ward container: reconstruct the cross-repo skill surface + fence host-only scripts (substrate-vs-full-tree coupling)

coilysiren commented

2026-06-17 19:55:00 +00:00

Owner

The skill surface and a lot of agent context are coupled to the full host ~/projects tree at absolute paths. ward container reproduces only a curated substrate, so this needs a deliberate design pass. Surfaced during the June 2026 reduction.

Coupling map (cross-repo links on disk)

Skill surface = absolute-path symlink forest. ~/.claude/skills + ~/.codex/skills symlink to /Users/kai/projects/<org>/<repo>/.agents/skills/*. mount-skills.sh builds it by self-mounting agentic-os-kai skills, linking agentic-os public skills (coding-* language, kai-*, agents-*, models-*), walking every on-disk org dir to aggregate repo-<name> pointers, and pulling per-repo capability skills.
agent-compose composes the global CLAUDE.md from absolute-path sources (agentic-os + agentic-os-kai AGENTS.md) and embeds /Users/kai/projects/... markers + skill links.
~18 fleet-management scripts in agentic-os-kai walk all org dirs (up-to-date.py, _fleet.py, fleet-pulse.sh, build-catalog-graph.py, sweep-repo-pointer-skills.py, audit-precommit.py, sync-repo-registry.py).
catalog system reads across the fleet (build-catalog-graph from each .coily/coily.yaml; repo-digests are checked-in sibling README copies).

Container implications

Absolute host paths do not translate. mount-skills + agent-compose must run INSIDE the container against its clone paths (path-portable, just not reusable from host).
Full-tree aggregation shrinks to the substrate. Core surface survives (language/kai/coding skills live in agentic-os + agentic-os-kai, both substrate). LOST in-container: repo-<name> pointers for the ~30 non-substrate repos, and capability pulls from non-substrate repos (e.g. galaxy-gen's 2 capability skills vanish - galaxy-gen is not in the substrate set).
Fleet-management scripts are host-only. In a 9-repo container they silently produce partial results; they need an explicit control-node-only fence.

Decisions

In-container skill surface = substrate slice only, or warm more for fleet awareness + capability skills? preclone-repos.txt is the single lever.
Which scripts are host-only vs container-safe, and how is that fenced?
Reconcile the substrate list against the post-reduction kept set.

First concrete fix (in progress)

Drop coily from preclone-repos.txt + infrastructure/scripts/clone-substrate-repos.sh (coily was archived in the reduction).

The skill surface and a lot of agent context are coupled to the full host `~/projects` tree at absolute paths. ward container reproduces only a curated substrate, so this needs a deliberate design pass. Surfaced during the June 2026 reduction. ## Coupling map (cross-repo links on disk) - **Skill surface = absolute-path symlink forest.** `~/.claude/skills` + `~/.codex/skills` symlink to `/Users/kai/projects/<org>/<repo>/.agents/skills/*`. `mount-skills.sh` builds it by self-mounting agentic-os-kai skills, linking agentic-os public skills (`coding-*` language, `kai-*`, `agents-*`, `models-*`), **walking every on-disk org dir** to aggregate `repo-<name>` pointers, and pulling per-repo capability skills. - **agent-compose** composes the global CLAUDE.md from absolute-path sources (agentic-os + agentic-os-kai AGENTS.md) and embeds `/Users/kai/projects/...` markers + skill links. - **~18 fleet-management scripts** in agentic-os-kai walk all org dirs (up-to-date.py, _fleet.py, fleet-pulse.sh, build-catalog-graph.py, sweep-repo-pointer-skills.py, audit-precommit.py, sync-repo-registry.py). - **catalog system** reads across the fleet (build-catalog-graph from each `.coily/coily.yaml`; repo-digests are checked-in sibling README copies). ## Container implications - **Absolute host paths do not translate.** mount-skills + agent-compose must run INSIDE the container against its clone paths (path-portable, just not reusable from host). - **Full-tree aggregation shrinks to the substrate.** Core surface survives (language/kai/coding skills live in agentic-os + agentic-os-kai, both substrate). LOST in-container: `repo-<name>` pointers for the ~30 non-substrate repos, and capability pulls from non-substrate repos (e.g. galaxy-gen's 2 capability skills vanish - galaxy-gen is not in the substrate set). - **Fleet-management scripts are host-only.** In a 9-repo container they silently produce partial results; they need an explicit control-node-only fence. ## Decisions 1. In-container skill surface = substrate slice only, or warm more for fleet awareness + capability skills? `preclone-repos.txt` is the single lever. 2. Which scripts are host-only vs container-safe, and how is that fenced? 3. Reconcile the substrate list against the post-reduction kept set. ## First concrete fix (in progress) Drop `coily` from `preclone-repos.txt` + `infrastructure/scripts/clone-substrate-repos.sh` (coily was archived in the reduction).

coilysiren referenced this issue from a commit

2026-06-17 19:55:57 +00:00

chore(container): drop archived coily from substrate preclone list

coilysiren referenced this issue from a commit

2026-06-17 19:56:22 +00:00

chore(substrate): drop archived coily from clone-substrate-repos list

coilysiren added the

P3

consult

labels

2026-06-18 06:18:42 +00:00

coilyco-ops added

P2

and removed

P3

labels

2026-06-24 04:11:52 +00:00

coilyco-ops commented

2026-06-24 17:26:11 +00:00

Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

P2 - Reconstruct the cross-repo skill surface inside the container + fence host-only scripts, big design pass.
consult - Deep coupling map needing a deliberate human design pass.

**Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P2** - Reconstruct the cross-repo skill surface inside the container + fence host-only scripts, big design pass. - **consult** - Deep coupling map needing a deliberate human design pass.

coilyco-ops commented

2026-06-24 17:28:27 +00:00

Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

P2 - Reconstruct the cross-repo skill surface inside the container + fence host-only scripts, big design pass.
consult - Deep coupling map needing a deliberate human design pass.

**Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P2** - Reconstruct the cross-repo skill surface inside the container + fence host-only scripts, big design pass. - **consult** - Deep coupling map needing a deliberate human design pass.

coilysiren added

P3

and removed

P2

labels

2026-07-01 04:29:58 +00:00

coilyco-ops added

headless

and removed

consult

labels

2026-07-02 00:18:45 +00:00

coilyco-ops commented

2026-07-02 00:20:46 +00:00

Member

Flipped headless with a design-first gate: agent proposes the substrate-vs-full-tree design in a doc PR (coupling map is already in the body), then implements; Kai reviews direction at PR. Recorded by Claude Code (Fable) during the 2026-07-01 ward launch triage session with Kai.

coilyco-ops commented

2026-07-07 06:17:39 +00:00

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-114 on host KAI-DESKTOP-TOWER is carrying this issue (reserved 2026-07-07T06:17:33Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#114 · branch issue-114 · driver claude · workflow direct-main
Run: engineer-claude-ward-114 · ward v0.419.0 · dispatched 2026-07-07T06:17:33Z
Comment thread: 3 included in the pre-flight read, 0 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-06-24T17:26:11Z), @coilyco-ops (2026-06-24T17:28:27Z), @coilyco-ops (2026-07-02T00:20:46Z)

Issue body as seeded:

The skill surface and a lot of agent context are coupled to the full host `~/projects` tree at absolute paths. ward container reproduces only a curated substrate, so this needs a deliberate design pass. Surfaced during the June 2026 reduction.

## Coupling map (cross-repo links on disk)
- **Skill surface = absolute-path symlink forest.** `~/.claude/skills` + `~/.codex/skills` symlink to `/Users/kai/projects/<org>/<repo>/.agents/skills/*`. `mount-skills.sh` builds it by self-mounting agentic-os-kai skills, linking agentic-os public skills (`coding-*` language, `kai-*`, `agents-*`, `models-*`), **walking every on-disk org dir** to aggregate `repo-<name>` pointers, and pulling per-repo capability skills.
- **agent-compose** composes the global CLAUDE.md from absolute-path sources (agentic-os + agentic-os-kai AGENTS.md) and embeds `/Users/kai/projects/...` markers + skill links.
- **~18 fleet-management scripts** in agentic-os-kai walk all org dirs (up-to-date.py, _fleet.py, fleet-pulse.sh, build-catalog-graph.py, sweep-repo-pointer-skills.py, audit-precommit.py, sync-repo-registry.py).
- **catalog system** reads across the fleet (build-catalog-graph from each `.coily/coily.yaml`; repo-digests are checked-in sibling README copies).

## Container implications
- **Absolute host paths do not translate.** mount-skills + agent-compose must run INSIDE the container against its clone paths (path-portable, just not reusable from host).
- **Full-tree aggregation shrinks to the substrate.** Core surface survives (language/kai/coding skills live in agentic-os + agentic-os-kai, both substrate). LOST in-container: `repo-<name>` pointers for the ~30 non-substrate repos, and capability pulls from non-substrate repos (e.g. galaxy-gen's 2 capability skills vanish - galaxy-gen is not in the substrate set).
- **Fleet-management scripts are host-only.** In a 9-repo container they silently produce partial results; they need an explicit control-node-only fence.

## Decisions
1. In-container

… (truncated to 2000 chars; full body is on this issue)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.419.0).

