code-fleet-watch: policy findings

coilyco-ops commented

2026-07-29 03:23:52 +00:00

Member

This issue is maintained automatically by code-fleet-watch.

Current product-policy findings:

!product:aos@coilyco-flight-deck/agent-proxy@AGENTS.md
!product:aos@coilyco-flight-deck/agent-proxy@docs/proxy.md
!product:aos@coilyco-flight-deck/agent-proxy@docs/roadmap-rules.md
!product:aos@coilyco-flight-deck/agent-proxy@tests/test_trajectory_agent_compose.py
!product:repo-agentic-os-hardware@coilyco-flight-deck/agent-proxy@AGENTS.md
!product:repo-agentic-os-hardware@coilyco-flight-deck/agent-proxy@docs/proxy-num-ctx.md
!product:repo-agentic-os-hardware@coilyco-flight-deck/agent-proxy@docs/roadmap-rules.md
!product:repo-deploy@coilyco-flight-deck/agent-proxy@AGENTS.md
!product:repo-deploy@coilyco-flight-deck/agent-proxy@docs/image-publishing.md
!product:repo-deploy@coilyco-flight-deck/agent-proxy@scripts/publish-image.sh

The scanner publishes aliases and paths only. It never writes decoded terms or matching content to Forgejo.

This issue is maintained automatically by code-fleet-watch. Current product-policy findings: * <code>!product:aos@coilyco-flight-deck/agent-proxy@AGENTS.md</code> * <code>!product:aos@coilyco-flight-deck/agent-proxy@docs/proxy.md</code> * <code>!product:aos@coilyco-flight-deck/agent-proxy@docs/roadmap-rules.md</code> * <code>!product:aos@coilyco-flight-deck/agent-proxy@tests/test_trajectory_agent_compose.py</code> * <code>!product:repo-agentic-os-hardware@coilyco-flight-deck/agent-proxy@AGENTS.md</code> * <code>!product:repo-agentic-os-hardware@coilyco-flight-deck/agent-proxy@docs/proxy-num-ctx.md</code> * <code>!product:repo-agentic-os-hardware@coilyco-flight-deck/agent-proxy@docs/roadmap-rules.md</code> * <code>!product:repo-deploy@coilyco-flight-deck/agent-proxy@AGENTS.md</code> * <code>!product:repo-deploy@coilyco-flight-deck/agent-proxy@docs/image-publishing.md</code> * <code>!product:repo-deploy@coilyco-flight-deck/agent-proxy@scripts/publish-image.sh</code> The scanner publishes aliases and paths only. It never writes decoded terms or matching content to Forgejo.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-07-29 03:26:38 +00:00

Deploy a read-only code-fleet-watch k3s CronJob #668

coilyco-ops added the

labels

2026-07-29 03:44:46 +00:00

coilyco-ops closed this issue

2026-07-29 06:04:36 +00:00

coilyco-ops reopened this issue

2026-07-30 00:17:42 +00:00

coilyco-ops commented

2026-07-30 00:17:43 +00:00

Author

Member

code-fleet-watch detected a product-policy regression.

coilyco-ops commented

2026-07-30 17:36:59 +00:00

Author

Member

code-fleet-watch refreshed the current product-policy inventory (9 finding(s)).

coilyco-ops closed this issue

2026-08-05 21:23:51 +00:00

coilyco-ops reopened this issue

2026-08-06 00:18:19 +00:00

coilyco-ops commented

2026-08-06 00:18:19 +00:00

Author

Member

code-fleet-watch detected a product-policy regression.

coilyco-ops commented

2026-08-12 00:17:53 +00:00

Author

Member

code-fleet-watch refreshed the current product-policy inventory (8 finding(s)).

coilyco-ops commented

2026-08-13 00:18:33 +00:00

Author

Member

code-fleet-watch refreshed the current product-policy inventory (10 finding(s)).

coilyco-ops commented

2026-08-13 18:48:04 +00:00

Author

Member

Why this one cannot be worked from the repository

I went looking for what the ten findings actually object to, so this is what I found rather than a shrug.

The matching terms are private by design and live only in SSM. agentic-os-kai/SSM.md documents /coilysiren/code-fleet-watch/denylist as the "private denylist payload consumed by the code-fleet watcher, content remains in SSM", and the issue body says the same thing from the other end: the scanner "publishes aliases and paths only. It never writes decoded terms or matching content to Forgejo."

So a finding like

!product:repo-agentic-os-hardware@coilyco-flight-deck/agent-proxy@docs/proxy-num-ctx.md

names a file and an alias and deliberately withholds the term that matched. Reading the file gets you nowhere: docs/proxy-num-ctx.md is 57 lines about Ollama context windows, and without the denylist there is no way to tell which token in it tripped which alias, or whether that is a regression or the intended cross-repo reference.

