📖 docs: track Goose upstream after its move to the Agentic AI Foundation

[mendezr]

Summary

Fixes #10627.

• Track Goose's canonical aaif-goose/goose repo in both Dockerfiles and the pin resolver; retain version 1.53.0 and both SHA256 pins.
• Add a headless Goose/Hive integration guide covering environment-key authentication, containerized contributor operation, and the local unconfined refusal gate.
• Document the relationship precisely: Goose moved to the Agentic AI Foundation (AAIF); Hive integrates Goose as a contributor backend and tracks its upstream as an independent CNCF project. Hive does not join AAIF, seek AAIF membership, rely on AAIF to host or govern Hive, or claim AAIF endorsement/compliance.

Verification

• GitHub's repository API resolves block/goose to aaif-goose/goose.
• Downloaded both canonical v1.53.0 Linux release tarballs and checked them with sha256sum -c: x86_64 OK; aarch64 OK. Release API digests also match both existing pins.
• Added network-free regression coverage for the canonical release API, both architecture download URLs/digests, and both Dockerfile download sources to src/scripts/test-cli-pin-bump.sh.
• Tests and lint not run locally per AGENTS.md; the existing CLI pin CI workflow runs the shell syntax checks and regression suite. No Go changes.
• Reviewed guide commands against the Justfile, relay headless invocation, backend confinement config, and upstream Goose documentation.

Remaining upstream handoff

No Goose docs PR was opened: its current AGENTS.md and CONTRIBUTING.md require a Ready issue before external implementation/PRs, and ask humans to write new issues themselves. An open-issue search found no Hive proposal. A human sponsor must file the Goose documentation proposal and obtain Ready status before this page can be proposed upstream. This PR does not bypass that gate or claim all acceptance criteria are met.

— hive: backend=pi model=openai-codex/gpt-6.1-sol

---

🐝 Hive Agent: contributor | SHA: 9705782a6

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#10642	📖 docs: review Symphony positioning and spec alignment	same files	src/docs/landscape.md
#10631	📖 docs: add gh-aw on-ramp and agentics gallery entry	same files	README.md src/docs/landscape.md

[hivecommons-hive]

Check report (fork branch — hive cannot push here): every failing check on this PR is the v5 baseline fingerprint tracked in #10623 (RE2 (?= regexp panic → docker (hive)/overlayfs-exec-guard/golangci-lint/test shards; TestOpenAPISpecCoversEveryRegisteredRoute; TestAgentsCollapsedSummaryRendersPerAgentTiles; TestStableNextPromotionAtUnknownWhenNothingQueued hitting live GitHub, stubbed by #10587), none of it from this docs diff. The fix landed on v5 at 6552932 (#10612).

Fix: sync your branch with v5 and push — git fetch upstream v5 && git merge upstream/v5 && git push (a merge commit keeps your DCO sign-offs intact; no force-push needed). CI will re-run on the green base.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the diff against the v5 tree. The documentation is accurate to the code, and the source-of-truth switch is consistent across the three places that download Goose. Looks correct to me, with one thing I could not verify.

What I verified:

• docs/goose-at-scale.md claims match the tree: the refusal gate HIVE_GOOSE_DANGEROUSLY_RUN_UNCONFINED is the one config/backends.conf enforces; contribute-check, contribute-setup, contribute-hive exist (Justfile:312, :347, :888); CONTRIBUTOR_MODE=headless is honoured (Justfile:1570, forwarded at :1841); the relay really launches goose run --no-session -t (Justfile:3333, the embedded contributor-relay.js table). Both relative links (../src/docs/contributor-relay.md, ../src/docs/sandbox-isolation.md) resolve.
• src/Dockerfile, src/Dockerfile.contributor and src/scripts/cli-pin-bump.sh all move from block/goose to aaif-goose/goose; after the change no block/goose release URL remains, and test-cli-pin-bump.sh now asserts exactly that.

Open question (not a finding): the Dockerfiles keep the existing GOOSE_VERSION=1.53.0 and per-arch SHA256 pins while changing the download host to the new org. If the repo was transferred on GitHub the assets are byte-identical and this is fine; I did not fetch the external release to confirm. The image build in CI is the real check here.

Scope note: the title says "docs", but the PR also changes the image download source and the pin-bump script. That is tightly coupled to the doc claim "both Hive images use that release source", so it reads as intentional rather than creep.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[clubanderson]

Reviewed after rebase onto current v5. Goose canonical AAIF source and v1.53.0 assets/checksums verified; Dockerfile pins stay SHA-verified; docs clarify Hive is not AAIF-hosted/endorsed. Script test covers the new release source. No CI/security weakening found.

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: 6b0171df9ec80503c39fcf72c301be64c42461bd

[clubanderson]

/approve
/lgtm

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [clubanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment