[ward-salvage] cli-guard: unmerged container work on ward-salvage/cli-guard-4fc321b4 #161

New issue

Closed

opened 2026-06-24 06:54:28 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-06-24 06:54:28 +00:00

Owner

An ephemeral ward container (claude mode) finished but its work was not merged to main, so the reaper preserved it on a branch before the container was torn down.

Repo: coilyco-flight-deck/cli-guard
Salvage branch: ward-salvage/cli-guard-4fc321b4
Reason: merge conflict integrating onto main
Container uptime at reap: 10m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token)

Recover

git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard.git ward-salvage/cli-guard-4fc321b4
git checkout -b ward-salvage/cli-guard-4fc321b4 FETCH_HEAD

Working tree at reap time

A  cli/dispatch/ci.go
A  cli/dispatch/ci_test.go
M  cli/dispatch/dispatch.go
A  cli/dispatch/foreground.go
UU cli/execverb/describe.go
M  cli/execverb/describe_test.go
UU cli/execverb/execverb.go
M  cli/execverb/execverb_test.go
UU cli/execverb/guardfile.go
M  docs/FEATURES.md
A  docs/execverb-inspect.md
M  docs/execverb.md
A  docs/specverb-inherit.md
M  docs/specverb-resolution.md
A  docs/specverb-wildcard.md
UU godoc-current.txt
M  http/guardfile/guardfile.go
M  http/guardfile/guardfile_test.go
A  http/guardfile/inherit.go
A  http/guardfile/inherit_test.go
M  http/specdrv/specdrv.go
M  http/specverb/action.go
A  http/specverb/action_collect.go
A  http/specverb/action_collect_test.go
M  http/specverb/describe.go
A  http/specverb/inherit_compose_test.go
M  http/specverb/prune.go
M  http/specverb/specverb.go
A  http/specverb/testdata/forgejo-readonly.kdl
A  http/specverb/wildcard.go
A  http/specverb/wildcard_test.go

— Claude (she/her), via ward agent

An ephemeral `ward container` (claude mode) finished but its work was **not merged to `main`**, so the reaper preserved it on a branch before the container was torn down. - **Repo:** `coilyco-flight-deck/cli-guard` - **Salvage branch:** `ward-salvage/cli-guard-4fc321b4` - **Reason:** merge conflict integrating onto main - **Container uptime at reap:** 10m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token) ## Recover ```bash git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard.git ward-salvage/cli-guard-4fc321b4 git checkout -b ward-salvage/cli-guard-4fc321b4 FETCH_HEAD ``` ## Working tree at reap time ``` A cli/dispatch/ci.go A cli/dispatch/ci_test.go M cli/dispatch/dispatch.go A cli/dispatch/foreground.go UU cli/execverb/describe.go M cli/execverb/describe_test.go UU cli/execverb/execverb.go M cli/execverb/execverb_test.go UU cli/execverb/guardfile.go M docs/FEATURES.md A docs/execverb-inspect.md M docs/execverb.md A docs/specverb-inherit.md M docs/specverb-resolution.md A docs/specverb-wildcard.md UU godoc-current.txt M http/guardfile/guardfile.go M http/guardfile/guardfile_test.go A http/guardfile/inherit.go A http/guardfile/inherit_test.go M http/specdrv/specdrv.go M http/specverb/action.go A http/specverb/action_collect.go A http/specverb/action_collect_test.go M http/specverb/describe.go A http/specverb/inherit_compose_test.go M http/specverb/prune.go M http/specverb/specverb.go A http/specverb/testdata/forgejo-readonly.kdl A http/specverb/wildcard.go A http/specverb/wildcard_test.go ```  — Claude (she/her), via `ward agent`

coilyco-ops commented

2026-06-25 04:56:03 +00:00

Member

🔒 Reserved by ward agent --driver claude — container ward-cli-guard-issue-161-claude-38195bd0 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-06-25T04:56:01Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `ward-cli-guard-issue-161-claude-38195bd0` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-06-25T04:56:01Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-06-25 04:59:34 +00:00

Merge ward-salvage/cli-guard-4fc321b4: passthrough work already on main (closes #161)

coilysiren closed this issue

2026-06-25 04:59:34 +00:00

coilysiren commented

2026-06-25 04:59:59 +00:00

Author

Owner

What fought back was mostly the analysis: the three-dot main...salvage diff is genuinely misleading here (it shows the salvage commit's own additions, not the net delta vs main), and only the two-dot diff plus a file/test inventory made it obvious nothing was actually missing. Easy trap to fall into and merge a regression.

So the integration is an -s ours merge: it records the salvage branch as merged for a clean audit trail and keeps main's tree byte-identical (verified empty diff vs origin/main). Confidence is high - the only test failures are the seccomp/ptrace sandbox suite, which needs kernel privileges this linuxkit container doesn't grant and is identical on stock main; pre-commit passed.

One loose end worth a follow-up: the ward-salvage/cli-guard-4fc321b4 branch is now a merged ancestor of main and can be pruned, but I left it in place rather than delete a shared remote branch unilaterally.

Retro from the salvage run: this one was almost entirely triage, not recovery. The reaper flagged a merge conflict, so I went in expecting to hand-resolve lost work. Instead the branch turned out to be strictly *behind* main on every file - its feature payload (the execverb passthrough dialect + host-gate guards) had already landed via #158, and main had since lapped it twice over with the #154 coily scrub and the #163 consumer-name neutralization. The 'conflict' was just main's later refactors colliding with the stale tree. What fought back was mostly the analysis: the three-dot `main...salvage` diff is genuinely misleading here (it shows the salvage commit's own additions, not the net delta vs main), and only the two-dot diff plus a file/test inventory made it obvious nothing was actually missing. Easy trap to fall into and merge a regression. So the integration is an `-s ours` merge: it records the salvage branch as merged for a clean audit trail and keeps main's tree byte-identical (verified empty diff vs origin/main). Confidence is high - the only test failures are the seccomp/ptrace sandbox suite, which needs kernel privileges this linuxkit container doesn't grant and is identical on stock main; pre-commit passed. One loose end worth a follow-up: the `ward-salvage/cli-guard-4fc321b4` branch is now a merged ancestor of main and can be pruned, but I left it in place rather than delete a shared remote branch unilaterally.