Lane: headless engineer burn-down in agentic-os, 28 issues at P1 and P2, ordered so the toolchain unblocks itself first #1177

Open
opened 2026-08-22 20:54:50 +00:00 by coilyco-ops · 5 comments
Member

Lane definition filed by the exec seat on 2026-08-22 at Kai's direction, following the queue re-baseline in coilysiren/inbox#391. This issue assigns and orders work. It does not do it.

Scope selected by Kai: a long headless engineer lane, P0 through P2. P1 alone was 12 issues, which does not give an engineer meaningful flight time. P0 through P2 gives 28.

Membership is every open issue in this repo carrying autonomy/headless and role/engineer at priority/P1 or priority/P2. There are currently zero P0s in this repo matching that filter, so the lane starts at P1.

Deliberately excluded from the burn, per Kai: coilyco-bridge/deploy (most tasks are interactive because they carry risk), coilysiren/website (most tasks are interactive because they need Kai to encode the task), and any repo with two or fewer qualifying issues.

Ordering principle

A long autonomous run should spend its early hours removing the friction that taxes every later hour, then work correctness, then hygiene, then the tail. The sequence below is a recommendation from evidence rather than a lock. An engineer who finds a dependency inverted should say so on this issue and re-order.

Phase 1 - unblock the toolchain (do these first)

These are cases where the repository's own guardrails currently obstruct correct work. Every hour spent elsewhere is an hour spent fighting them.

  • #1089 - AGENTS.md is over its own cap on main, so any edit to it fails the hook. Self-blocking, and it gates any doctrine edit the rest of this lane might need.
  • #957 - TestStandaloneDefaultAgentForRole asserts against live configuration and fails on main. A red test on main makes every other change ambiguous.
  • #1062 - the other eleven tree-walking hooks still read gitignored build output.
  • #993 - code-comments should skip the apply-agentic-os-hooks managed marker region.
  • #969 - typos has no per-repo path exclusion, so preserved data files need word-level opt-outs.

The last three are hook false positives. They are individually small and collectively they are why commits get fought.

Phase 2 - the compounding speed win

  • #1004 - agent sessions pay roughly 1s of pyenv on every git call, which is why aos-test takes 11 minutes.

Ranked alone and immediately after phase 1 deliberately. This is the only issue in the lane whose payoff scales with the length of the run itself. An 11-minute test cycle sets the iteration ceiling for the other 26 issues. Fixing it early pays for itself; fixing it last pays nothing.

  • #987 - one transient language-payload failure costs the whole dev-base publish and a manual re-dispatch. Same category, lower frequency.

Phase 3 - fail closed and fail loud

A cluster with one shared defect: something reports success or proceeds silently when it should stop or shout.

  • #1032 - publish-release reports success while the release workflow it calls never runs.
  • #1047 - aosguard issue-label add silently drops a numeric label ID and exits 0.
  • #903 - fail closed when the repository plan is stale or incomplete.
  • #810 - fail closed when aos acompose silently bypasses a requested Ward launch.
  • #1034 - fail loud when pushing to a branch whose PR already merged.
  • #985 - apply-agentic-os-hooks reports updated on the first refresh of a config it just created. Same family: a status line that does not describe what happened.

Worth testing one hypothesis before working these five separately: they may not share a root, but they share a shape, and a common helper for "refuse rather than proceed quietly" may serve several. An hour establishes that either way.

Phase 4 - session and checkout hygiene

  • #1086 - a session worktree can check out the default branch and lock the canonical checkout out of it.
  • #878 - native session shadow-home never links ~/.claude.json, wiping trust and onboarding state every restart.
  • #1084 - nothing reaps un-checked-out local branches, so 253 fully-pushed branches have accumulated across the fleet.
  • #1033 - keep resident checkouts under ~/projects/coily*/ pinned to main, and make leaving main a deliberate act.

Phase 5 - taxonomy and tooling tail

  • #1105 - require a priority and an autonomy label on AOSguard's Forgejo issue create. Promoted within this phase. This is the structural fix that prevents recurrence of the defect recorded in inbox#391 Finding 3, where unlabeled and mislabeled issues made fleet-wide queries silently wrong. It pairs directly with inbox#392, which migrates the existing vocabulary. Doing #1105 without #392 leaves the backlog dirty; doing #392 without #1105 lets it re-dirty.
  • #1073 - gate roles.kdl against the composed catalogue in both directions.
  • #1028 - restore aosguard skill generation, one skill per wrapped entity plus a concept skill.
  • #994 - align git-workflow prose, ward agent.workflow keys, and Forgejo branch protection across the fleet.
  • #1031 - route the pre-commit path through the egress proxy, and drop the cache blocks the image bake retired.
  • #849 - reconcile WARD_CONFIG_REF cleanup with the Warp environment parser.
  • #830 - split the generic voice linter engine from Kai's rule profile.
  • #1097 - close the docs-count gap, 66 to 40 is a trimming pass rather than a deletion pass.
  • #813 - refresh shared dev-base tool pins.
  • #606 - consume Ward release artifacts in dev-base and workflow bootstrap.

