No doc names the agent container image (forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:latest): registry, tag policy, and pull accessibility are undiscoverable

coilyco-ops commented

2026-07-01 22:41:14 +00:00

Member

Why

Persona agent-power-user / angle feature-gaps. Must-have: "what actually runs on my machine when I type warded #98?" Trail: README → docs/FEATURES.md → docs/agent.md → docs/container.md → docs/container-substrate.md.

docs/container.md says only that it "wraps the aos-published dev-base image", and its See-also cites "agentic-os docs/dev-base-image.md" — a sibling-repo doc with no link. docs/container-substrate.md repeats "Built by aos, see its docs/dev-base-image.md", again unlinked. No ward doc names the image ref, the registry it pulls from, the tag policy, or whether a stranger can pull it at all.

Verification (rule-3 code peek, confirming "documented nowhere"): cmd/ward/container_compute.go pins containerImageDefault = "forgejo.coilysiren.me/coilyco-flight-deck/agentic-os", tag latest. A registry probe shows anonymous pull does work — but a cold user can only learn any of this by reading Go source and speaking the OCI token flow.

Two walls this leaves standing:

First-launch expectations: what is being downloaded, from where, and how big — invisible until docker output scrolls by (or a detached run quietly pulls).
Provenance: the agent runs bypassPermissions (per docs/container-permissions.md) inside an image identified only by a moving latest tag on a personal Forgejo registry, and no public doc states a pinning or provenance story — the first question a security-conscious adopter asks.

Sharper sub-finding of #464 (Docker never named as prerequisite) and #467 (no first-run guide); overlaps eng anchor #395 (externalize registry topology) and #441 (compiled-in endpoint/SSM/owner-gate).

Deliverable

docs/container.md (and the prerequisites/first-run surface from #464/#467) names the default image ref and registry, states that anonymous pull works, links the aos dev-base-image doc with a real URL, and gives one line on pinning (--image/--tag, WARD_AGENT_{IMAGE,TAG}) for users who don't want a moving tag.

Done condition

A cold reader of docs/container.md can answer "what image runs, from where, can I pull it, and how do I pin it" without reading Go. grep -r 'coilyco-flight-deck/agentic-os' docs/ returns at least one hit naming the full ref.

Severity: major-friction · persona: agent-power-user · angle: feature-gaps
Filed by Claude Code during a cold-read release pressure test (run 30).

## Why Persona `agent-power-user` / angle `feature-gaps`. Must-have: "what actually runs on my machine when I type `warded #98`?" Trail: README → `docs/FEATURES.md` → `docs/agent.md` → `docs/container.md` → `docs/container-substrate.md`. `docs/container.md` says only that it "wraps the aos-published dev-base image", and its See-also cites "agentic-os `docs/dev-base-image.md`" — a sibling-repo doc with **no link**. `docs/container-substrate.md` repeats "Built by aos, see its `docs/dev-base-image.md`", again unlinked. No ward doc names the image ref, the registry it pulls from, the tag policy, or whether a stranger can pull it at all. Verification (rule-3 code peek, confirming "documented nowhere"): `cmd/ward/container_compute.go` pins `containerImageDefault = "forgejo.coilysiren.me/coilyco-flight-deck/agentic-os"`, tag `latest`. A registry probe shows anonymous pull **does** work — but a cold user can only learn any of this by reading Go source and speaking the OCI token flow. Two walls this leaves standing: 1. **First-launch expectations**: what is being downloaded, from where, and how big — invisible until docker output scrolls by (or a detached run quietly pulls). 2. **Provenance**: the agent runs `bypassPermissions` (per `docs/container-permissions.md`) inside an image identified only by a **moving `latest` tag** on a personal Forgejo registry, and no public doc states a pinning or provenance story — the first question a security-conscious adopter asks. Sharper sub-finding of #464 (Docker never named as prerequisite) and #467 (no first-run guide); overlaps eng anchor #395 (externalize registry topology) and #441 (compiled-in endpoint/SSM/owner-gate). ## Deliverable `docs/container.md` (and the prerequisites/first-run surface from #464/#467) names the default image ref and registry, states that anonymous pull works, links the aos dev-base-image doc with a real URL, and gives one line on pinning (`--image`/`--tag`, `WARD_AGENT_{IMAGE,TAG}`) for users who don't want a moving tag. ## Done condition A cold reader of `docs/container.md` can answer "what image runs, from where, can I pull it, and how do I pin it" without reading Go. `grep -r 'coilyco-flight-deck/agentic-os' docs/` returns at least one hit naming the full ref. --- **Severity: major-friction** · persona: agent-power-user · angle: feature-gaps Filed by Claude Code during a cold-read release pressure test (run 30).

