ward agent advisor fails to launch with exit status 125 (engineer dispatch works; advisor-only tailnet/~/.aws mount likely) #604

New issue

Closed

opened 2026-07-04 09:11:50 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-07-04 09:11:50 +00:00

Owner

Problem

ward agent advisor (the warded advisor <ref> "..." path) fails to launch with exit status 125 every time, while ward agent engineer dispatches from the same broker, same session, same host succeed normally. Exit 125 is Docker's "the container failed to run / daemon refused to start it" code, so the advisor container is dying at start, before the agent does any work - this is a dispatch/container-config failure specific to the advisor role, not an agent-logic problem.

Reproduction (2026-07-04, director surface session)

Dispatching coilyco-flight-deck/ward#601 as an advisor failed four consecutive times, spread across ~40 minutes and across a window where 5 other containers started and finished (so host capacity was demonstrably available for at least part of it):

warded advisor coilyco-flight-deck/ward#601 "design ..."
-> ward: dispatch broker: ward agent advisor --driver claude: research coilyco-flight-deck/ward#601: exit status 125

In the same session, every engineer dispatch through the same broker forwarded and ran fine: infrastructure#466, deploy#32, reddit-mcp#1, steam-ops#2, steam-ops#3, deploy#33, deploy#36, ward#600. So the broker path and host ward are healthy - only the advisor role 125s.

Direction (needs the host-side dispatch log to confirm)

The advisor role differs from engineer in a way that maps straight onto an exit-125: per the roster help, "the advisor role holds the live-observe guardfile set (tailnet + ~/.aws) by default; use --no-tailnet to stay isolated." Engineer carries no such mount set. The most likely causes, in order:

A mount that does not exist / is not readable on this host (a tailnet socket/state path or ~/.aws) - Docker refuses the run with 125 when a bind source is missing.
An advisor-only image tag or entrypoint that is absent/unpullable on the host.
A guardfile/flag the advisor injects that Docker rejects at create/run.

The decisive evidence is the host-side dispatch log, which a container/surface session cannot read (it lives on the host at e.g. C:\Users\firem\.ward\agent-logs\dispatch\<ts>-...-ward-601.log). First diagnostic step: read that log for the docker: Error response from daemon: ... line the 125 wraps.

Impact

The advisor role is currently unusable - any design/research dispatch (warded advisor #N "...") fails. That removes the "dispatch a sibling to design before an engineer implements" path the director doctrine leans on, forcing either an engineer dispatch (which implements before the design is settled - wrong for design tasks) or doing the research inline. ward#601 itself is blocked on this: it is a design task that wants an advisor and cannot get one.

Asks

Read the host dispatch log for a failed advisor run and capture the actual docker daemon error the 125 wraps.
Fix the missing-mount / image / guardfile cause so warded advisor <ref> "..." launches.
If a required mount (tailnet / ~/.aws) is legitimately absent on some hosts, the advisor dispatch should degrade gracefully (auto --no-tailnet, or a clear "advisor needs X, rerun with --no-tailnet" message) instead of a bare exit status 125 that gives the operator nothing to act on.

Acceptance

warded advisor <ref> "question" launches and runs on this host.
A genuinely missing advisor prerequisite produces an actionable error naming the missing mount/flag, not a bare exit status 125.
ward#601 can then be dispatched to an advisor as intended.

Refs

Blocked design task: coilyco-flight-deck/ward#601 (mid-run comment delivery).
Advisor role definition / the tailnet + ~/.aws guardfile default (roster help, ward agent advisor).

Provenance: director surface session, 2026-07-04 - hit while dispatching the ward#601 advisor.

