Finish OSS release pipeline

Author: ramseymcgrath

.goreleaser.yml

@@ -9,7 +9,9 @@ builds:
       - -X main.version={{.Version}}
       - -X main.commit={{.ShortCommit}}
       - -X main.date={{.Date}}
-      - -X main.baseImageTag=v{{.Version}}
+      # The OSS repo does not publish matching base-image tags. Leave the
+      # runtime on :latest unless a caller explicitly sets BACK2BASE_BASE_IMAGE.
+      - -X main.baseImageTag=dev
     env:
       - CGO_ENABLED=0
     goos:

Makefile

@@ -3,7 +3,8 @@
 VERSION ?= dev
 COMMIT  := $(shell git rev-parse --short HEAD 2>/dev/null || echo "none")
 DATE    := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
-LDFLAGS := -s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(DATE) -X main.baseImageTag=$(VERSION)
+BASE_IMAGE_TAG ?= dev
+LDFLAGS := -s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(DATE) -X main.baseImageTag=$(BASE_IMAGE_TAG)
 
 # Build the binary
 build:

README.md

@@ -32,7 +32,7 @@ Anthropic API key works too — set `BACK2BASE_ANTHROPIC_API_KEY` in `~/.config/
 
 ## What's included
 
-- **CLI commands**: `run` (default), `shell`, `doctor`, `explore`, `profile`, `prune`, `mcp`, `overview`, `update`, `selfupdate`, `install`, `setup`, `clean`, `resume`, `status`, `build`/`rebuild`, `session`, `version`.
+- **CLI commands**: `run` (default), `shell`, `doctor`, `profile`, `prune`, `mcp`, `overview`, `update`, `selfupdate`, `install`, `setup`, `clean`, `resume`, `status`, `build`/`rebuild`, `session`, `version`.
 - **Container payload** (`back2base-container/`): Dockerfile, docker-compose, entrypoint, iptables-based outbound firewall, MCP profile defaults, baseline `CLAUDE.md` template, skills + slash-command bundle.
 - **GitHub Actions**: `ci.yml` (go test/vet, lint, cross-build matrix) and `release.yml` (goreleaser on tag push).
 
@@ -41,7 +41,8 @@ Anthropic API key works too — set `BACK2BASE_ANTHROPIC_API_KEY` in `~/.config/
 - `auth0/`, `auth.go`, `login.go`, the device-flow code, and the host keychain credential store — all removed.
 - `workers/` (Cloudflare Workers for proxy, config, memory, landing site) — never copied.
 - `lib/cloud-sync.sh`, `lib/hooks/memory-push.sh`, `lib/hooks/memory-pull.sh` — removed from the container payload.
-- OTel telemetry to `otel.back2base.net` — disabled by default; users can point `BACK2BASE_OTEL_ENDPOINT` at their own collector.
+- Hosted telemetry defaults — removed. OTel is disabled unless users point
+  `BACK2BASE_OTEL_ENDPOINT` at their own collector.
 
 ## Repository layout
 

back2base-container/Dockerfile

@@ -35,7 +35,6 @@ COPY --chown=node:node defaults/CLAUDE.md.template /opt/back2base/defaults/CLAUD
 COPY --chown=node:node defaults/profile-snippets/ /opt/back2base/defaults/profile-snippets/
 
 # Hook scripts (power-steering-drain, claude-md-audit, and shared lib).
-# Memory/cloud-sync hooks are not shipped in the OSS build.
 COPY --chown=node:node --chmod=0755 lib/hooks/ /opt/back2base/hooks/
 
 # Session snapshot daemon — invoked by absolute path from entrypoint.sh

back2base-container/defaults/CLAUDE.md.template

@@ -67,7 +67,7 @@ If the user says "remember this" or "save X", treat that as one case among many
 
 Use the `Write` tool to create a file at `~/.claude/projects/$MEMORY_NAMESPACE/memory/<slug>_<YYYY-MM-DD>_<hash>.md`, where:
 
