Publish Aguard for native host sessions

coilyco-ops commented

2026-07-24 21:15:32 +00:00

Owner

Problem

Aguard is the AOS-owned, specgen-generated operator CLI. Full dev-base builds it from .specgen/aguard and installs it in the container, but the portable native release and Homebrew/Scoop packaging currently ship only aos.

The Ward operator cutover in ward#1548 retires human-facing generated ward ops leaves. Native operator sessions therefore need aguard on PATH too. Requiring a dev-base container or an AOS checkout would leave that cutover incomplete.

Ownership

AOS owns the Aguard source, build, and portable release artifacts. Host convergence belongs downstream in infrastructure and is tracked separately.

Change

Extend the portable AOS release matrix to build Aguard from the pinned .specgen/aguard project for every supported native OS and architecture.
Publish checksummed Aguard artifacts on the existing aos-v* release train.
Make the Homebrew and Scoop AOS packages install matching aos and aguard commands together.
Make every Aguard leaf work without an AOS checkout, an image-only PYTHONPATH, Ward, ward-kdl, or specgen at runtime. In particular, package or remove the current checkout dependency of the Forgejo Actions Python bridge.
Keep dev-base and native artifacts generated from the same .specgen/aguard source and dependency lock.
Document the paired native install and update the feature inventory.
Add release and install tests that exercise both commands from an empty temporary working directory.

Acceptance

A clean Homebrew or Scoop install exposes both aos and aguard on PATH.
aguard --help and aguard --version work outside any checkout.
At least one offline-safe generated leaf and the packaged Actions bridge start successfully outside any checkout.
Native Aguard does not load or mention Ward or ward-kdl.
Release assets cover the same supported platform matrix as the native AOS CLI and are included in checksums.
Existing dev-base Aguard behavior remains green.
Repository tests and pre-commit pass.

## Problem Aguard is the AOS-owned, specgen-generated operator CLI. Full dev-base builds it from `.specgen/aguard` and installs it in the container, but the portable native release and Homebrew/Scoop packaging currently ship only `aos`. The Ward operator cutover in [ward#1548](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/1548) retires human-facing generated `ward ops` leaves. Native operator sessions therefore need `aguard` on `PATH` too. Requiring a dev-base container or an AOS checkout would leave that cutover incomplete. ## Ownership AOS owns the Aguard source, build, and portable release artifacts. Host convergence belongs downstream in infrastructure and is tracked separately. ## Change * Extend the portable AOS release matrix to build Aguard from the pinned `.specgen/aguard` project for every supported native OS and architecture. * Publish checksummed Aguard artifacts on the existing `aos-v*` release train. * Make the Homebrew and Scoop AOS packages install matching `aos` and `aguard` commands together. * Make every Aguard leaf work without an AOS checkout, an image-only `PYTHONPATH`, Ward, ward-kdl, or specgen at runtime. In particular, package or remove the current checkout dependency of the Forgejo Actions Python bridge. * Keep dev-base and native artifacts generated from the same `.specgen/aguard` source and dependency lock. * Document the paired native install and update the feature inventory. * Add release and install tests that exercise both commands from an empty temporary working directory. ## Acceptance * A clean Homebrew or Scoop install exposes both `aos` and `aguard` on `PATH`. * `aguard --help` and `aguard --version` work outside any checkout. * At least one offline-safe generated leaf and the packaged Actions bridge start successfully outside any checkout. * Native Aguard does not load or mention Ward or ward-kdl. * Release assets cover the same supported platform matrix as the native AOS CLI and are included in checksums. * Existing dev-base Aguard behavior remains green. * Repository tests and pre-commit pass.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-07-24 21:15:53 +00:00

Converge native Aguard on operator hosts #635

coilyco-ops referenced this issue from a commit

2026-07-24 21:46:03 +00:00

feat: publish native aguard release

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-24 21:46:35 +00:00

feat: publish native Aguard release #733

coilyco-ops commented

2026-07-24 21:47:47 +00:00

Author

Owner

WARD-WORKFLOW: failed ❌

reap details

ward container reap found no residual work to salvage, but this launched run exited without a WARD-WORKFLOW comment.

