coilyco-flight-deck/ward

Fork 0

Allowlist non-secret launch env and derive git identity from host config #1296

New issue

Closed

opened 2026-07-15 00:53:25 +00:00 by coilyco-ops · 5 comments

coilyco-ops commented

2026-07-15 00:53:25 +00:00

Member

Problem\n\nWard's default-deny container env boundary is doing the right thing for secrets, but it is too blunt for known non-secret launch context. The recent attribution regression showed the failure mode: when a typed value is not propagated, ward can silently fall back to baked placeholder defaults such as example-bot.\n\n## Desired behavior\n\nKeep raw host env default-denied, but auto-populate safe, typed launch env.\n\n## Proposed scope\n\n* Auto-pass a small allowlist of known non-secret env vars, for example terminal and locale context such as TERM, COLORTERM, LANG, LC_, TZ, NO_COLOR, CLICOLOR, and CLICOLOR_FORCE.\n Auto-populate ward-owned WARD_* values resolved by ward itself from config, flags, or operator-local config.\n* Do not blindly pass host-sourced WARD_* values. Token-like names and broker credentials still need explicit deny or allowlist handling.\n* Resolve git author identity for normal users from git config before falling back to baked defaults. Suggested precedence:\n 1. explicit WARD_GIT_NAME and WARD_GIT_EMAIL\n 2. selected fleet attribution, when non-placeholder\n 3. repo-local git config --get user.name and user.email\n 4. global git config --global --get user.name and user.email\n 5. warn or fail loud if only baked placeholder identity remains\n* For Kai's coilyco bundle, selected fleet attribution should still win and keep coilyco-ops as the container identity.\n\n## Out of scope\n\nSigning keys and commit signing should be punted. Do not copy commit.gpgsign, user.signingkey, gpg.*, SSH agent sockets, GPG agent sockets, or signing material as part of this issue.\n\n## Notes\n\nThe intent is typed propagation plus explainability, not opening the whole shell env to containers. A later env explain surface would make the passed, redacted, and dropped categories auditable.

## Problem\n\nWard's default-deny container env boundary is doing the right thing for secrets, but it is too blunt for known non-secret launch context. The recent attribution regression showed the failure mode: when a typed value is not propagated, ward can silently fall back to baked placeholder defaults such as example-bot.\n\n## Desired behavior\n\nKeep raw host env default-denied, but auto-populate safe, typed launch env.\n\n## Proposed scope\n\n* Auto-pass a small allowlist of known non-secret env vars, for example terminal and locale context such as TERM, COLORTERM, LANG, LC_*, TZ, NO_COLOR, CLICOLOR, and CLICOLOR_FORCE.\n* Auto-populate ward-owned WARD_* values resolved by ward itself from config, flags, or operator-local config.\n* Do not blindly pass host-sourced WARD_* values. Token-like names and broker credentials still need explicit deny or allowlist handling.\n* Resolve git author identity for normal users from git config before falling back to baked defaults. Suggested precedence:\n 1. explicit WARD_GIT_NAME and WARD_GIT_EMAIL\n 2. selected fleet attribution, when non-placeholder\n 3. repo-local git config --get user.name and user.email\n 4. global git config --global --get user.name and user.email\n 5. warn or fail loud if only baked placeholder identity remains\n* For Kai's coilyco bundle, selected fleet attribution should still win and keep coilyco-ops as the container identity.\n\n## Out of scope\n\nSigning keys and commit signing should be punted. Do not copy commit.gpgsign, user.signingkey, gpg.*, SSH agent sockets, GPG agent sockets, or signing material as part of this issue.\n\n## Notes\n\nThe intent is typed propagation plus explainability, not opening the whole shell env to containers. A later env explain surface would make the passed, redacted, and dropped categories auditable.

coilyco-ops added the

headless

labels

2026-07-15 04:51:14 +00:00

coilyco-ops added this to the warded control plane coherence milestone

2026-07-15 05:14:49 +00:00

coilyco-ops commented

2026-07-15 05:19:30 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-ward-1296 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-15T05:19:29Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#1296 · branch issue-1296 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-ward-1296 · ward v0.697.0 · dispatched 2026-07-15T05:19:07Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-ward-1296` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-15T05:19:29Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#1296` · branch `issue-1296` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-ward-1296` · ward `v0.697.0` · dispatched `2026-07-15T05:19:07Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-15 05:33:55 +00:00

Allowlist non-secret launch env and derive git identity from host config #1324

coilyco-ops commented

2026-07-15 05:38:19 +00:00

Author

Member

WARDED_WORKFLOW: failed ❌

details

workflow: pull-request-and-merge; review summary: review gate intentionally skipped because temporary ward default pending brokered QA.

