coding: the prompt's screenshot destination rule demands a push the tool rules refuse — no path exists for a produced image to reach a PR

[justinhelmer]

Two ship children asked to "send me screenshots" (nominal#3537, run 55c2a001; polylanedotcom#382, run 93a175a0; 2026-09-20) posted the PNGs to the Slack thread and the run page only. Their handoff deviations cite the push guard.

Root cause: the coding prompt mandates a destination the tool rules forbid. src/agents/registry.ts:221 (SHOW_FILES, in both coding prompts; agent-coding.md item 10 "destination rule") says: commit the images to an assets branch (never the PR's own diff) and reference them from the description or a PR comment. src/core/harness/pi/toolRules.ts:263–266 judgePush refuses, for a run with a bound branch (every ship child, on branch <unit branch> via spawn.ts:211), any refspec other than ctx.branch: repo:use — push to X, not the run's branch. Evidence: 55c2a001 seq 317–320 tool_refused … assets/badge-version-8; 93a175a0 finding at eventIndex 268 assets/pricing-estimate-buttons refused.

The alternatives are closed too: the run-page artifact proxy (/runs/:id/artifacts/<key>, live-view.md item 26) needs the live ?t= token or an Access actor, so GitHub's camo cannot fetch it; GitHub has no API for user-attachment uploads; github_issue_comment can only reference a URL. So no working path exists, and agent-coding.md's e2e criterion at line 69 is [agent]-class and has never been proven. The vendored skills/pr-description/SKILL.md carries no visual-change screenshot criterion; that rule lives only in the operator's validation rules.

Design flaws. (4) Prompt vs grant contradiction — invariant: no prompt demands a write the tool rules refuse; one spec owns both (agent-coding.md item 10 vs toolRules.ts; authorization.md:128 lists the push target as an open row). (5) No PR-renderable file address — invariant: a produced file has one durable address a PR body can embed (a public artifact URL, or a GitHub-native upload) — live-view item 26, record 0033.

Fix direction (a design decision, not a patch): pick the one destination (a public, token-free artifact URL per produced file is the smallest change that also serves #2102's inbound catalogue), make the prompt say only that, delete the assets-branch sentence, and prove the e2e criterion with one live PR. Related: #2102 (inbound half of the same boundary), #1950, #908.

[justinhelmer]

September 25, 2026, live ship failure and priority reassessment

Boris's nominal ship request explicitly asked for screenshots in the PR. The original Ship 63c74fe2-c995-437c-9a84-27cc8ebe3f75 aborted after zero review rounds because coding run d07d8a06-9f20-44e6-abc7-60b5c5c7ad36 opened no PR. The run first pushed the bound unit branch plan/in-nominal-this-email-is-85b275/u1, then explicit assets-branch pushes were refused by repo:use (events 336 and 351). While checked out on assets/investigation-pacing-email-u1, it later ran git push -u origin HEAD; the run log shows that command created the remote assets branch. The final run record retained only the assets ref 2165e5a7d6d6ae676f9ddb6c30a74397935163c4 as its pushed handoff. The subsequent original-thread reply received Unit U1 does not retain a durable pull request identity rather than a supported continuation.

This turns the existing prompt/grant contradiction into a demonstrated user-facing ship failure: the requested screenshot destination was not available to the bound writer, an auxiliary push displaced the PR handoff, and review never began. Reassess from P2 to P1 delivery reliability. A separate active Switchboard task owns the HEAD alias/branch-ownership fix and Boris's nominal PR recovery; this comment does not start another writer or supersede that work. #2130 still needs one permitted, PR-renderable screenshot destination with an end-to-end receipt, plus a prompt that names only that destination. A guard fix alone will prevent the unsafe auxiliary push but will not satisfy Boris's screenshot-in-PR request.

[coreplane-switchboard]

U1 is held before source edits under the request's reservation guard. Bound ref: plan/implement-p1-issue-2130-4df9fe/u1. Initial and final fetch/rebase completed successfully; GitHub main and the local base both read 1ac78cc04279849632f4873f03749387ce0d1452. Worktree clean, zero commits over main, no push or PR.

Draft #1625 is still open at b0a3c0b6e0c2952875c08c5098691fbf3294841b on codex/linear-agent (author: @matanyall). Its changed-file list overlaps src/agents/registry.ts, src/artifacts/store.ts, src/artifacts/keys.ts, src/artifacts/keys.test.ts, src/tools/attach.ts, src/tools/attach.test.ts, src/core/types.ts, src/index.ts, and docs/reference/specs/{agent-coding,authorization,execution}.md. No source-reservation agreement was supplied in this unit or found in that PR's discussion (zero discussion comments); this is not a claim that no agreement exists elsewhere.

Live Ship/run ownership could not be verified: credential-free /runs and /api/runs.list reads return HTTP 302, no live-runs/MCP tool is connected, and the credential guard refuses shell credential access. The contract establishes U1 and its ref, not an independently verified parent Ship run ID. No competing writer or replacement Ship was started.

