Director surface misses aos role-tier capabilities #1141

New issue

Closed

opened 2026-07-13 03:02:38 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-07-13 03:02:38 +00:00

Member

A read-only director surface for coilyco-flight-deck/agentic-os is below the tier documented in aos docs/role-surface-tiers.md.

Observed in director-codex-tt45, ward v0.633.0, aos commit 0354ab3ca93ed565619d91719d534df77ebb633c:

bash .ward/surface-check.sh director reports three missing capabilities:
- tailscale status fails because local tailscaled is not running or not connected.
- KUBECONFIG is absent and ~/.kube/config is absent.
- ward ops forgejo actions generate-runner-token is not mounted.
ward exec surface-check does not reach the script. It refuses because its audit preflight runs git fetch origin, and the read-only surface cannot write .git/FETCH_HEAD.
The image binary layer is present: aws, kubectl, tailscale, ward, and git are on PATH.
FORGEJO_TOKEN and AWS env credentials are present. KUBECONFIG is absent.
WARD_CONFIG_REF matches the checkout commit, and aos .ward/roles.kdl binds guardfile.forgejo.runnertoken.kdl for the director role. The live ward ops forgejo actions --help surface only lists logs.

Expected:

A director surface satisfies the aos director tier: Forgejo read/write, Actions read, AWS/SSM, kubectl, runner-token minting, and tailnet live observation.
ward exec surface-check can run as the intended bring-up self-check on a read-only director surface, or ward has a read-only-compatible audit path for this probe.
ward ops forgejo actions --help includes generate-runner-token for director and ops roles.

This looks ward-side rather than aos-side: the aos contract and guardfile binding are present at the pinned commit, while the live surface is missing container bring-up state and one mounted role verb.

A read-only director surface for `coilyco-flight-deck/agentic-os` is below the tier documented in aos `docs/role-surface-tiers.md`. Observed in `director-codex-tt45`, ward `v0.633.0`, aos commit `0354ab3ca93ed565619d91719d534df77ebb633c`: * `bash .ward/surface-check.sh director` reports three missing capabilities: * `tailscale status` fails because local `tailscaled` is not running or not connected. * `KUBECONFIG` is absent and `~/.kube/config` is absent. * `ward ops forgejo actions generate-runner-token` is not mounted. * `ward exec surface-check` does not reach the script. It refuses because its audit preflight runs `git fetch origin`, and the read-only surface cannot write `.git/FETCH_HEAD`. * The image binary layer is present: `aws`, `kubectl`, `tailscale`, `ward`, and `git` are on `PATH`. * `FORGEJO_TOKEN` and AWS env credentials are present. `KUBECONFIG` is absent. * `WARD_CONFIG_REF` matches the checkout commit, and aos `.ward/roles.kdl` binds `guardfile.forgejo.runnertoken.kdl` for the `director` role. The live `ward ops forgejo actions --help` surface only lists `logs`. Expected: * A director surface satisfies the aos director tier: Forgejo read/write, Actions read, AWS/SSM, kubectl, runner-token minting, and tailnet live observation. * `ward exec surface-check` can run as the intended bring-up self-check on a read-only director surface, or ward has a read-only-compatible audit path for this probe. * `ward ops forgejo actions --help` includes `generate-runner-token` for director and ops roles. This looks ward-side rather than aos-side: the aos contract and guardfile binding are present at the pinned commit, while the live surface is missing container bring-up state and one mounted role verb.

coilyco-ops commented

2026-07-13 03:02:56 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-ward-1141 on host KAI-DESKTOP-TOWER.

Reserved by ward agent --harness codex (reserved 2026-07-13T03:02:54Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#1141 · branch issue-1141 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-ward-1141 · ward v0.633.0 · dispatched 2026-07-13T03:02:54Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.633.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-ward-1141` on host `KAI-DESKTOP-TOWER`. Reserved by `ward agent --harness codex` (reserved 2026-07-13T03:02:54Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#1141` · branch `issue-1141` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-ward-1141` · ward `v0.633.0` · dispatched `2026-07-13T03:02:54Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.633.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from coilyco-flight-deck/agentic-os

2026-07-13 03:12:39 +00:00

Ship tailscaled in the dev-base ops tier #486

coilyco-ops commented

2026-07-13 03:12:39 +00:00

Author

Member

Additional expectation from Kai: this surface should be able to run git fetch and git pull, not only read static checkout state. The observed git fetch origin failure is therefore not just a surface-check nuisance. It is part of the missing director capability and should be fixed as a normal git operation path for read-only director clones.

Additional expectation from Kai: this surface should be able to run `git fetch` and `git pull`, not only read static checkout state. The observed `git fetch origin` failure is therefore not just a surface-check nuisance. It is part of the missing director capability and should be fixed as a normal git operation path for read-only director clones.

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-13 03:25:42 +00:00

Fix director surface missing aos role-tier capabilities #1148

coilyco-ops commented

2026-07-13 03:26:44 +00:00

Author

Member

WARD-OUTCOME: submitted

details

workflow: pull-request-and-merge; review summary: skipped: review gate intentionally skipped because of the temporary ward default pending brokered QA
felt: straightforward
confidence: high
surprises: none
follow-ups: director merge sweep can land this once it is picked up

WARD-OUTCOME: submitted <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped: review gate intentionally skipped because of the temporary ward default pending brokered QA felt: straightforward confidence: high surprises: none follow-ups: director merge sweep can land this once it is picked up </details>