Container: engineer-codex-agentic-os-728
Workflow: pull-request-and-merge
Recovery: inspect the container log, fix the engineer seed or launch mode, and redispatch.

— Codex, via ward agent

WARD-WORKFLOW: failed ❌ <details><summary>reap details</summary> `ward container reap` found no residual work to salvage, but this launched run exited without a `WARD-WORKFLOW` comment. - **Container:** `engineer-codex-agentic-os-728` - **Workflow:** `pull-request-and-merge` - **Recovery:** inspect the container log, fix the engineer seed or launch mode, and redispatch. </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-24 21:47:47 +00:00

Author

Owner

WARD-WORKFLOW: reservation-released

release details

Run finished with WARD-WORKFLOW: failed ❌.

ward container reap released container engineer-codex-agentic-os-728 (--harness codex): the terminal outcome supersedes the reservation, so a later redispatch no longer needs --override-reservation.

— Codex, via ward agent

WARD-WORKFLOW: reservation-released <details><summary>release details</summary> Run finished with `WARD-WORKFLOW: failed ❌`. `ward container reap` released container `engineer-codex-agentic-os-728` (`--harness codex`): the terminal outcome supersedes the reservation, so a later redispatch no longer needs `--override-reservation`. </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-25 14:03:58 +00:00

Author

Owner

WARD-OUTCOME: done ✅

details

The agent completed the implementation, current-main integration, review, and validation for PR #733. The director merge remains as the final landing action.

workflow: pull-request-and-merge; review summary: passed: current-main integration reviewed, 593 Linux tests, full pre-commit, Ward doctor, focused release tests, shellcheck, and documentation layout are green

WARD-OUTCOME: done ✅ <details><summary>details</summary> The agent completed the implementation, current-main integration, review, and validation for PR #733. The director merge remains as the final landing action. workflow: pull-request-and-merge; review summary: passed: current-main integration reviewed, 593 Linux tests, full pre-commit, Ward doctor, focused release tests, shellcheck, and documentation layout are green </details>

coilyco-ops commented

2026-07-25 14:04:04 +00:00

Author

Owner

WARD-WORKFLOW: merge-ready

details

director merge authorization: reviewed-and-ready
workflow: pull-request-and-merge; review summary: passed: current-main integration reviewed, 593 Linux tests, full pre-commit, Ward doctor, focused release tests, shellcheck, and documentation layout are green

status context: ci / gate (pull_request)=success, ci / ward-doctor (pull_request)=success
status state: success

PR #733 is mergeable against current main.

WARD-WORKFLOW: merge-ready <details><summary>details</summary> director merge authorization: reviewed-and-ready workflow: pull-request-and-merge; review summary: passed: current-main integration reviewed, 593 Linux tests, full pre-commit, Ward doctor, focused release tests, shellcheck, and documentation layout are green status context: ci / gate (pull_request)=success, ci / ward-doctor (pull_request)=success status state: success PR #733 is mergeable against current main. </details>

coilyco-ops commented

2026-07-25 14:09:21 +00:00

Author

Owner

WARD-WORKFLOW: reopened

release evidence

The agent reopened the issue because the post-merge AOS CLI release failed during the Aguard build. The release script replaces the valid compressed Swagger lock with plain JSON under the .gz filename, and specgen fails with gzip: invalid header.

The agent will remove that transformation and carry one repo-grounded fix through review and CI.

