Grant Engineer and QA read-only live observability #736

New issue

Closed

opened 2026-07-24 22:14:01 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-24 22:14:01 +00:00

Member

Parent

coilyco-flight-deck/agent-compose#75

Decision

Kai approved a live-observe, never live-operate boundary for Engineer and QA on 2026-07-24.

What to build

Replace the current no-live-access doctrine for Engineer and QA with a narrow, guarded read-only observability surface. Both roles may inspect logs, traces, metrics, health, and rollout status as evidence. Ops retains every live mutation and remediation action.

The runtime permission and public doctrine must land together. Update the canonical .ward role bundle, guardfiles, AGENTS doctrine, role-surface documentation, and validation so the grant is real and auditable rather than prose-only.

Allowed boundary

Read-only logs, traces, metrics, health, events, resource state, and rollout status through approved guarded surfaces
Engineer may use directly observed evidence for diagnosis
QA may use directly observed evidence in a verdict

Denied boundary

No command execution inside workloads
No secrets, credentials, or raw customer payload inspection
No deploy, apply, scale, restart, rollback, edit, patch, delete, port-forward, or other live mutation
No repeated production or CI pushes used as probes
Any live action beyond observation stays with Ops

Acceptance criteria

AGENTS.md describes Engineer and QA as sealed against live mutation rather than live observation.
Engineer and QA receive a dedicated read-only observability guard surface without receiving the existing mixed read and write kubectl surface.
Runtime tests prove the allowed observability verbs work for Engineer and QA and every mutation or shell-equivalent verb remains unavailable.
The existing Director and Ops surfaces retain their current operational authority.
docs/role-surface-tiers.md and the existing FEATURES inventory entry reflect the materially changed public boundary.
Repository validation passes through the declared Ward verbs.

Blocked by

None - can start immediately.

Execution type

AFK

## Parent https://forgejo.coilysiren.me/coilyco-flight-deck/agent-compose/issues/75 ## Decision Kai approved a live-observe, never live-operate boundary for Engineer and QA on 2026-07-24. ## What to build Replace the current no-live-access doctrine for Engineer and QA with a narrow, guarded read-only observability surface. Both roles may inspect logs, traces, metrics, health, and rollout status as evidence. Ops retains every live mutation and remediation action. The runtime permission and public doctrine must land together. Update the canonical `.ward` role bundle, guardfiles, AGENTS doctrine, role-surface documentation, and validation so the grant is real and auditable rather than prose-only. ## Allowed boundary - Read-only logs, traces, metrics, health, events, resource state, and rollout status through approved guarded surfaces - Engineer may use directly observed evidence for diagnosis - QA may use directly observed evidence in a verdict ## Denied boundary - No command execution inside workloads - No secrets, credentials, or raw customer payload inspection - No deploy, apply, scale, restart, rollback, edit, patch, delete, port-forward, or other live mutation - No repeated production or CI pushes used as probes - Any live action beyond observation stays with Ops ## Acceptance criteria - [ ] `AGENTS.md` describes Engineer and QA as sealed against live mutation rather than live observation. - [ ] Engineer and QA receive a dedicated read-only observability guard surface without receiving the existing mixed read and write kubectl surface. - [ ] Runtime tests prove the allowed observability verbs work for Engineer and QA and every mutation or shell-equivalent verb remains unavailable. - [ ] The existing Director and Ops surfaces retain their current operational authority. - [ ] `docs/role-surface-tiers.md` and the existing FEATURES inventory entry reflect the materially changed public boundary. - [ ] Repository validation passes through the declared Ward verbs. ## Blocked by None - can start immediately. ## Execution type AFK

coilyco-ops referenced this issue from coilyco-flight-deck/agent-compose

2026-07-24 22:14:36 +00:00

Align Engineer and QA charters with read-only observability #80