coilyco-flight-deck/ward

Watch

Make split-stack engineer dispatch preserve tracker authority and verify git-host drift #1519

New issue

Closed

opened 2026-07-23 04:53:12 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-07-23 04:53:12 +00:00

Member

Incident

A read-only director surfaced in coilysiren/coilysiren, a deliberately inverted repository:

GitHub is canonical for git and renders the profile README.
Forgejo is the mirror and the only enabled issue tracker. GitHub Issues returns HTTP 410 because issues are disabled.
The director clone fetches from Forgejo and has a read-only push URL.
At incident time, GitHub main and Forgejo main were equal at 49d949432084749df060e13e529f60aaedb8fffc.

The director captured the work on Forgejo as coilysiren/coilysiren#18, then hit every side of the current authority ambiguity:

warded engineer coilysiren/coilysiren#18 selected GitHub from repository policy and failed with github: get issue coilysiren/coilysiren#18, even though the issue exists on Forgejo.
Passing the full Forgejo URL produced the same failure. Ward normalized the URL to coilysiren/coilysiren#18, discarded its host authority, then re-resolved it as GitHub.
warded engineer coilysiren/coilysiren --instructions-file ... filed coilysiren/coilysiren#19 and then, in the same command, tried to read issue 19 from GitHub and failed. The create path and resolve path selected different tracker clients.
Creating a GitHub carrier issue was impossible because GitHub Issues is disabled for this repository.

No engineer launched. Issue 19 is only an accidental duplicate of issue 18.

Existing architecture and missing integration

This is a concrete regression or incomplete integration under:

#633, the split-stack git-host plus tracker epic.
#634, which split issueForge into git-host and Tracker ports and is closed as landed.

The ports may be separate internally, but dispatch still collapses a target to {owner, repo, number} too early and lets one repo-authority decision control issue lookup, clone source, and landing behavior. The broker boundary also appears to receive the lossy normalized ref instead of a host-qualified tracker ref.

Product contract

Make split-stack authority a first-class run property. A resolved engineer run must carry these independently:

Tracker authority: adapter, host/base URL, repository or project identity, item number or stable id, and canonical item URL.
Git checkout authority: the canonical source used to resolve the base branch and build the working clone.
Landing authority: the remote and branch that receive the pushed branch, PR, or direct merge.
Known mirrors: optional alternate git remotes whose branch heads can be compared for drift.

Do not use the current working clone's origin, the git-host choice, or a repo-level GitHub-native policy as an implicit substitute for tracker authority.

Resolution precedence

A full issue URL pins the tracker adapter and host. Parsing may normalize the owner, repo, and number, but must never discard or later override the URL authority.
A bare #N may infer logical repository identity from the current checkout, but resolves the tracker through explicit tracker configuration, independently of the git remote.
An ambiguous owner/repo#N uses the configured tracker authority. If the repository has more than one possible tracker and none is selected, fail with an actionable ambiguity error instead of guessing.
Freeform or --instructions-file mode creates the item on the configured tracker, then launches from the exact typed ref returned by that create call. It must not create on one tracker and re-resolve on another.
Same-host Forgejo-only and GitHub-only repositories remain zero-config and backward compatible.

Git and mirror preflight

When more than one git authority is known, show which host is canonical for checkout and landing. Fetch or query the target branch head on each known host and report equal, ahead, behind, or diverged before launch.

If no landing authority is configured and heads differ, fail closed with the observed heads and the configuration needed to choose.
If a canonical landing authority is explicitly configured, use it and surface mirror drift without silently switching hosts.
Never infer that the tracker host is also the landing host.

--print, dispatch logs, reservation comments, and the run seed should expose a compact plan such as:

issue:   forgejo  https://.../issues/18
clone:   github   coilysiren/coilysiren@main
land:    github   coilysiren/coilysiren@main
mirror:  forgejo  equal at 49d9494

Use stable, host-qualified links in durable output, consistent with #1501.

Capability behavior

A valid split-stack run must preflight the capabilities of both sides independently. In the incident fixture, Forgejo issue read/comment/close through the broker plus GitHub clone/push/PR credentials is a supported pairing. GitHub Issues being disabled must not block the run because GitHub is not the selected tracker.

Errors should name the failed role and host, for example tracker read: Forgejo ... or landing push: GitHub ..., instead of reporting a generic repo-authority resolution failure.

