Require labels on move-issue, the other path that files an issue #1407

Merged

coilyco-ops merged 1 commit from aos/claude/ee98-moveissue into main

2026-08-29 11:16:35 +00:00

coilyco-ops commented

2026-08-29 11:11:29 +00:00

Owner

#1105 closed the issue create path: no issue is filed without a priority and an autonomy label. move-issue is the other verb in this guardfile that creates an issue, and it carried none, so every move produced an unlabelled issue in the target repo - the fail-closed default that reaches no queue.

Not a regression from #1105: a shadow replaces the CLI leaf, not the grant, so move-issue's own call create issue still targets the generated leaf. The hole predates the guard and only became conspicuous beside it.

--labels is now required with the same two matches clauses, so the same vocabulary is enforced with the same messages, and a second add issue-label call threads $dst.number the way create's does.

Built with the pinned specgen and probed

$ aosguard ops forgejo action move-issue <src> 99999 <dst>
aosguard: missing required flag --labels

$ aosguard ops forgejo action move-issue --labels=priority/p2 --labels=autonomy/headless ...
aosguard: --labels: no priority label: add --labels priority/P2 (P0 highest, P4 lowest)

The lowercase priority/p2 case matters: the labels endpoint drops an unknown name silently with a 200, so without the enumerated matches the move would succeed and apply nothing.

--dry-run shows the label call threaded into the plan between create and comment:

- as: moved-labels
  url: .../issues/${dst.number}/labels

The positional signature is unchanged (<source> <index> <target>), so no existing invocation breaks on argument order - only on the new required flag, which is the point.

The comment saying labels were "deferred (array flow)" is gone, since array inputs carry now.

Closes #1317

#1105 closed the `issue create` path: no issue is filed without a priority and an autonomy label. `move-issue` is the **other** verb in this guardfile that creates an issue, and it carried none, so every move produced an unlabelled issue in the target repo - the fail-closed default that reaches no queue. Not a regression from #1105: a shadow replaces the CLI leaf, not the grant, so `move-issue`'s own `call create issue` still targets the generated leaf. The hole predates the guard and only became conspicuous beside it. `--labels` is now required with the same two `matches` clauses, so the same vocabulary is enforced with the same messages, and a second `add issue-label` call threads `$dst.number` the way create's does. ## Built with the pinned specgen and probed ``` $ aosguard ops forgejo action move-issue <src> 99999 <dst> aosguard: missing required flag --labels $ aosguard ops forgejo action move-issue --labels=priority/p2 --labels=autonomy/headless ... aosguard: --labels: no priority label: add --labels priority/P2 (P0 highest, P4 lowest) ``` The lowercase `priority/p2` case matters: the labels endpoint drops an unknown name **silently with a 200**, so without the enumerated `matches` the move would succeed and apply nothing. `--dry-run` shows the label call threaded into the plan between create and comment: ``` - as: moved-labels url: .../issues/${dst.number}/labels ``` The positional signature is unchanged (`<source> <index> <target>`), so no existing invocation breaks on argument order - only on the new required flag, which is the point. The comment saying labels were "deferred (array flow)" is gone, since array inputs carry now. Closes #1317

coilyco-ops added 1 commit

2026-08-29 11:11:29 +00:00

feat(aosguard): require labels on move-issue, the other path that files one

ci / aos-cli-tests (pull_request) Successful in 39s

Details

ci / gate (pull_request) Successful in 1m3s

Details

9b63e86e18

#1105 closed the `issue create` path: no issue is filed without a priority
and an autonomy label. `move-issue` is the other verb in this guardfile
that creates an issue and it carried none, so every move produced an
unlabelled issue in the target repo, which is the fail-closed default that
reaches no queue.

It is not a regression from #1105: a shadow replaces the CLI leaf, not the
grant, so move-issue's own `call create issue` still targets the generated
leaf. The hole predates the guard.

`--labels` is now required with the same two `matches` clauses, so the same
vocabulary is enforced by the same messages, and the refusal binds before
any call fires. A second `add issue-label` call threads $dst.number the way
create's does.

The comment saying labels were "deferred (array flow)" is gone; array
inputs carry now.

Closes coilyco-flight-deck/agentic-os#1317

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops referenced this pull request

2026-08-29 11:12:10 +00:00

#1349 breaks 65 existing aosguard ops kubectl call sites at rebuild, including two live-mutation scripts #1352

coilyco-ops merged commit 72024956f6 into main

2026-08-29 11:16:35 +00:00

coilyco-ops deleted branch aos/claude/ee98-moveissue

2026-08-29 11:16:36 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-29 11:16:36 +00:00

Require labels on move-issue, the other path that files an issue (#1407)