WARD-WORKFLOW: reopened <details><summary>release evidence</summary> The agent reopened the issue because the post-merge AOS CLI release failed during the Aguard build. The release script replaces the valid compressed Swagger lock with plain JSON under the `.gz` filename, and specgen fails with `gzip: invalid header`. The agent will remove that transformation and carry one repo-grounded fix through review and CI. </details>

coilyco-ops referenced this issue from a commit

2026-07-25 14:11:11 +00:00

fix(release): preserve compressed Aguard spec lock

coilyco-ops referenced this issue

2026-07-25 14:12:36 +00:00

fix(release): preserve compressed Aguard spec lock #745

coilyco-ops commented

2026-07-25 14:14:11 +00:00

Author

Owner

WARD-OUTCOME: done ✅

release fix details

The agent completed the gzip-lock release fix in PR #745.

workflow: pull-request-and-merge; review summary: passed: the fix removes the invalid lock transformation, focused release tests and Aguard build pass locally, and full Forgejo CI plus Ward doctor are green

WARD-OUTCOME: done ✅ <details><summary>release fix details</summary> The agent completed the gzip-lock release fix in PR #745. workflow: pull-request-and-merge; review summary: passed: the fix removes the invalid lock transformation, focused release tests and Aguard build pass locally, and full Forgejo CI plus Ward doctor are green </details>

coilyco-ops commented

2026-07-25 14:14:20 +00:00

Author

Owner

WARD-WORKFLOW: merge-ready

release fix handoff

director merge authorization: reviewed-and-ready
workflow: pull-request-and-merge; review summary: passed: the fix removes the invalid lock transformation, focused release tests and Aguard build pass locally, and full Forgejo CI plus Ward doctor are green

status context: ci / gate (pull_request)=success, ci / ward-doctor (pull_request)=success
status state: success

PR #745 is mergeable against current main.

WARD-WORKFLOW: merge-ready <details><summary>release fix handoff</summary> director merge authorization: reviewed-and-ready workflow: pull-request-and-merge; review summary: passed: the fix removes the invalid lock transformation, focused release tests and Aguard build pass locally, and full Forgejo CI plus Ward doctor are green status context: ci / gate (pull_request)=success, ci / ward-doctor (pull_request)=success status state: success PR #745 is mergeable against current main. </details>

coilysiren referenced this issue from a commit

2026-07-25 14:14:29 +00:00

fix(release): preserve compressed Aguard spec lock (#745)

coilyco-ops added the

autonomy

live-collab

label

2026-07-25 14:22:27 +00:00

coilyco-ops commented

2026-07-25 14:22:49 +00:00

Author

Owner

WARD-WORKFLOW: blocked 🛑

live release handoff

PR #733 and the gzip-lock repair in PR #745 are merged. The corrected AOS CLI release run 2075 advanced through spec generation, which proves the repository defect is fixed.

The run then failed while Go fetched public GitHub modules. Every failing fetch reported Recv failure: Connection reset by peer, including the KDL, JMESPath, tablewriter, kin-openapi, and AWS SDK repositories.

The remaining step needs live operator verification:

Inspect runner egress or proxy behavior for direct GitHub module fetches.
Rerun the existing AOS CLI release after connectivity is healthy.
Confirm the release publishes paired aos and aguard assets plus Homebrew and Scoop metadata.

The agent made no additional code push because the remaining failure is live CI network state, not a repo-proven defect.

workflow: pull-request-and-merge; review summary: passed: repository implementation and gzip repair are green, live release publication is blocked by runner connectivity

WARD-WORKFLOW: blocked 🛑 <details><summary>live release handoff</summary> PR #733 and the gzip-lock repair in PR #745 are merged. The corrected AOS CLI release run 2075 advanced through spec generation, which proves the repository defect is fixed. The run then failed while Go fetched public GitHub modules. Every failing fetch reported `Recv failure: Connection reset by peer`, including the KDL, JMESPath, tablewriter, kin-openapi, and AWS SDK repositories. The remaining step needs live operator verification: * Inspect runner egress or proxy behavior for direct GitHub module fetches. * Rerun the existing AOS CLI release after connectivity is healthy. * Confirm the release publishes paired `aos` and `aguard` assets plus Homebrew and Scoop metadata. The agent made no additional code push because the remaining failure is live CI network state, not a repo-proven defect. workflow: pull-request-and-merge; review summary: passed: repository implementation and gzip repair are green, live release publication is blocked by runner connectivity </details>

coilyco-ops commented

2026-07-25 16:54:05 +00:00

Author

Owner

WARD-WORKFLOW: reopened

CI babysit contract

Goal - make the AOS native release pipeline publish a valid paired aos and aguard release.
Done-condition - the repository-grounded release check passes, the fix lands through the resolved workflow, and the resulting Forgejo release workflow is green with paired assets and package metadata.
Non-goals - no runner, registry, secret, package-store, or deployment mutation. No local binary bypass. Live-only remediation remains an ops handoff.

