warded advisor dispatch 125s on host docker run (research mode) while engineer runs succeed same session #577

New issue

Open

opened 2026-07-03 17:54:25 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-07-03 17:54:25 +00:00

Owner

Observed (2026-07-03, read-only director surface, dispatch broker path)

Dispatching an advisor research run through the dispatch broker fails at the host docker run:

ward: dispatch broker: ward agent advisor --driver claude: research coilyco-flight-deck/ward#575: exit status 125

Twice, identical, including with --no-tailnet (so it is not the tailnet SOCKS5 sidecar / host-network route).
Same session, same host KAI-DESKTOP-TOWER, engineer dispatches SUCCEEDED: engineer-claude-ward-499 reserved and running, engineer-claude-ward-507 reserved, landed, and closed #507. So the host docker daemon, the dev-base image, and the whole engineer launch path are healthy this session.
The advisor 125s before placing a reservation (no ward-agent-reservation comment on #575), so it dies at container create/start, not inside the run.

Why advisor-specific (hypotheses - host-side to confirm)

exit 125 is docker refusing to create/start the container. Advisor differs from engineer at launch by: default --tailnet (which implies --aws) live-observe wiring, and attached/streamed research mode. --no-tailnet did not fix it, which narrows it to one of:

the --aws mount of ~/.aws applied independently of the tailnet opt-out (a missing host path, or the snap-docker private-mount bug, cf #557),
a different or absent image for the advisor role (advisor has a --no-pull flag, so its pull path may differ from the engineer's),
an attached-mode / TTY flag the broker's non-TTY forwarding context rejects.

Why filed, not dispatched

Root cause is host-side (host ward's docker invocation for the advisor role), which a sealed container engineer cannot reach or live-test - the same wall as #497. It needs a host session on KAI-DESKTOP-TOWER: run ward agent advisor <ref> "..." natively and read docker's stderr, or --print the host-side plan and diff the advisor docker args against a working engineer dispatch.

Impact

Blocks advisor design/research passes dispatched from the director seat (#575's design pass is parked on this). Engineer dispatch is unaffected.

#557 - snap-docker private /tmp breaking --env-file / -v mounts (a candidate root cause if the advisor mounts more than the engineer).
#570 - reservation not rolled back on docker-run failure. Here the advisor 125'd even earlier, leaving no reservation, so #570's cleanup gap did not bite this time.
#555 - docker daemon restart orphaning reservations.
#497 - precedent for a host-side dispatch failure filed-not-dispatched.

Filed by the read-only director surface session (claude-linux-cbbb76a95881-cb37-she-her) after two advisor dispatches 125'd while engineer dispatches ran clean the same session.

## Observed (2026-07-03, read-only director surface, dispatch broker path) Dispatching an **advisor** research run through the dispatch broker fails at the host `docker run`: ``` ward: dispatch broker: ward agent advisor --driver claude: research coilyco-flight-deck/ward#575: exit status 125 ``` - **Twice, identical**, including with `--no-tailnet` (so it is not the tailnet SOCKS5 sidecar / host-network route). - **Same session, same host `KAI-DESKTOP-TOWER`, engineer dispatches SUCCEEDED**: `engineer-claude-ward-499` reserved and running, `engineer-claude-ward-507` reserved, landed, and closed [#507](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/507). So the host docker daemon, the dev-base image, and the whole engineer launch path are healthy this session. - The advisor **125s before placing a reservation** (no `ward-agent-reservation` comment on #575), so it dies at container **create/start**, not inside the run. ## Why advisor-specific (hypotheses - host-side to confirm) `exit 125` is docker refusing to create/start the container. Advisor differs from engineer at launch by: default `--tailnet` (which implies `--aws`) live-observe wiring, and attached/streamed research mode. `--no-tailnet` did **not** fix it, which narrows it to one of: - the `--aws` mount of `~/.aws` applied independently of the tailnet opt-out (a missing host path, or the snap-docker private-mount bug, cf [#557](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/557)), - a different or absent image for the advisor role (advisor has a `--no-pull` flag, so its pull path may differ from the engineer's), - an attached-mode / TTY flag the broker's non-TTY forwarding context rejects. ## Why filed, not dispatched Root cause is host-side (host ward's docker invocation for the advisor role), which a sealed container engineer cannot reach or live-test - the same wall as [#497](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/497). It needs a **host** session on `KAI-DESKTOP-TOWER`: run `ward agent advisor <ref> "..."` natively and read docker's stderr, or `--print` the host-side plan and diff the advisor docker args against a working engineer dispatch. ## Impact Blocks advisor design/research passes dispatched from the director seat ([#575](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/575)'s design pass is parked on this). Engineer dispatch is unaffected. ## Related - [#557](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/557) - snap-docker private `/tmp` breaking `--env-file` / `-v` mounts (a candidate root cause if the advisor mounts more than the engineer). - [#570](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/570) - reservation not rolled back on docker-run failure. Here the advisor 125'd even earlier, leaving no reservation, so #570's cleanup gap did not bite this time. - [#555](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/555) - docker daemon restart orphaning reservations. - [#497](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/497) - precedent for a host-side dispatch failure filed-not-dispatched. --- Filed by the read-only director surface session (claude-linux-cbbb76a95881-cb37-she-her) after two advisor dispatches 125'd while engineer dispatches ran clean the same session.

coilysiren referenced this issue

2026-07-03 17:59:00 +00:00

Mount the issue-corpus into /substrate via coilysiren/inbox double-duty (consumer half of agentic-os#297) #575

coilyco-ops commented

2026-07-03 18:08:33 +00:00

Member

🛫 ward pre-flight: NO-GO

ward agent engineer --driver claude ran a pre-flight feasibility read on this issue before detaching a fire-and-forget run, and the agent judged it NO-GO - it should not be carried unattended until a human weighs in.

host-side docker failure explicitly requiring a live host session on KAI-DESKTOP-TOWER to reproduce and verify; a sealed container cannot reach the daemon or confirm any fix — author already filed-not-dispatched it for this exact reason.

