fix(aosguard): re-lock onto umbra v0.161.0 so --query stops being refused #1154

Merged

coilysiren merged 4 commits from chore/relock-umbra-query-fix into main 2026-08-20 09:01:50 +00:00

Conversation 0 Commits 4 Files changed 2 +5 -5

coilyco-ops commented 2026-08-20 08:19:40 +00:00

Member

Copy link

Closes #1153.

--query is refused on every aosguard ops forgejo verb on the current release, not repo get alone:

$ aosguard --version
aosguard version aos-v0.214.0
$ aosguard ops forgejo repo get coilyco-flight-deck umbra --query topics --output json
aosguard: --query cannot project a non-JSON response

Cause

umbra#293. A shared $ref response carries the root produces, so a JSON operation is flagged raw and writeRawResponse refuses the projection rather than ignoring it. Forgejo's swagger has exactly that shape, which is why the whole area went with it.

The pin missed the fix by hours:

• v0.142.0 tagged 2026-08-15 16:23 UTC
• 92afd48 ("fix(specverb): a response offering JSON is parsed, not raw") landed 2026-08-15 21:01 -0700
• 22352d05 (#1066) re-locked onto v0.142.0 that same day

The fix first ships in v0.143.0, so every release since has carried the refusal.

Change

just aosguard-lock, which moves the frozen umbra graph v0.142.0 -> v0.161.0. One file, .specgen/guardfiles/specverb.lock. The two vendored swagger locks re-locked to identical bytes.

Verification

Against a binary built from this lock:

• repo get --query topics returns the topics array
• issue get --query title returns the title
• org-repo list --query '[*].name' and the flatten form '[].name' both project
• reads without --query are unchanged

Note for review

The failure was quiet at the call site, which is the part that made it expensive. A caller that reads a non-zero --query result as "no data" writes an empty value instead of reporting a broken tool. coilyco-bridge/agentic-os-kai#888 hit exactly that: a bare except turned the refusal into an empty topic list, indistinguishable from a repository with no topics, and would have blanked every topic in the fleet registry. Fixed on that caller in agentic-os-kai a2775aa, but other --query callers may be swallowing it the same way.

Generated with Claude Code

Closes #1153. `--query` is refused on every `aosguard ops forgejo` verb on the current release, not `repo get` alone: ``` $ aosguard --version aosguard version aos-v0.214.0 $ aosguard ops forgejo repo get coilyco-flight-deck umbra --query topics --output json aosguard: --query cannot project a non-JSON response ``` ## Cause umbra#293. A shared `$ref` response carries the root `produces`, so a JSON operation is flagged raw and `writeRawResponse` refuses the projection rather than ignoring it. Forgejo's swagger has exactly that shape, which is why the whole area went with it. The pin missed the fix by hours: - `v0.142.0` tagged 2026-08-15 16:23 UTC - `92afd48` ("fix(specverb): a response offering JSON is parsed, not raw") landed 2026-08-15 21:01 -0700 - 22352d05 (#1066) re-locked onto `v0.142.0` that same day The fix first ships in `v0.143.0`, so every release since has carried the refusal. ## Change `just aosguard-lock`, which moves the frozen umbra graph `v0.142.0` -> `v0.161.0`. One file, `.specgen/guardfiles/specverb.lock`. The two vendored swagger locks re-locked to identical bytes. ## Verification Against a binary built from this lock: - `repo get --query topics` returns the topics array - `issue get --query title` returns the title - `org-repo list --query '[*].name'` and the flatten form `'[].name'` both project - reads without `--query` are unchanged ## Note for review The failure was quiet at the call site, which is the part that made it expensive. A caller that reads a non-zero `--query` result as "no data" writes an empty value instead of reporting a broken tool. coilyco-bridge/agentic-os-kai#888 hit exactly that: a bare except turned the refusal into an empty topic list, indistinguishable from a repository with no topics, and would have blanked every topic in the fleet registry. Fixed on that caller in agentic-os-kai a2775aa, but other `--query` callers may be swallowing it the same way. Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 1 commit 2026-08-20 08:19:41 +00:00

fix(aosguard): re-lock onto umbra v0.161.0 so --query stops being refused ... 745bcc3842

Every `aosguard ops forgejo` verb refused a projection with "--query cannot
project a non-JSON response". Not `repo get` alone: every object read.