Current evidence: all eight native binaries pass their basic checks, then the packaged aguard fails with specverb: unrecognized spec version (want swagger 2.x or openapi 3.x). The engineer will reproduce from the committed release source, make at most one locally proven push, and monitor read-only workflow evidence at a minimum 60-second poll cadence.

WARD-WORKFLOW: reopened ## CI babysit contract * **Goal** - make the AOS native release pipeline publish a valid paired `aos` and `aguard` release. * **Done-condition** - the repository-grounded release check passes, the fix lands through the resolved workflow, and the resulting Forgejo release workflow is green with paired assets and package metadata. * **Non-goals** - no runner, registry, secret, package-store, or deployment mutation. No local binary bypass. Live-only remediation remains an ops handoff. Current evidence: all eight native binaries pass their basic checks, then the packaged `aguard` fails with `specverb: unrecognized spec version (want swagger 2.x or openapi 3.x)`. The engineer will reproduce from the committed release source, make at most one locally proven push, and monitor read-only workflow evidence at a minimum 60-second poll cadence.

coilysiren referenced this issue from a commit

2026-07-25 17:13:47 +00:00

fix(release): stage decoded Aguard spec lock

coilyco-ops commented

2026-07-25 17:17:06 +00:00

Author

Owner

Checkpoint: pushed 6113132 plus current-main integration on codex/aos-release-spec-version.

Repository evidence confirms the direct cross-builder diverged from specgen materialization: the committed lock must remain gzip for specgen gen, while the generated Go module must embed decoded JSON for specverb. The fix now decodes after generation and before cross-compilation. Focused Aguard/release tests pass 9 of 9, and task-isolated shellcheck passes.

The exact Linux release-image validate plus build pipeline is running against the clean pushed commit before the PR is opened.

**Checkpoint:** pushed `6113132` plus current-main integration on `codex/aos-release-spec-version`. Repository evidence confirms the direct cross-builder diverged from specgen materialization: the committed lock must remain gzip for `specgen gen`, while the generated Go module must embed decoded JSON for `specverb`. The fix now decodes after generation and before cross-compilation. Focused Aguard/release tests pass 9 of 9, and task-isolated shellcheck passes. The exact Linux release-image `validate` plus `build` pipeline is running against the clean pushed commit before the PR is opened.

~~coilyco-ops referenced this issue 2026-07-25 17:39:50 +00:00~~

fix(release): stage decoded Aguard spec lock #751

coilysiren referenced this issue from a commit

2026-07-25 18:03:49 +00:00

fix(release): keep staging comment within cap

coilysiren referenced this issue from a commit

2026-07-25 18:03:49 +00:00

fix(release): smoke Aguard actions group

coilysiren referenced this issue from a commit

2026-07-25 18:03:49 +00:00

fix(release): match Aguard version output

coilyco-ops commented

2026-07-25 18:04:43 +00:00

Author

Owner

Checkpoint: PR #751 now carries the locally complete release fix. The exact Linux release image built and verified all eight AOS and Aguard artifacts. The native Aguard smoke passes from an empty directory, including root help, version output, AWS help, and Actions group help, and ends with verified aos and aguard release aos-v0.0.0. The original specverb: unrecognized spec version error no longer reproduces. Forgejo PR CI is rerunning, and independent QA is re-reviewing the final smoke assertions.