coilyco-ops added the

pressure-test

label

2026-07-01 22:41:14 +00:00

coilyco-ops referenced this issue

2026-07-01 22:42:08 +00:00

meta: release pressure-test run log (cold-read usability sweeps) #428

coilyco-ops added this to the ward launch milestone

2026-07-01 23:29:26 +00:00

coilyco-ops added the

headless

P1

labels

2026-07-01 23:30:21 +00:00

coilyco-ops referenced this issue

2026-07-02 00:01:42 +00:00

meta: jul 1st evening sprint - launch burndown session 1 #492

coilyco-ops commented

2026-07-02 02:40:25 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-475 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T02:40:21Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-475` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T02:40:21Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-07-02 02:49:09 +00:00

docs(container): name the dev-base image, registry, tag policy, and pull access

coilysiren closed this issue

2026-07-02 02:49:09 +00:00

coilysiren commented

2026-07-02 02:49:32 +00:00

Owner

WARD-OUTCOME: done - docs/container.md + a new docs/container-image.md name the image ref, registry, anonymous-pull, tag policy, and pinning; README's Docker prereq names it too.

The doc content itself was the easy part - the four questions (what image, from where, can I pull it, how do I pin it) all had clean answers already sitting in the code and in aos's dev-base-image.md, so it was mostly transcription plus real links to replace the two unlinked bare docs/dev-base-image.md mentions.

What fought back was the doc-size cap. container.md was already sitting exactly at the 80-line / 4000-char ceiling, so adding a full "The image" section blew both limits and I had to split the detail into a sibling doc (container-image.md) and then micro-trim neighbouring prose - down to shaving a single character at one point to clear 4000. That's a smell: a doc pinned to the cap is fragile, and the next person who touches container.md will hit the same wall. Might be worth a follow-up to either raise the cap for hub docs or pre-emptively thin container.md.

Confidence is high - the done-condition grep passes, the full ref appears inline in container.md (no Go-reading needed), pre-commit is green, and the merged tree compiles. One honest caveat: I stated "anonymous pull works" from the issue's verified registry probe rather than re-probing myself, and aos's own doc still says a one-time docker login is needed, so those two could drift. If the registry ever flips to auth-required, container-image.md is the line to fix.

WARD-OUTCOME: done - docs/container.md + a new docs/container-image.md name the image ref, registry, anonymous-pull, tag policy, and pinning; README's Docker prereq names it too. The doc content itself was the easy part - the four questions (what image, from where, can I pull it, how do I pin it) all had clean answers already sitting in the code and in aos's dev-base-image.md, so it was mostly transcription plus real links to replace the two unlinked bare `docs/dev-base-image.md` mentions. What fought back was the doc-size cap. container.md was already sitting *exactly* at the 80-line / 4000-char ceiling, so adding a full "The image" section blew both limits and I had to split the detail into a sibling doc (container-image.md) and then micro-trim neighbouring prose - down to shaving a single character at one point to clear 4000. That's a smell: a doc pinned to the cap is fragile, and the next person who touches container.md will hit the same wall. Might be worth a follow-up to either raise the cap for hub docs or pre-emptively thin container.md. Confidence is high - the done-condition grep passes, the full ref appears inline in container.md (no Go-reading needed), pre-commit is green, and the merged tree compiles. One honest caveat: I stated "anonymous pull works" from the issue's verified registry probe rather than re-probing myself, and aos's own doc still says a one-time `docker login` is needed, so those two could drift. If the registry ever flips to auth-required, container-image.md is the line to fix.

