aosguard's umbra pin predates the --query fix, so projection is refused fleet-wide #1153

New issue

Closed

opened 2026-08-20 08:10:47 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-20 08:10:47 +00:00

Member

--query is refused on every aosguard ops forgejo verb, on the current release:

$ aosguard --version
aosguard version aos-v0.214.0
$ aosguard ops forgejo repo get coilyco-flight-deck umbra --query topics --output json
aosguard: --query cannot project a non-JSON response
$ aosguard ops forgejo issue get coilyco-bridge agentic-os-kai 888 --query title --output json
aosguard: --query cannot project a non-JSON response

Not repo get alone. Every object read.

Cause

This is umbra#293: a shared $ref response carries the root produces, so a JSON operation is flagged raw and writeRawResponse refuses the projection rather than ignoring it. Forgejo's swagger has exactly that shape, which is why the whole area is affected.

umbra fixed it in 92afd48, "fix(specverb): a response offering JSON is parsed, not raw", with a regression test named for the symptom (TestASharedResponseDoesNotMakeEveryLeafRaw).

The pin missed it by hours:

.specgen/guardfiles/specverb.lock pins umbra v0.142.0, re-locked in 22352d05 (#1066) on 2026-08-15.
v0.142.0 was tagged 2026-08-15 16:23 UTC.
92afd48 landed 2026-08-15 21:01 -0700, after that tag.
The fix first appears in v0.143.0. umbra is now at v0.162.0.

So the re-lock and the fix happened the same day, in the wrong order, and every aos release since has shipped the refusal.

Fix

Re-run just aosguard-lock to move the frozen umbra graph to v0.143.0 or later, then cut a release. Verifying is the probe above returning the topics array.

Why it matters

The failure is quiet at the call site. A caller that treats a non-zero --query result as "no data" writes an empty value rather than reporting a broken tool. That happened in agentic-os-kai: sync-repo-registry read topics through --query topics inside a bare except, so the refusal became an empty topic list, indistinguishable from a repository with no topics. It would have blanked every topic in the fleet registry. Fixed on the caller side in agentic-os-kai a2775aa by reading the field off the whole payload and raising instead of returning empty, but other --query callers may be swallowing it the same way.

Context: coilyco-bridge/agentic-os-kai#888.

Generated with Claude Code

`--query` is refused on every `aosguard ops forgejo` verb, on the current release: ``` $ aosguard --version aosguard version aos-v0.214.0 $ aosguard ops forgejo repo get coilyco-flight-deck umbra --query topics --output json aosguard: --query cannot project a non-JSON response $ aosguard ops forgejo issue get coilyco-bridge agentic-os-kai 888 --query title --output json aosguard: --query cannot project a non-JSON response ``` Not `repo get` alone. Every object read. ## Cause This is umbra#293: a shared `$ref` response carries the root `produces`, so a JSON operation is flagged raw and `writeRawResponse` refuses the projection rather than ignoring it. Forgejo's swagger has exactly that shape, which is why the whole area is affected. umbra fixed it in `92afd48`, "fix(specverb): a response offering JSON is parsed, not raw", with a regression test named for the symptom (`TestASharedResponseDoesNotMakeEveryLeafRaw`). The pin missed it by hours: - `.specgen/guardfiles/specverb.lock` pins `umbra v0.142.0`, re-locked in 22352d05 (#1066) on 2026-08-15. - `v0.142.0` was tagged 2026-08-15 16:23 UTC. - `92afd48` landed 2026-08-15 21:01 -0700, after that tag. - The fix first appears in `v0.143.0`. umbra is now at `v0.162.0`. So the re-lock and the fix happened the same day, in the wrong order, and every aos release since has shipped the refusal. ## Fix Re-run `just aosguard-lock` to move the frozen umbra graph to `v0.143.0` or later, then cut a release. Verifying is the probe above returning the topics array. ## Why it matters The failure is quiet at the call site. A caller that treats a non-zero `--query` result as "no data" writes an empty value rather than reporting a broken tool. That happened in agentic-os-kai: `sync-repo-registry` read topics through `--query topics` inside a bare except, so the refusal became an empty topic list, indistinguishable from a repository with no topics. It would have blanked every topic in the fleet registry. Fixed on the caller side in agentic-os-kai a2775aa by reading the field off the whole payload and raising instead of returning empty, but other `--query` callers may be swallowing it the same way. Context: coilyco-bridge/agentic-os-kai#888. Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-20 08:19:40 +00:00

fix(aosguard): re-lock onto umbra v0.161.0 so --query stops being refused #1154