fix(release): keep the director dry-run smoke unauthenticated #1000

Merged

coilysiren merged 1 commit from aos/claude/release-smoke-director-auth into main

2026-08-12 05:40:04 +00:00

coilyco-ops commented

2026-08-12 05:37:50 +00:00

Member

The aos-cli-release train has failed every run since 2026-08-09. Runs 3130, 3202, and 3213 all die at the same line with the same message, so no AOS CLI release has published in three days.

The failure

aoscompose: claude auth: file-backed credentials not found at /root/.claude/.credentials.json
and host keyring projection is unsupported on this platform (use --auth=false for
unauthenticated commands)

It comes from the Build binaries and package metadata step, inside scripts/check-aos-release.sh. Checksums, bundle contents, package metadata, and every earlier smoke pass first.

Why

check-aos-release.sh runs two role-default aoscompose --dry-run smokes. The engineer one carries --auth=false. The director one, added in #931, does not:

aoscompose_director_plan=$("$native_aoscompose" \
    --image agentic-os:test \
    --dry-run \
    director)

.agents/harness-launch-profiles.yaml gives director a default agent of claude, so that call resolves Claude credentials on a runner that has none. The earlier smokes pass because they either pin --agent codex with --auth=false or take the warded path.

The omission was latent for three days. runStandaloneIntegratedLaunch resolves auth before it stages the workspace, and before #974 a missing ~/.claude/.credentials.json returned an empty projection and the launch continued logged out. #974 made that path fail closed, which is correct for a real launch and fatal for this smoke.

The fix

One line. Add --auth=false to the director dry-run, matching its engineer sibling. A dry-run prints a plan and launches nothing, so no smoke in this script needs real credentials. #907 applied the same fix to the other dry-run smokes.

Verified

ward exec pre-commit-all passes, shellcheck included.
--auth=false now appears on all four aoscompose and aos dry-run smokes in the script. The remaining credential-free calls are the aosward warded plan and the agent-terminal / aosterm launch-plan writers, none of which resolve auth.

On merge

promote advances release, the scripts/check-aos-release.sh path filter selects the change, and aos-cli-release should tag and publish the first AOS bundle since aos-v0.190.0.

🤖 Generated with Claude Code

The `aos-cli-release` train has failed every run since 2026-08-09. Runs [3130](https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/3130), [3202](https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/3202), and [3213](https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/3213) all die at the same line with the same message, so no AOS CLI release has published in three days. ## The failure ``` aoscompose: claude auth: file-backed credentials not found at /root/.claude/.credentials.json and host keyring projection is unsupported on this platform (use --auth=false for unauthenticated commands) ``` It comes from the `Build binaries and package metadata` step, inside `scripts/check-aos-release.sh`. Checksums, bundle contents, package metadata, and every earlier smoke pass first. ## Why `check-aos-release.sh` runs two role-default `aoscompose --dry-run` smokes. The engineer one carries `--auth=false`. The director one, added in #931, does not: ```sh aoscompose_director_plan=$("$native_aoscompose" \ --image agentic-os:test \ --dry-run \ director) ``` `.agents/harness-launch-profiles.yaml` gives `director` a default agent of `claude`, so that call resolves Claude credentials on a runner that has none. The earlier smokes pass because they either pin `--agent codex` with `--auth=false` or take the warded path. The omission was latent for three days. `runStandaloneIntegratedLaunch` resolves auth before it stages the workspace, and before #974 a missing `~/.claude/.credentials.json` returned an empty projection and the launch continued logged out. #974 made that path fail closed, which is correct for a real launch and fatal for this smoke. ## The fix One line. Add `--auth=false` to the director dry-run, matching its engineer sibling. A dry-run prints a plan and launches nothing, so no smoke in this script needs real credentials. #907 applied the same fix to the other dry-run smokes. ## Verified * `ward exec pre-commit-all` passes, shellcheck included. * `--auth=false` now appears on all four `aoscompose` and `aos` dry-run smokes in the script. The remaining credential-free calls are the `aosward` warded plan and the `agent-terminal` / `aosterm` launch-plan writers, none of which resolve auth. ## On merge `promote` advances `release`, the `scripts/check-aos-release.sh` path filter selects the change, and `aos-cli-release` should tag and publish the first AOS bundle since aos-v0.190.0. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 1 commit

2026-08-12 05:37:50 +00:00

fix(release): keep the director dry-run smoke unauthenticated

ci / aos-cli-tests (pull_request) Successful in 27s

Details

ci / ward-doctor (pull_request) Successful in 11s

Details

ci / gate (pull_request) Successful in 55s

Details

b5139e99e8

`check-aos-release.sh` runs two role-default `aoscompose --dry-run` smokes.
The engineer one passes `--auth=false`. The director one, added in #931, did
not. The director launch profile defaults to `claude`, so that call resolves
Claude credentials on a runner that has none.

It stayed green until #974 made Claude auth fail closed. Before that, a
missing `~/.claude/.credentials.json` returned an empty projection and the
launch continued logged out. Since then the same call aborts:

    aoscompose: claude auth: file-backed credentials not found at
    /root/.claude/.credentials.json and host keyring projection is
    unsupported on this platform (use --auth=false for unauthenticated
    commands)

That has failed every `aos-cli-release` run since 2026-08-09 (runs 3130,
3202, 3213), so the AOS CLI release train has published nothing in three
days. This is the same fix #907 applied to the other dry-run smokes.

A dry-run prints a plan and launches nothing, so no smoke in this script
needs real credentials.

Verified with `ward exec pre-commit-all` (all hooks pass, shellcheck
included).

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>