The branch reached PR #1324, but test / test (pull_request) failed in go test before lint. Local focused tests for the changed env and git-identity paths passed; the repo-wide go test ./cmd/ward still shows pre-existing defaults asset drift failures unrelated to this patch.

Retrospective: the env allowlist was direct; the only wrinkle was keeping the placeholder fallback warning loud without spamming every test run. Confidence is moderate. Follow-up is to resolve the repo's asset-drift baseline or narrow the workflow if that failure is expected.

WARDED_WORKFLOW: failed ❌ <details><summary>details</summary> workflow: pull-request-and-merge; review summary: review gate intentionally skipped because temporary ward default pending brokered QA. The branch reached PR #1324, but `test / test (pull_request)` failed in `go test` before lint. Local focused tests for the changed env and git-identity paths passed; the repo-wide `go test ./cmd/ward` still shows pre-existing defaults asset drift failures unrelated to this patch. Retrospective: the env allowlist was direct; the only wrinkle was keeping the placeholder fallback warning loud without spamming every test run. Confidence is moderate. Follow-up is to resolve the repo's asset-drift baseline or narrow the workflow if that failure is expected.  </details>

coilyco-ops commented

2026-07-15 06:25:30 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-ward-1296 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-15T06:25:30Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#1296 · branch issue-1296 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-ward-1296 · ward v0.697.0 · dispatched 2026-07-15T06:25:15Z
Comment thread: 1 included in the pre-flight read, 1 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-07-15T05:38:19Z)
- stripped: @coilyco-ops (2026-07-15T05:19:30Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-ward-1296` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-15T06:25:30Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#1296` · branch `issue-1296` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-ward-1296` · ward `v0.697.0` · dispatched `2026-07-15T06:25:15Z` - **Comment thread:** 1 included in the pre-flight read, 1 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-15T05:38:19Z) - stripped: @coilyco-ops (2026-07-15T05:19:30Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-15 06:29:35 +00:00

Author

Member

WARDED_WORKFLOW: #1324

details

workflow: pull-request-and-merge; review summary: skipped: the in-container review gate was intentionally skipped because the temporary ward default pending brokered QA.

changed: allowed safe launch env (TERM/COLORTERM, LANG, LC_, TZ, NO_COLOR, CLICOLOR, CLICOLOR_FORCE), kept host WARD_ default-denied, and resolved git identity from fleet attribution with repo-local/global git config fallback before the placeholder.

tests: go test ./cmd/ward and go test ./... passed; PR #1324 is green.

felt: straightforward after the main merge. confidence: high. surprise: none beyond the baseline moving under the branch.

follow-up: director merge the ready PR when you take the landing step.

WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/pulls/1324 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped: the in-container review gate was intentionally skipped because the temporary ward default pending brokered QA. changed: allowed safe launch env (TERM/COLORTERM, LANG, LC_*, TZ, NO_COLOR, CLICOLOR, CLICOLOR_FORCE), kept host WARD_* default-denied, and resolved git identity from fleet attribution with repo-local/global git config fallback before the placeholder. tests: `go test ./cmd/ward` and `go test ./...` passed; PR #1324 is green. felt: straightforward after the `main` merge. confidence: high. surprise: none beyond the baseline moving under the branch. follow-up: director merge the ready PR when you take the landing step.  </details>

coilysiren closed this issue

2026-07-15 06:29:40 +00:00

coilysiren referenced this issue from a commit

2026-07-15 06:29:40 +00:00

Allowlist non-secret launch env and derive git identity from host config (#1324)

coilyco-ops commented

2026-07-15 07:16:38 +00:00

Author

Member

WARD-TRIAGE: warded control plane coherence milestone

This issue is part of the warded control plane coherence sprint. The release thesis is to make warded feel like one dependable control plane for agent work: higher safe parallelism, coherent config defaults, reliable broker/container behavior, human-feedback gates, and enough structured evidence for the next actor after a paused or failed run.

For this sprint, headless means an engineer should be able to carry the issue from current issue context to a merged change without new human decisions. If the issue discovers a missing decision, split or demote the unclear part instead of guessing.

WARD-TRIAGE: warded control plane coherence milestone This issue is part of the `warded control plane coherence` sprint. The release thesis is to make `warded` feel like one dependable control plane for agent work: higher safe parallelism, coherent config defaults, reliable broker/container behavior, human-feedback gates, and enough structured evidence for the next actor after a paused or failed run. For this sprint, `headless` means an engineer should be able to carry the issue from current issue context to a merged change without new human decisions. If the issue discovers a missing decision, split or demote the unclear part instead of guessing.