Checkpoint: PR #751 now carries the locally complete release fix. The exact Linux release image built and verified all eight AOS and Aguard artifacts. The native Aguard smoke passes from an empty directory, including root help, version output, AWS help, and Actions group help, and ends with `verified aos and aguard release aos-v0.0.0`. The original `specverb: unrecognized spec version` error no longer reproduces. Forgejo PR CI is rerunning, and independent QA is re-reviewing the final smoke assertions.

coilyco-ops commented

2026-07-25 18:07:45 +00:00

Author

Owner

WARD-OUTCOME: done ✅

workflow: pull-request-and-merge

PR #751 is ready for the director lane. Forgejo reports both ci / gate and ci / ward-doctor successful. The exact Linux release image built and verified all eight artifacts, and the native release check passes from an empty directory. Independent QA re-reviewed the final branch and returned PASS with no blocking findings.

WARD-OUTCOME: done ✅ workflow: pull-request-and-merge PR #751 is ready for the director lane. Forgejo reports both `ci / gate` and `ci / ward-doctor` successful. The exact Linux release image built and verified all eight artifacts, and the native release check passes from an empty directory. Independent QA re-reviewed the final branch and returned PASS with no blocking findings.

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-25 18:13:11 +00:00

fix(release): stage decoded Aguard spec lock #751

coilyco-ops commented

2026-07-25 18:13:41 +00:00

Author

Owner

WARD-WORKFLOW: blocked 🛑

details

manual close/update snapshot at 2026-07-25T18:13:11Z is newer than the latest ward acknowledgement at 2026-07-25T18:07:45Z

This action is blocked until the feedback is visibly acknowledged.

— Claude (she/her), via ward agent

WARD-WORKFLOW: blocked 🛑 <details><summary>details</summary> manual close/update snapshot at 2026-07-25T18:13:11Z is newer than the latest ward acknowledgement at 2026-07-25T18:07:45Z This action is blocked until the feedback is visibly acknowledged. </details>  — Claude (she/her), via `ward agent`

coilyco-ops commented

2026-07-25 18:13:54 +00:00

Author

Owner

WARD-OUTCOME: done ✅

workflow: pull-request-and-merge

Fresh acknowledgement after the PR body gained Closes #728. PR #751 remains unchanged at its green head, Forgejo reports both required CI contexts successful, the exact Linux release check passes, and independent QA reports PASS with no blocking findings.

WARD-OUTCOME: done ✅ workflow: pull-request-and-merge Fresh acknowledgement after the PR body gained `Closes #728`. PR #751 remains unchanged at its green head, Forgejo reports both required CI contexts successful, the exact Linux release check passes, and independent QA reports PASS with no blocking findings.

coilyco-ops commented

2026-07-25 18:14:54 +00:00

Author

Owner

WARD-OUTCOME: done ✅

workflow: pull-request-and-merge

Fresh acknowledgement after PR #751 gained the exact ward.workflow: pull-request-and-merge body marker. The code head is unchanged, both required CI contexts remain successful, the exact Linux release check passes, and independent QA reports PASS with no blocking findings.

WARD-OUTCOME: done ✅ workflow: pull-request-and-merge Fresh acknowledgement after PR #751 gained the exact `ward.workflow: pull-request-and-merge` body marker. The code head is unchanged, both required CI contexts remain successful, the exact Linux release check passes, and independent QA reports PASS with no blocking findings.

coilyco-ops commented

2026-07-25 18:17:18 +00:00

Author

Owner

WARD-WORKFLOW: qa-done ✅

verdict: pass
reviewed_sha: e6255d5cf5
reviewer_family: internal
workflow: pull-request-and-merge
issue_ref: coilyco-flight-deck/agentic-os#728
pr_ref: coilyco-flight-deck/agentic-os#751
reason: Release staging now mirrors specgen's decoded embed contract, and the corrected smokes match guarded Actions and Aguard version behavior.
run_identity: /root/qa_release_spec

Evidence:

The final diff is limited to scripts/aos-release-build.sh, scripts/check-aos-release.sh, tests/test_aguard.py, and tests/test_aos_cli_release.py.
Focused Ward validation passed 9 of 9 tests.
The exact Linux release image reported all eight aos and aguard artifacts OK, then reported verified aos and aguard release aos-v0.0.0.

