opschain admin agent-release retire
packs:agentspacks:agent-governance
opschain admin agent-release retire <name>@<version> [--reason <text>]
Retire a release — the ladder's last rung (v2 AgentReleaseService.RetireAgentRelease).
Moves the release to retired — the last rung of the stage ladder
(dev → test → prod → retired): it accepts no new enrolment (an
instance declaring it refuses by name) and no rollover to it, while
instances already running it are untouched. The natural step after a
rollover away from it finishes — opschain admin agent rollover finish
prints exactly this command. Attested on the release, audited as
info:agent_release:retired. Signing keys are untouched (key retirement
is opschain admin agent-release key-status).
Releases move one way: active → retired → revoked, never back.
Flags
| Flag | Meaning |
|---|---|
--reason <text> | Audited retirement reason. |
Output
retired felix@2.0.0 (stage prod): it accepts no new enrolment or rollover; running instances are untouched
Exit codes
| Code | Meaning |
|---|---|
| 0 | The release moved. |
| 1 | The server refused or failed the request: an unknown release, a backwards move (agent releases move active to retired to revoked - never back), a rejected credential. |
| 2 | Usage — the release is not named <name>@<version>. |
See also
opschain docs cli/admin-agent-release— the command family.opschain docs cli/admin-agent-rollover— moving instances between releases.opschain docs agent-releases— the release lifecycle.