Restore `ward ops aws ssm put-parameter` in the mounted coilyco ops bundle #636

New issue

Closed

opened 2026-07-23 09:41:38 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-23 09:41:38 +00:00

Owner

Problem

The current coilyco Ward ops bundle exposes SSM read leaves, but ward ops aws ssm --help does not expose put-parameter. The authoring guardfile already declares can run ssm put-parameter, so the mounted bundle and its source contract have drifted.

This blocks agent-runnable, guarded SecureString rotation workflows. This issue is intentionally generic and must not link to private credential incidents.

Work

Agentic OS restores the exact put-parameter leaf in the authored .ward overlay consumed by Ward releases.
The guard requires an explicit parameter name and value source, supports SecureString, and avoids printing secret values.
Tests cover command rendering, permission enforcement, redaction, overwrite behavior, and failure output.
The generated Ward ops reference documents the restored leaf.
Release validation proves the installed or built Ward surface exposes the leaf, not only the source guardfile.

Done when

ward ops aws ssm put-parameter --help is present in the shipped coilyco bundle.
A guarded non-secret fixture demonstrates create and overwrite behavior without value disclosure.
The relevant validation and documentation checks pass.

## Problem The current coilyco Ward ops bundle exposes SSM read leaves, but `ward ops aws ssm --help` does not expose `put-parameter`. The authoring guardfile already declares `can run ssm put-parameter`, so the mounted bundle and its source contract have drifted. This blocks agent-runnable, guarded SecureString rotation workflows. This issue is intentionally generic and must not link to private credential incidents. ## Work * Agentic OS restores the exact `put-parameter` leaf in the authored `.ward` overlay consumed by Ward releases. * The guard requires an explicit parameter name and value source, supports `SecureString`, and avoids printing secret values. * Tests cover command rendering, permission enforcement, redaction, overwrite behavior, and failure output. * The generated Ward ops reference documents the restored leaf. * Release validation proves the installed or built Ward surface exposes the leaf, not only the source guardfile. ## Done when * `ward ops aws ssm put-parameter --help` is present in the shipped coilyco bundle. * A guarded non-secret fixture demonstrates create and overwrite behavior without value disclosure. * The relevant validation and documentation checks pass.

coilyco-ops added the

autonomy

headless

priority

labels

2026-07-23 09:41:38 +00:00

coilyco-ops referenced this issue from a commit

2026-07-23 13:29:22 +00:00

fix(ward): repair deployment overlays (fixes #631, fixes #638, fixes #636)

coilyco-ops closed this issue

2026-07-23 13:29:22 +00:00