fix(pr-guard): stand down on the merge-remote-main lane it was overriding #1330

Merged

coilyco-ops merged 1 commit from ops/1321-pr-guard-reads-lane into main

2026-08-28 02:35:18 +00:00

coilyco-ops commented

2026-08-28 02:33:31 +00:00

Owner

Closes #1321.

The contradiction

pr-guard refused any push whose destination is the remote default branch, unconditionally. merge-remote-main is defined as commit, push to main, close the issue, so on the eight repos declaring that lane one hook in this suite rendered prose telling the agent to push main and a second hook refused the push. The only documented override is git push --no-verify, which the fleet rules forbid outright, so those repos had no compliant path at all.

The fix

The lane already has one owning reader, so the guard asks it rather than growing a second frontmatter parser:

generate-git-workflow gains --print-lane, which prints the resolved slug and prints nothing when the repo declares none. A fallback slug there would hand the guard an authority the repo never granted.
The guard resolves that reader through AOS_LANE_READER, then PATH, then the python env pre-commit built for this same hook repo's python hooks (pre-commit builds no environment for a language: script hook). An unresolved answer reads as undeclared, and undeclared stays guarded.

Standing down exits rather than falling through: the already-published half below judges feature branches, and the default branch has no pull request of its own for it to find.

Acceptance, each covered by a test

merge-remote-main pushes to the default branch and the guard says nothing.
pull-request, pull-request-and-merge, remote-branch-only, and an undeclared repo are refused exactly as before, and the refusal now names the lane it read.
An unresolvable reader refuses and says why, so a stand-down that could not fire is diagnosable.
The already-published-branch half is untouched on every lane, including a feature branch on a merge-remote-main repo.
No second lane parser exists.

Verified end to end against the real generate-git-workflow, not only the test stub. Full pre-commit run --all-files exits 0 and 746 tests pass.

Not in this change

umbra declares its lane in .ward/ward.yaml rather than AGENTS.md frontmatter, so every reader sees it as undeclared and guards it. Teaching the resolver that file would deepen a dependency the fleet is shedding (#1329), so the honest fix is umbra declaring in frontmatter. Filed separately rather than folded in here.

Closes #1321. ## The contradiction `pr-guard` refused any push whose destination is the remote default branch, unconditionally. `merge-remote-main` is defined as commit, push to `main`, close the issue, so on the eight repos declaring that lane one hook in this suite rendered prose telling the agent to push `main` and a second hook refused the push. The only documented override is `git push --no-verify`, which the fleet rules forbid outright, so those repos had no compliant path at all. ## The fix The lane already has one owning reader, so the guard asks it rather than growing a second frontmatter parser: * `generate-git-workflow` gains `--print-lane`, which prints the resolved slug and prints **nothing** when the repo declares none. A fallback slug there would hand the guard an authority the repo never granted. * The guard resolves that reader through `AOS_LANE_READER`, then PATH, then the python env pre-commit built for this same hook repo's python hooks (pre-commit builds no environment for a `language: script` hook). An unresolved answer reads as undeclared, and undeclared stays guarded. Standing down **exits** rather than falling through: the already-published half below judges feature branches, and the default branch has no pull request of its own for it to find. ## Acceptance, each covered by a test * `merge-remote-main` pushes to the default branch and the guard says nothing. * `pull-request`, `pull-request-and-merge`, `remote-branch-only`, and an undeclared repo are refused exactly as before, and the refusal now names the lane it read. * An unresolvable reader refuses and says why, so a stand-down that could not fire is diagnosable. * The already-published-branch half is untouched on every lane, including a feature branch on a `merge-remote-main` repo. * No second lane parser exists. Verified end to end against the real `generate-git-workflow`, not only the test stub. Full `pre-commit run --all-files` exits 0 and 746 tests pass. ## Not in this change `umbra` declares its lane in `.ward/ward.yaml` rather than AGENTS.md frontmatter, so every reader sees it as undeclared and guards it. Teaching the resolver that file would deepen a dependency the fleet is shedding (#1329), so the honest fix is umbra declaring in frontmatter. Filed separately rather than folded in here.

coilyco-ops added 1 commit

2026-08-28 02:33:31 +00:00

fix(pr-guard): stand down on the merge-remote-main lane it was overriding

ci / ward-doctor (pull_request) Successful in 7s

Details

ci / aos-eval-tests (pull_request) Successful in 8s

Details

ci / aos-cli-tests (pull_request) Successful in 29s

Details

ci / gate (pull_request) Successful in 50s

Details

8a42b63af3

pr-guard refused every push whose destination is the remote default branch,
unconditionally. `merge-remote-main` is defined as commit, push to `main`,
close the issue, so on the eight repos declaring that lane one hook rendered
prose telling the agent to push `main` and a second hook refused the push. The
only documented override is `--no-verify`, which the fleet rules forbid, so
those repos had no compliant path and every further hook-pin advance widened
the contradiction.

The lane has one owning reader, so the guard asks it rather than growing a
second frontmatter parser: `generate-git-workflow` gains `--print-lane`, and
the guard resolves it through `AOS_LANE_READER`, PATH, then the python env
pre-commit built for this hook repo's other hooks. An unresolved answer reads
as undeclared, and undeclared stays guarded.

Standing down exits rather than falling through, because the already-published
half below judges feature branches and the default branch has no pull request
of its own to find. That half is untouched on every lane.

Closes #1321

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops merged commit 3d80e355aa into main

2026-08-28 02:35:18 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-28 02:35:19 +00:00

fix(pr-guard): stand down on the merge-remote-main lane it was overriding (#1330)

coilyco-ops referenced this pull request

2026-08-28 03:02:32 +00:00

Decide whether 15 repos keep declaring .ward/ward.yaml, now that no validator reads it #1329

coilyco-ops referenced this pull request

2026-08-28 04:47:41 +00:00

Decide whether 15 repos keep declaring .ward/ward.yaml, now that no validator reads it #1329