Repair WARD_CONFIG_REF propagation for read-only director containers #430

Merged

coilysiren merged 1 commit from issue-427 into main

2026-07-10 10:14:53 +00:00

coilyco-ops commented

2026-07-10 09:59:46 +00:00

Member

closes #427
ward.workflow: pull-requests-and-merge

Fixes the read-only director/container startup path by seeding AOS_REPO_ROOT and WARD_CONFIG_REF before bash starts, while keeping shell/common.sh pinned to the canonical aos checkout.

closes #427 ward.workflow: pull-requests-and-merge Fixes the read-only director/container startup path by seeding AOS_REPO_ROOT and WARD_CONFIG_REF before bash starts, while keeping shell/common.sh pinned to the canonical aos checkout.

coilyco-ops added 1 commit

2026-07-10 09:59:46 +00:00

fix: seed ward config ref in read-only director containers 7eb7f2fa6e

coilyco-ops commented

2026-07-10 10:02:38 +00:00

Author

Member

verdict: pass
confidence: medium
summary: PR #430 addresses the missed surface from agentic-os#427 by adding a dev-base runtime entrypoint that seeds AOS_REPO_ROOT and WARD_CONFIG_REF, and by making shell/common.sh prefer canonical aos checkouts instead of the current working tree. The dev-base tier chain builds full from agent, so the agent-tier entrypoint should carry into the default full surface.
findings: []
conclusion: The patch satisfies the review contract from the diff: it covers the read-only container startup path, preserves child inheritance, removes the foreign-repo SHA fallback, and adds focused tests for both the entrypoint and shell fallback. Residual risk is operational rather than code-local: after merge and image publish, a fresh director surface still needs a smoke check that warded list --json works without an inline WARD_CONFIG_REF.

verdict: pass confidence: medium summary: PR #430 addresses the missed surface from agentic-os#427 by adding a dev-base runtime entrypoint that seeds `AOS_REPO_ROOT` and `WARD_CONFIG_REF`, and by making `shell/common.sh` prefer canonical aos checkouts instead of the current working tree. The dev-base tier chain builds `full` from `agent`, so the agent-tier entrypoint should carry into the default full surface. findings: [] conclusion: The patch satisfies the review contract from the diff: it covers the read-only container startup path, preserves child inheritance, removes the foreign-repo SHA fallback, and adds focused tests for both the entrypoint and shell fallback. Residual risk is operational rather than code-local: after merge and image publish, a fresh director surface still needs a smoke check that `warded list --json` works without an inline `WARD_CONFIG_REF`.

coilyco-ops referenced this pull request

2026-07-10 10:13:31 +00:00

Stop requiring manual WARD_CONFIG_REF overrides for warded surfaces #426