Held out of the automatic lane

  • #1101 - catalog-trifecta requires a fourth member that ward#1660 deletes, and umbra is already red on it. This has a cross-repo dependency on a Ward change that is not this lane's to make. An agent that picks this up headless will either block or reach into a repo outside the lane. It needs the Ward side sequenced first, so it should be worked deliberately rather than drawn from the queue.

Working discipline

Unchanged from the standing rules and not relaxed by lane membership:

  • Commit and push in-scope work before pausing. A local-only commit is not a checkpoint.
  • This repo runs pull-request-and-merge. Open the PR in the same turn as the branch's first push, and merge it yourself once green.
  • Never --no-verify, never force-push.
  • One meaningful variable at a time, with a rollback path identified before the change lands.
  • Update docs/FEATURES.md only when a change adds, removes, or materially reshapes a shipped capability. Most of this lane is defect work and should not touch it.

Revisit

This lane is re-derived rather than maintained by hand. Re-run the membership query to get current state:

/repos/coilyco-flight-deck/agentic-os/issues?state=open&type=issues&labels=priority/P1,autonomy/headless,role/engineer
/repos/coilyco-flight-deck/agentic-os/issues?state=open&type=issues&labels=priority/P2,autonomy/headless,role/engineer

Use per-repo X-Total-Count rather than issues/search, which lags the indexer.

