Repair WARD_CONFIG_REF propagation for read-only director containers #427

New issue

Closed

opened 2026-07-10 09:47:17 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-10 09:47:17 +00:00

Member

Problem

PR agentic-os#426 improves host shell rc behavior for agentic-os#422, but it misses the surface where the bug was observed.

Current evidence from the read-only director surface:

WARD_CONFIG_REF=
AOS_REPO_ROOT=
SHELL=/bin/bash

Commands still need the manual prefix:

WARD_CONFIG_REF="forgejo.coilysiren.me/coilyco-flight-deck/agentic-os@$(git rev-parse HEAD)//.ward" warded list --json

The PR only changes shell/bashrc, shell/zshrc, and shell/common.sh. It does not change the ward/container entrypoint or any startup path that creates the read-only director surface session, so child warded invocations launched from that surface still do not inherit the config ref.

A secondary bug in the PR: _siren_aos_repo_root falls back to git rev-parse --show-toplevel before the canonical aos checkout, so a direct source of common.sh from another repo can construct an agentic-os config ref using the wrong repo's commit SHA.

Acceptance criteria

A fresh read-only director surface has WARD_CONFIG_REF=forgejo.coilysiren.me/coilyco-flight-deck/agentic-os@<current aos commit>//.ward without a manual inline prefix.
warded list --json works from that surface without setting WARD_CONFIG_REF inline.
warded engineer coilyco-flight-deck/<repo>#N --harness codex --details ... inherits the same ref without setting it inline.
Host shell sourcing cannot construct an agentic-os config ref from a non-agentic-os repository's commit SHA.
Tests or a documented smoke check cover the read-only director/container startup path, not only shell/common.sh sourced in a unit test.

## Problem PR `agentic-os#426` improves host shell rc behavior for `agentic-os#422`, but it misses the surface where the bug was observed. Current evidence from the read-only director surface: ```text WARD_CONFIG_REF= AOS_REPO_ROOT= SHELL=/bin/bash ``` Commands still need the manual prefix: ```bash WARD_CONFIG_REF="forgejo.coilysiren.me/coilyco-flight-deck/agentic-os@$(git rev-parse HEAD)//.ward" warded list --json ``` The PR only changes `shell/bashrc`, `shell/zshrc`, and `shell/common.sh`. It does not change the ward/container entrypoint or any startup path that creates the read-only director surface session, so child `warded` invocations launched from that surface still do not inherit the config ref. A secondary bug in the PR: `_siren_aos_repo_root` falls back to `git rev-parse --show-toplevel` before the canonical aos checkout, so a direct source of `common.sh` from another repo can construct an agentic-os config ref using the wrong repo's commit SHA. ## Acceptance criteria * A fresh read-only director surface has `WARD_CONFIG_REF=forgejo.coilysiren.me/coilyco-flight-deck/agentic-os@<current aos commit>//.ward` without a manual inline prefix. * `warded list --json` works from that surface without setting `WARD_CONFIG_REF` inline. * `warded engineer coilyco-flight-deck/<repo>#N --harness codex --details ...` inherits the same ref without setting it inline. * Host shell sourcing cannot construct an agentic-os config ref from a non-agentic-os repository's commit SHA. * Tests or a documented smoke check cover the read-only director/container startup path, not only `shell/common.sh` sourced in a unit test.

coilyco-ops added the

headless

labels

2026-07-10 09:47:17 +00:00

coilyco-ops commented

2026-07-10 09:47:28 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-agentic-os-427 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T09:47:27Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#427 · branch issue-427 · harness codex · workflow pull-requests-and-merge
Run: engineer-codex-agentic-os-427 · ward v0.569.0 · dispatched 2026-07-10T09:47:27Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.569.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-agentic-os-427` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T09:47:27Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#427` · branch `issue-427` · harness `codex` · workflow `pull-requests-and-merge` - **Run:** `engineer-codex-agentic-os-427` · ward `v0.569.0` · dispatched `2026-07-10T09:47:27Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.569.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-10 09:59:46 +00:00

Repair WARD_CONFIG_REF propagation for read-only director containers #430

coilyco-ops commented

2026-07-10 10:01:14 +00:00

Author

Member

WARD-OUTCOME: merge-ready

details

workflow: pull-requests-and-merge; review summary: skipped (review gate skipped by ~/.ward/config.yaml default)
felt: small, cross-cutting seam fix.
confidence: high
surprises: Forgejo Actions reported no runs for the PR.
follow-ups: none

WARD-OUTCOME: merge-ready <details><summary>details</summary> workflow: pull-requests-and-merge; review summary: skipped (review gate skipped by ~/.ward/config.yaml default) felt: small, cross-cutting seam fix. confidence: high surprises: Forgejo Actions reported no runs for the PR. follow-ups: none  </details>