Authenticate Forgejo Git LFS during private-repo engineer preclone

coilyco-ops commented

2026-07-23 05:57:20 +00:00

Member

Dispatching private Forgejo repositories with Git LFS can die before the agent starts because the normal Git clone credential does not authenticate the LFS batch request.

Reproduction from the 2026-07-23 Eco wave:

An authenticated shallow clone of coilyco-gaming/eco-ops reaches checkout.
Git LFS tries to smudge mods/Mods/MightyMoose/Dependencies/Nito.AsyncEx.Coordination.dll.
The Forgejo LFS batch endpoint responds Authentication required: Unauthorized and checkout exits 128.
warded accepted eco-ops#56, #54, and #19, but every container remained before agent startup with no transcript. Skipping the harness smoke test did not help.
A clone with GIT_LFS_SKIP_SMUDGE=1 succeeds, confirming the ordinary Git objects and issue token are otherwise usable.

Scope:

Make the sealed preclone authenticate Forgejo Git LFS with the same short-lived repository credential used for Git, without placing the token in argv, logs, remotes, tracked config, or the final agent environment longer than required.
Preserve host separation and current repository authority checks.
Fail with a classified, visible pre-start diagnostic when an LFS fetch is unauthorized, instead of an empty cleanup-needed record.
Add a regression fixture/test covering a private Forgejo repo with at least one LFS pointer and proving checkout materializes the object.
Consider a documented skip-smudge path only as a bounded fallback for text-only work; it must not silently present LFS pointers as real assets to an engineer.

Acceptance: a warded engineer reaches the harness in an authenticated private LFS repo, and a deliberately bad LFS credential produces a redacted, actionable pre-start failure.

Dispatching private Forgejo repositories with Git LFS can die before the agent starts because the normal Git clone credential does not authenticate the LFS batch request. Reproduction from the 2026-07-23 Eco wave: 1. An authenticated shallow clone of `coilyco-gaming/eco-ops` reaches checkout. 2. Git LFS tries to smudge `mods/Mods/MightyMoose/Dependencies/Nito.AsyncEx.Coordination.dll`. 3. The Forgejo LFS batch endpoint responds `Authentication required: Unauthorized` and checkout exits 128. 4. `warded` accepted eco-ops#56, #54, and #19, but every container remained before agent startup with no transcript. Skipping the harness smoke test did not help. 5. A clone with `GIT_LFS_SKIP_SMUDGE=1` succeeds, confirming the ordinary Git objects and issue token are otherwise usable. Scope: - Make the sealed preclone authenticate Forgejo Git LFS with the same short-lived repository credential used for Git, without placing the token in argv, logs, remotes, tracked config, or the final agent environment longer than required. - Preserve host separation and current repository authority checks. - Fail with a classified, visible pre-start diagnostic when an LFS fetch is unauthorized, instead of an empty cleanup-needed record. - Add a regression fixture/test covering a private Forgejo repo with at least one LFS pointer and proving checkout materializes the object. - Consider a documented skip-smudge path only as a bounded fallback for text-only work; it must not silently present LFS pointers as real assets to an engineer. Acceptance: a warded engineer reaches the harness in an authenticated private LFS repo, and a deliberately bad LFS credential produces a redacted, actionable pre-start failure.

coilyco-ops referenced this issue from a commit

2026-07-23 06:11:59 +00:00

fix(agent): authenticate LFS preclone (#1524)

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-23 06:12:26 +00:00

Authenticate Forgejo Git LFS preclone #1525

coilyco-ops commented

2026-07-23 06:24:50 +00:00

Author

Member

Forgejo Actions run 2383 (run 10077) was cancelled at its 10-minute workflow timeout, with no failing conclusion. The exposed job target is the placeholder jobs/0, and its log endpoint returns 404, so Forgejo has not provided a failing step to patch. Local ward exec lint, ward exec vet, and ward exec test passed; I am rerunning the official workflow once. If the retry times out again, the runner/log surface needs operator attention.

Forgejo Actions run 2383 (run 10077) was cancelled at its 10-minute workflow timeout, with no failing conclusion. The exposed job target is the placeholder `jobs/0`, and its log endpoint returns 404, so Forgejo has not provided a failing step to patch. Local `ward exec lint`, `ward exec vet`, and `ward exec test` passed; I am rerunning the official workflow once. If the retry times out again, the runner/log surface needs operator attention.

coilyco-ops commented

2026-07-23 06:25:12 +00:00

Author

Member

WARDED_WORKFLOW: blocked 🛑

details

Review gate: intentionally skipped because the temporary ward default is pending brokered QA.

workflow: pull-request-and-merge; review summary: skipped intentionally pending brokered QA

Forgejo Actions run 2383 cancelled at its 10-minute timeout; the job log endpoint is a 404 placeholder and the authenticated rerun endpoint also returns 404. Local lint, vet, and tests pass.

Felt: implementation was direct; the blocker is CI control-plane visibility, not the LFS change. Confidence: high in the patch, blocked on official CI. Follow-up: repair the Forgejo Actions job/log and rerun endpoints, then rerun PR #1525.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> Review gate: intentionally skipped because the temporary ward default is pending brokered QA. workflow: pull-request-and-merge; review summary: skipped intentionally pending brokered QA Forgejo Actions run 2383 cancelled at its 10-minute timeout; the job log endpoint is a 404 placeholder and the authenticated rerun endpoint also returns 404. Local lint, vet, and tests pass. Felt: implementation was direct; the blocker is CI control-plane visibility, not the LFS change. Confidence: high in the patch, blocked on official CI. Follow-up: repair the Forgejo Actions job/log and rerun endpoints, then rerun PR #1525. </details>

coilyco-ops commented

2026-07-23 06:25:21 +00:00

Author

Member

WARDED_WORKFLOW: reservation-released

release details

Run finished with WARDED_WORKFLOW: blocked 🛑.

ward container reap released container engineer-codex-ward-1524 (--harness codex): the terminal outcome supersedes the reservation, so a later redispatch no longer needs --override-reservation.