Lane definition filed by the exec seat on 2026-08-22 at Kai's direction, following the queue re-baseline in coilysiren/inbox#391. **This issue assigns and orders work. It does not do it.** Scope selected by Kai: a long headless engineer lane, P0 through P2. P1 alone was 12 issues, which does not give an engineer meaningful flight time. P0 through P2 gives 28. Membership is every open issue in this repo carrying `autonomy/headless` and `role/engineer` at `priority/P1` or `priority/P2`. There are currently **zero P0s** in this repo matching that filter, so the lane starts at P1. Deliberately excluded from the burn, per Kai: `coilyco-bridge/deploy` (most tasks are interactive because they carry risk), `coilysiren/website` (most tasks are interactive because they need Kai to encode the task), and any repo with two or fewer qualifying issues. ## Ordering principle A long autonomous run should spend its early hours removing the friction that taxes every later hour, then work correctness, then hygiene, then the tail. The sequence below is a recommendation from evidence rather than a lock. An engineer who finds a dependency inverted should say so on this issue and re-order. ## Phase 1 - unblock the toolchain (do these first) These are cases where the repository's own guardrails currently obstruct correct work. Every hour spent elsewhere is an hour spent fighting them. * **#1089** - AGENTS.md is over its own cap on main, so any edit to it fails the hook. Self-blocking, and it gates any doctrine edit the rest of this lane might need. * **#957** - `TestStandaloneDefaultAgentForRole` asserts against live configuration and fails on main. A red test on main makes every other change ambiguous. * **#1062** - the other eleven tree-walking hooks still read gitignored build output. * **#993** - `code-comments` should skip the `apply-agentic-os-hooks` managed marker region. * **#969** - `typos` has no per-repo path exclusion, so preserved data files need word-level opt-outs. The last three are hook false positives. They are individually small and collectively they are why commits get fought. ## Phase 2 - the compounding speed win * **#1004** - agent sessions pay roughly 1s of pyenv on every git call, which is why `aos-test` takes 11 minutes. **Ranked alone and immediately after phase 1 deliberately.** This is the only issue in the lane whose payoff scales with the length of the run itself. An 11-minute test cycle sets the iteration ceiling for the other 26 issues. Fixing it early pays for itself; fixing it last pays nothing. * **#987** - one transient language-payload failure costs the whole dev-base publish and a manual re-dispatch. Same category, lower frequency. ## Phase 3 - fail closed and fail loud A cluster with one shared defect: something reports success or proceeds silently when it should stop or shout. * **#1032** - `publish-release` reports success while the release workflow it calls never runs. * **#1047** - `aosguard issue-label add` silently drops a numeric label ID and exits 0. * **#903** - fail closed when the repository plan is stale or incomplete. * **#810** - fail closed when `aos acompose` silently bypasses a requested Ward launch. * **#1034** - fail loud when pushing to a branch whose PR already merged. * **#985** - `apply-agentic-os-hooks` reports `updated` on the first refresh of a config it just created. Same family: a status line that does not describe what happened. Worth testing one hypothesis before working these five separately: they may not share a root, but they share a *shape*, and a common helper for "refuse rather than proceed quietly" may serve several. An hour establishes that either way. ## Phase 4 - session and checkout hygiene * **#1086** - a session worktree can check out the default branch and lock the canonical checkout out of it. * **#878** - native session shadow-home never links `~/.claude.json`, wiping trust and onboarding state every restart. * **#1084** - nothing reaps un-checked-out local branches, so 253 fully-pushed branches have accumulated across the fleet. * **#1033** - keep resident checkouts under `~/projects/coily*/` pinned to main, and make leaving main a deliberate act. ## Phase 5 - taxonomy and tooling tail * **#1105** - require a priority and an autonomy label on AOSguard's Forgejo issue create. **Promoted within this phase.** This is the structural fix that prevents recurrence of the defect recorded in inbox#391 Finding 3, where unlabeled and mislabeled issues made fleet-wide queries silently wrong. It pairs directly with inbox#392, which migrates the existing vocabulary. Doing #1105 without #392 leaves the backlog dirty; doing #392 without #1105 lets it re-dirty. * **#1073** - gate `roles.kdl` against the composed catalogue in both directions. * **#1028** - restore aosguard skill generation, one skill per wrapped entity plus a concept skill. * **#994** - align git-workflow prose, `ward agent.workflow` keys, and Forgejo branch protection across the fleet. * **#1031** - route the pre-commit path through the egress proxy, and drop the cache blocks the image bake retired. * **#849** - reconcile `WARD_CONFIG_REF` cleanup with the Warp environment parser. * **#830** - split the generic voice linter engine from Kai's rule profile. * **#1097** - close the docs-count gap, 66 to 40 is a trimming pass rather than a deletion pass. * **#813** - refresh shared dev-base tool pins. * **#606** - consume Ward release artifacts in dev-base and workflow bootstrap. ## Held out of the automatic lane * **#1101** - catalog-trifecta requires a fourth member that `ward#1660` deletes, and umbra is already red on it. **This has a cross-repo dependency on a Ward change that is not this lane's to make.** An agent that picks this up headless will either block or reach into a repo outside the lane. It needs the Ward side sequenced first, so it should be worked deliberately rather than drawn from the queue. ## Working discipline Unchanged from the standing rules and not relaxed by lane membership: * Commit and push in-scope work before pausing. A local-only commit is not a checkpoint. * This repo runs `pull-request-and-merge`. Open the PR in the same turn as the branch's first push, and merge it yourself once green. * Never `--no-verify`, never force-push. * One meaningful variable at a time, with a rollback path identified before the change lands. * Update `docs/FEATURES.md` only when a change adds, removes, or materially reshapes a shipped capability. Most of this lane is defect work and should not touch it. ## Revisit This lane is re-derived rather than maintained by hand. Re-run the membership query to get current state: ``` /repos/coilyco-flight-deck/agentic-os/issues?state=open&type=issues&labels=priority/P1,autonomy/headless,role/engineer /repos/coilyco-flight-deck/agentic-os/issues?state=open&type=issues&labels=priority/P2,autonomy/headless,role/engineer ``` Use per-repo `X-Total-Count` rather than `issues/search`, which lags the indexer.
Author
Member

Director note on how review is reaching this lane, from the first four issues.

Three merged so far (#1089, #1062, #993) and #957 closed as already-fixed. Quality is high and the pace is higher than review. Two of my three PR reviews landed after the merge, and the third landed before it but was not picked up. That is not a complaint about the engineer, it is the lane working as designed: pull-request-and-merge says the author merges as soon as it is green, and a headless engineer reaches green in a couple of minutes.

So I am not going to pretend to be a merge gate. Findings will arrive as follow-up issues rather than as blocking review, and they belong to whoever picks them up next rather than to the PR author. Two are open now:

  • #1183 (P1) - is_repo_content vetoes any hook whose walk root sits inside the skip set, so repo-pointer-skills exits 0 in a .claude/skills repo. From #1062.
  • #1185 (P2) - an unterminated # BEGIN managed by region exempts the rest of a YAML file. From #993.

The pattern worth naming

Both are fail-opens, and both were introduced by phase-1 toolchain work. Phase 3 of this lane is "fail closed and fail loud", and phase 1 has now shipped two of exactly the defect phase 3 exists to remove. That is not bad luck. A hook fix is mostly about deciding what a hook should stop reading, and every such decision has a silent-pass failure mode on the wrong side of it.

Suggestion for the rest of phase 1, and for #1183 and #1185 when they get picked up: for any change that narrows what a check reads, write the test that proves the check still fails on the thing it is supposed to catch, not only the test that proves it ignores the thing it should ignore. #1179 had the second and not the first. #1182 had it for the closed-region case and not the unterminated one.

Both issues carry a reproducer that is one file and two commands. Neither needs re-diagnosis.

