coilyco-flight-deck/agentic-os

Watch

Stop verifying Ward in the image, which is frozen as a contract #1409

Merged

coilyco-ops merged 4 commits from aos/claude/ee98-wardfreeze into main

2026-08-29 13:28:23 +00:00

coilyco-ops commented

2026-08-29 11:52:42 +00:00

Owner

Kai settled this on 2026-08-24. Ward's schema, the ward: AGENTS.md lane vocabulary, and the shipped binary all stay. The runtime comes out of this repo's hot paths.

What was actually left

The CI and promote call sites the issue enumerates are already gone - ci.yml and promote.yml carry no Ward reference today. What remained is the image's common verification:

ward --version
CLIGUARD_NO_SANDBOX=1 WARD_DOCTOR_ALLOW_PLACEHOLDERS=1 ward doctor

That is the risk the issue names: an unmaintained binary (dispatch record ends 2026-06-18, repo quiet since 2026-08-17) sitting where a toolchain bump breaking its install surfaces as a broken image build rather than as a Ward problem.

test_common_verification_covers_the_composed_runtime_surface asserted both commands were present. It now asserts they are absent, because the invariant is what changed rather than the code drifting from it.

Two judgment calls, both stated rather than assumed

The issue's scope lists install-common.sh:193-195 as removable "only if nothing else reads that path". Nothing in this repo does - the one other hit is a fixture string inside a code-comments test. But Ward itself writes there at runtime, and Ward is still installed, so I left the ~/.ward/audit provisioning in place.

Same reasoning for Dockerfile:35, which installs Ward and ends with its own ward --version. Removing that stops the image shipping Ward at all, which is a bigger change than "runtime out of hot paths" and would break ward agent dispatch. It stays.

So a dispatch works exactly as before. Verification of a frozen component stopped, not the component. docs/ward-specs.md records that, including why, so the next reader does not restore the check as a missing safety net.

Closes #1299

Kai settled this on 2026-08-24. Ward's schema, the `ward:` AGENTS.md lane vocabulary, and the shipped binary all stay. The runtime comes out of this repo's hot paths. ## What was actually left The CI and promote call sites the issue enumerates are **already gone** - `ci.yml` and `promote.yml` carry no Ward reference today. What remained is the image's common verification: ```sh ward --version CLIGUARD_NO_SANDBOX=1 WARD_DOCTOR_ALLOW_PLACEHOLDERS=1 ward doctor ``` That is the risk the issue names: an unmaintained binary (dispatch record ends 2026-06-18, repo quiet since 2026-08-17) sitting where a toolchain bump breaking its install surfaces as a broken image build rather than as a Ward problem. `test_common_verification_covers_the_composed_runtime_surface` asserted both commands were present. It now asserts they are **absent**, because the invariant is what changed rather than the code drifting from it. ## Two judgment calls, both stated rather than assumed The issue's scope lists `install-common.sh:193-195` as removable "only if nothing else reads that path". Nothing in this repo does - the one other hit is a fixture string inside a `code-comments` test. But **Ward itself writes there at runtime**, and Ward is still installed, so I left the `~/.ward/audit` provisioning in place. Same reasoning for `Dockerfile:35`, which installs Ward and ends with its own `ward --version`. Removing that stops the image shipping Ward at all, which is a bigger change than "runtime out of hot paths" and would break `ward agent` dispatch. It stays. So a dispatch works exactly as before. **Verification of a frozen component stopped, not the component.** `docs/ward-specs.md` records that, including why, so the next reader does not restore the check as a missing safety net. Closes #1299

coilyco-ops added 1 commit

2026-08-29 11:52:42 +00:00

chore(dev-base): stop verifying Ward, which is frozen as a contract

ci / aos-cli-tests (pull_request) Successful in 40s

Details

ci / gate (pull_request) Successful in 1m5s

Details

dev-base-pr / build (pull_request) Failing after 15m21s

Details

17237bbafd

Kai settled this on 2026-08-24. Ward's schema, the `ward:` lane vocabulary,
and the shipped binary all stay; the runtime comes out of the hot paths.

The CI and promote call sites the issue lists are already gone. What was
left is `ward --version` and `ward doctor` in the image's common
verification, so an unmaintained binary sat where a toolchain bump breaking
its install would read as a broken image build rather than a Ward problem.

The test that asserted those two commands are present now asserts they are
absent, since the invariant is what changed rather than the code drifting
from it.

Two things deliberately left alone, both outside "runtime out of hot paths":
the Dockerfile still installs Ward, and install-common.sh still provisions
~/.ward/audit, so a `ward agent` dispatch works exactly as before. Nothing
in this repo reads that path, but the still-installed binary writes it.

Closes coilyco-flight-deck/agentic-os#1299

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops added 1 commit

2026-08-29 12:09:10 +00:00

merge: bring main into the branch

ci / aos-cli-tests (pull_request) Successful in 49s

Details

ci / gate (pull_request) Successful in 1m9s

Details

dev-base-pr / build (pull_request) Successful in 14m46s

Details

3d77a8dc67

coilyco-ops added 1 commit

2026-08-29 13:05:27 +00:00

merge: bring main into the branch

ci / aos-cli-tests (pull_request) Successful in 35s

Details

ci / gate (pull_request) Successful in 58s

Details

dev-base-pr / build (pull_request) Successful in 9m49s

Details

3fff530945

coilyco-ops added 1 commit

2026-08-29 13:15:51 +00:00

merge: bring main into the branch

ci / aos-cli-tests (pull_request) Successful in 30s

Details

ci / gate (pull_request) Successful in 56s

Details

dev-base-pr / build (pull_request) Successful in 12m12s

Details

0a466bbbdf

coilyco-ops merged commit edc9ffc7e2 into main

2026-08-29 13:28:23 +00:00

coilyco-ops deleted branch aos/claude/ee98-wardfreeze

2026-08-29 13:28:24 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-29 13:28:24 +00:00

Stop verifying Ward in the image, which is frozen as a contract (#1409)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os!1409

No description provided.

Rows
Columns