coilyco-flight-deck/agentic-os

Fork 0

Reshape ward KDL bundle filenames and role guardfile declarations #431

New issue

Closed

opened 2026-07-10 10:05:34 +00:00 by coilyco-ops · 5 comments

coilyco-ops commented

2026-07-10 10:05:34 +00:00

Member

Problem

The coilyco ward-specs bundle still has old top-level names and filenames:

.ward/ward-kdl.fleet.kdl owns both the agent roster and role guardfile bindings.
Role guardfiles are encoded as a plural guardfiles node with multiple positional values.
Bundle filenames carry the ward-kdl. prefix even where the file is not the ward-kdl executable itself.
.ward/ward-kdl.defaults.kdl contains both smart defaults and repo authority.
The old node names are smart-defaults, repo-authority, and fleet.

Kai wants the bundle shape renamed and split.

Requested shape

Use repeated singular guardfile entries in the role config. KDL supports this style as repeated same-name child nodes, which is already how this bundle models repeated role, repo, and trusted-owner entries.

Move the role guardfile bindings out of the former fleet file and into .ward/roles.kdl, under each matching role block. For example:

role engineer {
    ...
    guardfile "guardfile.forgejo.read.kdl"
    guardfile "guardfile.forgejo.readactions.kdl"
    guardfile "guardfile.forgejo.write.kdl"
}

Rename the bundle files and root nodes:

.ward/ward-kdl.fleet.kdl -> .ward/agents.kdl
root node fleet -> agents
.ward/ward-kdl.roles.kdl -> .ward/roles.kdl
.ward/ward-kdl.defaults.kdl -> .ward/defaults.kdl
root node smart-defaults -> defaults
move repo-authority out of defaults into .ward/repos.kdl
root node repo-authority -> repos
rename guardfile artifacts so guardfile is the first filename word and ward-kdl is dropped, for example:
- .ward/ward-kdl.forgejo.write.guardfile.kdl -> .ward/guardfile.forgejo.write.kdl
- .ward/ward-kdl.forgejo.read.guardfile.kdl -> .ward/guardfile.forgejo.read.kdl
- .ward/ward-kdl.forgejo.readactions.guardfile.kdl -> .ward/guardfile.forgejo.readactions.kdl
- .ward/ward-kdl.forgejo.admin.guardfile.kdl -> .ward/guardfile.forgejo.admin.kdl
- .ward/ward-kdl.forgejo.guardfile.kdl -> .ward/guardfile.forgejo.kdl
- .ward/ward-kdl.aws.guardfile.kdl -> .ward/guardfile.aws.kdl
- .ward/ward-kdl.kubectl.guardfile.kdl -> .ward/guardfile.kubectl.kdl

Drop the ward-kdl filename literal from all bundle filenames where it is only the old naming prefix. Keep literal command names like wrap ward-kdl ..., ward-kdl-read, ward-kdl-write, and documentation text that refers to the actual ward-kdl tool, unless the renamed file path itself is being referenced.

Implementation notes

Update every path reference that depends on the old filenames:

.forgejo/workflows/release.yml explicit ward-specs tar member list.
agentic_os/pre_commit/check_ward_specs_bundle.py expected defaults path, expected defaults body, expected tar members, and removed-member assertions.
tests/test_ward_specs_bundle.py file reads and string assertions.
guardfile inherit paths inside write/admin guardfiles.
docs/ward-specs.md wording for the bundle inventory.
any other rg "ward-kdl\.|guardfiles|smart-defaults|repo-authority|fleet \{" hits that are genuinely part of this bundle schema.

Do not update docs/FEATURES.md unless the public feature boundary changes. This is a schema/file-layout cleanup inside the existing ward deployment spec bundle.

Acceptance criteria

The role guardfile declarations live in .ward/roles.kdl as repeated singular guardfile nodes.
The former agent roster file is .ward/agents.kdl with root node agents and no embedded role guardfile binding block.
Defaults and repo authority are split into .ward/defaults.kdl and .ward/repos.kdl, with root nodes defaults and repos.
Guardfile filenames start with guardfile. and no longer include the ward-kdl. prefix.
Release packaging includes the new file list and no old bundle member names.
ward exec test and ward exec pre-commit-all pass.