Unblock owner: the parent runner/requester, coordinating with #1625's owner. Release condition: obtain authenticated live owner/run/unit facts and an explicit source reservation or handoff covering the shared implementation, tests and specs, then re-admit this same unit. Recheck main, the draft head/path overlap and live ownership at re-admission, before any edit; do not automatically retry while held.

HEAD-alias containment is already on main in 8b5d4701 (#2365); it was not duplicated. Decision 0074 is not a prerequisite. Release #2379 remains unmerged and its requested hold is untouched. No implementation gates or live screenshot acceptance were run, and no live proof is claimed.

[coreplane-switchboard]

Replacement implementation admitted under the new request in the requesting Slack thread. Contract unit: U1; bound ref: plan/agent-ship-implement-p1-e2f2f0/u1. The required initial fetch/rebase onto main passed at 4d95b8aa. This is not a continuation of plan-implement-p1-issue-2130-4df9fe:U1; that old unit/ref is untouched. The request explicitly waives the draft #1625 reservation prerequisite for this replacement.

The new run UUID and canonical parent/unit linkage are not exposed by this coding child's available tools; the parent Ship runner must stamp those durable identifiers rather than have the child invent them. Implementation is in progress: explicit PNG publication after attach_file thread delivery, through a separate token-free public-copy route while the R2 bucket and ordinary run-artifact reader remain private. Exact-head review and CI remain parent Ship gates; live PR rendering remains deployment-gated. Decision 0074 and HEAD-alias containment are not part of this change. Release #2379 remains untouched and held.

[justinhelmer]

Live screenshot destination receipt — v1.264.0

The deployed bot reports version 1.264.0 at release commit 3f965ac7812604e62bd3e7df613ccf72ee665615 (release run). Draft probe PR #2393 is closed, unmerged, and at head 8484a5aa40eca58860375fa772d9d16faa09ffe2.

Positive publication: Run 05836fe7-50ed-46a2-b355-9e2f927b7ee4 attached harmless synthetic 2880×1800 light/dark PNGs inline in the requesting Slack thread (files F0C5G4DSX4Y, F0C4PMGUDBK). Each publication returned a distinct token-free URL:

• Light: https://switchboard.coreplanelabs.dev/pr-images/ee42d277-24fd-4793-a80d-73d69184e802.png
• Dark: https://switchboard.coreplanelabs.dev/pr-images/0de98406-2a7c-4b29-ab89-005be8e2d4d7.png

The PR body and receipt comment contain both Markdown images. GitHub bodyHTML rendered two camo images; anonymous camo GET returned 200 image/png. Direct anonymous GET/HEAD of both originals returned 200 after run completion with image/png, inline, nosniff, no-store, and SHA-256 matching the source fixtures. A guessed public UUID and inbound-shaped path returned 404; a private run-artifact path redirected to Cloudflare Access; unauthenticated internal publication returned 401; the wrong public method returned 405.

Storage read-back: Polylane's connected Cloudflare API returned HTTP 200: the managed R2 domain is disabled, no custom domains exist, and enabled lifecycle rules delete objects after 30 days and abort multipart uploads after one day. The public copies carry the expected source keys, MIME, and expiry metadata. The separate local CLI token received 403 for artifacts check.

Negative publication: Run ad66d74d-16f0-43b3-83fe-241d8655585b used a harmless 192-byte SVG named invalid-markup.png and a structurally valid 12,585,988-byte PNG. Publishing the invalid file attached it privately, then failed HTTP 400 without a public URL (Slack file F0C4KS7SCS2). Publishing the oversized PNG failed preflight with PR images take at most 10485760 bytes; a separate private-only attachment succeeded (Slack file F0C4MM2QQG2). A complete published-pr/ R2 listing showed no public copy sourced from either negative run.

Revocation passed — 2026-09-26 03:45 UTC: After the operator action, independent anonymous GET and HEAD on the light public URL each returned 404. The dark control URL still returned 200 image/png for both methods. Polylane Cloudflare R2 listing no longer contains published-pr/ee42d277-24fd-4793-a80d-73d69184e802.png; it still contains the dark public copy. Both original runs/05836fe7-50ed-46a2-b355-9e2f927b7ee4/out/ objects remain in the private bucket. An unauthenticated HEAD to the light run-artifact path still redirects to Cloudflare Access (302). External caches may retain previously fetched bytes. The dark test copy was subsequently deleted. At 2026-09-26 03:49 UTC, anonymous GET and HEAD on both original public URLs returned 404; a complete published-pr/ R2 listing contained neither test copy. Both private source objects remained in runs/05836fe7-50ed-46a2-b355-9e2f927b7ee4/out/.

Remaining live gate: One-day expiry still needs a disposable deployment, the stored expiresAt, R2 object presence at that deadline, and anonymous GET/HEAD 404. The connected Polylane coreplane-infra account remains read-only and its automatic safety review had rejected the earlier direct DELETE attempt; the operator action supplied the revocation proof above. No disposable Switchboard Worker or bucket was visible in the connected account. Keep this issue open; test PR #2393 is closed and unmerged.

Disposition — 2026-09-26: The requester deferred the disposable one-day expiry test as not worth setting up right now. No live expiry receipt exists, so that criterion remains unverified. Issue #2130 stays open as the recorded gap; no further deployment is planned for this probe now.