WARD-WORKFLOW: qa-done ✅ verdict: pass reviewed_sha: e6255d5cf5f47864038d489f327b26f7a354114f reviewer_family: internal workflow: pull-request-and-merge issue_ref: coilyco-flight-deck/agentic-os#728 pr_ref: coilyco-flight-deck/agentic-os#751 reason: Release staging now mirrors specgen's decoded embed contract, and the corrected smokes match guarded Actions and Aguard version behavior. run_identity: /root/qa_release_spec Evidence: * The final diff is limited to scripts/aos-release-build.sh, scripts/check-aos-release.sh, tests/test_aguard.py, and tests/test_aos_cli_release.py. * Focused Ward validation passed 9 of 9 tests. * The exact Linux release image reported all eight aos and aguard artifacts OK, then reported `verified aos and aguard release aos-v0.0.0`.

coilyco-ops commented

2026-07-25 18:18:21 +00:00

Author

Owner

WARD-WORKFLOW: merge-ready ✅

workflow: pull-request-and-merge; review summary: passed: independent QA PASS for the current four-file diff and exact Linux release proof
checked head sha: e6255d5cf5
status context: ci / gate (pull_request)=success, ci / ward-doctor (pull_request)=success
status state: success

WARD-WORKFLOW: merge-ready ✅ workflow: pull-request-and-merge; review summary: passed: independent QA PASS for the current four-file diff and exact Linux release proof checked head sha: e6255d5cf5f47864038d489f327b26f7a354114f status context: ci / gate (pull_request)=success, ci / ward-doctor (pull_request)=success status state: success

coilyco-ops commented

2026-07-25 18:28:02 +00:00

Author

Owner

WARD-WORKFLOW: reopened. Post-merge AOS CLI release run 2110 failed on commit 21bc338e89 after the repository-grounded release fix landed. The same commit passed CI, promotion, and mirror workflows. Dev-base publish run 2114 remains in progress. The engineer's approved read-only operator surface exposes the run outcome but not the failed job list, so the exact release failure remains live-only. The agent made no additional code push. Operator action: inspect the failed job and step in https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/2110 and return the exact error. If the evidence shows transient runner connectivity or infrastructure state, restore that state and rerun the existing failed jobs once. Confirm the resulting release publishes paired aos and aguard assets plus Homebrew and Scoop metadata. workflow: pull-request-and-merge. Review summary: commit 21bc338 passed repository CI, promotion, and mirroring, while native release publication remains unverified.

WARD-WORKFLOW: reopened. Post-merge AOS CLI release run 2110 failed on commit 21bc338e89d3d051c37545484af95822be3cca9e after the repository-grounded release fix landed. The same commit passed CI, promotion, and mirror workflows. Dev-base publish run 2114 remains in progress. The engineer's approved read-only operator surface exposes the run outcome but not the failed job list, so the exact release failure remains live-only. The agent made no additional code push. Operator action: inspect the failed job and step in https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/2110 and return the exact error. If the evidence shows transient runner connectivity or infrastructure state, restore that state and rerun the existing failed jobs once. Confirm the resulting release publishes paired aos and aguard assets plus Homebrew and Scoop metadata. workflow: pull-request-and-merge. Review summary: commit 21bc338 passed repository CI, promotion, and mirroring, while native release publication remains unverified.

coilyco-ops commented

2026-07-25 18:32:30 +00:00

Author

Owner

WARD-OUTCOME: done ✅. AOS CLI release retry 2115 succeeded for commit 21bc338e89. Release aos-v0.92.0 is published with four Aguard binaries, four AOS binaries, SHA256SUMS, Homebrew metadata, and Scoop metadata. The live publication done-condition is verified.

WARD-OUTCOME: done ✅. AOS CLI release retry 2115 succeeded for commit 21bc338e89d3d051c37545484af95822be3cca9e. Release aos-v0.92.0 is published with four Aguard binaries, four AOS binaries, SHA256SUMS, Homebrew metadata, and Scoop metadata. The live publication done-condition is verified.

coilyco-ops closed this issue

2026-07-25 18:32:32 +00:00

Rows
Columns

Publish Aguard for native host sessions #728

Problem

Ownership

Change

Acceptance

CI babysit contract