[mashkovd]

Summary

Single bump skipping the 1.5.0 / 1.6.0 intermediates — all three features land atomically with one ArgoCD sync.

Why one PR not three

There is no functional benefit to a staged rollout — each feature is net-additive and gated by env / state:

• deploy: libertex/nginx → latest (Docker Hub) #8 (1.5.0) mctl-docs github fallback — only triggers when local sibling clones are missing and GITHUB_TOKEN is set. Without the token, mctl-docs degrades gracefully to "no signal: rate-limited" (instead of "path missing"); behaviour is otherwise unchanged.
• Consolidate deploy-worker into deploy-service template #9 (1.6.0) digest rotation — only fires when _mentor/digest/ has >8 weeks of files. Currently 1 file on disk → no-op.
• Refactor Backstage templates: improve UX and simplify service naming #10 (1.7.0) Tier 2 implementer scaffold — dormant until activation infra lands (Vault github-token key, ExternalSecret update, new CWT cwft-mctl-agents-tier2.yaml, MCP tool mctl_trigger_implementer). The Tier 1 daily run does not call into the implementer.

A staged 1.5 → 1.6 → 1.7 rollout would burn 2× extra cycles (Copilot review + ArgoCD sync per bump) for zero risk reduction.

What 1.7.0 carries

• mctl-agents#8 — mctl-docs falls back to GitHub REST API via WebFetch / curl when sibling clones are absent. Ports deploy: liberty/test #1 from Russian-base to English; Copilot SWE Agent autonomously fixed the jq orphan-commit filter (<= 1 → == 1) and updated the deprecated diff media type.
• mctl-agents#9 — orchestrator rotates _mentor/digest/ files older than 8 ISO weeks into digest/archive/. Deterministic, zero-token. Ports deploy: libertex/nginx #3 from Russian-base; Copilot added an OSError guard so a permission/NotADirectoryError on archive/ doesn't abort the whole mentor run.
• mctl-agents#10 — Tier 2 implementer scaffold (orchestrator/run_implementer.py + 7 implementer.md sub-agents + Dockerfile gh CLI install + IMPLEMENTER_BUDGET_USD=$3.00). Ports deploy: developers/test #2 from Russian-base; Copilot fixed three real bugs: hardcoded developer path as DEFAULT_STATE_DIR, finally block always deleting clone dir despite "keep on failure" comment, and a global os.environ["PROPOSAL_DIR"] mutation that leaked between proposals.

Out of scope (operational follow-ups for tier-2 activation)

• Vault key: secret/platform/mctl-agents/github-token (fine-grained PAT with repo write on mctlhq/*).
• ExternalSecret: extend mctl-agents-secrets to surface as GITHUB_TOKEN env in the workflow pod.
• ClusterWorkflowTemplate: cwft-mctl-agents-tier2.yaml mirroring -run but invoking orchestrator.run_implementer with service / slug parameters.
• MCP tool: mctl_trigger_implementer in mctl-api for on-demand triggers.

Image readiness

Tag 1.7.0 build: https://github.com/mctlhq/mctl-agents/actions/runs — completed:success.

Test plan

• All three tag builds (1.5.0, 1.6.0, 1.7.0) green.
• After merge: wait ≥3 min for ArgoCD sync (per memory rule), verify live CWT image=1.7.0 via kubectl, then trigger mctl_trigger_mentor_only to smoke-test that the new mentor (with rotation) runs cleanly.

[mashkovd]

@copilot review

[Copilot]

@copilot review

Review: ✅ LGTM — single-line bump, no issues introduced

Change
One line: ghcr.io/mctlhq/mctl-agents:1.4.0 → 1.7.0 (commit dc23a5d). No structural changes.

What I checked

Area	Finding
YAML validity	All yamllint findings (line-length, braces) are pre-existing — identical in both d1cfb52 (before) and dc23a5d (after). Zero regressions introduced.
IMPLEMENTER_BUDGET_USD missing	Intentional — Tier 2 implementer is dormant until the activation follow-ups land (Vault key, ExternalSecret, new CWT). The orchestrator won't invoke the implementer without those.
GITHUB_TOKEN missing	Intentional — mctl-agents#8 degrades gracefully when the token is absent ("no signal: rate-limited"). Wiring it via ExternalSecret is an explicit out-of-scope follow-up.
activeDeadlineSeconds: 3600	Still sufficient for the current full / mentor-only / single-service run modes.
onExit: notify-telegram	Unaffected; fires after orchestrator regardless of image version.
Security	No secrets hardcoded, no new attack surface.

Verdict: Change is correct, minimal, and the PR description thoroughly justifies skipping the 1.5.0 / 1.6.0 intermediates. Safe to merge.