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-114` on host `KAI-DESKTOP-TOWER` is carrying this issue (reserved 2026-07-07T06:17:33Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#114` · branch `issue-114` · driver `claude` · workflow `direct-main` - **Run:** `engineer-claude-ward-114` · ward `v0.419.0` · dispatched `2026-07-07T06:17:33Z` - **Comment thread:** 3 included in the pre-flight read, 0 stripped (ward's own automated comments). - included: @coilyco-ops (2026-06-24T17:26:11Z), @coilyco-ops (2026-06-24T17:28:27Z), @coilyco-ops (2026-07-02T00:20:46Z) **Issue body as seeded:** ``` The skill surface and a lot of agent context are coupled to the full host `~/projects` tree at absolute paths. ward container reproduces only a curated substrate, so this needs a deliberate design pass. Surfaced during the June 2026 reduction. ## Coupling map (cross-repo links on disk) - **Skill surface = absolute-path symlink forest.** `~/.claude/skills` + `~/.codex/skills` symlink to `/Users/kai/projects/<org>/<repo>/.agents/skills/*`. `mount-skills.sh` builds it by self-mounting agentic-os-kai skills, linking agentic-os public skills (`coding-*` language, `kai-*`, `agents-*`, `models-*`), **walking every on-disk org dir** to aggregate `repo-<name>` pointers, and pulling per-repo capability skills. - **agent-compose** composes the global CLAUDE.md from absolute-path sources (agentic-os + agentic-os-kai AGENTS.md) and embeds `/Users/kai/projects/...` markers + skill links. - **~18 fleet-management scripts** in agentic-os-kai walk all org dirs (up-to-date.py, _fleet.py, fleet-pulse.sh, build-catalog-graph.py, sweep-repo-pointer-skills.py, audit-precommit.py, sync-repo-registry.py). - **catalog system** reads across the fleet (build-catalog-graph from each `.coily/coily.yaml`; repo-digests are checked-in sibling README copies). ## Container implications - **Absolute host paths do not translate.** mount-skills + agent-compose must run INSIDE the container against its clone paths (path-portable, just not reusable from host). - **Full-tree aggregation shrinks to the substrate.** Core surface survives (language/kai/coding skills live in agentic-os + agentic-os-kai, both substrate). LOST in-container: `repo-<name>` pointers for the ~30 non-substrate repos, and capability pulls from non-substrate repos (e.g. galaxy-gen's 2 capability skills vanish - galaxy-gen is not in the substrate set). - **Fleet-management scripts are host-only.** In a 9-repo container they silently produce partial results; they need an explicit control-node-only fence. ## Decisions 1. In-container ``` … (truncated to 2000 chars; full body is on this issue) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.419.0). </details>  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-07-07 06:33:26 +00:00

feat(container): reconstruct the in-container skill surface + fence host-only fleet scripts (closes #114)

coilysiren closed this issue

2026-07-07 06:33:26 +00:00

coilysiren commented

2026-07-07 06:33:59 +00:00

Author

Owner

WARD-OUTCOME: done - landed the substrate-vs-full-tree design doc + a WARD_CONTAINER fence marker; substrate list reconciled.

This one was more design than code, which fit the design-first gate. The honest surprise was realizing the ward container never rebuilt the host skill-symlink forest in the first place - there is no mount-skills/agent-compose step in the entrypoint at all. So "reconstruct the skill surface" resolved to naming and defending what the container already does (read substrate skills as docs) rather than building something new, plus giving the host-only fleet scripts a real signal to fence on (WARD_CONTAINER=1). That kept the code change tiny and low-risk: one env key, one entrypoint fallback, one test.

What fought back was purely the 4000-char / 80-line doc caps - the design doc and container-substrate.md both sat right at the budget and I spent several rounds shaving prose to fit. Annoying but the caps are doing their job.

Confidence: high on the marker + reconciliation (tested, builds, pre-commit green, pushed clean to main). Medium on the design direction - the actual guard clauses in the ~18 fleet scripts and any path-portable mount-skills rewrite live in agentic-os-kai and are called out as follow-ups there, so Kai should sanity-check the substrate-slice-only call before someone wires the guards. One pre-existing unrelated test failure (TestReadBootstrapEnvDefaults, CodexModel default drift) is on main independent of this work, worth its own issue.

WARD-OUTCOME: done - landed the substrate-vs-full-tree design doc + a WARD_CONTAINER fence marker; substrate list reconciled. This one was more design than code, which fit the design-first gate. The honest surprise was realizing the ward container never rebuilt the host skill-symlink forest in the first place - there is no mount-skills/agent-compose step in the entrypoint at all. So "reconstruct the skill surface" resolved to *naming and defending* what the container already does (read substrate skills as docs) rather than building something new, plus giving the host-only fleet scripts a real signal to fence on (WARD_CONTAINER=1). That kept the code change tiny and low-risk: one env key, one entrypoint fallback, one test. What fought back was purely the 4000-char / 80-line doc caps - the design doc and container-substrate.md both sat right at the budget and I spent several rounds shaving prose to fit. Annoying but the caps are doing their job. Confidence: high on the marker + reconciliation (tested, builds, pre-commit green, pushed clean to main). Medium on the design *direction* - the actual guard clauses in the ~18 fleet scripts and any path-portable mount-skills rewrite live in agentic-os-kai and are called out as follow-ups there, so Kai should sanity-check the substrate-slice-only call before someone wires the guards. One pre-existing unrelated test failure (TestReadBootstrapEnvDefaults, CodexModel default drift) is on main independent of this work, worth its own issue.

Rows
Columns

ward container: reconstruct the cross-repo skill surface + fence host-only scripts (substrate-vs-full-tree coupling) #114

Coupling map (cross-repo links on disk)

Container implications

Decisions

First concrete fix (in progress)