Delete Ward’s obsolete Tailnet transport stack

coilyco-ops commented

2026-07-22 05:29:38 +00:00

Member

Problem

Ward’s public Tailnet launch flags are already gone, but the repository still carries an inactive transport stack for a standing Tailscale SOCKS proxy. That dead stack spans launch plans, topology defaults, preflight, warnings, a hidden TCP forwarder, bootstrap environment, Compose rendering, documentation, tests, and skills.

Ward’s core need is to launch governed agent containers without knowing how the deployment reaches private services. Deployment-owned Agent Proxy and AOS standalone connectivity own that transport.

Contract

Delete the TSSidecar and HostNet plan fields and all code that derives, normalizes, renders, logs, preflights, or warns about them.
Delete Tailnet Docker-network creation and inspection, standing-proxy detection, proxy hostname and port resolution, tower hostname and port resolution, and the related topology defaults.
Delete the hidden ward container forward command and its SOCKS5 implementation.
Delete WARD_TS_*, WARD_TAILNET_*, and WARD_TOWER_* environment contracts and bootstrap fields.
Delete sidecar and host-network docs and tests. Remove Tailnet and SOCKS guidance from remaining errors, comments, Ward skills, and generated expectations.
Keep DispatchBrokerNetwork. It is an active broker-minted Compose network used for authenticated sibling communication.
Keep typed ConfigEnv model and endpoint inputs, including WARD_OLLAMA_URL. Deployment configuration points that endpoint at Agent Proxy.
Add no public arbitrary network or environment passthrough, host-network flag, proxy abstraction, compatibility alias, or replacement transport.
A default run uses ordinary isolated Docker networking. A brokered peer joins only its explicit broker network.
Do not update docs/FEATURES.md; Tailnet is not in the shipped inventory.

Acceptance

Active Ward source, config, help, tests, docs, and skills contain no Tailscale, tailnet, SOCKS, ts-sidecar, WARD_TS_*, WARD_TAILNET_*, or WARD_TOWER_* behavior.
Active plans contain neither TSSidecar nor HostNet.
DispatchBrokerNetwork and its broker-network behavior remain covered and functional.
Typed model and endpoint configuration, including Agent Proxy endpoints, remains covered and functional.
Default and brokered container planning tests pass without a proxy, external network, or reachability target.
Full Ward validation passes.

Execution boundary

Repository-only removal. Do not inspect or mutate live proxy, Docker networks, Tailscale state, or infrastructure.

Cross-repo follow-up

AOS owns its standalone connectivity path independently. Remove the stale Ward-consumer description from the AOS Tailscale skill in the linked follow-up issue.

## Problem Ward’s public Tailnet launch flags are already gone, but the repository still carries an inactive transport stack for a standing Tailscale SOCKS proxy. That dead stack spans launch plans, topology defaults, preflight, warnings, a hidden TCP forwarder, bootstrap environment, Compose rendering, documentation, tests, and skills. Ward’s core need is to launch governed agent containers without knowing how the deployment reaches private services. Deployment-owned Agent Proxy and AOS standalone connectivity own that transport. ## Contract * Delete the `TSSidecar` and `HostNet` plan fields and all code that derives, normalizes, renders, logs, preflights, or warns about them. * Delete Tailnet Docker-network creation and inspection, standing-proxy detection, proxy hostname and port resolution, tower hostname and port resolution, and the related topology defaults. * Delete the hidden `ward container forward` command and its SOCKS5 implementation. * Delete `WARD_TS_*`, `WARD_TAILNET_*`, and `WARD_TOWER_*` environment contracts and bootstrap fields. * Delete sidecar and host-network docs and tests. Remove Tailnet and SOCKS guidance from remaining errors, comments, Ward skills, and generated expectations. * Keep `DispatchBrokerNetwork`. It is an active broker-minted Compose network used for authenticated sibling communication. * Keep typed `ConfigEnv` model and endpoint inputs, including `WARD_OLLAMA_URL`. Deployment configuration points that endpoint at Agent Proxy. * Add no public arbitrary network or environment passthrough, host-network flag, proxy abstraction, compatibility alias, or replacement transport. * A default run uses ordinary isolated Docker networking. A brokered peer joins only its explicit broker network. * Do not update `docs/FEATURES.md`; Tailnet is not in the shipped inventory. ## Acceptance * Active Ward source, config, help, tests, docs, and skills contain no Tailscale, tailnet, SOCKS, `ts-sidecar`, `WARD_TS_*`, `WARD_TAILNET_*`, or `WARD_TOWER_*` behavior. * Active plans contain neither `TSSidecar` nor `HostNet`. * `DispatchBrokerNetwork` and its broker-network behavior remain covered and functional. * Typed model and endpoint configuration, including Agent Proxy endpoints, remains covered and functional. * Default and brokered container planning tests pass without a proxy, external network, or reachability target. * Full Ward validation passes. ## Execution boundary Repository-only removal. Do not inspect or mutate live proxy, Docker networks, Tailscale state, or infrastructure. ## Cross-repo follow-up AOS owns its standalone connectivity path independently. Remove the stale Ward-consumer description from the AOS Tailscale skill in the linked follow-up issue.

