chore(ci): cut Ward's runtime out of AOS CI, since the repository is archived #1345

Merged

coilysiren merged 1 commit from aos/claude/mt75-ward-cut into main

2026-08-28 18:26:54 +00:00

coilyco-ops commented

2026-08-28 18:15:12 +00:00

Owner

Closes the repo-side half of #1299. Kai's call, made in session after the #1344 diagnosis.

Why

coilyco-flight-deck/ward was archived on 2026-08-28. AOS CI installed a release binary from it five times across four workflows, on every run.

Three of those five never invoked the binary. The ci gate, mirror-to-github, and aos-cli-release jobs installed ward and never called it, each paying a network round-trip that can fail the job on its own.

The two that did use it ran ward doctor against .ward/ward.yaml - the file #1328 already recorded as read by nothing, after inbox#366 moved dev verbs to the justfile and inbox#385 stopped catalog-trifecta requiring the path. The gate was validating a contract with no consumer, using a product that no longer ships.

What moved, not dropped

tests/test_ward_specs_bundle.py shelled out to ward doctor from the pytest suite, which is the actual reason the repo gate installed the binary at all. Its second assertion, that .ward carries no retired KDL, is independent of Ward's runtime and enforces a standing AGENTS.md rule. It moves to tests/test_ward_directory_shape.py rather than disappearing with the file.

Explicitly out of scope

The dev-base image keeps its ward binary. A warded run still needs it, and ward agent headless dispatch is still live vocabulary. Archiving a source repository does not retire the runtime, so docker/dev-base/full/Dockerfile, test_dev_base_image.py, and docs/ci-in-dev-base.md are untouched.

This is not the CI fix

Every open PR is red right now because the runner cannot reach forgejo.coilysiren.me: 133-second connect timeouts to port 443 inside actions/checkout, plus context deadline exceeded on the registry. That is #1344 / #1343 and it is live-infrastructure work, handed to the sysadmin seat. This PR cannot go green until that lands either.

What it does do is remove five network dependencies that made the outage both worse and much harder to read.

Known defect left behind, deliberately

resolve_release_ref returns the literal string "release" on any API failure, and that string lands in a release-tag download path that can never resolve. It is what turned an unreachable API into six anonymous 404s during this outage. Removing the ward product does not fix it: aos, umbra, specgen, and guard all still resolve through it. Caught by Delphi reviewing the cut. Filed separately rather than folded in, since it is a behavior change to a fleet-wide resolver and deserves its own review.

Verification

uv run pytest 742 passed, and pre-commit run --all-files green, both locally. The Forgejo Actions lint and validator hooks pass on all four edited workflows.

Note test_promote_workflow_runs_every_gate_ci_runs still passes: it asserts promote runs everything ci runs, and both lost the same steps.

Closes the repo-side half of #1299. Kai's call, made in session after the #1344 diagnosis. ## Why `coilyco-flight-deck/ward` was archived on 2026-08-28. AOS CI installed a release binary from it **five times across four workflows**, on every run. Three of those five never invoked the binary. The ci `gate`, `mirror-to-github`, and `aos-cli-release` jobs installed `ward` and never called it, each paying a network round-trip that can fail the job on its own. The two that did use it ran `ward doctor` against `.ward/ward.yaml` - the file #1328 already recorded as read by nothing, after inbox#366 moved dev verbs to the justfile and inbox#385 stopped catalog-trifecta requiring the path. The gate was validating a contract with no consumer, using a product that no longer ships. ## What moved, not dropped `tests/test_ward_specs_bundle.py` shelled out to `ward doctor` from the pytest suite, which is the actual reason the repo gate installed the binary at all. Its **second** assertion, that `.ward` carries no retired KDL, is independent of Ward's runtime and enforces a standing AGENTS.md rule. It moves to `tests/test_ward_directory_shape.py` rather than disappearing with the file. ## Explicitly out of scope **The dev-base image keeps its `ward` binary.** A warded run still needs it, and `ward agent` headless dispatch is still live vocabulary. Archiving a source repository does not retire the runtime, so `docker/dev-base/full/Dockerfile`, `test_dev_base_image.py`, and `docs/ci-in-dev-base.md` are untouched. ## This is not the CI fix Every open PR is red right now because the runner cannot reach `forgejo.coilysiren.me`: 133-second connect timeouts to port 443 inside `actions/checkout`, plus `context deadline exceeded` on the registry. That is #1344 / #1343 and it is live-infrastructure work, handed to the sysadmin seat. This PR cannot go green until that lands either. What it does do is remove five network dependencies that made the outage both worse and much harder to read. ## Known defect left behind, deliberately `resolve_release_ref` returns the literal string `"release"` on any API failure, and that string lands in a release-tag download path that can never resolve. It is what turned an unreachable API into six anonymous 404s during this outage. Removing the `ward` product does not fix it: aos, umbra, specgen, and guard all still resolve through it. Caught by Delphi reviewing the cut. Filed separately rather than folded in, since it is a behavior change to a fleet-wide resolver and deserves its own review. ## Verification `uv run pytest` 742 passed, and `pre-commit run --all-files` green, both locally. The Forgejo Actions lint and validator hooks pass on all four edited workflows. Note `test_promote_workflow_runs_every_gate_ci_runs` still passes: it asserts promote runs everything ci runs, and both lost the same steps.

coilyco-ops added 1 commit

2026-08-28 18:15:12 +00:00

chore(ci): cut Ward's runtime out of AOS CI, since the repository is archived

ci / aos-eval-tests (pull_request) Successful in 22s

Details

ci / aos-cli-tests (pull_request) Successful in 3m13s

Details

ci / gate (pull_request) Successful in 3m37s

Details

51af08bb86

Five steps across four workflows pulled a `ward` release binary from
coilyco-flight-deck/ward on every run. That repository was archived on
2026-08-28, so CI depended on an archived product to gate itself.

Three of the five never invoked the binary at all. The ci `gate`,
`mirror-to-github`, and `aos-cli-release` jobs installed it and moved on,
each paying a network round-trip that can fail the job on its own.

The two that did use it ran `ward doctor` against `.ward/ward.yaml`, which
#1328 already recorded as read by nothing: dev verbs moved to the justfile
in inbox#366 and catalog-trifecta stopped requiring the path in inbox#385.
So the gate validated a contract with no consumer.

`tests/test_ward_specs_bundle.py` shelled out to `ward doctor` from the
pytest suite, which is the real reason the repo gate installed the binary.
Its second assertion, that `.ward` carries no retired KDL, outlives Ward
and moves to `tests/test_ward_directory_shape.py` rather than being dropped
with the file.

The dev-base image keeps its `ward` binary. A warded run still needs it,
and archiving the source repository does not retire the runtime.

Not a fix for the CI outage (#1344, #1343). Every open PR is currently red
because the runner cannot reach forgejo.coilysiren.me, measured as 133s
connect timeouts to port 443 in `actions/checkout`. This only removes five
network dependencies that made that fault worse and harder to read.

The `resolve_release_ref` fallback that turned the outage into six
anonymous 404s survives for aos, umbra, specgen, and guard. Filed
separately rather than folded in here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops referenced this pull request

2026-08-28 18:15:31 +00:00

resolve_release_ref falls back to a branch name inside a release-tag URL, so an unreachable API becomes an anonymous 404 #1346

coilyco-ops referenced this pull request

2026-08-28 18:15:46 +00:00

CI is blocked repo-wide: ward-doctor 404s because the install ref falls back to a release-tag path that cannot exist #1344