refactor(aos): drop the director/engineer/qa and kubeconfig carve-outs #1040

Merged

coilysiren merged 1 commit from aos/claude/fx48-uniform-roles into main

2026-08-13 09:54:23 +00:00

coilyco-ops commented

2026-08-13 09:51:54 +00:00

Owner

Kai reviewed the tradeoff and asked for the role special-casing removed. Every warded role now takes one path, and --kubeconfig honors any role.

What changed

aos-cli/composition.go - buildWardLaunchPlan always emits ward agent run --role <role>. The director/engineer/qa branch onto Ward's fixed lanes is gone.
aos-cli/composition.go - validateIntegratedLaunch requires work text from every warded role, and no longer rejects --agent-id for the former triad.
aos-cli/kubeconfig.go - roleCanUseKubeconfig is deleted. The explicit --kubeconfig flag is the only gate, and resolveKubeconfigMount no longer takes a role.

Behavior changes, accepted deliberately

These were raised before the change and chosen anyway. Recording them so review sees them:

ward agent run is a read-only one-shot. ward agent run --role qa --print returns "read_only":true and sets WARD_READONLY=1. Warded engineer and qa therefore no longer reach Ward's writable ticket-carrying lanes, and warded director no longer opens the supervision surface. ward agent roster still lists the three fixed workflows, AOS just stops routing to them.
engineer and qa containers can now receive live cluster credentials when the operator passes --kubeconfig. The test that named them sealed roles is replaced by one asserting projection for every role.
A warded director now needs work text where it previously launched bare.

Docs

docs/aos-kubeconfig.md, docs/aos-generic-warded-roles.md, docs/aos-cli.md, and the docs/FEATURES.md Ward entry each asserted the old rules and would have been left false.

Validation

go test -C aos-cli ./... - ok
ward exec test - 522 passed
pre-commit run --all-files - all hooks passed

Kai reviewed the tradeoff and asked for the role special-casing removed. Every warded role now takes one path, and `--kubeconfig` honors any role. ## What changed * `aos-cli/composition.go` - `buildWardLaunchPlan` always emits `ward agent run --role <role>`. The `director`/`engineer`/`qa` branch onto Ward's fixed lanes is gone. * `aos-cli/composition.go` - `validateIntegratedLaunch` requires work text from every warded role, and no longer rejects `--agent-id` for the former triad. * `aos-cli/kubeconfig.go` - `roleCanUseKubeconfig` is deleted. The explicit `--kubeconfig` flag is the only gate, and `resolveKubeconfigMount` no longer takes a role. ## Behavior changes, accepted deliberately These were raised before the change and chosen anyway. Recording them so review sees them: * `ward agent run` is a **read-only** one-shot. `ward agent run --role qa --print` returns `"read_only":true` and sets `WARD_READONLY=1`. Warded engineer and qa therefore no longer reach Ward's writable ticket-carrying lanes, and warded director no longer opens the supervision surface. `ward agent roster` still lists the three fixed workflows, AOS just stops routing to them. * `engineer` and `qa` containers can now receive live cluster credentials when the operator passes `--kubeconfig`. The test that named them sealed roles is replaced by one asserting projection for every role. * A warded director now needs work text where it previously launched bare. ## Docs `docs/aos-kubeconfig.md`, `docs/aos-generic-warded-roles.md`, `docs/aos-cli.md`, and the `docs/FEATURES.md` Ward entry each asserted the old rules and would have been left false. ## Validation * `go test -C aos-cli ./...` - ok * `ward exec test` - 522 passed * `pre-commit run --all-files` - all hooks passed

coilyco-ops added 1 commit

2026-08-13 09:51:54 +00:00

refactor(aos): drop the director/engineer/qa and kubeconfig carve-outs

ci / ward-doctor (pull_request) Successful in 16s

Details

ci / aos-cli-tests (pull_request) Successful in 30s

Details

ci / gate (pull_request) Successful in 1m4s

Details

efd044c0da

Kai asked for the role special-casing gone after reviewing the tradeoff, so
every warded role now takes one path and `--kubeconfig` honors any role.

* buildWardLaunchPlan always emits `ward agent run --role <role>`. The
  director/engineer/qa branch onto Ward's fixed lanes is gone.
* validateIntegratedLaunch requires work text from every warded role and no
  longer rejects `--agent-id` for the former triad.
* resolveKubeconfigMount drops roleCanUseKubeconfig, so the explicit flag is
  the only gate and the role argument is gone with it.

Known behavior changes, accepted deliberately:

* `ward agent run` is a read-only one-shot (`WARD_READONLY=1`), so warded
  engineer and qa no longer reach Ward's writable ticket-carrying lanes and
  warded director no longer opens the supervision surface.
* `engineer` and `qa` containers can now receive live cluster credentials
  when the operator passes `--kubeconfig`.
* A warded director now needs work text where it previously launched bare.

Validation:
* go test -C aos-cli ./...: ok
* ward exec test: 522 passed
* pre-commit run --all-files: all hooks passed

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-13 09:51:54 +00:00