Fix Docker helper SSM path for agent surface pulls #514

New issue

Closed

opened 2026-07-14 06:13:01 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-14 06:13:01 +00:00

Member

ward agent surface --harness codex failed before opening the container because Docker invoked docker-credential-forgejo-ssm, and the helper tried SSM paths outside the engineer role allowlist.

Observed failure:

registry-read-token absent; falling back to admin api-token - run rotate-registry-read-token.sh
ssm fetch failed
docker: error getting credentials

The helper should read bot-owned registry token paths that match the active ward engineer SSM guard, and should not fall back to a personal/admin token path for routine image pulls.

Acceptance:

docker pull forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:release succeeds through the helper.
The helper uses the coilyco-ops registry token namespace for both the read token and temporary fallback.
Tests cover the helper without reading real SSM values.

ward agent surface --harness codex failed before opening the container because Docker invoked docker-credential-forgejo-ssm, and the helper tried SSM paths outside the engineer role allowlist. Observed failure: ``` registry-read-token absent; falling back to admin api-token - run rotate-registry-read-token.sh ssm fetch failed docker: error getting credentials ``` The helper should read bot-owned registry token paths that match the active ward engineer SSM guard, and should not fall back to a personal/admin token path for routine image pulls. Acceptance: * docker pull forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:release succeeds through the helper. * The helper uses the coilyco-ops registry token namespace for both the read token and temporary fallback. * Tests cover the helper without reading real SSM values.

coilyco-ops referenced this issue

2026-07-14 06:13:15 +00:00

Mint registry read token under coilyco-ops SSM path #515

coilyco-ops referenced this issue from a commit

2026-07-14 06:14:07 +00:00

Fix Docker registry helper SSM path

coilyco-ops closed this issue

2026-07-14 06:14:07 +00:00