Acceptance tests

End-to-end broker test: Forgejo issue URL plus GitHub-canonical git repository with GitHub Issues disabled resolves, reserves, clones, and reaches engineer launch.
Full Forgejo and GitHub URLs retain their host authority through parsing, broker forwarding, reservation identity, and final comments.
Bare and owner/repo#N refs use configured tracker authority without inheriting the git host accidentally.
--instructions-file creates on the configured tracker and immediately carries the exact returned typed ref.
Tests cover equal, ahead, behind, and diverged GitHub/Forgejo main heads, including the fail-closed ambiguous case.
Same-host Forgejo-only and GitHub-only behavior remains unchanged.
No path silently retries the same issue number on another tracker after a not-found or disabled-issues response.
--print and dispatch diagnostics show tracker, checkout, landing, and mirror decisions before mutation.
Ward validation gates pass and the split-stack compatibility docs are updated.

Reproduction artifacts

Source lane: coilysiren/coilysiren#18
Accidental create-then-misresolve duplicate: coilysiren/coilysiren#19
Related split-stack epic: #633
Landed port split: #634
Host-qualified durable refs: #1501

## Incident A read-only director surfaced in `coilysiren/coilysiren`, a deliberately inverted repository: - GitHub is canonical for git and renders the profile README. - Forgejo is the mirror and the only enabled issue tracker. GitHub Issues returns HTTP 410 because issues are disabled. - The director clone fetches from Forgejo and has a read-only push URL. - At incident time, GitHub `main` and Forgejo `main` were equal at `49d949432084749df060e13e529f60aaedb8fffc`. The director captured the work on Forgejo as https://forgejo.coilysiren.me/coilysiren/coilysiren/issues/18, then hit every side of the current authority ambiguity: 1. `warded engineer coilysiren/coilysiren#18` selected GitHub from repository policy and failed with `github: get issue coilysiren/coilysiren#18`, even though the issue exists on Forgejo. 2. Passing the full Forgejo URL produced the same failure. Ward normalized the URL to `coilysiren/coilysiren#18`, discarded its host authority, then re-resolved it as GitHub. 3. `warded engineer coilysiren/coilysiren --instructions-file ...` filed https://forgejo.coilysiren.me/coilysiren/coilysiren/issues/19 and then, in the same command, tried to read issue 19 from GitHub and failed. The create path and resolve path selected different tracker clients. 4. Creating a GitHub carrier issue was impossible because GitHub Issues is disabled for this repository. No engineer launched. Issue 19 is only an accidental duplicate of issue 18. ## Existing architecture and missing integration This is a concrete regression or incomplete integration under: - https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/633, the split-stack git-host plus tracker epic. - https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/634, which split `issueForge` into git-host and Tracker ports and is closed as landed. The ports may be separate internally, but dispatch still collapses a target to `{owner, repo, number}` too early and lets one `repo-authority` decision control issue lookup, clone source, and landing behavior. The broker boundary also appears to receive the lossy normalized ref instead of a host-qualified tracker ref. ## Product contract Make split-stack authority a first-class run property. A resolved engineer run must carry these independently: - **Tracker authority:** adapter, host/base URL, repository or project identity, item number or stable id, and canonical item URL. - **Git checkout authority:** the canonical source used to resolve the base branch and build the working clone. - **Landing authority:** the remote and branch that receive the pushed branch, PR, or direct merge. - **Known mirrors:** optional alternate git remotes whose branch heads can be compared for drift. Do not use the current working clone's `origin`, the git-host choice, or a repo-level GitHub-native policy as an implicit substitute for tracker authority. ### Resolution precedence - A full issue URL pins the tracker adapter and host. Parsing may normalize the owner, repo, and number, but must never discard or later override the URL authority. - A bare `#N` may infer logical repository identity from the current checkout, but resolves the tracker through explicit tracker configuration, independently of the git remote. - An ambiguous `owner/repo#N` uses the configured tracker authority. If the repository has more than one possible tracker and none is selected, fail with an actionable ambiguity error instead of guessing. - Freeform or `--instructions-file` mode creates the item on the configured tracker, then launches from the exact typed ref returned by that create call. It must not create on one tracker and re-resolve on another. - Same-host Forgejo-only and GitHub-only repositories remain zero-config and backward compatible. ### Git and mirror preflight When more than one git authority is known, show which host is canonical for checkout and landing. Fetch or query the target branch head on each known host and report `equal`, `ahead`, `behind`, or `diverged` before launch. - If no landing authority is configured and heads differ, fail closed with the observed heads and the configuration needed to choose. - If a canonical landing authority is explicitly configured, use it and surface mirror drift without silently switching hosts. - Never infer that the tracker host is also the landing host. `--print`, dispatch logs, reservation comments, and the run seed should expose a compact plan such as: ```text issue: forgejo https://.../issues/18 clone: github coilysiren/coilysiren@main land: github coilysiren/coilysiren@main mirror: forgejo equal at 49d9494 ``` Use stable, host-qualified links in durable output, consistent with https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/1501. ## Capability behavior A valid split-stack run must preflight the capabilities of both sides independently. In the incident fixture, Forgejo issue read/comment/close through the broker plus GitHub clone/push/PR credentials is a supported pairing. GitHub Issues being disabled must not block the run because GitHub is not the selected tracker. Errors should name the failed role and host, for example `tracker read: Forgejo ...` or `landing push: GitHub ...`, instead of reporting a generic repo-authority resolution failure. ## Acceptance tests - End-to-end broker test: Forgejo issue URL plus GitHub-canonical git repository with GitHub Issues disabled resolves, reserves, clones, and reaches engineer launch. - Full Forgejo and GitHub URLs retain their host authority through parsing, broker forwarding, reservation identity, and final comments. - Bare and `owner/repo#N` refs use configured tracker authority without inheriting the git host accidentally. - `--instructions-file` creates on the configured tracker and immediately carries the exact returned typed ref. - Tests cover equal, ahead, behind, and diverged GitHub/Forgejo `main` heads, including the fail-closed ambiguous case. - Same-host Forgejo-only and GitHub-only behavior remains unchanged. - No path silently retries the same issue number on another tracker after a not-found or disabled-issues response. - `--print` and dispatch diagnostics show tracker, checkout, landing, and mirror decisions before mutation. - Ward validation gates pass and the split-stack compatibility docs are updated. ## Reproduction artifacts - Source lane: https://forgejo.coilysiren.me/coilysiren/coilysiren/issues/18 - Accidental create-then-misresolve duplicate: https://forgejo.coilysiren.me/coilysiren/coilysiren/issues/19 - Related split-stack epic: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/633 - Landed port split: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/634 - Host-qualified durable refs: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/1501

