Implement stale model-config launch gates for live WARD_CONFIG_REF #670

New issue

Closed

opened 2026-07-08 09:49:26 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-08 09:49:26 +00:00

Member

Follow-up from #658 under the config-driven ward epic (#650). The advisor recommendation is accepted for implementation: a stale per-harness model value from live WARD_CONFIG_REF should fail loud before launch, not silently fall back to a harness default.

Do

Add harness-owned pre-launch validation for resolved model config.
claude: when the resolved WARD_CLAUDE_MODEL is non-empty, extend the existing pre-launch/auth smoke path to probe with that --model and classify unknown/invalid model as a distinct config failure. Do not retry without --model.
codex: add codex's first bounded pre-launch check that exercises the resolved model/config enough to catch codex's own unknown-model rejection. Do not retry with the model removed.
opencode: extend the Ollama gate from endpoint reachability to endpoint + configured-model existence. A reachable Ollama with missing model is stale config, not success.
goose: no new validation unless the fleet config starts carrying a goose model field.
Surface the failure as a named gate/recovery path such as model-config, so the operator is told to update the fleet model string or pin WARD_CONFIG_REF to a compatible ref.

Policy

If a resolved per-harness model value is invalid for the selected harness, ward aborts at a harness-owned pre-launch gate. Ward does not silently fall back to the harness default.

Validate

Add unit tests for each new gate/classification path.
Run ward exec test.

Closes #658 when implemented.

Follow-up from #658 under the config-driven ward epic (#650). The advisor recommendation is accepted for implementation: a stale per-harness model value from live `WARD_CONFIG_REF` should fail loud before launch, not silently fall back to a harness default. ## Do - Add harness-owned pre-launch validation for resolved model config. - `claude`: when the resolved `WARD_CLAUDE_MODEL` is non-empty, extend the existing pre-launch/auth smoke path to probe with that `--model` and classify unknown/invalid model as a distinct config failure. Do not retry without `--model`. - `codex`: add codex's first bounded pre-launch check that exercises the resolved model/config enough to catch codex's own unknown-model rejection. Do not retry with the model removed. - `opencode`: extend the Ollama gate from endpoint reachability to endpoint + configured-model existence. A reachable Ollama with missing model is stale config, not success. - `goose`: no new validation unless the fleet config starts carrying a goose model field. - Surface the failure as a named gate/recovery path such as `model-config`, so the operator is told to update the fleet model string or pin `WARD_CONFIG_REF` to a compatible ref. ## Policy If a resolved per-harness model value is invalid for the selected harness, ward aborts at a harness-owned pre-launch gate. Ward does not silently fall back to the harness default. ## Validate - Add unit tests for each new gate/classification path. - Run `ward exec test`. Closes #658 when implemented.

coilyco-ops commented

2026-07-08 09:49:50 +00:00

Author

Member

🔒 Reserved by ward agent --harness codex — container engineer-codex-ward-670 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-08T09:49:48Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#670 · branch issue-670 · harness codex · workflow direct-main
Run: engineer-codex-ward-670 · ward v0.449.0 · dispatched 2026-07-08T09:49:48Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Issue body as seeded:

Follow-up from #658 under the config-driven ward epic (#650). The advisor recommendation is accepted for implementation: a stale per-harness model value from live `WARD_CONFIG_REF` should fail loud before launch, not silently fall back to a harness default.

## Do

- Add harness-owned pre-launch validation for resolved model config.
- `claude`: when the resolved `WARD_CLAUDE_MODEL` is non-empty, extend the existing pre-launch/auth smoke path to probe with that `--model` and classify unknown/invalid model as a distinct config failure. Do not retry without `--model`.
- `codex`: add codex's first bounded pre-launch check that exercises the resolved model/config enough to catch codex's own unknown-model rejection. Do not retry with the model removed.
- `opencode`: extend the Ollama gate from endpoint reachability to endpoint + configured-model existence. A reachable Ollama with missing model is stale config, not success.
- `goose`: no new validation unless the fleet config starts carrying a goose model field.
- Surface the failure as a named gate/recovery path such as `model-config`, so the operator is told to update the fleet model string or pin `WARD_CONFIG_REF` to a compatible ref.

