Use native shadow workspaces for standalone AOS #942

Closed
coilyco-ops wants to merge 0 commits from aos/codex/standalone-shadow-workspace into main
Owner

Summary

  • Route standalone AOS and legacy composed launches through native shadow workspace preparation.
  • Bind the leased session projects root at /workspace, so owner/repo hierarchy and repository subdirectories stay active inside Docker.
  • Mount a copied, allowlisted session HOME at /home/aos while keeping host HOME, AWS, Git, Docker, and credential paths out of that surface.
  • Add role-scoped Forgejo pinned-issue hydration from .agents/issue-pin-context.yaml, with cache freshness, stale fallback, fail-closed mode, clipping markers, snapshot digests, and no token material in generated context.
  • Keep auth fail-closed before workspace creation and preserve --auth=false startup checks.
  • Document the shared shadow workspace, safe HOME, and issue-pin context contracts.

Closes #926
Closes #925
Closes #924
Closes #919

Validation

  • ward exec aos-fmt
  • ward exec aos-test
  • ward exec aos-build
  • ward exec aos-lint
  • ward exec test
  • AOS_RELEASE_VERSION=aos-v0.0.0 ward exec aos-release-build
  • AOS_RELEASE_VERSION=aos-v0.0.0 ward exec aos-release-package
  • AOS_RELEASE_VERSION=aos-v0.0.0 ward exec aos-release-check
  • ward exec pre-commit-all

CI

  • Forgejo Actions run #2940 failed during Set up job before checkout or repository code execution. Filed #944 with the exact live-run evidence and needed operator verification.
## Summary - Route standalone AOS and legacy composed launches through native shadow workspace preparation. - Bind the leased session projects root at `/workspace`, so owner/repo hierarchy and repository subdirectories stay active inside Docker. - Mount a copied, allowlisted session HOME at `/home/aos` while keeping host HOME, AWS, Git, Docker, and credential paths out of that surface. - Add role-scoped Forgejo pinned-issue hydration from `.agents/issue-pin-context.yaml`, with cache freshness, stale fallback, fail-closed mode, clipping markers, snapshot digests, and no token material in generated context. - Keep auth fail-closed before workspace creation and preserve `--auth=false` startup checks. - Document the shared shadow workspace, safe HOME, and issue-pin context contracts. Closes #926 Closes #925 Closes #924 Closes #919 ## Validation - `ward exec aos-fmt` - `ward exec aos-test` - `ward exec aos-build` - `ward exec aos-lint` - `ward exec test` - `AOS_RELEASE_VERSION=aos-v0.0.0 ward exec aos-release-build` - `AOS_RELEASE_VERSION=aos-v0.0.0 ward exec aos-release-package` - `AOS_RELEASE_VERSION=aos-v0.0.0 ward exec aos-release-check` - `ward exec pre-commit-all` ## CI - Forgejo Actions run #2940 failed during `Set up job` before checkout or repository code execution. Filed #944 with the exact live-run evidence and needed operator verification.
Use native shadow workspaces for standalone AOS
Some checks failed
ci / gate (pull_request) Has been cancelled
ci / aos-cli-tests (pull_request) Has been cancelled
ci / ward-doctor (pull_request) Has been cancelled
e596a21083
Cover standalone projects-root shadow launch
Some checks failed
ci / aos-cli-tests (pull_request) Failing after 1m9s
ci / ward-doctor (pull_request) Successful in 1m6s
ci / gate (pull_request) Successful in 1m56s
4351b60d98
Project safe home for standalone AOS
Some checks are pending
ci / gate (pull_request) Has started running
ci / ward-doctor (pull_request) Successful in 14s
ci / aos-cli-tests (pull_request) Successful in 4m14s
cc73c1cbee
Hydrate role issue pins into AOS context
Some checks failed
ci / ward-doctor (pull_request) Successful in 13s
ci / aos-cli-tests (pull_request) Failing after 17s
ci / gate (pull_request) Successful in 52s
e1b6ed5365
Merge remote-tracking branch 'origin/main' into aos/codex/standalone-shadow-workspace
Some checks failed
ci / ward-doctor (pull_request) Successful in 12s
ci / aos-cli-tests (pull_request) Successful in 34s
ci / gate (pull_request) Successful in 1m8s
ci / aos-cli-tests (push) Successful in 27s
ci / ward-doctor (push) Successful in 11s
ci / gate (push) Successful in 1m0s
mirror-to-github / test (push) Successful in 1m0s
mirror-to-github / mirror (push) Successful in 9s
promote / gate (push) Successful in 54s
promote / promote-release (push) Successful in 8s
aos-cli-release / release (push) Failing after 2m0s
53b035bbb9
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Codex <noreply@openai.com>

# Conflicts:
#	docs/FEATURES.md
coilyco-ops closed this pull request 2026-08-06 06:55:48 +00:00
Some checks failed
ci / ward-doctor (pull_request) Successful in 12s
ci / aos-cli-tests (pull_request) Successful in 34s
ci / gate (pull_request) Successful in 1m8s
ci / aos-cli-tests (push) Successful in 27s
ci / ward-doctor (push) Successful in 11s
ci / gate (push) Successful in 1m0s
mirror-to-github / test (push) Successful in 1m0s
mirror-to-github / mirror (push) Successful in 9s
promote / gate (push) Successful in 54s
promote / promote-release (push) Successful in 8s
aos-cli-release / release (push) Failing after 2m0s

Pull request closed

Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
coilyco-flight-deck/agentic-os!942
No description provided.