## Problem `ward agent advisor` (the `warded advisor <ref> "..."` path) fails to launch with **`exit status 125`** every time, while `ward agent engineer` dispatches from the same broker, same session, same host succeed normally. Exit 125 is Docker's "the container failed to run / daemon refused to start it" code, so the advisor container is dying at **start**, before the agent does any work - this is a dispatch/container-config failure specific to the advisor role, not an agent-logic problem. ## Reproduction (2026-07-04, director surface session) Dispatching `coilyco-flight-deck/ward#601` as an advisor failed **four consecutive times**, spread across ~40 minutes and across a window where 5 other containers started and finished (so host capacity was demonstrably available for at least part of it): ``` warded advisor coilyco-flight-deck/ward#601 "design ..." -> ward: dispatch broker: ward agent advisor --driver claude: research coilyco-flight-deck/ward#601: exit status 125 ``` In the **same session**, every engineer dispatch through the same broker forwarded and ran fine: `infrastructure#466`, `deploy#32`, `reddit-mcp#1`, `steam-ops#2`, `steam-ops#3`, `deploy#33`, `deploy#36`, `ward#600`. So the broker path and host ward are healthy - only the **advisor** role 125s. ## Direction (needs the host-side dispatch log to confirm) The advisor role differs from engineer in a way that maps straight onto an exit-125: per the roster help, **"the advisor role holds the live-observe guardfile set (tailnet + `~/.aws`) by default; use `--no-tailnet` to stay isolated."** Engineer carries no such mount set. The most likely causes, in order: 1. A **mount that does not exist / is not readable** on this host (a tailnet socket/state path or `~/.aws`) - Docker refuses the run with 125 when a bind source is missing. 2. An advisor-only **image tag or entrypoint** that is absent/unpullable on the host. 3. A guardfile/flag the advisor injects that Docker rejects at `create`/`run`. The decisive evidence is the host-side dispatch log, which a container/surface session cannot read (it lives on the host at e.g. `C:\Users\firem\.ward\agent-logs\dispatch\<ts>-...-ward-601.log`). First diagnostic step: read that log for the `docker: Error response from daemon: ...` line the 125 wraps. ## Impact The advisor role is currently **unusable** - any design/research dispatch (`warded advisor #N "..."`) fails. That removes the "dispatch a sibling to design before an engineer implements" path the director doctrine leans on, forcing either an engineer dispatch (which implements before the design is settled - wrong for design tasks) or doing the research inline. `ward#601` itself is blocked on this: it is a design task that wants an advisor and cannot get one. ## Asks - Read the host dispatch log for a failed advisor run and capture the actual `docker` daemon error the 125 wraps. - Fix the missing-mount / image / guardfile cause so `warded advisor <ref> "..."` launches. - If a required mount (tailnet / `~/.aws`) is legitimately absent on some hosts, the advisor dispatch should **degrade gracefully** (auto `--no-tailnet`, or a clear "advisor needs X, rerun with --no-tailnet" message) instead of a bare `exit status 125` that gives the operator nothing to act on. ## Acceptance - `warded advisor <ref> "question"` launches and runs on this host. - A genuinely missing advisor prerequisite produces an actionable error naming the missing mount/flag, not a bare `exit status 125`. - `ward#601` can then be dispatched to an advisor as intended. ## Refs - Blocked design task: `coilyco-flight-deck/ward#601` (mid-run comment delivery). - Advisor role definition / the tailnet + `~/.aws` guardfile default (roster help, `ward agent advisor`). Provenance: director surface session, 2026-07-04 - hit while dispatching the ward#601 advisor.

coilyco-ops added the

interactive

labels

2026-07-04 17:24:07 +00:00

coilysiren commented

2026-07-06 18:58:25 +00:00

Author

Owner

Closing: fixed in code by ward#597 - the advisor exit-125-at-launch root cause (missing ward-tailnet network for the advisor-only tailnet/~/.aws mount) is created on dispatch now (commit 4cf59d5). Live end-to-end verification on the host is still pending (see #595), so reopen if it recurs. Re-triage 2026-07-06.

Closing: fixed in code by ward#597 - the advisor exit-125-at-launch root cause (missing ward-tailnet network for the advisor-only tailnet/~/.aws mount) is created on dispatch now (commit 4cf59d5). Live end-to-end verification on the host is still pending (see #595), so reopen if it recurs. Re-triage 2026-07-06.

coilysiren closed this issue

2026-07-06 18:58:25 +00:00

coilysiren referenced this issue

2026-07-06 18:58:25 +00:00

advisor ref-mode returns docker exit 125 through the dispatch broker (TTY/attach in non-interactive host-forward context) #605