Expose machine-readable fleet pre-commit compliance evaluation #774

New issue

Open

opened 2026-07-28 19:46:55 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-28 19:46:55 +00:00

Member

Outcome

Expose one read-only, machine-readable AOS surface that evaluates a consumer repository against the canonical pre-commit policy without duplicating hook IDs or rollout rules in infrastructure.

Current state

scripts/audit-pre-commit-coverage.py derives expected hook IDs from .pre-commit-hooks.yaml, but its remote mode is GitHub-specific and its output is human-oriented.
scripts/apply-agentic-os-hooks.py owns the managed block, per-repository hook selection, opt-out marker, and target revision behavior.
Infrastructure needs to observe coverage and rollout progress from isolated Forgejo clones inside a k3s CronJob.

Required surface

The AOS package exposes a read-only evaluator that accepts a repository identity, consumer .pre-commit-config.yaml content or path, and an explicit rollout target.
The evaluator returns stable structured output for ok, missing-config, invalid-config, missing-hooks, pin-behind, pin-ahead, opted-out, and evaluation errors.
The evaluator reports coverage, rollout-target progress, and release freshness as distinct dimensions.
The evaluator derives canonical hook inventory, per-repository selection, managed-block semantics, and .agentic-os-ignore behavior from their owning loaders.
The existing audit and apply tools reuse the same owning evaluation logic where their boundaries overlap.
The evaluator performs no repository mutation and requires no GitHub-specific API access.

Acceptance

Infrastructure can run the evaluator against a shallow Forgejo checkout and consume versioned JSON output.
The output includes stable rule IDs and safe evidence suitable for a fleet digest.
Tests exercise evaluator behavior with fixtures and validate real owning configuration through the AOS loader. Tests do not restate the catalog or managed block.
Existing ward exec audit-pre-commit-coverage, rollout behavior, documentation, and canonical pre-commit validation remain green.

Boundary

AOS owns policy evaluation. Infrastructure owns Forgejo inventory, isolated checkout orchestration, k3s scheduling, deployment tuning, persistent finding state, and Telegram delivery.

## Outcome Expose one read-only, machine-readable AOS surface that evaluates a consumer repository against the canonical pre-commit policy without duplicating hook IDs or rollout rules in infrastructure. ## Current state * `scripts/audit-pre-commit-coverage.py` derives expected hook IDs from `.pre-commit-hooks.yaml`, but its remote mode is GitHub-specific and its output is human-oriented. * `scripts/apply-agentic-os-hooks.py` owns the managed block, per-repository hook selection, opt-out marker, and target revision behavior. * Infrastructure needs to observe coverage and rollout progress from isolated Forgejo clones inside a k3s CronJob. ## Required surface * The AOS package exposes a read-only evaluator that accepts a repository identity, consumer `.pre-commit-config.yaml` content or path, and an explicit rollout target. * The evaluator returns stable structured output for `ok`, `missing-config`, `invalid-config`, `missing-hooks`, `pin-behind`, `pin-ahead`, `opted-out`, and evaluation errors. * The evaluator reports coverage, rollout-target progress, and release freshness as distinct dimensions. * The evaluator derives canonical hook inventory, per-repository selection, managed-block semantics, and `.agentic-os-ignore` behavior from their owning loaders. * The existing audit and apply tools reuse the same owning evaluation logic where their boundaries overlap. * The evaluator performs no repository mutation and requires no GitHub-specific API access. ## Acceptance * Infrastructure can run the evaluator against a shallow Forgejo checkout and consume versioned JSON output. * The output includes stable rule IDs and safe evidence suitable for a fleet digest. * Tests exercise evaluator behavior with fixtures and validate real owning configuration through the AOS loader. Tests do not restate the catalog or managed block. * Existing `ward exec audit-pre-commit-coverage`, rollout behavior, documentation, and canonical pre-commit validation remain green. ## Boundary AOS owns policy evaluation. Infrastructure owns Forgejo inventory, isolated checkout orchestration, k3s scheduling, deployment tuning, persistent finding state, and Telegram delivery.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-07-28 19:47:45 +00:00

Deploy a read-only code-fleet-watch k3s CronJob #668

coilyco-ops commented

2026-07-28 19:47:58 +00:00

Author

Member

Infrastructure consumer and deployment tracking: infrastructure#668.

Infrastructure consumer and deployment tracking: [infrastructure#668](https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/668).

coilyco-ops commented

2026-07-28 20:29:44 +00:00

Author

Member

Infrastructure adapter is now landed but disabled in infrastructure@053769d. The adapter passes deployment-owned {repo}, {target}, and {rollout_target} placeholders to the AOS command. It accepts exit 0 or 1 plus safe JSON stdout shaped as {"status":"compliant|noncompliant","findings":[{"id":"safe-stable-id"}]}. Infrastructure ignores evaluator prose and renders a static policy mismatch detail, so AOS output cannot leak repository content into Telegram. A noncompliant status without findings fails closed. AOS still owns the canonical hook inventory, opt-out parsing, rollout-target semantics, and latest-release freshness dimensions.

Infrastructure adapter is now landed but disabled in infrastructure@053769d. The adapter passes deployment-owned `{repo}`, `{target}`, and `{rollout_target}` placeholders to the AOS command. It accepts exit 0 or 1 plus safe JSON stdout shaped as `{"status":"compliant|noncompliant","findings":[{"id":"safe-stable-id"}]}`. Infrastructure ignores evaluator prose and renders a static `policy mismatch` detail, so AOS output cannot leak repository content into Telegram. A noncompliant status without findings fails closed. AOS still owns the canonical hook inventory, opt-out parsing, rollout-target semantics, and latest-release freshness dimensions.

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 03:45:23 +00:00

coilyco-ops added

priority

and removed

priority

labels

2026-07-29 06:19:29 +00:00