The trust-gate refusal ('refusing untrusted owner') is a documented-nowhere dead end: no doc defines the primary-org set or a next step

coilyco-ops commented

2026-07-01 22:58:07 +00:00

Member

Why

Persona forgejo-selfhoster / angle failure-paths. This persona's first real failure is predictable: point warded at an issue in their own org. The run dies at the trust gate (cmd/ward/agent.go, rule-3 peek to capture the exact behavior):

<cmd>: refusing untrusted owner "<their-org>" (allowed: coilysiren, coilyco-flight-deck, …)

The error is honest but a dead end, and every documented rescue path fails from here:

Search the docs for the error: "untrusted owner" appears once, as an aside in docs/agent-engineer.md ("a bad ref or untrusted owner fails first"). No doc defines the trust gate, names the primary-org set, or says whether it is extensible (env? config? fork-and-rebuild?).
ward doctor: checks only the allowlist + security: probes (docs/doctor.md) — nothing validates "can this host dispatch an agent for owner X", so the doctor passes on a host where every warded call will be refused (#195's agent-doctor gap, day-2 flavor).
Troubleshooting entry point: none exists (#447).

#441 already covers disclosing the compiled-in owner gate before install. This is the complementary day-2 slice, independently dispatchable: when the refusal fires, neither the error nor any doc offers a next step, so the ICP's first failure has no documented exit.

Deliverable

Two small changes: (1) the refusal message points somewhere — a docs URL or one clause ("this build dispatches only for the compiled-in primary orgs; see ") — and (2) a short docs section (agent.md or a troubleshooting page per #447) defines the trust gate: what set applies, why (bypassPermissions containers), and the current extension story (even if that story is "not extensible yet, see #441/#395").

Done condition

A self-hoster who hits the refusal can go from the error text to an accurate explanation and the current workaround/limitation in one hop, without reading Go.

Severity: major-friction · persona: forgejo-selfhoster · angle: failure-paths
Filed by Claude Code during a cold-read release pressure test (run 35).

## Why Persona `forgejo-selfhoster` / angle `failure-paths`. This persona's first real failure is predictable: point `warded` at an issue in their own org. The run dies at the trust gate (`cmd/ward/agent.go`, rule-3 peek to capture the exact behavior): ``` <cmd>: refusing untrusted owner "<their-org>" (allowed: coilysiren, coilyco-flight-deck, …) ``` The error is honest but a dead end, and every documented rescue path fails from here: - **Search the docs for the error**: "untrusted owner" appears once, as an aside in `docs/agent-engineer.md` ("a bad ref or untrusted owner fails first"). No doc defines the trust gate, names the primary-org set, or says whether it is extensible (env? config? fork-and-rebuild?). - **`ward doctor`**: checks only the allowlist + `security:` probes (docs/doctor.md) — nothing validates "can this host dispatch an agent for owner X", so the doctor passes on a host where every `warded` call will be refused (#195's agent-doctor gap, day-2 flavor). - **Troubleshooting entry point**: none exists (#447). #441 already covers disclosing the compiled-in owner gate *before install*. This is the complementary day-2 slice, independently dispatchable: when the refusal fires, neither the error nor any doc offers a next step, so the ICP's first failure has no documented exit. ## Deliverable Two small changes: (1) the refusal message points somewhere — a docs URL or one clause ("this build dispatches only for the compiled-in primary orgs; see <doc>") — and (2) a short docs section (agent.md or a troubleshooting page per #447) defines the trust gate: what set applies, why (bypassPermissions containers), and the current extension story (even if that story is "not extensible yet, see #441/#395"). ## Done condition A self-hoster who hits the refusal can go from the error text to an accurate explanation and the current workaround/limitation in one hop, without reading Go. --- **Severity: major-friction** · persona: forgejo-selfhoster · angle: failure-paths Filed by Claude Code during a cold-read release pressure test (run 35).