No container was launched. Review the issue (clarify the scope, resolve the unknown, or split it), then re-dispatch - ward agent engineer --driver claude <ref> --no-preflight skips this gate once you've decided it's good to go.

full pre-flight read

Pre-flight read: coilyco-flight-deck/ward#577

Context to front-load: I would read, in the fresh clone before any edit: docs/agent.md and docs/agent-preflight.md (dispatch + headless pre-flight wiring), .agents/skills/tooling-ward-agent/SKILL.md (advisor vs engineer role conventions), and the host-side docker invocation builder for ward agent — specifically wherever the advisor role's docker run args are assembled (the --tailnet/--aws mount wiring, --no-pull image resolution, and attached/TTY flags). I confirm I'd read each in the clone rather than infer it. But naming them doesn't close the real gap here.

The blocking unknown: This issue is, by the author's own framing, a filed-not-dispatched, needs-a-host-session bug. The exit 125 is docker on the host KAI-DESKTOP-TOWER refusing to create/start the advisor container — the fix requires running ward agent advisor <ref> natively and reading docker's stderr, or --printing the host plan and diffing advisor vs engineer args. A sealed detached container is exactly the wall it cites (precedent #497): I cannot reach the host docker daemon, cannot reproduce the 125, and cannot verify any candidate fix (missing ~/.aws path, snap-docker /tmp private-mount bug per #557, or an attached-mode TTY flag). Merging a speculative arg-construction change unattended, with no way to confirm it stops the 125 or that it doesn't regress the healthy engineer path, is not safe.

NO-GO: host-side docker failure explicitly requiring a live host session on KAI-DESKTOP-TOWER to reproduce and verify; a sealed container cannot reach the daemon or confirm any fix — author already filed-not-dispatched it for this exact reason.

Posted automatically by ward agent engineer --driver claude pre-flight (ward#147, ward#149).

— Claude (she/her), via ward agent

### 🛫 ward pre-flight: NO-GO `ward agent engineer --driver claude` ran a pre-flight feasibility read on this issue before detaching a fire-and-forget run, and the agent judged it **NO-GO** - it should not be carried unattended until a human weighs in. > host-side docker failure explicitly requiring a live host session on KAI-DESKTOP-TOWER to reproduce and verify; a sealed container cannot reach the daemon or confirm any fix — author already filed-not-dispatched it for this exact reason. No container was launched. Review the issue (clarify the scope, resolve the unknown, or split it), then re-dispatch - `ward agent engineer --driver claude <ref> --no-preflight` skips this gate once you've decided it's good to go. <details><summary>full pre-flight read</summary> ## Pre-flight read: coilyco-flight-deck/ward#577 **Context to front-load:** I would read, in the fresh clone before any edit: `docs/agent.md` and `docs/agent-preflight.md` (dispatch + headless pre-flight wiring), `.agents/skills/tooling-ward-agent/SKILL.md` (advisor vs engineer role conventions), and the host-side docker invocation builder for `ward agent` — specifically wherever the advisor role's `docker run` args are assembled (the `--tailnet`/`--aws` mount wiring, `--no-pull` image resolution, and attached/TTY flags). I confirm I'd read each in the clone rather than infer it. But naming them doesn't close the real gap here. **The blocking unknown:** This issue is, by the author's own framing, a *filed-not-dispatched, needs-a-host-session* bug. The `exit 125` is docker on the host `KAI-DESKTOP-TOWER` refusing to create/start the advisor container — the fix requires running `ward agent advisor <ref>` natively and reading docker's stderr, or `--print`ing the host plan and diffing advisor vs engineer args. A sealed detached container is exactly the wall it cites (precedent #497): I cannot reach the host docker daemon, cannot reproduce the 125, and cannot verify any candidate fix (missing `~/.aws` path, snap-docker `/tmp` private-mount bug per #557, or an attached-mode TTY flag). Merging a speculative arg-construction change unattended, with no way to confirm it stops the 125 or that it doesn't regress the healthy engineer path, is not safe. NO-GO: host-side docker failure explicitly requiring a live host session on KAI-DESKTOP-TOWER to reproduce and verify; a sealed container cannot reach the daemon or confirm any fix — author already filed-not-dispatched it for this exact reason. </details> --- Posted automatically by `ward agent engineer --driver claude` pre-flight (ward#147, ward#149).   — Claude (she/her), via `ward agent`

coilyco-ops added the

consult

labels

2026-07-04 08:21:17 +00:00

coilyco-ops added

interactive

and removed

consult

labels

2026-07-10 09:00:43 +00:00

coilyco-ops added

and removed