Also still true

#1004 is not engineering work. The engineer reached the same conclusion independently and measured it. It is waiting on Kai's convergence run and nothing in this repo unblocks it.

**Director note on how review is reaching this lane, from the first four issues.** Three merged so far (#1089, #1062, #993) and #957 closed as already-fixed. Quality is high and the pace is higher than review. Two of my three PR reviews landed **after** the merge, and the third landed before it but was not picked up. That is not a complaint about the engineer, it is the lane working as designed: `pull-request-and-merge` says the author merges as soon as it is green, and a headless engineer reaches green in a couple of minutes. So I am not going to pretend to be a merge gate. **Findings will arrive as follow-up issues rather than as blocking review**, and they belong to whoever picks them up next rather than to the PR author. Two are open now: * **#1183** (P1) - `is_repo_content` vetoes any hook whose walk root sits inside the skip set, so `repo-pointer-skills` exits 0 in a `.claude/skills` repo. From #1062. * **#1185** (P2) - an unterminated `# BEGIN managed by` region exempts the rest of a YAML file. From #993. ## The pattern worth naming Both are **fail-opens**, and both were introduced by phase-1 toolchain work. Phase 3 of this lane is "fail closed and fail loud", and phase 1 has now shipped two of exactly the defect phase 3 exists to remove. That is not bad luck. A hook fix is mostly about deciding what a hook should stop reading, and every such decision has a silent-pass failure mode on the wrong side of it. **Suggestion for the rest of phase 1, and for #1183 and #1185 when they get picked up:** for any change that narrows what a check reads, write the test that proves the check still fails on the thing it is supposed to catch, not only the test that proves it ignores the thing it should ignore. #1179 had the second and not the first. #1182 had it for the closed-region case and not the unterminated one. Both issues carry a reproducer that is one file and two commands. Neither needs re-diagnosis. ## Also still true **#1004 is not engineering work.** The engineer reached the same conclusion independently and measured it. It is waiting on Kai's convergence run and nothing in this repo unblocks it.
Author
Member

Phase 3's hypothesis, tested. Answer: shape, not root. Do not spend the hour looking for the helper.

#1177 says the six fail-closed issues may share a root and that a common "refuse rather than proceed quietly" helper may serve several, and budgets an hour to establish it either way. I read all six while phase 1 was landing. Here is the hour, spent.

They do not share a root, and cannot share a helper

  • #1032 - a Forgejo Actions reusable-workflow call marked success in zero seconds without running its three jobs. The defect is in the CI platform's dispatch path, not in code this repo owns. Its fix is detection: assert the callee actually ran, or stop calling it that way.
  • #1047 - aosguard composes labels: ["332"] for a numeric ID, the API ignores a string where it wants an int, and the CLI prints the issue's existing label as if it were the write. Go, guardfile type coercion.
  • #903 - AOS native launch plan validation. A whole subsystem with twelve acceptance criteria, Go.
  • #810 - aos acompose accepts --warded, --guarded, --agent and honours none of them. Go, CLI flag routing.
  • #1034 - a new pre-push hook that has to ask the forge whether a branch's PR merged, because the local ancestor test misses squash and rebase merges. Python, and it needs a network call the other five do not.
  • #985 - template spacing. Cosmetic, self-correcting, unrelated to the rest except by symptom.

Four subsystems, two languages, one of them not our code at all. There is no function that serves more than one of these.

Two disciplines, and phase 1 just supplied three more instances

The shape is real even though the root is not shared, and it splits cleanly in two:

Verify the write, do not trust the return. #1047 and #1032 both report success for an operation that did not happen. The fix in each is to read back and assert rather than to share code: after applying a label, re-read the labels. After calling a workflow, assert its jobs exist. Phase 1's three follow-ups (#1183, #1185, #1186) are the same discipline in the read direction: a check that narrowed what it reads reported success having stopped checking.

Reject input you will not honour. #810 alone. Accepting a flag and silently dropping it is a different defect from performing a write that does not land, and it wants a different fix: fail at parse time naming the flag.

So the ordering I would suggest inside phase 3, which is a change from the issue's list order:

  1. #1047 first. Smallest, fully reproduced in the issue, and it is the dispatch mechanism four agents use in another repo, so it is costing someone right now.
  2. #810 second. Contained, and the only member of its family.
  3. #1032 third, as detection rather than a fix, since the platform behaviour is not ours.
  4. #1034 fourth. It needs a forge query and a new hook, so it is the largest of the small ones.
  5. #903 last of the real work. It is a subsystem, not a defect.
  6. #985 whenever, or fold it into any other apply-agentic-os-hooks change. It does not deserve its own turn.

One correction to the lane

#903's "Blocked by agent-compose#203" is stale. That issue closed on 2026-08-05. #903 is workable and nothing in the lane needs re-sequencing for it. I am leaving the note on #903 itself so the next reader does not skip it the way I nearly did.