coilyco-ops added the

pressure-test

label

2026-07-01 22:58:07 +00:00

coilyco-ops referenced this issue

2026-07-01 22:58:09 +00:00

meta: release pressure-test run log (cold-read usability sweeps) #428

coilyco-ops referenced this issue

2026-07-01 23:12:15 +00:00

meta: release pressure-test run log (cold-read usability sweeps) #428

coilyco-ops added this to the ward launch milestone

2026-07-01 23:29:22 +00:00

coilyco-ops added the

P1

headless

labels

2026-07-01 23:30:38 +00:00

coilyco-ops commented

2026-07-01 23:58:54 +00:00

Author

Member

DECISION - document now, do not wait for #453: describe the current compiled-in trust gate honestly (the exact refusal string, the allowed-owner set, 'not extensible without rebuild today'), link #441/#453 as the fix in flight, and give the reader their actual next step. Recorded by Claude Code (Fable) during the 2026-07-01 ward launch triage session with Kai.

coilyco-ops referenced this issue

2026-07-02 00:01:42 +00:00

meta: jul 1st evening sprint - launch burndown session 1 #492

coilyco-ops commented

2026-07-02 02:34:11 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-484 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T02:34:09Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-484` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T02:34:09Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-07-02 02:43:50 +00:00

docs(agent): give the untrusted-owner refusal a documented exit (closes #484)

coilysiren closed this issue

2026-07-02 02:43:54 +00:00

coilysiren commented

2026-07-02 02:44:32 +00:00

Owner

WARD-OUTCOME: done - the untrusted-owner refusal now points at docs/agent-trust-gate.md, which defines the gate, why it exists, and the fork-and-rebuild extension story.

Candid retro: this was a clean, satisfying one. The refusal message turned out to be copy-pasted across six dispatch sites, so the honest fix was to collapse them into one Runner.untrustedOwnerErr helper and give that single place the doc pointer - the deliverable and a small dedup fell out of the same move. The doc itself was the easy part.

What fought back was mundane: the container's root volume was pegged at 100% (a shared host disk, not mine to reclaim), so the first go build died on "no space left on device" mid-compile. Redirecting caches didn't help since the roomy mounts were read-only, but a single-process build (-p=1) squeezed through and the disk recovered on its own. The other snag was the 4000-char markdown cap: agent.md and agent-engineer.md were already sitting right at the ceiling, so my cross-links tipped them over and I had to trim my own additions down to terse one-liners.

Confidence is high: build, vet, and the full cmd/ward suite are green, a new test locks in the doc pointer, and pre-commit passed clean. Rough edges worth noting - the actual fixes (ward#441 disclose-before-install, ward#395 make the set configurable, ward#195 a doctor check for dispatchable owners) are all still open, so this closes the documentation gap but the underlying "not extensible without a fork" limitation stands. If someone wants to go further, ward#447 (a real troubleshooting entry point) is the natural next home for this content.

WARD-OUTCOME: done - the untrusted-owner refusal now points at docs/agent-trust-gate.md, which defines the gate, why it exists, and the fork-and-rebuild extension story. Candid retro: this was a clean, satisfying one. The refusal message turned out to be copy-pasted across six dispatch sites, so the honest fix was to collapse them into one `Runner.untrustedOwnerErr` helper and give that single place the doc pointer - the deliverable and a small dedup fell out of the same move. The doc itself was the easy part. What fought back was mundane: the container's root volume was pegged at 100% (a shared host disk, not mine to reclaim), so the first `go build` died on "no space left on device" mid-compile. Redirecting caches didn't help since the roomy mounts were read-only, but a single-process build (`-p=1`) squeezed through and the disk recovered on its own. The other snag was the 4000-char markdown cap: agent.md and agent-engineer.md were already sitting right at the ceiling, so my cross-links tipped them over and I had to trim my own additions down to terse one-liners. Confidence is high: build, vet, and the full cmd/ward suite are green, a new test locks in the doc pointer, and pre-commit passed clean. Rough edges worth noting - the actual fixes (ward#441 disclose-before-install, ward#395 make the set configurable, ward#195 a doctor check for dispatchable owners) are all still open, so this closes the documentation gap but the underlying "not extensible without a fork" limitation stands. If someone wants to go further, ward#447 (a real troubleshooting entry point) is the natural next home for this content.

coilysiren referenced this issue

2026-07-14 15:27:09 +00:00

director should emit colorized, space buffered, visually distinct messages about the categories of actions its performing on startup #1283

Rows
Columns

The trust-gate refusal ('refusing untrusted owner') is a documented-nowhere dead end: no doc defines the primary-org set or a next step #484

Why

Deliverable

Done condition