coilyco-ops referenced this issue

2026-07-22 08:41:47 +00:00

Audit and remove remaining baked coilyco fleet configuration from ward #1498

coilyco-ops referenced this issue

2026-07-23 06:51:41 +00:00

Fix the director SOCKS proxy hostname and Docker alias contract #1529

coilyco-ops commented

2026-07-23 06:56:07 +00:00

Author

Member

Kai clarified the ownership boundary after the mis-scoped #1529 dispatch: Ward must remove knowledge of the SOCKS/Tailnet proxy entirely and leave the configuration to AOS. Live evidence: a director joined Docker network ward-tailnet with WARD_TS_SOCKS5 naming tailscale-proxy, while the standing mac-proxy container exposed only mac-proxy and tailscale aliases, producing Could not resolve host: tailscale-proxy. This is evidence of why the contract cannot remain split across Ward defaults and AOS topology. Acceptance refinement: remove WARD_TS_SOCKS5, SOCKS hostname and port defaults, proxy alias selection, sidecar-specific flags, proxy-container lifecycle, Tailnet network names, reachability preflight, warnings, help, docs, and tests from Ward. Ward may retain only provider-neutral container/network/environment inputs with no SOCKS semantics. AOS must own and test the full proxy configuration, including the canonical hostname exported to agents and the Docker alias assigned to the standing proxy, while preserving the userspace no-TUN/no-NET_ADMIN model. Do not add Kubernetes behavior or credentials. The #1529 engineer was stopped and #1529 was closed as superseded.

Kai clarified the ownership boundary after the mis-scoped #1529 dispatch: Ward must remove knowledge of the SOCKS/Tailnet proxy entirely and leave the configuration to AOS. Live evidence: a director joined Docker network ward-tailnet with WARD_TS_SOCKS5 naming tailscale-proxy, while the standing mac-proxy container exposed only mac-proxy and tailscale aliases, producing `Could not resolve host: tailscale-proxy`. This is evidence of why the contract cannot remain split across Ward defaults and AOS topology. Acceptance refinement: remove WARD_TS_SOCKS5, SOCKS hostname and port defaults, proxy alias selection, sidecar-specific flags, proxy-container lifecycle, Tailnet network names, reachability preflight, warnings, help, docs, and tests from Ward. Ward may retain only provider-neutral container/network/environment inputs with no SOCKS semantics. AOS must own and test the full proxy configuration, including the canonical hostname exported to agents and the Docker alias assigned to the standing proxy, while preserving the userspace no-TUN/no-NET_ADMIN model. Do not add Kubernetes behavior or credentials. The #1529 engineer was stopped and #1529 was closed as superseded.

