{"record":{"id":"6bfa0c645714a2c7","repo":"Hmbown/CodeWhale","slug":"write-capable-fleet-worker-has-no-launch-manifest","errorCode":null,"errorMessage":"write-capable Fleet worker '{}' has no launch manifest","messagePattern":"write-capable Fleet worker '(.+?)' has no launch manifest","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/fleet/executor.rs","lineNumber":220,"sourceCode":") -> Option<u32> {\n    match (task_max_steps(task_spec), exec_config.max_turns) {\n        (Some(task_max_steps), fleet_max_turns) if fleet_max_turns > 0 => {\n            Some(task_max_steps.min(fleet_max_turns))\n        }\n        (Some(task_max_steps), _) => Some(task_max_steps),\n        (None, fleet_max_turns) if fleet_max_turns > 0 => Some(fleet_max_turns),\n        (None, _) => None,\n    }\n}\n\npub(crate) fn authority_envelope_for_worker(\n    spec: &AgentWorkerSpec,\n    task_spec: &FleetTaskSpec,\n) -> Result<ToolAuthorityEnvelope> {\n    let (authority, writable_roots, writable_files, coordination_contracts) =\n        if spec.runtime_profile.permissions.write {\n            let manifest = spec.launch_manifest.as_ref().ok_or_else(|| {\n                anyhow::anyhow!(\n                    \"write-capable Fleet worker '{}' has no launch manifest\",\n                    spec.worker_id\n                )\n            })?;\n            (\n                ToolMutationAuthority::ScopedWrite,\n                super::worker_runtime::fleet_runtime_write_roots(task_spec)?,\n                manifest.writable_files.clone(),\n                manifest.coordination_contracts.clone(),\n            )\n        } else {\n            (\n                ToolMutationAuthority::ReadOnly,\n                Vec::new(),\n                Vec::new(),\n                Vec::new(),\n            )\n        };","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/fleet/executor.rs#L202-L238","documentation":"When building a worker's ToolAuthorityEnvelope, a worker whose runtime profile grants write permissions must carry a launch manifest that scopes its writable roots/files and coordination contracts. A write-capable spec without a launch manifest cannot be safely constrained, so authority construction refuses to proceed.","triggerScenarios":"Calling `authority_envelope_for_worker` (via build_worker_exec_command_with_launch_spec or start_worker_task) with an AgentWorkerSpec whose `runtime_profile.permissions.write` is true but whose `launch_manifest` is None.","commonSituations":"A worker spec built programmatically set permissions.write = true but never attached the launch manifest; a verifier-spec or task template omitted the manifest while requesting write access; config migration dropped the manifest field.","solutions":["Attach the launch manifest to the AgentWorkerSpec before starting a write-capable worker.","If the worker is not supposed to write, set runtime_profile.permissions.write = false so the manifest is unnecessary.","Fix the spec builder/template so write-capable workers always generate a manifest."],"exampleFix":"// before\nlet spec = AgentWorkerSpec { worker_id: \"w1\".into(), runtime_profile: prof_with_write, launch_manifest: None, .. };\n// after\nlet spec = AgentWorkerSpec { worker_id: \"w1\".into(), runtime_profile: prof_with_write, launch_manifest: Some(manifest), .. };","handlingStrategy":"validation","validationCode":"fn ensure_manifest(spec: &AgentWorkerSpec) -> Result<()> {\n    if spec.runtime_profile.permissions.write {\n        anyhow::ensure!(spec.launch_manifest.is_some(), \"write worker needs launch manifest\");\n    }\n    Ok(())\n}","typeGuard":"fn has_write_manifest(spec: &AgentWorkerSpec) -> bool {\n    !spec.runtime_profile.permissions.write || spec.launch_manifest.is_some()\n}","tryCatchPattern":"match build_worker_exec_command(&spec, &task) {\n    Err(e) if e.to_string().contains(\"no launch manifest\") => {\n        log::error!(\"worker {} requested write authority without a manifest\", spec.worker_id);\n        // reject the spec rather than downgrading silently\n    }\n    other => other,\n}","preventionTips":["Make spec builders always produce a manifest when write permission is requested.","Validate worker specs (write => manifest present) before starting tasks.","If a worker only needs read access, do not enable permissions.write."],"tags":["fleet","workers","authority","sandbox","rust"],"backgroundTag":"missing-required-config-field","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}