0 Fork 0

mirror of https://github.com/garrytan/gstack.git synced 2026-10-31 22:14:25 +01:00

Files

T

garrytan 914b3a0b29 CI: no credential-shaped URLs in added lines (quality scan); release floor measured on the merged tree

The quality job's credential scan of the PR diff flagged 7 db.url_with_password
lines: three docs lines now describe the login instead of spelling a URL, and
three tests build the URL from parts. paid-retry-supervision's periodic release
floor is the merged tree's measured 35,711 (main's value; the evals lane's
33,821 predates main's new paid files).

2026-10-03 23:53:59 +00:00

24 KiB

Raw Blame History

Troubleshooting gstack messages

Find the message you saw, then follow its fix. Every check gstack runs ends in one of three states:

ran: the check executed. It may still have found problems.
not run: gstack chose not to run it (you turned it off, or nothing applied).
unavailable: gstack tried and could not run it. This is missing coverage, never a pass.

A message that is not ran has this shape:

<check>: not run (<reason>). Fix: <command>
<check> unavailable: <reason> (<detail>). No review ran; this is missing coverage, not a pass. Fix: <command>
<check>: ran, verdict unverified (<reason>). Fix: read the output above

Search this page for the words after unavailable: or not run (. Each section has a stable link anchor; the reason codes and anchors come from lib/gate-outcomes.ts, and a free test fails if a code has no section here.

Outside reviews (Codex and Claude Code)

Outside reviews send your diff, plan or question to a second AI provider. Their verdict comes from lib/outside-review-result.ts, which prints VERDICT: clean|findings|unverified|unavailable. A findings verdict with a P0 or P1 finding blocks exactly like a native P0/P1. unverified and unavailable are missing coverage: /ship and /review continue, show the gap in the readiness dashboard and the PR body, and never count it as a pass.

`Codex outside review unavailable: Codex's sandbox could not start here (...)`

Meaning. Codex runs every command inside a Linux sandbox (bubblewrap). In many containers and devcontainers the kernel does not allow unprivileged user namespaces, so the sandbox cannot start and every command Codex tries fails. gstack reports this instead of trusting a review that read nothing. CODEX_MODE: sandbox_unavailable is the same condition found by the free preflight before any paid call.

What is kept. Nothing was sent for review, or the review was discarded. Your code and files are unchanged.

Fix. Enable unprivileged user namespaces for the container (for Docker, a seccomp profile that allows them), or, inside a container you trust, run Codex without its sandbox for this shell:

export GSTACK_CODEX_NO_SANDBOX=1

Expected result. With namespaces enabled, the next review prints OUTSIDE_STATUS: completed. With GSTACK_CODEX_NO_SANDBOX=1, every review prints WARNING: GSTACK_CODEX_NO_SANDBOX=1: ... because Codex can then read and write anything your user can. Only the exact value 1 works, and only from your shell environment.

`... outside review unavailable: the reviewer could not run commands or read the diff (...)`

Meaning. The reviewer tried to run commands but none succeeded, or its answer says it could not run commands or read the diff. A "no issues found" written after that is not a review.

What is kept. Nothing; the answer is shown above but not counted.

Fix. Read the reviewer's stderr above, repair what it names, and re-run.

Expected result. OUTSIDE_STATUS: completed with a VERDICT: line.

`... outside review unavailable: the reviewer process failed (exit N: ...)`

Meaning. The provider CLI exited non-zero. The first stderr line is in the parentheses.

What is kept. Partial output is shown above; it is not counted.

Fix. Repair the cause in the provider diagnosis (log in again, fix the model, check the network), then re-run.