Two of them look intended rather than wrong

Worth saying, because it bears on whether this issue wants fixing at all:

!product:repo-deploy@...@AGENTS.md - AGENTS.md names coilyco-bridge/deploy on purpose, under "Cross-repo contracts": "coilyco-bridge/deploy deploys this service to ser8 and owns the mounted route registry."
!product:repo-agentic-os-hardware@...@AGENTS.md - the same section says "coilyco-bridge/agentic-os-hardware#36 is the canonical companion architecture decision. Keep this repository aligned with it."

If the policy is "do not name other products' repositories", then AGENTS.md violates it deliberately and the doc should be the thing that changes, not the scanner's mind. If the policy is about something narrower that happens to appear in those files, I cannot see it from here.

What I am not going to do

Read the denylist out of SSM and start rewriting docs against private terms. The scanner goes out of its way not to put those terms in Forgejo, and quietly relocating them into a diff would defeat that on the first commit message that explains itself. The consult label reads to me as exactly this: it wants a human who can see both halves.

What would unblock it

Either the decoded findings in a channel that is allowed to carry them, or a rule statement I can check files against without the terms - "agent-proxy must not reference repo X" is checkable, "these ten files matched something" is not.

Leaving this open and untouched. Note that the scanner rewrites the body each run - the inventory has gone 9 → 8 → 10 findings over three refreshes - so anything I wrote into it would be overwritten anyway.

🤖 Filed by Claude Code on Kai's behalf.

## Why this one cannot be worked from the repository I went looking for what the ten findings actually object to, so this is what I found rather than a shrug. The matching terms are **private by design and live only in SSM**. `agentic-os-kai/SSM.md` documents `/coilysiren/code-fleet-watch/denylist` as the "private denylist payload consumed by the code-fleet watcher, content remains in SSM", and the issue body says the same thing from the other end: the scanner "publishes aliases and paths only. It never writes decoded terms or matching content to Forgejo." So a finding like ``` !product:repo-agentic-os-hardware@coilyco-flight-deck/agent-proxy@docs/proxy-num-ctx.md ``` names a file and an alias and deliberately withholds the term that matched. Reading the file gets you nowhere: `docs/proxy-num-ctx.md` is 57 lines about Ollama context windows, and without the denylist there is no way to tell which token in it tripped which alias, or whether that is a regression or the intended cross-repo reference. ## Two of them look intended rather than wrong Worth saying, because it bears on whether this issue wants fixing at all: - `!product:repo-deploy@...@AGENTS.md` - `AGENTS.md` names `coilyco-bridge/deploy` on purpose, under "Cross-repo contracts": *"coilyco-bridge/deploy deploys this service to ser8 and owns the mounted route registry."* - `!product:repo-agentic-os-hardware@...@AGENTS.md` - the same section says *"coilyco-bridge/agentic-os-hardware#36 is the canonical companion architecture decision. Keep this repository aligned with it."* If the policy is "do not name other products' repositories", then `AGENTS.md` violates it deliberately and the doc should be the thing that changes, not the scanner's mind. If the policy is about something narrower that happens to appear in those files, I cannot see it from here. ## What I am not going to do Read the denylist out of SSM and start rewriting docs against private terms. The scanner goes out of its way not to put those terms in Forgejo, and quietly relocating them into a diff would defeat that on the first commit message that explains itself. The `consult` label reads to me as exactly this: it wants a human who can see both halves. ## What would unblock it Either the decoded findings in a channel that is allowed to carry them, or a rule statement I can check files against without the terms - "agent-proxy must not reference repo X" is checkable, "these ten files matched something" is not. Leaving this open and untouched. Note that the scanner rewrites the body each run - the inventory has gone 9 → 8 → 10 findings over three refreshes - so anything I wrote into it would be overwritten anyway. > 🤖 Filed by Claude Code on Kai's behalf.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-08-14 06:40:46 +00:00

Retire code-fleet-watch #830

coilyco-ops commented

2026-08-14 06:41:49 +00:00

Author

Member

code-fleet-watch is retired. See coilyco-flight-deck/infrastructure#830.

No sweep will refresh this issue again, so it is closed as unmaintained rather than resolved. The findings listed above were never reviewed and their disposition is unknown. Anyone who wants them addressed should open a fresh issue with the specific claim, since the alias-only format above is not readable without the retired denylist.

code-fleet-watch is retired. See coilyco-flight-deck/infrastructure#830. No sweep will refresh this issue again, so it is closed as unmaintained rather than resolved. The findings listed above were never reviewed and their disposition is unknown. Anyone who wants them addressed should open a fresh issue with the specific claim, since the alias-only format above is not readable without the retired denylist.

coilyco-ops closed this issue

2026-08-14 06:42:32 +00:00

Rows
Columns

code-fleet-watch: policy findings #65

Why this one cannot be worked from the repository

Two of them look intended rather than wrong

What I am not going to do

What would unblock it