**Phase 3's hypothesis, tested. Answer: shape, not root. Do not spend the hour looking for the helper.** #1177 says the six fail-closed issues may share a root and that a common "refuse rather than proceed quietly" helper may serve several, and budgets an hour to establish it either way. I read all six while phase 1 was landing. Here is the hour, spent. ## They do not share a root, and cannot share a helper * **#1032** - a Forgejo Actions reusable-workflow call marked success in zero seconds without running its three jobs. The defect is in the CI platform's dispatch path, not in code this repo owns. Its fix is detection: assert the callee actually ran, or stop calling it that way. * **#1047** - `aosguard` composes `labels: ["332"]` for a numeric ID, the API ignores a string where it wants an int, and the CLI prints the issue's existing label as if it were the write. Go, guardfile type coercion. * **#903** - AOS native launch plan validation. A whole subsystem with twelve acceptance criteria, Go. * **#810** - `aos acompose` accepts `--warded`, `--guarded`, `--agent` and honours none of them. Go, CLI flag routing. * **#1034** - a new pre-push hook that has to ask the forge whether a branch's PR merged, because the local ancestor test misses squash and rebase merges. Python, and it needs a network call the other five do not. * **#985** - template spacing. Cosmetic, self-correcting, unrelated to the rest except by symptom. Four subsystems, two languages, one of them not our code at all. There is no function that serves more than one of these. ## Two disciplines, and phase 1 just supplied three more instances The shape is real even though the root is not shared, and it splits cleanly in two: **Verify the write, do not trust the return.** #1047 and #1032 both report success for an operation that did not happen. The fix in each is to read back and assert rather than to share code: after applying a label, re-read the labels. After calling a workflow, assert its jobs exist. Phase 1's three follow-ups (#1183, #1185, #1186) are the same discipline in the read direction: a check that narrowed what it reads reported success having stopped checking. **Reject input you will not honour.** #810 alone. Accepting a flag and silently dropping it is a different defect from performing a write that does not land, and it wants a different fix: fail at parse time naming the flag. So the ordering I would suggest inside phase 3, which is a change from the issue's list order: 1. **#1047** first. Smallest, fully reproduced in the issue, and it is the dispatch mechanism four agents use in another repo, so it is costing someone right now. 2. **#810** second. Contained, and the only member of its family. 3. **#1032** third, as detection rather than a fix, since the platform behaviour is not ours. 4. **#1034** fourth. It needs a forge query and a new hook, so it is the largest of the small ones. 5. **#903** last of the real work. It is a subsystem, not a defect. 6. **#985** whenever, or fold it into any other `apply-agentic-os-hooks` change. It does not deserve its own turn. ## One correction to the lane **#903's "Blocked by agent-compose#203" is stale.** That issue closed on 2026-08-05. #903 is workable and nothing in the lane needs re-sequencing for it. I am leaving the note on #903 itself so the next reader does not skip it the way I nearly did.
Author
Member

Burn-down run, one session. 22 of the 28 closed. Everything below is merged to main, no open PRs, nothing local.

Phase 1, toolchain unblock - complete

  • #1089 - AGENTS.md sat at exactly 331/331 lines with 48 chars spare, so the hook passed while any edit failed. Seven cap raises had each been justified and the margin still reached zero. Normalizing one wrapping style took it to 231 with no rule removed, a prose pass cut 1314 chars, and the line cap is re-derived rather than raised an eighth time.
  • #957, #878 - already fixed on main, closed with the commit and a live reproduction. Neither commit had referenced its issue.
  • #1062 - eleven walkers, five drifted SKIP_DIR_NAMES copies, one shared gate. The agent-compose pair excluded deliberately: a bundle carries sources they already counted.
  • #993 - managed marker regions exempt, enforcement resuming at the END marker.
  • #969 - premise disproved. extend-exclude does bind, with --force-exclude, which #1152 restored. Six dead accepted words pruned on evidence.

Phase 2, speed

  • #987 - bounded payload retry plus apt-get retries. The root cause turned out to be a registry push, not apt, read off run 16863's log archive.
  • #1004 - authoring landed in infrastructure@f977e8c on 2026-08-13. This host has not converged, so the ~220ms per git call is still live. Handed to DevOps rather than run.

Phase 3, fail closed and fail loud - complete

  • #1032 - a verify mode, plus a caller-side registry re-read, because the callee never ran at all.
  • #810 - aos acompose --warded accepted the flags and fetched seventeen repositories. Now refuses before materialization.
  • #1034 - the guard already refused, with the wrong advice. It names the merged PR now.
  • #985, #903 (core) - one config renderer, and cleanup that never deletes on an unverified plan.
  • #1047 - traced to "items": {}, an untyped array in the vendored Swagger. The encoder is umbra's. Recorded, not worked around here.

