forgejo read/write/admin guardfile chain still carries Phase-1 example* anchors in the deployment bundle #495

New issue

Open

opened 2026-07-13 06:02:50 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-13 06:02:50 +00:00

Member

Found while refactoring the bundle tests (27eccc2). The deployment bundle's role-overlay chain still carries the generic ward#278 Phase-1 anchors, while only the ops and merge surfaces carry the real deployment values:

.ward/guardfile.forgejo.read.kdl - base-url "git.example.com/api/v1", auth ... ssm "/example/forgejo/api-token", restrict owner matches example*
.ward/guardfile.forgejo.write.kdl and .ward/guardfile.forgejo.admin.kdl - restrict owner matches example* (re-declared per tier)
.ward/guardfile.forgejo.kdl (ops) and .ward/guardfile.forgejo.merge.kdl - real coily* gate and real singletons

ward doctor v0.633.0 passes all five checks on this bundle, so either the chain's singletons are superseded at mount (in which case the example* lines are dead text worth deleting) or the read/write/admin overlays are pointing agents at a placeholder forge and owner gate (in which case this is a live misconfig for every role that mounts them - all six roles bind the read pair).

Related ward-side context:

ward#1167 (first-class placeholder sentinel) makes doctor fail when an annotated sentinel survives in a real bundle - once that lands, this file set is exactly what it should flag.
ward#1141 observed a live director surface below tier; worth re-checking against this once resolved.

Ask: determine which semantics hold, then either replace the example* anchors with the real deployment values or delete the dead singletons, in one commit. The repo suite intentionally no longer asserts guardfile content (27eccc2), so the fix is a config edit plus the doctor gate.

Found while refactoring the bundle tests (`27eccc2`). The deployment bundle's role-overlay chain still carries the generic ward#278 Phase-1 anchors, while only the ops and merge surfaces carry the real deployment values: * `.ward/guardfile.forgejo.read.kdl` - `base-url "git.example.com/api/v1"`, `auth ... ssm "/example/forgejo/api-token"`, `restrict owner matches example*` * `.ward/guardfile.forgejo.write.kdl` and `.ward/guardfile.forgejo.admin.kdl` - `restrict owner matches example*` (re-declared per tier) * `.ward/guardfile.forgejo.kdl` (ops) and `.ward/guardfile.forgejo.merge.kdl` - real `coily*` gate and real singletons `ward doctor v0.633.0` passes all five checks on this bundle, so either the chain's singletons are superseded at mount (in which case the example* lines are dead text worth deleting) or the read/write/admin overlays are pointing agents at a placeholder forge and owner gate (in which case this is a live misconfig for every role that mounts them - all six roles bind the read pair). Related ward-side context: * ward#1167 (first-class placeholder sentinel) makes doctor fail when an annotated sentinel survives in a real bundle - once that lands, this file set is exactly what it should flag. * ward#1141 observed a live director surface below tier; worth re-checking against this once resolved. Ask: determine which semantics hold, then either replace the example* anchors with the real deployment values or delete the dead singletons, in one commit. The repo suite intentionally no longer asserts guardfile content (`27eccc2`), so the fix is a config edit plus the doctor gate.

coilyco-ops added the

headless

labels

2026-07-14 07:44:04 +00:00