Make Docker Lint Runs Bounded and Observable

[ptr727]

Problem

The Docker lint authorization guidance from #866 narrows repository exposure, but the documented workflow can still appear stuck to the maintainer. An agent pulls several images and then runs several containers that can produce no output on success. The instructions do not require a timeout, a per-linter completion marker, a checked-file count, or a progress update between the pull and run phases.

This has now been reported as a recurring agent stall during pre-push verification. A maintainer may interrupt the turn because there is no visible distinction between a healthy quiet linter, a Docker bind problem, and an agent that has not started the lint commands.

Observed evidence

In HomeAutomation-Config worktree HomeAutomation-Config-github-runners:

• all five image pulls completed in 5.9 seconds
• the turn was interrupted before any docker run command started
• no orphaned lint container or process existed after the interruption
• a bounded reproduction using the exact absolute worktree path, a read-only mount, disabled networking, and the resolved editorconfig-checker digest completed successfully in 3.4 seconds
• editorconfig-checker produced no stdout on success

The evidence disproves a wrong bind path for this occurrence. It shows that the current procedure gives the maintainer too little evidence about which phase is active and whether a quiet command completed.

Expected behavior

Make the standard agent-facing Docker lint procedure bounded and observable:

• require a bounded timeout for every container invocation
• emit a start and completion line for each linter
• report the checked-file count where the tool supports it
• keep pull and execution as separate phases
• require a concise progress update after image pulls and before repository mounts
• distinguish timeout, container failure, zero-target execution, and successful quiet completion

Prefer a hub-hosted wrapper that implements this consistently instead of requiring each agent to reconstruct five commands and their reporting behavior.

Relevant surfaces

• .agents/skills/comment-and-doc-style/SKILL.md
• GOVERNANCE.md restricted-executor and local-lint instructions
• hub-hosted lint tooling, if a wrapper is added
• generated skill distributions

Related

• Clarify Docker Lint Authorization in Agent Skills #866 addressed Docker repository-exposure authorization, read-only mounts, disabled networking, and digest-pinned execution. This issue covers bounded execution and maintainer-visible progress after that authorization model is in place.

[ptr727]

Fixed by the verified squash merge in #888 (2cfc3fe).