Ship tailscaled in the dev-base ops tier #486

New issue

Closed

opened 2026-07-13 03:12:39 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-13 03:12:39 +00:00

Member

The dev-base ops tier currently installs only the tailscale client binary:

docker/dev-base/ops/Dockerfile extracts tailscale_${TAILSCALE_VERSION}_${TS_ARCH}/tailscale into /usr/local/bin.
docs/dev-base-image.md and docs/dev-base-image-tiering.md describe this as Tailscale CLI/client only.
docs/role-surface-tiers.md expects advisor/director/ops surfaces to have tailnet live-observe, and the live director check now fails with tailscale status because local tailscaled is not running.

Kai clarified that the image should carry tailscaled too. Please update the aos dev-base image contract and implementation so the ops tier ships both tailscale and tailscaled from the pinned Tailscale tarball.

Acceptance criteria:

docker/dev-base/ops/Dockerfile installs both /usr/local/bin/tailscale and /usr/local/bin/tailscaled for the supported architectures.
The image build verifies both binaries exist, ideally with tailscale version and a non-network daemon binary check such as tailscaled --version if supported by the installed version.
The relevant docs stop saying the image ships only the Tailscale CLI/client, and clearly split image responsibility (daemon binary exists) from ward/container bring-up responsibility (daemon process/auth/socket wiring).
Run the repo validation expected for a dev-base Dockerfile/docs change, including the dev-base build command if feasible in the engineer container, and pre-commit run --all-files before landing.

Context: this is related to the live director surface drift captured in coilyco-flight-deck/ward#1141, but the image contents are authored in aos.

The dev-base ops tier currently installs only the `tailscale` client binary: * `docker/dev-base/ops/Dockerfile` extracts `tailscale_${TAILSCALE_VERSION}_${TS_ARCH}/tailscale` into `/usr/local/bin`. * `docs/dev-base-image.md` and `docs/dev-base-image-tiering.md` describe this as Tailscale CLI/client only. * `docs/role-surface-tiers.md` expects advisor/director/ops surfaces to have tailnet live-observe, and the live director check now fails with `tailscale status` because local `tailscaled` is not running. Kai clarified that the image should carry `tailscaled` too. Please update the aos dev-base image contract and implementation so the ops tier ships both `tailscale` and `tailscaled` from the pinned Tailscale tarball. Acceptance criteria: * `docker/dev-base/ops/Dockerfile` installs both `/usr/local/bin/tailscale` and `/usr/local/bin/tailscaled` for the supported architectures. * The image build verifies both binaries exist, ideally with `tailscale version` and a non-network daemon binary check such as `tailscaled --version` if supported by the installed version. * The relevant docs stop saying the image ships only the Tailscale CLI/client, and clearly split image responsibility (daemon binary exists) from ward/container bring-up responsibility (daemon process/auth/socket wiring). * Run the repo validation expected for a dev-base Dockerfile/docs change, including the dev-base build command if feasible in the engineer container, and `pre-commit run --all-files` before landing. Context: this is related to the live director surface drift captured in coilyco-flight-deck/ward#1141, but the image contents are authored in aos.

coilyco-ops commented

2026-07-13 03:12:58 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-agentic-os-486 on host KAI-DESKTOP-TOWER.

Reserved by ward agent --harness codex (reserved 2026-07-13T03:12:56Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#486 · branch issue-486 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-agentic-os-486 · ward v0.633.0 · dispatched 2026-07-13T03:12:56Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.633.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-agentic-os-486` on host `KAI-DESKTOP-TOWER`. Reserved by `ward agent --harness codex` (reserved 2026-07-13T03:12:56Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#486` · branch `issue-486` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-486` · ward `v0.633.0` · dispatched `2026-07-13T03:12:56Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.633.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-13 03:19:43 +00:00

Ship tailscaled in the dev-base ops tier #487

coilyco-ops commented

2026-07-13 03:21:27 +00:00

Author

Member

WARD-OUTCOME: submitted

details

workflow: pull-request-and-merge; review summary: skipped because the temporary ward default pending brokered QA
retrospective: the implementation felt mechanical once the tarball layout and doc split were confirmed
confidence: high
surprises: the local dev-base build could not run here because Docker has no daemon
follow-ups: watch PR #487, merge on green review, and record the final director outcome

WARD-OUTCOME: submitted <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped because the temporary ward default pending brokered QA retrospective: the implementation felt mechanical once the tarball layout and doc split were confirmed confidence: high surprises: the local dev-base build could not run here because Docker has no daemon follow-ups: watch PR #487, merge on green review, and record the final director outcome </details>