— Codex, via ward agent

WARDED_WORKFLOW: reservation-released <details><summary>release details</summary> Run finished with `WARDED_WORKFLOW: blocked 🛑`. `ward container reap` released container `engineer-codex-ward-1524` (`--harness codex`): the terminal outcome supersedes the reservation, so a later redispatch no longer needs `--override-reservation`. </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-27 03:14:34 +00:00

Author

Member

PR #1525 has been refreshed onto current main and pushed at 7343aeecb8.

The patch now also prevents Git LFS from replaying a sealed credential after Git reports it rejected. Valid private-LFS materialization, bounded rejected-credential handling, redacted lfs-auth recovery, clone branch recovery, build, vet, lint, and the full pre-commit suite all pass locally.

Official Forgejo Actions run 2448 waited about 6m43s, ran for 64s, and failed. Forgejo exposes no failing step: every guarded log request for the run, internal run id 11904, placeholder job id 0, and task id 18568 returns 404. The operator evidence and exact requested verification are recorded on coilyco-flight-deck/infrastructure#602 (comment).

The agent left PR #1525 open and unmerged. The pull-request-and-merge gate still lacks both passing official CI and a passed review summary, so merging would violate the repository workflow.

PR #1525 has been refreshed onto current main and pushed at 7343aeecb87e1fdd5b1174c171e72c50b461ce7b. The patch now also prevents Git LFS from replaying a sealed credential after Git reports it rejected. Valid private-LFS materialization, bounded rejected-credential handling, redacted lfs-auth recovery, clone branch recovery, build, vet, lint, and the full pre-commit suite all pass locally. Official Forgejo Actions run 2448 waited about 6m43s, ran for 64s, and failed. Forgejo exposes no failing step: every guarded log request for the run, internal run id 11904, placeholder job id 0, and task id 18568 returns 404. The operator evidence and exact requested verification are recorded on https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/602#issuecomment-40723. The agent left PR #1525 open and unmerged. The pull-request-and-merge gate still lacks both passing official CI and a passed review summary, so merging would violate the repository workflow.

coilyco-ops referenced this issue

2026-07-28 02:25:02 +00:00

Stabilize Ward for safe autonomous burndown and verified releases #1574

coilyco-ops commented

2026-07-28 02:47:41 +00:00

Author

Member

Current verification state

This comment supersedes the older head and run references in the thread without changing the implementation claim.

Pull request: #1525
Current head: 2ba11b2b64c7553698b916067ba7ac465ebf925e
Current combined status: failure
Failing run: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/actions/runs/2453
Failing context: test / test (pull_request)
Observed duration: 31 seconds
Log evidence: both the exposed job and task log routes returned 404
QA evidence: no structured QA verdict exists for the current head
Operator log recovery owner: coilyco-flight-deck/infrastructure#602

The pull request remains blocked. A director must not merge it until the current commit has green CI and QA posts a passing verdict bound to that exact commit.

Codex, via advisor surface

## Current verification state This comment supersedes the older head and run references in the thread without changing the implementation claim. * Pull request: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/pulls/1525 * Current head: `2ba11b2b64c7553698b916067ba7ac465ebf925e` * Current combined status: failure * Failing run: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/actions/runs/2453 * Failing context: `test / test (pull_request)` * Observed duration: 31 seconds * Log evidence: both the exposed job and task log routes returned 404 * QA evidence: no structured QA verdict exists for the current head * Operator log recovery owner: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/602 The pull request remains blocked. A director must not merge it until the current commit has green CI and QA posts a passing verdict bound to that exact commit.  Codex, via advisor surface

coilyco-ops referenced this issue

2026-07-28 02:47:45 +00:00

Stabilize Ward for safe autonomous burndown and verified releases #1574

coilyco-ops referenced this issue

2026-07-28 03:47:33 +00:00

Authenticate Forgejo Git LFS preclone #1525

coilyco-ops commented

2026-07-28 03:47:52 +00:00

Author

Member

Parent #1574 disposition: PR #1525 is closed without merge at failing head be6351c83a. The remote branch remains available as evidence, but it is not an approved implementation. This issue stays open as the replacement contract. Redispatch onto a clean branch only after #1565 restores a reliable repository test gate and infrastructure #602 restores the supported failing-job evidence path. Any future PR still requires green current-head CI and exact-commit QA.

Parent #1574 disposition: PR #1525 is closed without merge at failing head be6351c83a1b3507f20955e9ce76d6cdf7136efb. The remote branch remains available as evidence, but it is not an approved implementation. This issue stays open as the replacement contract. Redispatch onto a clean branch only after #1565 restores a reliable repository test gate and infrastructure #602 restores the supported failing-job evidence path. Any future PR still requires green current-head CI and exact-commit QA.

coilyco-ops referenced this issue

2026-07-28 03:48:04 +00:00

Stabilize Ward for safe autonomous burndown and verified releases #1574

coilyco-ops added the

labels

2026-07-29 03:47:18 +00:00

coilyco-ops closed this issue

2026-07-29 06:04:43 +00:00