coilyco-ops commented

2026-07-23 06:56:40 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-ward-1495 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-23T06:56:39Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#1495 · branch issue-1495 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-ward-1495 · ward v0.793.0 · dispatched 2026-07-23T06:56:28Z
Reservation: held
Comment thread: 1 included in the pre-flight read, 0 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-07-23T06:56:07Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.793.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-ward-1495` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-23T06:56:39Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#1495` · branch `issue-1495` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-ward-1495` · ward `v0.793.0` · dispatched `2026-07-23T06:56:28Z` - **Reservation:** held - **Comment thread:** 1 included in the pre-flight read, 0 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-23T06:56:07Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.793.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from coilyco-flight-deck/agentic-os

2026-07-23 11:45:15 +00:00

Compose infrastructure-owned private-network access into AOS agent surfaces #642

coilyco-ops added the

labels

2026-07-29 03:47:16 +00:00

coilyco-ops added

and removed

labels

2026-07-29 06:27:14 +00:00

coilyco-ops referenced this issue

2026-07-31 07:25:05 +00:00

Collapse the documentation tree into durable product contracts #1624

coilyco-ops referenced this issue

2026-07-31 08:14:34 +00:00

warded advisor dispatch 125s on host docker run (research mode) while engineer runs succeed same session #577

coilyco-ops added

and removed

labels

2026-07-31 08:29:32 +00:00

coilyco-ops referenced this issue

2026-07-31 09:25:31 +00:00

code-fleet-watch: policy findings #1616

coilyco-ops referenced this issue

2026-08-05 09:39:08 +00:00

Collapse the documentation tree into durable product contracts #1624

coilyco-ops referenced this issue

2026-08-05 09:48:55 +00:00

code-fleet-watch: policy findings #1616

coilyco-ops changed title from ~~Remove all Tailscale awareness from ward~~ to Delete Ward’s obsolete Tailnet transport stack

2026-08-05 18:32:55 +00:00

coilyco-ops added

and removed

labels

2026-08-05 18:32:57 +00:00

coilyco-ops referenced this issue from coilyco-flight-deck/agentic-os

2026-08-05 18:32:59 +00:00

Remove the retired Ward sidecar consumer from the Tailscale skill #901

coilyco-ops commented

2026-08-05 18:33:22 +00:00

Author

Member

Design settled on 2026-08-05. Hard-delete the inactive Tailnet, SOCKS, and host-network stack. Preserve only the active broker-minted network and typed endpoint configuration. AOS standalone connectivity is already independent. Its stale Ward-consumer skill text is tracked at coilyco-flight-deck/agentic-os#901.

coilyco-ops referenced this issue from a commit

2026-08-06 00:44:57 +00:00

refactor: remove the Tailnet transport stack

coilyco-ops closed this issue

2026-08-06 00:44:57 +00:00

coilyco-ops commented

2026-08-06 00:45:04 +00:00

Author

Member

Landed on canonical main in 0f2a6635.

Deleted the inactive sidecar, host-network, proxy preflight, network provisioning, topology-default, bootstrap-environment, and hidden TCP forwarder stack.
Deleted the dedicated implementation tests and documentation, and removed remaining product, error, skill, and fixture vocabulary.
Preserved ordinary isolated container networking, the explicit broker-minted sibling network, ConfigEnv, and WARD_OLLAMA_URL endpoint configuration.
The strict transport and topology residue search is empty.
Passed command tests, full repository tests, doctor, formatting, build, lint, vet, and the complete pre-commit suite.

Landed on canonical `main` in `0f2a6635`. * Deleted the inactive sidecar, host-network, proxy preflight, network provisioning, topology-default, bootstrap-environment, and hidden TCP forwarder stack. * Deleted the dedicated implementation tests and documentation, and removed remaining product, error, skill, and fixture vocabulary. * Preserved ordinary isolated container networking, the explicit broker-minted sibling network, `ConfigEnv`, and `WARD_OLLAMA_URL` endpoint configuration. * The strict transport and topology residue search is empty. * Passed command tests, full repository tests, doctor, formatting, build, lint, vet, and the complete pre-commit suite.

Rows
Columns

Delete Ward’s obsolete Tailnet transport stack #1495

Problem

Contract

Acceptance

Execution boundary

Cross-repo follow-up