coilyco-flight-deck/agentic-os

Fork 0

Use bare kubectl exec target in ward KDL guardfile #513

New issue

Closed

opened 2026-07-13 22:52:54 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-07-13 22:52:54 +00:00

Member

.ward/guardfile.kubectl.kdl currently pins the exec target as /usr/local/bin/kubectl.

That is the wrong authoring shape for a cli-guard KDL guardfile:

cli-guard exec guardfiles support bare executable names such as exec kubectl
the guardfile should describe the guarded tool by target exec name, not imply that one absolute path is the security boundary
lockdown enforcement belongs in cli-guard and should apply across every binary with that target basename

Task:

change .ward/guardfile.kubectl.kdl from exec /usr/local/bin/kubectl to exec kubectl
update the nearby comment that says the binary is fixed at parse to avoid implying the absolute path is load-bearing
keep the kubectl allowlist behavior unchanged
run the repo validation/doctor gate expected for the ward KDL bundle

Related cli-guard product issue: coilyco-flight-deck/cli-guard#225.

.ward/guardfile.kubectl.kdl currently pins the exec target as /usr/local/bin/kubectl. That is the wrong authoring shape for a cli-guard KDL guardfile: - cli-guard exec guardfiles support bare executable names such as exec kubectl - the guardfile should describe the guarded tool by target exec name, not imply that one absolute path is the security boundary - lockdown enforcement belongs in cli-guard and should apply across every binary with that target basename Task: - change .ward/guardfile.kubectl.kdl from exec /usr/local/bin/kubectl to exec kubectl - update the nearby comment that says the binary is fixed at parse to avoid implying the absolute path is load-bearing - keep the kubectl allowlist behavior unchanged - run the repo validation/doctor gate expected for the ward KDL bundle Related cli-guard product issue: coilyco-flight-deck/cli-guard#225.

coilyco-ops added the

headless

labels

2026-07-14 07:44:04 +00:00

coilyco-ops commented

2026-07-14 09:00:43 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-agentic-os-513 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-14T09:00:42Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#513 · branch issue-513 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-agentic-os-513 · ward v0.672.0 · dispatched 2026-07-14T09:00:40Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.672.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-agentic-os-513` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-14T09:00:42Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#513` · branch `issue-513` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-513` · ward `v0.672.0` · dispatched `2026-07-14T09:00:40Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.672.0). </details> </details>  — Codex, via `ward agent`

coilysiren referenced this issue from coilyco-flight-deck/ward

2026-07-14 15:27:09 +00:00

director should emit colorized, space buffered, visually distinct messages about the categories of actions its performing on startup #1283

coilyco-ops commented

2026-07-15 05:34:10 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-agentic-os-513 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-15T05:34:09Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#513 · branch issue-513 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-agentic-os-513 · ward v0.697.0 · dispatched 2026-07-15T05:33:55Z
Comment thread: 0 included in the pre-flight read, 1 stripped (ward's own automated comments).
- stripped: @coilyco-ops (2026-07-14T09:00:43Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-agentic-os-513` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-15T05:34:09Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#513` · branch `issue-513` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-513` · ward `v0.697.0` · dispatched `2026-07-15T05:33:55Z` - **Comment thread:** 0 included in the pre-flight read, 1 stripped (ward's own automated comments). - stripped: @coilyco-ops (2026-07-14T09:00:43Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.697.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-15 05:37:37 +00:00

fix: use bare kubectl exec target #554

coilyco-ops commented

2026-07-15 05:40:43 +00:00

Author

Member

WARDED_WORKFLOW: #554

details

workflow: pull-request-and-merge; review summary: review gate intentionally skipped because the temporary ward default is pending brokered QA
felt: small, direct, and low-risk
confidence: high
surprises: none beyond a generated provenance scratch file that was removed before commit
follow-ups: director merge and final done outcome

WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/554 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: review gate intentionally skipped because the temporary ward default is pending brokered QA felt: small, direct, and low-risk confidence: high surprises: none beyond a generated provenance scratch file that was removed before commit follow-ups: director merge and final done outcome </details>

coilyco-ops closed this issue

2026-07-15 05:43:59 +00:00