coilyco-ops added the

autonomy

headless

priority

labels

2026-07-23 04:53:12 +00:00

coilyco-ops referenced this issue from coilysiren/coilysiren

2026-07-23 04:53:24 +00:00

Correct the production floor bay count in the coilysiren profile README. #19

coilyco-ops commented

2026-07-23 04:53:44 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-ward-1519 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-23T04:53:43Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#1519 · branch issue-1519 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-ward-1519 · ward v0.789.0 · dispatched 2026-07-23T04:53:39Z
Reservation: held
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.789.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-ward-1519` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-23T04:53:43Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#1519` · branch `issue-1519` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-ward-1519` · ward `v0.789.0` · dispatched `2026-07-23T04:53:39Z` - **Reservation:** held - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.789.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue

2026-07-23 05:00:17 +00:00

Scope the GitHub authority exception to coilysiren/coilysiren, not coilysiren/* #1520

coilyco-ops commented

2026-07-23 06:17:00 +00:00

Author

Member

Fresh reproduction on 2026-07-23: warded engineer coilysiren/inbox#247 --repo coilyco-flight-deck/.github resolved the logical ref, then the host broker tried github: get issue coilysiren/inbox#247 three times. coilysiren/inbox is private and Forgejo-only, so this is the same authority collapse without even a split git host. The CODEOWNERS rollout had to move the carrier to coilyco-flight-deck/.github so it could dispatch.

Fresh reproduction on 2026-07-23: `warded engineer coilysiren/inbox#247 --repo coilyco-flight-deck/.github` resolved the logical ref, then the host broker tried `github: get issue coilysiren/inbox#247` three times. `coilysiren/inbox` is private and Forgejo-only, so this is the same authority collapse without even a split git host. The CODEOWNERS rollout had to move the carrier to coilyco-flight-deck/.github so it could dispatch.

coilyco-ops commented

2026-07-23 08:19:24 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-ward-1519 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-23T08:19:23Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#1519 · branch issue-1519 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-ward-1519 · ward v0.793.0 · dispatched 2026-07-23T08:19:20Z
Reservation: held
Comment thread: 1 included in the pre-flight read, 1 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-07-23T06:17:00Z)
- stripped: @coilyco-ops (2026-07-23T04:53:44Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.793.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-ward-1519` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-23T08:19:23Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#1519` · branch `issue-1519` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-ward-1519` · ward `v0.793.0` · dispatched `2026-07-23T08:19:20Z` - **Reservation:** held - **Comment thread:** 1 included in the pre-flight read, 1 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-23T06:17:00Z) - stripped: @coilyco-ops (2026-07-23T04:53:44Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.793.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-23 08:33:10 +00:00

Preserve split-stack tracker authority in dispatch #1532