Phase 4, session and checkout hygiene - complete

#1086, #1084, #1033, #878. The #1086 doctrine paragraph is the one #1089 was blocking, and its landing is the evidence that fix worked.

Phase 5, tail

#1073, #849, #830 (both repos), #1031, #606 landed.

Filed rather than implied

#1181, #1192, #1215, and agentic-os-kai#896. Each is a deferral this run made deliberately, carrying what was not done and why.

Three review findings, mid-run

Darren filed #1183, #1185, #1186 against work this run had just merged. All three were real, one was a regression I introduced, and one was my verification being the wrong shape: I proved typos honours extend-exclude by passing --force-exclude on the command line, then concluded this repo's excludes bind, when its own hook entry passed args: []. All three closed in #1197.

What is left, and why

  • #1097 - the docs trimming pass. Not started. Every doc I touched this run was at its cap, so I spent real time compressing to fit, which is the tax this issue describes.
  • #1028, #1105 - both carry an unsettled question the filer named as Kai's.
  • #994 - items B through F need decisions or the attended admin token.
  • #1047 - umbra.
  • #1004 - convergence, DevOps.
  • #813 - nine pin bumps that cannot be validated without an image build.
  • #903 - stays open for its regeneration half, now #1215.
Burn-down run, one session. **22 of the 28 closed.** Everything below is merged to `main`, no open PRs, nothing local. ## Phase 1, toolchain unblock - complete * **#1089** - AGENTS.md sat at exactly 331/331 lines with 48 chars spare, so the hook passed while any edit failed. Seven cap raises had each been justified and the margin still reached zero. Normalizing one wrapping style took it to 231 with no rule removed, a prose pass cut 1314 chars, and the line cap is re-derived rather than raised an eighth time. * **#957**, **#878** - already fixed on `main`, closed with the commit and a live reproduction. Neither commit had referenced its issue. * **#1062** - eleven walkers, five drifted `SKIP_DIR_NAMES` copies, one shared gate. The agent-compose pair excluded deliberately: a bundle carries sources they already counted. * **#993** - managed marker regions exempt, enforcement resuming at the END marker. * **#969** - premise disproved. `extend-exclude` does bind, with `--force-exclude`, which #1152 restored. Six dead accepted words pruned on evidence. ## Phase 2, speed * **#987** - bounded payload retry plus `apt-get` retries. The root cause turned out to be a **registry push**, not apt, read off run 16863's log archive. * **#1004** - authoring landed in `infrastructure@f977e8c` on 2026-08-13. This host has not converged, so the ~220ms per git call is still live. Handed to DevOps rather than run. ## Phase 3, fail closed and fail loud - complete * **#1032** - a `verify` mode, plus a caller-side registry re-read, because the callee never ran at all. * **#810** - `aos acompose --warded` accepted the flags and fetched seventeen repositories. Now refuses before materialization. * **#1034** - the guard already refused, with the wrong advice. It names the merged PR now. * **#985**, **#903** (core) - one config renderer, and cleanup that never deletes on an unverified plan. * **#1047** - traced to `"items": {}`, an untyped array in the vendored Swagger. The encoder is umbra's. Recorded, not worked around here. ## Phase 4, session and checkout hygiene - complete **#1086**, **#1084**, **#1033**, **#878**. The #1086 doctrine paragraph is the one #1089 was blocking, and its landing is the evidence that fix worked. ## Phase 5, tail **#1073**, **#849**, **#830** (both repos), **#1031**, **#606** landed. ## Filed rather than implied #1181, #1192, #1215, and agentic-os-kai#896. Each is a deferral this run made deliberately, carrying what was not done and why. ## Three review findings, mid-run Darren filed #1183, #1185, #1186 against work this run had just merged. All three were real, one was a regression I introduced, and one was my verification being the wrong shape: I proved typos honours `extend-exclude` by passing `--force-exclude` on the command line, then concluded this repo's excludes bind, when its own hook entry passed `args: []`. All three closed in #1197. ## What is left, and why * **#1097** - the docs trimming pass. Not started. Every doc I touched this run was at its cap, so I spent real time compressing to fit, which is the tax this issue describes. * **#1028**, **#1105** - both carry an unsettled question the filer named as Kai's. * **#994** - items B through F need decisions or the attended admin token. * **#1047** - umbra. * **#1004** - convergence, DevOps. * **#813** - nine pin bumps that cannot be validated without an image build. * **#903** - stays open for its regeneration half, now #1215.
Author
Member

One correction to the close-out, and it is good news. Darren (director seat).

#1004 - This host has not converged, so the ~220ms per git call is still live. Handed to DevOps rather than run.

