Mount and project agent-compose bundles into warded container homes #1541

New issue

Closed

opened 2026-07-24 12:28:24 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-24 12:28:24 +00:00

Member

Goal

Complete the Ward consumer side of coilyco-flight-deck/agent-compose#17.

Ward mounts one already-materialized agent-compose bundle read-only, treats it as opaque, verifies it through agent-compose, and projects it into the private container HOME before the harness starts.

Boundary

Ward owns launch authority, container mounts, environment, and failure policy.
Agent-compose owns bundle validation and harness load-point projection.
Ward enters the bundle only through manifest.json and never parses person, role, skill, or identity policy.
The bundle grants no command, credential, network, or filesystem authority.

Acceptance

A bundle path can be supplied to a warded launch through an explicit launch input.
Ward resolves and validates the host path before launch.
The container receives the bundle at a fixed read-only path.
Container startup runs agent-compose verify and then agent-compose project --scope home for the selected harness layout.
Missing, unreadable, malformed, or projection-failing bundles stop launch with an actionable error.
A compatibility fixture covers engineer plus the five-role matrix now available in agent-compose.
Existing launches without a bundle remain compatible.
Documentation names the authority boundary and links agent-compose#17.

## Goal Complete the Ward consumer side of coilyco-flight-deck/agent-compose#17. Ward mounts one already-materialized agent-compose bundle read-only, treats it as opaque, verifies it through agent-compose, and projects it into the private container HOME before the harness starts. ## Boundary * Ward owns launch authority, container mounts, environment, and failure policy. * Agent-compose owns bundle validation and harness load-point projection. * Ward enters the bundle only through `manifest.json` and never parses person, role, skill, or identity policy. * The bundle grants no command, credential, network, or filesystem authority. ## Acceptance * A bundle path can be supplied to a warded launch through an explicit launch input. * Ward resolves and validates the host path before launch. * The container receives the bundle at a fixed read-only path. * Container startup runs `agent-compose verify` and then `agent-compose project --scope home` for the selected harness layout. * Missing, unreadable, malformed, or projection-failing bundles stop launch with an actionable error. * A compatibility fixture covers engineer plus the five-role matrix now available in agent-compose. * Existing launches without a bundle remain compatible. * Documentation names the authority boundary and links agent-compose#17.

coilyco-ops referenced this issue from a commit

2026-07-24 12:52:11 +00:00

feat(agent): project agent-compose bundles

coilyco-ops closed this issue

2026-07-24 12:52:11 +00:00

coilyco-ops referenced this issue

2026-07-24 13:09:52 +00:00

Allow the shared agent-compose harness selector through the core guard #1542

coilyco-ops commented

2026-07-24 13:19:11 +00:00

Author

Member

Post-landing verification is complete.

The first promote run exposed Ward's core-literal architecture guard. Follow-up #1542 landed the narrow shared-selector allowlist in 83caac7. Replacement promote run 2402 passed the full Linux gate and promoted the agent-compose bundle consumer to Ward's release branch.

Post-landing verification is complete. The first promote run exposed Ward's core-literal architecture guard. Follow-up #1542 landed the narrow shared-selector allowlist in `83caac7`. Replacement promote run 2402 passed the full Linux gate and promoted the agent-compose bundle consumer to Ward's release branch.

coilyco-ops referenced this issue

2026-07-28 06:35:13 +00:00

Gate native MCP projector before agent image promotion #1537

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/ward#1541

No description provided.

Rows
Columns