ward.workflow: pull-requests-and-merge

## Problem The coilyco ward-specs bundle still has old top-level names and filenames: * `.ward/ward-kdl.fleet.kdl` owns both the agent roster and role guardfile bindings. * Role guardfiles are encoded as a plural `guardfiles` node with multiple positional values. * Bundle filenames carry the `ward-kdl.` prefix even where the file is not the ward-kdl executable itself. * `.ward/ward-kdl.defaults.kdl` contains both smart defaults and repo authority. * The old node names are `smart-defaults`, `repo-authority`, and `fleet`. Kai wants the bundle shape renamed and split. ## Requested shape Use repeated singular `guardfile` entries in the role config. KDL supports this style as repeated same-name child nodes, which is already how this bundle models repeated `role`, `repo`, and `trusted-owner` entries. Move the role guardfile bindings out of the former fleet file and into `.ward/roles.kdl`, under each matching `role` block. For example: ```kdl role engineer { ... guardfile "guardfile.forgejo.read.kdl" guardfile "guardfile.forgejo.readactions.kdl" guardfile "guardfile.forgejo.write.kdl" } ``` Rename the bundle files and root nodes: * `.ward/ward-kdl.fleet.kdl` -> `.ward/agents.kdl` * root node `fleet` -> `agents` * `.ward/ward-kdl.roles.kdl` -> `.ward/roles.kdl` * `.ward/ward-kdl.defaults.kdl` -> `.ward/defaults.kdl` * root node `smart-defaults` -> `defaults` * move `repo-authority` out of defaults into `.ward/repos.kdl` * root node `repo-authority` -> `repos` * rename guardfile artifacts so `guardfile` is the first filename word and `ward-kdl` is dropped, for example: * `.ward/ward-kdl.forgejo.write.guardfile.kdl` -> `.ward/guardfile.forgejo.write.kdl` * `.ward/ward-kdl.forgejo.read.guardfile.kdl` -> `.ward/guardfile.forgejo.read.kdl` * `.ward/ward-kdl.forgejo.readactions.guardfile.kdl` -> `.ward/guardfile.forgejo.readactions.kdl` * `.ward/ward-kdl.forgejo.admin.guardfile.kdl` -> `.ward/guardfile.forgejo.admin.kdl` * `.ward/ward-kdl.forgejo.guardfile.kdl` -> `.ward/guardfile.forgejo.kdl` * `.ward/ward-kdl.aws.guardfile.kdl` -> `.ward/guardfile.aws.kdl` * `.ward/ward-kdl.kubectl.guardfile.kdl` -> `.ward/guardfile.kubectl.kdl` Drop the `ward-kdl` filename literal from all bundle filenames where it is only the old naming prefix. Keep literal command names like `wrap ward-kdl ...`, `ward-kdl-read`, `ward-kdl-write`, and documentation text that refers to the actual ward-kdl tool, unless the renamed file path itself is being referenced. ## Implementation notes Update every path reference that depends on the old filenames: * `.forgejo/workflows/release.yml` explicit ward-specs tar member list. * `agentic_os/pre_commit/check_ward_specs_bundle.py` expected defaults path, expected defaults body, expected tar members, and removed-member assertions. * `tests/test_ward_specs_bundle.py` file reads and string assertions. * guardfile `inherit` paths inside write/admin guardfiles. * `docs/ward-specs.md` wording for the bundle inventory. * any other `rg "ward-kdl\.|guardfiles|smart-defaults|repo-authority|fleet \{"` hits that are genuinely part of this bundle schema. Do not update `docs/FEATURES.md` unless the public feature boundary changes. This is a schema/file-layout cleanup inside the existing ward deployment spec bundle. ## Acceptance criteria * The role guardfile declarations live in `.ward/roles.kdl` as repeated singular `guardfile` nodes. * The former agent roster file is `.ward/agents.kdl` with root node `agents` and no embedded role guardfile binding block. * Defaults and repo authority are split into `.ward/defaults.kdl` and `.ward/repos.kdl`, with root nodes `defaults` and `repos`. * Guardfile filenames start with `guardfile.` and no longer include the `ward-kdl.` prefix. * Release packaging includes the new file list and no old bundle member names. * `ward exec test` and `ward exec pre-commit-all` pass. ward.workflow: pull-requests-and-merge

coilyco-ops commented

2026-07-10 10:05:50 +00:00

Author

Member

WARD-DISPATCH: deferred ⏸

deferred details

This forwarded dispatch was deferred after the issue was already reserved.

Attempted harness: codex
Attempted run: ward agent engineer coilyco-flight-deck/agentic-os#431 --harness codex --ward-version v0.579.0
Container: engineer-codex-agentic-os-431
Container created: no running engineer was observed.
Host log: /Users/kai/.ward/agent-logs/dispatch/20260710T100547Z-director-codex-rh98-coilyco-flight-deck-agentic-os-431.log
Capacity: ward agent engineer --harness codex: global engineer limit is reached: 12 running (limit 12); wait for a run to finish or run ward agent reap for stale engineers

Retry: the issue stays queued and the director will try again when a slot opens.

— Codex, via ward agent

WARD-DISPATCH: deferred ⏸ <details><summary>deferred details</summary> This forwarded dispatch was deferred after the issue was already reserved. Attempted harness: `codex` Attempted run: `ward agent engineer coilyco-flight-deck/agentic-os#431 --harness codex --ward-version v0.579.0` Container: `engineer-codex-agentic-os-431` Container created: no running engineer was observed. Host log: `/Users/kai/.ward/agent-logs/dispatch/20260710T100547Z-director-codex-rh98-coilyco-flight-deck-agentic-os-431.log` Capacity: `ward agent engineer --harness codex: global engineer limit is reached: 12 running (limit 12); wait for a run to finish or run `ward agent reap` for stale engineers` Retry: the issue stays queued and the director will try again when a slot opens. </details>  — Codex, via `ward agent`

coilyco-ops added the

headless

labels

2026-07-10 10:17:42 +00:00

coilyco-ops commented

2026-07-10 10:19:00 +00:00

Author

Member

WARD-DISPATCH: failed ❌

failure details

This forwarded dispatch failed after the issue was already reserved.

