Repair review gate auth failures blocking warded PR workflow #764

New issue

Closed

opened 2026-07-09 05:27:42 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-09 05:27:42 +00:00

Member

Multiple warded runs on 2026-07-09 are blocked after producing useful branches because the in-container review gate cannot authenticate any reviewer. Observed threads:

coilyco-flight-deck/agentic-os#362: WARD-OUTCOME: blocked - review summary: blocked: codex: exit status 1; Codex, Claude, and Goose all failed.
coilyco-flight-deck/ward#760: same review panel failure after the branch/PR work.
coilyco-flight-deck/ward#763: same review panel failure while trying to fix the dispatch broker.

Impact: the default pr workflow can produce code but then parks the issue blocked or creates salvage noise. This is a full lane stoppage until reviewers can run or the failure is at least actionable.

Acceptance criteria:

Reproduce the failing ward agent review path from a warded container or a narrow test harness, enough to capture the real stderr/reason instead of only exit status 1.
Fix reviewer credential/model config injection for Codex/Claude/Goose if it is missing, or make auth-unavailable failures report the exact missing credential/smoke gate in the WARD-OUTCOME comment.
Keep fail-closed semantics for real review failures, but do not leave operators with an opaque all-reviewers-auth-dead result.
Add coverage for the failure classification/logging path.
Validate with ward exec test and the narrow review-related tests. Use --skip-review for this emergency repair run if needed, because the review gate itself is the broken subsystem.

Closes this issue only after default warded PR workflow is no longer blocked by opaque reviewer auth failures.

Multiple warded runs on 2026-07-09 are blocked after producing useful branches because the in-container review gate cannot authenticate any reviewer. Observed threads: * `coilyco-flight-deck/agentic-os#362`: `WARD-OUTCOME: blocked - review summary: blocked: codex: exit status 1`; Codex, Claude, and Goose all failed. * `coilyco-flight-deck/ward#760`: same review panel failure after the branch/PR work. * `coilyco-flight-deck/ward#763`: same review panel failure while trying to fix the dispatch broker. Impact: the default `pr` workflow can produce code but then parks the issue blocked or creates salvage noise. This is a full lane stoppage until reviewers can run or the failure is at least actionable. Acceptance criteria: * Reproduce the failing `ward agent review` path from a warded container or a narrow test harness, enough to capture the real stderr/reason instead of only `exit status 1`. * Fix reviewer credential/model config injection for Codex/Claude/Goose if it is missing, or make auth-unavailable failures report the exact missing credential/smoke gate in the `WARD-OUTCOME` comment. * Keep fail-closed semantics for real review failures, but do not leave operators with an opaque all-reviewers-auth-dead result. * Add coverage for the failure classification/logging path. * Validate with `ward exec test` and the narrow review-related tests. Use `--skip-review` for this emergency repair run if needed, because the review gate itself is the broken subsystem. Closes this issue only after default warded PR workflow is no longer blocked by opaque reviewer auth failures.

coilyco-ops commented

2026-07-09 05:28:14 +00:00

Author

Member

🔒 Reserved by ward agent --harness codex — container engineer-codex-ward-764 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-09T05:28:13Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#764 · branch issue-764 · harness codex · workflow pr
Run: engineer-codex-ward-764 · ward v0.474.0 · dispatched 2026-07-09T05:28:13Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.474.0).

— Codex, via ward agent

🔒 Reserved by `ward agent --harness codex` — container `engineer-codex-ward-764` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-09T05:28:13Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#764` · branch `issue-764` · harness `codex` · workflow `pr` - **Run:** `engineer-codex-ward-764` · ward `v0.474.0` · dispatched `2026-07-09T05:28:13Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.474.0). </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-09 05:36:01 +00:00

Repair review gate auth failures blocking warded PR workflow #766

coilyco-ops commented

2026-07-09 05:36:14 +00:00

Author

Member

WARD-OUTCOME: done - review gate stderr now carries auth/config failure detail in blocked reviewer summaries
workflow: pr; review summary: review gate skipped by --skip-review / --no-review-gate
The fix was straightforward once I traced the reviewer runner to Capture and saw stderr was only going to the terminal, not the structured result.
The only snag was ward exec test needing a writable HOME, which was environmental rather than code-related.
Confidence is high. The remaining rough edge is that auth failures still surface as raw stderr, so a later pass could add a more explicit semantic tag if operators want one.

WARD-OUTCOME: done - review gate stderr now carries auth/config failure detail in blocked reviewer summaries workflow: pr; review summary: review gate skipped by --skip-review / --no-review-gate The fix was straightforward once I traced the reviewer runner to `Capture` and saw stderr was only going to the terminal, not the structured result. The only snag was `ward exec test` needing a writable `HOME`, which was environmental rather than code-related. Confidence is high. The remaining rough edge is that auth failures still surface as raw stderr, so a later pass could add a more explicit semantic tag if operators want one.

coilyco-ops closed this issue

2026-07-09 06:18:52 +00:00