fix(dab): run main compose service as root (0:0)

[kentwelcome]

Problem

DAB tasks fail under Harbor's codex runtime with:

Permission denied (os error 13)

The codex runtime's setup runs as root and pre-creates root-owned
/logs/agent and $CODEX_HOME, then Harbor runs the agent as the
image's default USER. dab-agent:latest ships USER exedev
(non-root), so the agent cannot write those root-owned dirs and codex
aborts before doing any work. ade-bench's images run as root, so they
never hit this — which is why the failure is DAB-specific.

Fix

Pin the generated main compose service to user: "0:0" so the agent
runs as root and can write the pre-created dirs, matching the root
images ade-bench runs successfully.

services:
  main:
    image: dab-agent:latest
    working_dir: /workspace
    user: "0:0"

Design note — why hardcoded, not spec-driven

Needing root is a property of the codex runtime contract (the
runtime pre-creates root-owned dirs for every DAB task), not a
per-task or per-dataset variable. So this is hardcoded at the compose
layer alongside the other fixed defaults (POSTGRES_USER,
DEFAULT_AGENT_IMAGE) rather than threaded as config with no consumer.
If a future non-codex runtime needs a non-root agent, the clean seam is
a run_as_user: str | None = "0:0" param through
prepare_dataset_tasks → generate_compose (omit the key when None) —
out of scope for this bugfix.

Test

Adds test_main_service_runs_as_root asserting the emitted main
service carries user: "0:0".

$ uv run pytest packages/razorback-plugin-dab/tests/unit/test_compose_postgres.py -q
5 passed

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes DAB task failures under Harbor’s codex runtime by ensuring the generated main docker-compose service runs as root (user: "0:0"), allowing it to write to root-owned directories that the runtime pre-creates.

Changes:

• Set services.main.user to "0:0" in the generated compose YAML.
• Add a unit test asserting the emitted main service runs as root.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
packages/razorback-plugin-dab/src/razorback_plugin_dab/generate/compose.py	Pins the main service to run as root (user: "0:0") to avoid permission errors in codex runtime.
packages/razorback-plugin-dab/tests/unit/test_compose_postgres.py	Adds coverage to ensure main.user is emitted as "0:0".

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.