fix(sandcastle): unset checkout's extraheader before push + upload redacted agent logs - #61
Merged
Merged
Conversation
The first live agent:implement run (issue #56) failed at the fail-loud open-pr verification — the implementer committed, but the in-sandbox `git push` never landed and the open-pr phase claimed COMPLETE anyway. The transcript that would explain WHY lives in .sandcastle/logs/, which died with the runner: unlike connector's hardened agent-implement.yml, buzz's copy never uploaded the agent logs. Port connector's proven redact-then-upload pair (the block#462 sweep shape): - Redact credentials from agent logs (always()): three-pass redaction — exact values of the job's secrets, known token/key shapes, and labelled private keys / BIP-39 mnemonics. Buzz-specific addition: bech32 Nostr secret keys (nsec1...) join the shape pass. - Upload agent logs (always(), 14-day retention): the failure cases are exactly the ones that need the artifact. Artifact redaction before upload is mandatory here — this is a public repo, and Actions masks secrets only in step logs, not artifact contents. No runner behavior changes; the two new steps are observation-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Root cause of the first live agent:implement failure (issue #56, run 30751704405): actions/checkout persists an `AUTHORIZATION: basic` extraheader carrying the workflow's READ-ONLY job token in the repo-local git config; the engine bind-mounts the whole `.git` into the sandbox; and an explicit header BEATS any credential helper. So `gh auth setup-git` alone is not enough — the in-sandbox `git push` authenticated as the read-only token and was rejected, while `gh` API calls (which read GH_TOKEN directly) kept working. That is exactly the observed asymmetry: the implementer's issue comment landed, the branch push did not. Every other factory repo (relay/store/connector/toon/swap/rig/ toon-client/fractal) pairs `gh auth setup-git` with `git config --unset-all 'http.https://github.com/.extraheader'` in its onSandboxReady hook — buzz's scaffold dropped that line. Restore the org-wide pattern in the three pushing runners (agent-implement-issue, agent-review-pr, main). plan-dry-run stays plain, matching relay (the planner never pushes). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ALLiDoizCode
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first live
agent:implementrun on this repo (issue #56, run 30751704405) hit the fail-loud open-pr verification: the implementer committed (it even left its progress comment on #56), but the in-sandboxgit pushnever landed on origin and the open-pr phase reported COMPLETE anyway. The runner correctly failed the job — but the open-pr transcript that would explain why the push failed lives in.sandcastle/logs/, which is discarded with the runner. buzz's workflow never uploaded it.This ports connector's proven redact-then-upload step pair (from the block#462 sweep) into
agent-implement.yml:if: always()): three-pass redaction — exact secret values held by the job, known token/key shapes (with a buzz-specificnsec1...Nostr-key pattern added), and labelled private keys / BIP-39 mnemonics. Mandatory before upload: this repo is public, and Actions masks secrets in step logs but NOT in artifact contents.if: always(), 14-day retention): the failure cases are exactly the ones that need the artifact.Observation-only — no change to guard, runner, or engine behavior. Next
agent:implementretry on #56 will leave a diagnosable artifact if it fails again.Part of the toon-meta#256 hardening tail (buzz factory row liveness).
🤖 Generated with Claude Code