[CI] CI workflow failing on main and feat/federate — Chrome binary missing from Docker image (supervisor fails to spawn google-chrome)

[cerebral-work]

Summary

The CI workflow has been failing on main since at least 2026-07-13 (commit 0f883f72) and continues to fail on the current HEAD (d1ad313b, 2026-07-16). The same failure also occurs on the feat/federate branch (a7e3578f). All 39 E2E tests fail as a cascade.

Affected Runs

Run ID	Date	Branch	SHA
29469385559	2026-07-16	main	d1ad313b
29469107508	2026-07-16	feat/federate	a7e3578f
29232051436	2026-07-13	main	0f883f72

The last known passing CI run on main was sha e09ec977 (2026-04-07).

Failing Jobs

Supervisor Health (job 87529801011)

The container starts successfully (Docker build passes), but the reach-supervisor crashes immediately after attempting to spawn google-chrome:

Error: failed to start managed processes

Caused by:
    0: failed to spawn chrome
    1: No such file or directory (os error 2)

The supervisor process log shows all other processes start successfully:

• xvfb (pid 11) ✅
• openbox (pid 14) ✅
• x11vnc (pid 15) ✅
• novnc/websockify (pid 16) ✅
• chrome → FAIL — google-chrome binary not found

The health poll (curl -sf http://localhost:8400/health) times out after 30 seconds and the step fails.

E2E Tests (job 87529801016)

All 39 tests fail with cascading panics:

thread 't01_health_json' panicked at crates/reach-cli/tests/e2e_container.rs:22:10:
Once instance has previously been poisoned

This is because the test setup uses a Once cell to initialize the container connection; when the first test fails (health check), all subsequent tests inherit the poisoned state.

Failed tests include: t01_health_json, t02_four_processes_running, t16_chrome_version, t17_chrome_headed, t18_chrome_headless_dom, t19_chrome_click_navigates, t20_playwright_import … and 32 more.

test result: FAILED. 0 passed; 39 failed; 0 ignored; 0 measured; 0 filtered out; finished in 32.17s

Root Cause Hypothesis

google-chrome is not present in the Docker image at the path expected by reach-supervisor. This is an image packaging regression — either:

1. The Dockerfile step that installs Chrome was removed or broken in a recent commit.
2. The Chrome install script changed its install path, leaving the binary somewhere other than where the supervisor looks for it (/usr/bin/google-chrome or similar).
3. A base image update changed the available package repository or package name.

Since the failure affects both main (multiple commits) and feat/federate, it is likely a Dockerfile-level issue rather than a code-level issue.

The Docker Build job itself passes (exit 0), meaning the image builds successfully — Chrome is likely installed but not at the path the supervisor resolves, or its wrapper script is broken post-build.

Suggested Fix Direction

• Inspect the Dockerfile Chrome installation step — confirm google-chrome is installed and verify its path in the image with which google-chrome or ls /usr/bin/google-chrome*.
• Check if a recent apt/snap/flatpak-based Chrome install changed the binary path (e.g., google-chrome-stable vs google-chrome, or moved to /opt/google/chrome/chrome).
• Add a RUN which google-chrome || exit 1 assertion to the Dockerfile to catch this at build time.
• Check the supervisor config for the chrome command path — it may need to be updated to the new binary location.

Filed by CI/Ops Watchdog — 2026-07-16

[cerebral-work]

CI/Ops Watchdog update — 2026-07-16T08:00Z

Chrome spawn failure persists unchanged across all recent runs:

Run ID	Branch	SHA	Date	Result
29469385559	main	d1ad313	2026-07-16	❌ Supervisor Health: failed to spawn chrome
29469107508	feat/federate	(latest)	2026-07-16	❌ Supervisor Health: failed to spawn chrome
29232051436	main	(0f883f7)	2026-07-13	❌ Same

Confirmed error from run 29469385559 log:

starting process name="chrome" cmd="google-chrome"
Error: failed to start managed processes
Caused by:
    0: failed to spawn chrome
    1: No such file or directory (os error 2)

The terrarium federation standards commit (d1ad313, 2026-07-16) did not touch the Dockerfile or supervisor — CI failure pattern is unchanged. All other jobs (Deny, Clippy, Build, Format, Unit Tests, Docker Build) still pass; only Supervisor Health and E2E cascade fail.

No passing CI runs since sha e09ec97 (2026-04-07). Last introduced by sha 0f883f7 (2026-07-13, feat: scraper MCP tools, self-healing agent loop, CDP proxy contexts).