-- `<slug>` is a short kebab- or snake-case name for the topic (e.g. `user_role`, `feedback_testing`, `auth0_tenant_setup`).
+- `<slug>` is a short kebab- or snake-case name for the topic (e.g. `user_role`, `feedback_testing`, `billing_setup`).
 - `<YYYY-MM-DD>` is today's UTC date — get it via `date -u +%F`.
 - `<hash>` is the first 8 chars of the sha256 of the body you're about to write — `printf '%s' "$body" | shasum -a 256 | head -c 8`.
 

back2base-container/docker-compose.yml

@@ -62,7 +62,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
 
     # Add the docker daemon's socket GID as a supplementary group on the node
-    # user so it can read /var/run/docker.sock without sudo. bin/back2base
+    # user so it can read /var/run/docker.sock without sudo. oss-back2base
     # probes the active daemon at every launch (Colima → ~991 docker group,
     # Docker Desktop → 0 root) and exports BACK2BASE_DOCKER_GID; the cache
     # at $BACK2BASE_STATE/docker-gid is a fallback if the probe fails.
@@ -72,11 +72,11 @@ services:
       - "${BACK2BASE_DOCKER_GID:-999}"
 
     environment:
-      # Auth — long-lived OAuth token from `back2base login`, or an API key.
+      # Auth — long-lived Claude Code OAuth token, or an API key.
       # Source is the BACK2BASE_<NAME> variant only: the user's bare
       # ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN / etc. (in their shell
       # or in random tools' env files) is intentionally NOT picked up, so
-      # back2base can't accidentally inherit a credential the user meant
+      # oss-back2base can't accidentally inherit a credential the user meant
       # for something else. The container still receives the unprefixed
       # name because that's what Claude Code reads.
       - CLAUDE_CODE_OAUTH_TOKEN=${BACK2BASE_CLAUDE_CODE_OAUTH_TOKEN:-}

back2base-container/lib/power-steering-prompt.md

@@ -52,8 +52,8 @@ text or dispatching a Plan subagent.
 