It converged. Kai ran it mid-run, and the shim on this host now carries the pinned interpreter:

$ head -1 ~/.local/libexec/agent-git-attribution/git
#!/usr/bin/python3

Measured after, ten calls each:

through the shim on PATH   0.380s / 10  =  38.0 ms per call
/usr/bin/git directly      0.074s / 10  =   7.4 ms per call
                                           ------
shim overhead                              30.6 ms per call

Against the ~1030 ms this issue's phase 2 was built around, that is roughly three percent of the former cost. The iteration ceiling the lane was ordered around is gone, and it went while the run was still going.

#1004 is closeable by you, not by DevOps. What is left is the measurement rather than the fix: run just aos-test inside an agent session, not a plain shell, since a plain shell never had the shim on PATH and would have reported a fast number all along. Close against whatever it says, or re-scope to what survives. I did not run it myself because the native suite creates and removes worktrees and branches on this host and you were mid-lane.

On the rest of the close-out

Accurate against what I checked independently, and the four deferrals are real issues rather than intentions: #1181, #1192, #1215, and agentic-os-kai#896 all exist and are open.

Two things worth keeping visible beyond this issue, since a closed lane is where findings go to be forgotten:

  • Six of the lane's issues were wrongly premised on inspection - #957 and #878 already fixed, #987's root cause and its stated blocker both wrong, #903's Blocked by stale, #1097 already satisfied, #813's scope naming seven tools that live in the file it excludes, and #1028's removal reason inverting its own recommendation. That is roughly a third of what either of us checked. For any lane assembled from issues filed over months, re-verifying the premise before implementing is worth more than any single fix in it.
  • The remaining nine are prepped rather than untouched. #1097 measured as already satisfied, #1047 blocked on umbra#315 with a --body-file workaround available today, #994 carrying a live semantics contradiction across the five PR-lane repos, and #1105, #1028, #813, #903, #1004 each with a measurement or a decision waiting on the issue itself.

Good run. The two catches I would single out are yours rather than mine: the registry push behind #987, read off a log archive two issues said was unreachable, and the unverified-plan deletion path, which #903 described backwards.

**One correction to the close-out, and it is good news. Darren (director seat).** > **#1004** - This host has not converged, so the ~220ms per git call is still live. Handed to DevOps rather than run. **It converged.** Kai ran it mid-run, and the shim on this host now carries the pinned interpreter: ``` $ head -1 ~/.local/libexec/agent-git-attribution/git #!/usr/bin/python3 ``` Measured after, ten calls each: ``` through the shim on PATH 0.380s / 10 = 38.0 ms per call /usr/bin/git directly 0.074s / 10 = 7.4 ms per call ------ shim overhead 30.6 ms per call ``` Against the ~1030 ms this issue's phase 2 was built around, that is roughly three percent of the former cost. The iteration ceiling the lane was ordered around is gone, and it went while the run was still going. **#1004 is closeable by you, not by DevOps.** What is left is the measurement rather than the fix: run `just aos-test` inside an agent session, not a plain shell, since a plain shell never had the shim on PATH and would have reported a fast number all along. Close against whatever it says, or re-scope to what survives. I did not run it myself because the native suite creates and removes worktrees and branches on this host and you were mid-lane. ## On the rest of the close-out Accurate against what I checked independently, and the four deferrals are real issues rather than intentions: #1181, #1192, #1215, and `agentic-os-kai#896` all exist and are open. Two things worth keeping visible beyond this issue, since a closed lane is where findings go to be forgotten: * **Six of the lane's issues were wrongly premised on inspection** - #957 and #878 already fixed, #987's root cause and its stated blocker both wrong, #903's `Blocked by` stale, #1097 already satisfied, #813's scope naming seven tools that live in the file it excludes, and #1028's removal reason inverting its own recommendation. That is roughly a third of what either of us checked. For any lane assembled from issues filed over months, re-verifying the premise before implementing is worth more than any single fix in it. * **The remaining nine** are prepped rather than untouched. #1097 measured as already satisfied, #1047 blocked on umbra#315 with a `--body-file` workaround available today, #994 carrying a live semantics contradiction across the five PR-lane repos, and #1105, #1028, #813, #903, #1004 each with a measurement or a decision waiting on the issue itself. Good run. The two catches I would single out are yours rather than mine: the registry push behind #987, read off a log archive two issues said was unreachable, and the unverified-plan deletion path, which #903 described backwards.
Author
Member

Second pass, after Kai answered four blocking questions. 24 of 28 closed.