coilysiren referenced this issue

2026-07-02 02:57:46 +00:00

Docker is a hard requirement for ward agent / warded but is never named as a prerequisite anywhere in README, AGENTS.md, or agent.md #464

coilysiren referenced this issue from a commit

2026-07-02 08:04:19 +00:00

docs(agent): state codex/goose launch today, document the shell fallback (closes #456)

coilysiren referenced this issue

2026-07-02 08:04:58 +00:00

agent-goose.md and agent-codex.md claim image-baked, no self-install; container.md says both drop to a shell, not yet imaged #456

coilysiren referenced this issue

2026-07-02 08:06:25 +00:00

agent-goose.md and agent-codex.md claim image-baked, no self-install; container.md says both drop to a shell, not yet imaged #456

coilyco-ops commented

2026-07-02 08:11:19 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-475 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T08:11:16Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-475` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T08:11:16Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilyco-ops commented

2026-07-02 08:11:23 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-475 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T08:11:16Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-475` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T08:11:16Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilyco-ops commented

2026-07-02 08:11:26 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-475 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T08:11:16Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-475` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T08:11:16Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren commented

2026-07-02 08:12:54 +00:00

Owner

WARD-OUTCOME: done - the deliverable was already landed on main by commit 6c69bc7; verified the done-condition holds and closed-out.

Candid note: this run found the feature already done. docs/container-image.md exists, docs/container.md has an ## The image section naming the ref/registry/anonymous-pull/moving-tag with pinning flags, the aos dev-base doc is linked with a real URL, README names Docker as a prerequisite, and grep -r 'coilyco-flight-deck/agentic-os' docs/ returns hits. Commit 6c69bc7 ("docs(container): name the dev-base image, registry, tag policy, and pull access") is an ancestor of HEAD and the issue was already closed 2026-07-02.

So there was nothing to implement, commit, merge, or push - I verified rather than built. The one thing that stood out reading the landed work: the resolver hit container.md's 80-line/4000-char doc cap and split the detail into a sibling container-image.md, which is a clean call - the model overview stays lean and the registry/tag/provenance depth lives one hop away, cross-linked both directions. Confidence is high: the cold-reader questions (what image, from where, can I pull it, how do I pin it) are all answerable from the docs without touching Go. No follow-ups worth filing.

WARD-OUTCOME: done - the deliverable was already landed on main by commit 6c69bc7; verified the done-condition holds and closed-out. Candid note: this run found the feature already done. `docs/container-image.md` exists, `docs/container.md` has an `## The image` section naming the ref/registry/anonymous-pull/moving-tag with pinning flags, the aos dev-base doc is linked with a real URL, README names Docker as a prerequisite, and `grep -r 'coilyco-flight-deck/agentic-os' docs/` returns hits. Commit 6c69bc7 ("docs(container): name the dev-base image, registry, tag policy, and pull access") is an ancestor of HEAD and the issue was already closed 2026-07-02. So there was nothing to implement, commit, merge, or push - I verified rather than built. The one thing that stood out reading the landed work: the resolver hit `container.md`'s 80-line/4000-char doc cap and split the detail into a sibling `container-image.md`, which is a clean call - the model overview stays lean and the registry/tag/provenance depth lives one hop away, cross-linked both directions. Confidence is high: the cold-reader questions (what image, from where, can I pull it, how do I pin it) are all answerable from the docs without touching Go. No follow-ups worth filing.

coilysiren referenced this issue

2026-07-12 06:11:03 +00:00

feat(release): two-stage release - gate-green main promotes to a queued release branch #1126

Rows
Columns

No doc names the agent container image (forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:latest): registry, tag policy, and pull accessibility are undiscoverable #475

Why

Deliverable

Done condition