Attempted harness: codex
Attempted run: ward agent engineer coilyco-flight-deck/agentic-os#431 --harness codex --details Implement agentic-os#431. Reshape the aos .ward bundle filenames and root nodes as requested, keep the release tarball packaging deterministic, update docs/tests, and coordinate with cli-guard#219 and ward#1009 without restoring ward-side specgen.
Container: engineer-codex-agentic-os-431
Container created: no running engineer was observed.
Host log: /Users/kai/.ward/agent-logs/dispatch/20260710T101854Z-director-codex-zv99-coilyco-flight-deck-agentic-os-431.log
Failure: ward container: download Go bootstrap binary https://forgejo.coilysiren.me/coilyco-flight-deck/ward/releases/download/v0.580.0/ward-linux-arm64: unexpected status 404 Not Found: Not Found

Retry: choose another harness if the first one is down, or rerun with --force if the reservation is stale.

— Codex, via ward agent

WARD-DISPATCH: failed ❌ <details><summary>failure details</summary> This forwarded dispatch failed after the issue was already reserved. Attempted harness: `codex` Attempted run: `ward agent engineer coilyco-flight-deck/agentic-os#431 --harness codex --details Implement agentic-os#431. Reshape the aos .ward bundle filenames and root nodes as requested, keep the release tarball packaging deterministic, update docs/tests, and coordinate with cli-guard#219 and ward#1009 without restoring ward-side specgen.` Container: `engineer-codex-agentic-os-431` Container created: no running engineer was observed. Host log: `/Users/kai/.ward/agent-logs/dispatch/20260710T101854Z-director-codex-zv99-coilyco-flight-deck-agentic-os-431.log` Failure: `ward container: download Go bootstrap binary https://forgejo.coilysiren.me/coilyco-flight-deck/ward/releases/download/v0.580.0/ward-linux-arm64: unexpected status 404 Not Found: Not Found` Retry: choose another harness if the first one is down, or rerun with `--force` if the reservation is stale. </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-10 10:20:14 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-agentic-os-431 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T10:20:13Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#431 · branch issue-431 · harness codex · workflow pull-requests-and-merge
Run: engineer-codex-agentic-os-431 · ward v0.579.0 · dispatched 2026-07-10T10:20:13Z
Comment thread: 2 included in the pre-flight read, 0 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-07-10T10:05:50Z), @coilyco-ops (2026-07-10T10:19:00Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.579.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-agentic-os-431` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T10:20:13Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#431` · branch `issue-431` · harness `codex` · workflow `pull-requests-and-merge` - **Run:** `engineer-codex-agentic-os-431` · ward `v0.579.0` · dispatched `2026-07-10T10:20:13Z` - **Comment thread:** 2 included in the pre-flight read, 0 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-10T10:05:50Z), @coilyco-ops (2026-07-10T10:19:00Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.579.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-10 10:30:05 +00:00

Reshape ward KDL bundle filenames and role guardfile declarations #433

coilyco-ops commented

2026-07-10 10:37:46 +00:00

Author

Member

Forgejo CI failed on PR #433 at ci / gate -> Repo test gate. The same uv run pytest command passes locally in this tree, so the current failure looks runner-specific or transient. Run 903 exposes the failure summary but not the job logs through the REST log route here, so the next step is a rerun on the branch rather than a code change.

Forgejo CI failed on PR #433 at `ci / gate` -> `Repo test gate`. The same `uv run pytest` command passes locally in this tree, so the current failure looks runner-specific or transient. Run 903 exposes the failure summary but not the job logs through the REST log route here, so the next step is a rerun on the branch rather than a code change.

coilyco-ops commented

2026-07-10 10:40:34 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-agentic-os-431 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T10:40:33Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#431 · branch issue-431 · harness codex · workflow pull-requests-and-merge
Run: engineer-codex-agentic-os-431 · ward v0.580.0 · dispatched 2026-07-10T10:40:33Z
Comment thread: 3 included in the pre-flight read, 1 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-07-10T10:05:50Z), @coilyco-ops (2026-07-10T10:19:00Z), @coilyco-ops (2026-07-10T10:37:46Z)
- stripped: @coilyco-ops (2026-07-10T10:20:14Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-agentic-os-431` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T10:40:33Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#431` · branch `issue-431` · harness `codex` · workflow `pull-requests-and-merge` - **Run:** `engineer-codex-agentic-os-431` · ward `v0.580.0` · dispatched `2026-07-10T10:40:33Z` - **Comment thread:** 3 included in the pre-flight read, 1 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-10T10:05:50Z), @coilyco-ops (2026-07-10T10:19:00Z), @coilyco-ops (2026-07-10T10:37:46Z) - stripped: @coilyco-ops (2026-07-10T10:20:14Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue

2026-07-10 10:49:59 +00:00

Expose guarded Forgejo Actions task rerun command #434