.

Example: An Agent deployment reports REVISION_IMAGE_PULL_FAILED while its provisioning job still reports REVISION_INCOMPLETE.

• Before: Create Agent ignores the deployment's image-pull explanation until the job catches up, then prefixes it with “Provisioning Agent…”.
• After: Create Agent immediately shows the image-pull explanation alone, with the existing administrator guidance.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, correct repair with visible browser evidence and meaningful regression assertions; the evidence is appropriately limited to simulated console behavior.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (screenshot): The inspected phone and desktop screenshots exercise the changed Create Agent renderer in headless Chromium with simulated Storybook responses and show the fixed standalone explanation; the final-head discussion also supplies native media and reports retention and permission-clearing observations.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Create Agent gives an image-pull failure less immediate and less stable treatment than the existing actionable quota wait.
Reason: The maintainer-authored direction is supported by an existing diagnostic contract, a narrow implementation, and distinct regression coverage.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it completes a useful console diagnostic, preserves existing wait-handling rules, and adds focused regression coverage; no introduced defect was found.

Priority: P3
Reviewed head: c3fd9078a998184fbc216207fe6e564266a99d86

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The supplied browser evidence exercises production console rendering with simulated reads; it does not demonstrate a real cluster image-pull failure, whose detection is unchanged.

Agent review details

How this fits together

The console combines provisioning-job status with optional authorized deployment reads to show startup progress; Kubernetes Compute and the worker already supply the failure code and fixed explanation.

flowchart LR
  A[Kubernetes Pod status] --> B[Compute pending reason]
  B --> C[Worker deployment progress]
  C --> D[Authorized deployment read]
  C --> E[Provisioning job status]
  D --> F[Create Agent status line]
  E --> F

Loading

Technical review

Best possible solution:

Extend the existing named-wait set and retain the focused browser and conformance assertions as this PR does.

Do we have a high-confidence way to reproduce the issue?

Current-main source excludes REVISION_IMAGE_PULL_FAILED from named deployment waits, and the supplied before screenshots show the prefixed explanation; no reproduction was run during this review.

Is this the best way to solve the issue?

Adding the existing code to the shared set is the smallest complete fix because deployment-read precedence, retained text, standalone job text, and refusal clearing already consume that set.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5cc598483c9e.

Provenance checked

• Named deployment waits keeps the original intent (171d07f: fix(compute): name a full Namespace Pod quota instead of a bare provisioning wait #2674 made an actionable quota explanation replace the generic provisioning line.)
• Retention and permission clearing keeps the original intent (8f908ef: fix(console): keep the quota line, hide the catch-all conflict, gate deploy on unsaved secret picks #2714 retained explanations through interrupted reads; fix(console): keep focus on a phone drawer refocus, fit log timestamps, steady row reads and name the provisioning wait #2761 distinguished fresh, refused, and unavailable reads.)
• Kubernetes pending-reason tests keeps the original intent (c359d6c: fix(compute): name an image pull failure instead of a bare runtime wait #2851 intended live-Pod image-pull detection below quota and unschedulable precedence; the added assertions protect those existing rules.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Focused introduced change: The pinned introduced diff adds REVISION_IMAGE_PULL_FAILED to the existing named-wait set. Both deployment-read precedence and standalone job text reuse existing owners without adding another polling or state-management path. (apps/controller/src/console/agents/create.mjs:199, c3fd9078a998)
• Current-main gap and existing contract: Fetched main still names only Pod quota in NAMED_DEPLOYMENT_WAITS. The merged precursor fix(compute): name an image pull failure instead of a bare runtime wait #2851 supplies the image-pull code and explicitly leaves Create Agent handling outstanding. (apps/controller/src/console/agents/create.mjs:198, 5cc598483c9e)
• Distinct regression coverage: The browser sequence separates a deployment-read image-pull result from a job-named result with a quota transition. Conformance assertions independently cover terminating Pods and quota precedence over image pulls, matching the existing production implementation. (tests/conformance/kubernetes-compute.test.mjs:2855, c3fd9078a998)
• Inspected visual evidence: Downloaded before/after screenshots at 390 and 1280 pixels visibly show the explanation losing its generic provisioning prefix. The contributor labels these as real console rendering with simulated Storybook responses. fix(console): name an image pull wait on create agent and pin pending-reason precedence #2854 (comment) supplies native screenshot/video attachments and reports final-head retention and permission-clearing observations. (scripts/console-storybook/public/scenarios.mjs:1696, c3fd9078a998)
• Exact-head checks: CI Required, Console Browser 2, both conformance lanes, and the Storybook build succeeded for the reviewed head. First Agent Smoke and advisory QA remained in progress; a later successful dispatch superseded the cancelled dispatch. (c3fd9078a998)
• Review scope and inspection limits: The complete root AGENTS.md was read; no nested AGENTS.md or maintainer-notes directory was present for the changed paths. The checkout remained clean and no target code or secondary reviewer ran. Some older blobs were unavailable with lazy fetching disabled. Native-media downloads failed with curl error 23, ffprobe was unavailable, and no browser playback tool was exposed; prepared screenshots remained inspectable. (AGENTS.md, c3fd9078a998)

Labels

Label changes:

• add P3: This is limited diagnostic presentation polish and regression coverage; it does not change deployment execution or recovery.
• add proof: sufficient: Contributor real behavior proof is sufficient.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is limited diagnostic presentation polish and regression coverage; it does not change deployment execution or recovery.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 18, 2026, 10:37 AM ET / 14:37 UTC.