The cause is umbra#293. A shared `$ref` response carries the root `produces`,
so a JSON operation is flagged raw and writeRawResponse refuses the projection
rather than ignoring it. Forgejo's swagger has exactly that shape, so the whole
area went with it.

umbra fixed it in 92afd48 and the pin missed it by hours. v0.142.0 was tagged
2026-08-15 16:23 UTC, the fix landed 2026-08-15 21:01 -0700, and 22352d05
(#1066) re-locked onto v0.142.0 that same day. The fix first ships in v0.143.0,
so every release since has carried the refusal.

Verified against a binary built from this lock: `repo get --query topics`,
`issue get --query title`, and `org-repo list --query '[*].name'` all project,
and the flatten form projects too.

The failure was quiet at the call site, which is the part worth noting. A caller
that reads a non-zero --query result as "no data" writes an empty value instead
of reporting a broken tool. agentic-os-kai#888 hit exactly that: a bare except
turned the refusal into an empty topic list and nearly blanked every topic in
the fleet registry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

coilyco-ops requested review from coilysiren 2026-08-20 08:19:41 +00:00

coilysiren added 1 commit 2026-08-20 08:28:48 +00:00

fix(dev-base): carry the specgen pin with the umbra re-lock ... 78dbee3bb1

`test_specgen_pin_is_owned_by_the_dependency_lock` asserts the dev-base full
image pins the exact version the dependency lock names, and the re-lock moved
`cliGuard` to v0.161.0 while the Dockerfile still asked for 0.142.0. The image
fetches specgen from umbra's own release downloads, so the two are one train
and the test exists to keep them from drifting apart.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

coilysiren added 1 commit 2026-08-20 08:47:23 +00:00

Merge branch 'main' into chore/relock-umbra-query-fix c9b1742940

coilysiren added 1 commit 2026-08-20 08:53:51 +00:00

Merge branch 'main' into chore/relock-umbra-query-fix 31a68238d2

coilysiren merged commit 3a4d4584da into main 2026-08-20 09:01:50 +00:00

coilysiren deleted branch chore/relock-umbra-query-fix 2026-08-20 09:01:51 +00:00

coilysiren referenced this pull request from a commit 2026-08-20 09:01:52 +00:00

fix(aosguard): re-lock onto umbra v0.161.0 so --query stops being refused (#1154)

Sign in to join this conversation.

Reviewers

No reviewers

coilysiren

Labels

Clear labels   

burndown-2026-06

Backlog burndown June 2026

  

autonomy

async-consult

A human needs to consult on the issue to upgrade it to headless

  

autonomy

epic

This issue has many units of sub work - its size makes it meaningfully exclusive with other autonomy types

  

autonomy

headless

The agent can perform the work on its own

  

autonomy

live-collab

The agent and the human need to work together in realtime

  

coherence-core

Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  

priority

P0

priority tier

  

priority

P1

priority tier

  

priority

P2

priority tier

  

priority

P3

priority tier

  

priority

P4

priority tier

  

qa-fixture

Disposable issue admitted to the bounded Ward QA verification lane.

  

role/ai

requires work from the AI Engineer role

  

role/creator

requires work from Content Creator role

  

role/design

requires work from the design role

  

role/director

requires work from the director role

  

role/engineer

requires work from the engineer role

  

role/exec

requires work from the exec role

  

role/human

requires a person, and specifically not an agent seat

  

role/ops

requires work from the ops role

  

role/qa

requires work from the QA role

No labels

burndown-2026-06

autonomy

async-consult

autonomy

epic

autonomy

headless

autonomy

live-collab

coherence-core

priority

P0

priority

P1

priority

P2

priority

P3

priority

P4

qa-fixture

role/ai

role/creator

role/design

role/director

role/engineer

role/exec

role/human

role/ops

role/qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os!1154

No description provided.