## Policy

If a resolved per-harness model value is invalid for the selected harness, ward aborts at a harness-owned pre-launch gate. Ward does not silently fall back to the harness default.

## Validate

- Add unit tests for each new gate/classification path.
- Run `ward exec test`.

Closes #658 when implemented.

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.449.0).

— Codex, via ward agent

🔒 Reserved by `ward agent --harness codex` — container `engineer-codex-ward-670` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-08T09:49:48Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#670` · branch `issue-670` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-ward-670` · ward `v0.449.0` · dispatched `2026-07-08T09:49:48Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). **Issue body as seeded:** ``` Follow-up from #658 under the config-driven ward epic (#650). The advisor recommendation is accepted for implementation: a stale per-harness model value from live `WARD_CONFIG_REF` should fail loud before launch, not silently fall back to a harness default. ## Do - Add harness-owned pre-launch validation for resolved model config. - `claude`: when the resolved `WARD_CLAUDE_MODEL` is non-empty, extend the existing pre-launch/auth smoke path to probe with that `--model` and classify unknown/invalid model as a distinct config failure. Do not retry without `--model`. - `codex`: add codex's first bounded pre-launch check that exercises the resolved model/config enough to catch codex's own unknown-model rejection. Do not retry with the model removed. - `opencode`: extend the Ollama gate from endpoint reachability to endpoint + configured-model existence. A reachable Ollama with missing model is stale config, not success. - `goose`: no new validation unless the fleet config starts carrying a goose model field. - Surface the failure as a named gate/recovery path such as `model-config`, so the operator is told to update the fleet model string or pin `WARD_CONFIG_REF` to a compatible ref. ## Policy If a resolved per-harness model value is invalid for the selected harness, ward aborts at a harness-owned pre-launch gate. Ward does not silently fall back to the harness default. ## Validate - Add unit tests for each new gate/classification path. - Run `ward exec test`. Closes #658 when implemented. ``` Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.449.0). </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue

2026-07-08 09:51:57 +00:00

Config-driven ward: per-harness model-config validation - fall back vs fail (#650-6, design fork) #658

coilyco-ops referenced this issue

2026-07-08 09:51:57 +00:00

[epic] Config-driven ward: one precompiled binary, personal config resolved live from a git ref (supersedes the build-variant matrix) #650

coilyco-ops referenced this issue from a commit

2026-07-08 10:08:02 +00:00

Implement stale model-config launch gates

coilyco-ops closed this issue

2026-07-08 10:08:02 +00:00

coilyco-ops commented

2026-07-08 10:09:45 +00:00

Author

Member

WARD-OUTCOME: done - stale model-config launch gates landed for claude, codex, and opencode
PR-BODY-NOTE: ADVISORY-ONLY REVIEW: no heterogeneous reviewer family was available besides the worker (codex), so the adversarial panel could not run and did NOT gate this diff. Dropped: opencode (unavailable: opencode not on PATH); codex (worker's own family - never reviews its own diff). A human should review this change with the extra scrutiny an unrun panel would have applied.
The change was straightforward once I split model validation from reachability. The main friction was the repo's comment and doc guards plus the panel being advisory-only because opencode was unavailable. Confidence is good, but I would still watch live codex auth behavior for drift.

WARD-OUTCOME: done - stale model-config launch gates landed for claude, codex, and opencode PR-BODY-NOTE: ADVISORY-ONLY REVIEW: no heterogeneous reviewer family was available besides the worker (codex), so the adversarial panel could not run and did NOT gate this diff. Dropped: opencode (unavailable: opencode not on PATH); codex (worker's own family - never reviews its own diff). A human should review this change with the extra scrutiny an unrun panel would have applied. The change was straightforward once I split model validation from reachability. The main friction was the repo's comment and doc guards plus the panel being advisory-only because opencode was unavailable. Confidence is good, but I would still watch live codex auth behavior for drift.