coilyco-flight-deck/ward

Fork 0

Fix `warded director --repo` startup for private Forgejo repos. #937

New issue

Closed

opened 2026-07-10 04:18:06 +00:00 by coilyco-ops · 4 comments

coilyco-ops commented

2026-07-10 04:18:06 +00:00

Member

Fix warded director --repo startup for private Forgejo repos.

Observed command:

warded director --driver codex --repo coilyco-bridge/deploy
ward agent director --harness codex: note: codex self-assessment unavailable; skipping startup triage.
ward: ward agent director --harness codex: forgejo: list open issues in coilyco-bridge/deploy: forgejo GET /api/v1/repos/coilyco-bridge/deploy/issues returned 404 Not Found after 106 byte(s): "{\"message\":\"The target couldn't be found.\",\"url\":\"https://forgejo.coilysiren.me/api/swagger\",\"errors\":[]}"

Reproduction from a read-only director surface:

curl https://forgejo.coilysiren.me/api/v1/repos/coilyco-bridge/deploy/issues?state=open
# public:404

curl -H "Authorization: token $FORGEJO_TOKEN" https://forgejo.coilysiren.me/api/v1/repos/coilyco-bridge/deploy/issues?state=open
# auth:200

WARD_CONFIG_REF=forgejo.coilysiren.me/coilyco-flight-deck/agentic-os@main//.ward \
  warded director --driver codex --repo coilyco-bridge/deploy --print
# same 404 as above

Diagnosis:

coilyco-bridge/deploy exists and is private.
Forgejo deliberately returns 404 for unauthenticated or under-scoped reads of private repos.
The director startup issue-list path is not using the available Forgejo token, even when the environment has FORGEJO_TOKEN and the live config ref is set.

Acceptance:

warded director --harness codex --repo coilyco-bridge/deploy --print can list/open the director plan for a private Forgejo repo when FORGEJO_TOKEN is available.
The fix uses the same token-resolution contract as other Forgejo agent paths, without leaking the token to logs.
Add or update a focused test around director startup issue listing for private Forgejo repos or Forgejo auth header propagation.
Keep the Codex self-assessment skip behavior unchanged.

Filed by ward agent engineer --harness codex.

— Codex, via ward agent

Fix `warded director --repo` startup for private Forgejo repos. Observed command: ```text warded director --driver codex --repo coilyco-bridge/deploy ward agent director --harness codex: note: codex self-assessment unavailable; skipping startup triage. ward: ward agent director --harness codex: forgejo: list open issues in coilyco-bridge/deploy: forgejo GET /api/v1/repos/coilyco-bridge/deploy/issues returned 404 Not Found after 106 byte(s): "{\"message\":\"The target couldn't be found.\",\"url\":\"https://forgejo.coilysiren.me/api/swagger\",\"errors\":[]}" ``` Reproduction from a read-only director surface: ```text curl https://forgejo.coilysiren.me/api/v1/repos/coilyco-bridge/deploy/issues?state=open # public:404 curl -H "Authorization: token $FORGEJO_TOKEN" https://forgejo.coilysiren.me/api/v1/repos/coilyco-bridge/deploy/issues?state=open # auth:200 WARD_CONFIG_REF=forgejo.coilysiren.me/coilyco-flight-deck/agentic-os@main//.ward \ warded director --driver codex --repo coilyco-bridge/deploy --print # same 404 as above ``` Diagnosis: - `coilyco-bridge/deploy` exists and is private. - Forgejo deliberately returns 404 for unauthenticated or under-scoped reads of private repos. - The director startup issue-list path is not using the available Forgejo token, even when the environment has `FORGEJO_TOKEN` and the live config ref is set. Acceptance: - `warded director --harness codex --repo coilyco-bridge/deploy --print` can list/open the director plan for a private Forgejo repo when `FORGEJO_TOKEN` is available. - The fix uses the same token-resolution contract as other Forgejo agent paths, without leaking the token to logs. - Add or update a focused test around director startup issue listing for private Forgejo repos or Forgejo auth header propagation. - Keep the Codex self-assessment skip behavior unchanged. --- Filed by `ward agent engineer --harness codex`.  — Codex, via `ward agent`

coilyco-ops commented

2026-07-10 04:18:08 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-ward-937 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T04:18:08Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#937 · branch issue-937 · harness codex · workflow pull-requests
Run: engineer-codex-ward-937 · ward v0.555.0 · dispatched 2026-07-10T04:18:08Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.555.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-ward-937` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T04:18:08Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#937` · branch `issue-937` · harness `codex` · workflow `pull-requests` - **Run:** `engineer-codex-ward-937` · ward `v0.555.0` · dispatched `2026-07-10T04:18:08Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.555.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-10 04:21:47 +00:00

Author

Member

WARD-RESERVATION: released 🛑

release details

Run never started. ward container reap released container ward (--harness codex): it exited without launching the agent (smoke-test death, ward#222/#264/#595), so it did no work and the hold it took is retracted. Nothing is running on this issue. It needs re-dispatch. A ward agent director re-queues it automatically. A manual ward agent retry no longer needs --force.

— Codex, via ward agent

WARD-RESERVATION: released 🛑 <details><summary>release details</summary> Run never started. `ward container reap` released container `ward` (`--harness codex`): it exited without launching the agent (smoke-test death, ward#222/#264/#595), so it did no work and the hold it took is retracted. Nothing is running on this issue. It needs re-dispatch. A `ward agent director` re-queues it automatically. A manual `ward agent` retry no longer needs `--force`. </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-10 04:22:44 +00:00

Author

Member

WARD-RESERVATION: released 🛑

release details

— Codex, via ward agent

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-10 04:23:58 +00:00

Fix director private Forgejo startup auth #938

coilyco-ops commented

2026-07-10 04:24:53 +00:00

Author

Member

WARD-OUTCOME: submitted

details

workflow: pull-request; review summary: skipped because review gate skipped by ~/.ward/config.yaml default
implementation: pinned Forgejo auth at director client construction so private repo startup refreshes inherit the token
felt: tight and mechanical
confidence: high
surprise: none
follow-ups: none

WARD-OUTCOME: submitted <details><summary>details</summary> workflow: pull-request; review summary: skipped because review gate skipped by ~/.ward/config.yaml default implementation: pinned Forgejo auth at director client construction so private repo startup refreshes inherit the token felt: tight and mechanical confidence: high surprise: none follow-ups: none </details>