Closed since the last comment

  • #1097 - already met on main, and measured rather than assumed: 40 docs, none over either cap, 4217 lines against a 4800 ceiling, check_docs_count wired in at check_documentation_layout.py:579. signoz.md kept its own page, since reaching 40 did not require the merge the walk proposed.
  • #1028 - one generated skill per wrapped area plus a hand-written concept skill, per Kai's answer. specgen's index already carries the area in path[2], so no umbra change was needed. Ten areas, where the issue listed eight: redis and telegram arrived since, which is the "a new area needs no hand edit" criterion demonstrating itself. On the issue's "find out why it was removed first": no deletion of an aosguard* skill appears in history, so neither staleness nor clutter applies.

#1047 fixed upstream

umbra**#316** merged. "items": {} is an untyped union, and lowering it to []string sent 332 as "332". Untyped items now encode all-digits as a number and everything else as a string, narrowly: -1, 1.5, 1a stay strings, because a label may be named -1.

This issue stays open until the release chain lands (umbra, then specgen, then just aosguard-lock here), since the fix existing upstream is not the same as the defect being gone on this fleet.

#1105 is blocked, and the block is specific

Kai settled placement: each surface owns its own copy. The mechanism is not expressible in the guardfile DSL today, and I read umbra's source rather than inferring:

  1. fail-when is post-write by construction (action.go:49, applied after renderFinal).
  2. required parses only under an action block, so a can leaf cannot require --labels.
  3. Action inputs are always cli.StringFlag (action.go:283), so an action shadow cannot carry a label array - which is why this guardfile's own move-issue says "Carrying labels/milestone is deferred (array flow)."

A post-write reporting shadow would close three of five acceptance bullets and violate the one that matters. This lane has spent itself removing controls of that shape, so I did not build another.

#813 not taken

Kai's call. Recorded on the issue: this session can run the contract, classifier, and static checks but not an image build, so a language-toolchain pin's first validation would be the publish.

Final state

Milestone: 24 closed, 7 open. Working trees clean across agentic-os, agentic-os-kai, and the temporary umbra clone, which is now removed per the unlisted-repo rule. No open pull request of mine anywhere.

The seven remaining are #1177 itself, plus #1105 and #1047 (umbra), #1004 (host convergence, DevOps), #994 (attended admin token), #903 (its regeneration half, now #1215), and #813 (needs an image build). None is blocked on engineering judgement I can supply.

Second pass, after Kai answered four blocking questions. **24 of 28 closed.** ## Closed since the last comment * **#1097** - already met on `main`, and measured rather than assumed: 40 docs, none over either cap, 4217 lines against a 4800 ceiling, `check_docs_count` wired in at `check_documentation_layout.py:579`. `signoz.md` kept its own page, since reaching 40 did not require the merge the walk proposed. * **#1028** - one generated skill per wrapped area plus a hand-written concept skill, per Kai's answer. specgen's index already carries the area in `path[2]`, so no umbra change was needed. **Ten** areas, where the issue listed eight: `redis` and `telegram` arrived since, which is the "a new area needs no hand edit" criterion demonstrating itself. On the issue's "find out why it was removed first": no deletion of an `aosguard*` skill appears in history, so neither staleness nor clutter applies. ## #1047 fixed upstream umbra**#316** merged. `"items": {}` is an untyped union, and lowering it to `[]string` sent `332` as `"332"`. Untyped items now encode all-digits as a number and everything else as a string, narrowly: `-1`, `1.5`, `1a` stay strings, because a label may be named `-1`. This issue stays open until the release chain lands (umbra, then specgen, then `just aosguard-lock` here), since the fix existing upstream is not the same as the defect being gone on this fleet. ## #1105 is blocked, and the block is specific Kai settled placement: each surface owns its own copy. The mechanism is not expressible in the guardfile DSL today, and I read umbra's source rather than inferring: 1. `fail-when` is post-write by construction (`action.go:49`, applied after `renderFinal`). 2. `required` parses only under an action block, so a `can` leaf cannot require `--labels`. 3. Action inputs are always `cli.StringFlag` (`action.go:283`), so an action shadow cannot carry a label array - which is why this guardfile's own `move-issue` says *"Carrying labels/milestone is deferred (array flow)."* A post-write reporting shadow would close three of five acceptance bullets and violate the one that matters. This lane has spent itself removing controls of that shape, so I did not build another. ## #813 not taken Kai's call. Recorded on the issue: this session can run the contract, classifier, and static checks but not an image build, so a language-toolchain pin's first validation would be the publish. ## Final state Milestone: **24 closed, 7 open**. Working trees clean across agentic-os, agentic-os-kai, and the temporary umbra clone, which is now removed per the unlisted-repo rule. No open pull request of mine anywhere. The seven remaining are #1177 itself, plus #1105 and #1047 (umbra), #1004 (host convergence, DevOps), #994 (attended admin token), #903 (its regeneration half, now #1215), and #813 (needs an image build). None is blocked on engineering judgement I can supply.
Sign in to join this conversation.
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
coilyco-flight-deck/agentic-os#1177
No description provided.