 **Looks like:**
 ```
-- ORIGINAL TASK: "rewrite the auth flow to use Auth0 instead of Cognito,
-  it touches the worker, the client, and the migrations"
+- ORIGINAL TASK: "rewrite the billing flow to use Stripe Checkout instead
+  of invoices, it touches the worker, the client, and the migrations"
 - 1st assistant turn: tool_use: Edit(file="...auth.ts")
 - 2nd assistant turn: tool_use: Edit(file="...config.ts")
 - (no plan stated, no Plan subagent dispatched)

baseimage.go

@@ -6,11 +6,10 @@ import (
 	"os/exec"
 )
 
-// baseImageTag is injected via ldflags at release time (Makefile and
-// .goreleaser.yml wire it to the same string as main.version, which for
-// goreleaser is `v<semver>`). When built locally without LDFLAGS it stays
-// "dev", which resolveBaseImage treats as "no pin" and falls back to
-// :latest for local iteration.
+// baseImageTag may be injected via ldflags by downstream release builds. The
+// OSS release pipeline leaves it as "dev" so resolveBaseImage falls back to the
+// public :latest base image instead of requiring this repo to publish matching
+// base-image tags.
 var baseImageTag = "dev"
 
 const baseImageRepo = "ramseymcgrath/back2base-base"
@@ -19,9 +18,9 @@ const baseImageRepo = "ramseymcgrath/back2base-base"
 // compose runtime should build on top of. Precedence:
 //  1. BACK2BASE_BASE_IMAGE env var (explicit caller override — supports local
 //     testing against a custom image).
-//  2. The binary's embedded baseImageTag (release builds pin to the matching
-//     semver tag published by .github/workflows/base-image.yml on that tag).
-//  3. :latest — dev builds and any release whose ldflag wiring drops out.
+//  2. The binary's embedded baseImageTag, when a downstream build chooses to
+//     pin one.
+//  3. :latest — OSS releases and local builds.
 func resolveBaseImage() string {
 	if v := os.Getenv("BACK2BASE_BASE_IMAGE"); v != "" {
 		return v
@@ -36,9 +35,8 @@ func resolveBaseImage() string {
 // daemon, pulling it if not. Silent on cache hit; on miss it streams the
 // pull to stderr so the user sees why the first launch takes a minute.
 //
-// Called before compose build/run so the pinned-by-version contract is
-// real: a user on back2base v0.17.1 will end up running on
-// back2base-base:v0.17.1 even if their daemon has never seen that tag.
+// Called before compose build/run so first launch pulls the base image when the
+// daemon has not already cached it.
 func ensureBaseImage(image string) error {
 	if err := exec.Command("docker", "image", "inspect", image).Run(); err == nil {
 		return nil

clean.go

@@ -18,7 +18,7 @@ var cleanCmd = &cobra.Command{
 
 var wipeCmd = &cobra.Command{
 	Use:   "wipe-images",
-	Short: "Nuke ALL back2base containers and images",
+	Short: "Nuke ALL oss-back2base containers and images",
 	RunE:  runWipe,
 }
 
@@ -46,31 +46,38 @@ func runClean(cmd *cobra.Command, args []string) error {
 func runWipe(cmd *cobra.Command, args []string) error {
 	cfg := resolveConfig()
 
-	// Find back2base images
+	// Find oss-back2base/back2base-compatible images.
 	imgOut, _ := exec.Command("docker", "images", "--format", "{{.Repository}}:{{.Tag}}").Output()
 	var imageRefs []string
 	for _, line := range strings.Split(string(imgOut), "\n") {
 		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "back2base-claude") ||
+		if strings.HasPrefix(line, "oss-back2base-claude") ||
+			strings.HasPrefix(line, "back2base-claude") ||
 			strings.HasPrefix(line, "ramseymcgrath/back2base-base") ||
 			strings.HasPrefix(line, "back2base/back2base:") {
 			imageRefs = append(imageRefs, line)
 		}
 	}
 
-	// Find back2base containers from image names and compose labels
+	// Find oss-back2base/back2base-compatible containers from image names and
+	// compose labels.
 	ctrOut1, _ := exec.Command("docker", "ps", "-a",
 		"--format", "{{.Names}}\t{{.Image}}").Output()
-	ctrOut2, _ := exec.Command("docker", "ps", "-a",
+	ctrOut2a, _ := exec.Command("docker", "ps", "-a",
 		"--filter", "label=com.docker.compose.project=back2base",
 		"--format", "{{.Names}}").Output()
+	ctrOut2b, _ := exec.Command("docker", "ps", "-a",
+		"--filter", "label=com.docker.compose.project=oss-back2base",
+		"--format", "{{.Names}}").Output()
+	ctrOut2 := append(ctrOut2a, ctrOut2b...)
 
 	containerSet := make(map[string]bool)
 	for _, line := range strings.Split(string(ctrOut1), "\n") {
 		parts := strings.SplitN(strings.TrimSpace(line), "\t", 2)
 		if len(parts) == 2 {
 			img := parts[1]
-			if strings.HasPrefix(img, "back2base-claude") ||
+			if strings.HasPrefix(img, "oss-back2base-claude") ||
+				strings.HasPrefix(img, "back2base-claude") ||
 				strings.HasPrefix(img, "back2base/back2base") {
 				containerSet[parts[0]] = true
 			}
@@ -89,7 +96,7 @@ func runWipe(cmd *cobra.Command, args []string) error {
 	}
 
 	if len(imageRefs) == 0 && len(containers) == 0 {
-		fmt.Println("No back2base containers or images found.")
+		fmt.Println("No oss-back2base containers or images found.")
 		return nil
 	}
 
@@ -140,6 +147,6 @@ func runWipe(cmd *cobra.Command, args []string) error {
 		exec.Command("docker", rmiArgs...).Run()
 	}
 
-	fmt.Println("Done. Next 'back2base' run will rebuild from source.")
+	fmt.Println("Done. Next 'oss-back2base' run will rebuild from source.")
 	return nil
 }