Add repo-label create on the admin wrapper #1413

Merged

coilyco-ops merged 1 commit from aos/claude/ee98-repolabel3 into main

2026-08-29 13:10:58 +00:00

coilyco-ops commented

2026-08-29 13:07:49 +00:00

Owner

Forgejo mints labels per organization and coilysiren is a user account, so its six repositories including the tracker cannot receive a new label through any guarded path. coilysiren/inbox already carries 19 repo-level labels, hand-maintained outside the surface. Only the create verb was missing.

Where it lands, and why not the ordinary wrapper

forgejo-admin is exactly "operations Forgejo refuses to coilyco-ops", which is this situation, and a user-owned repo needs the admin PAT anyway. create org-label already lives there.

restrict is wrap-level, so a create label scoped to coilysiren cannot be a leaf inside forgejo.kdl. The ward#107 deny there is untouched and still answers for itself:

$ aosguard ops forgejo label create coilyco-flight-deck agentic-os
aosguard: repo-level label create is policy-disabled (ward#107): it mints labels
that duplicate and shadow the org P0-P4 taxonomy. Create org labels with
`create org-label`.

$ aosguard ops forgejo-admin label create --help
USAGE: aosguard ops forgejo-admin label create [options] <owner> <repo>
       --name (required) --color (required) --description --exclusive --is_archived

Both built with the pinned specgen 0.185.0 and probed, not read.

The cost, which is the real content of this PR

This wrapper loses its vendored .swagger.v1.json.gz.

A vendored snapshot is pruned to the operations declared when it was written, so it cannot grow a new one. issueCreateLabel is in live Forgejo (506 operations) and absent from the committed 88-operation copy, and specgen lock reads the snapshot rather than fetching. There is no specgen verb that refreshes one - gen, lock, skew, build, run, none writes a .v1.json.gz.

Dropping it makes lock fetch live for this guardfile. That costs hermetic locking here, and is why forgejo.kdl keeps its snapshot: the two are now inconsistent on purpose rather than by accident. Kai picked this over dropping both or building a refresh step first, and references/aosguard.md records the reasoning so the next reader does not restore the file as a missing safety net.

769 tests pass, full pre-commit suite green.

Closes #1377

Forgejo mints labels per organization and `coilysiren` is a **user account**, so its six repositories including the tracker cannot receive a new label through any guarded path. `coilysiren/inbox` already carries 19 repo-level labels, hand-maintained outside the surface. Only the create verb was missing. ## Where it lands, and why not the ordinary wrapper `forgejo-admin` is exactly "operations Forgejo refuses to coilyco-ops", which is this situation, and a user-owned repo needs the admin PAT anyway. `create org-label` already lives there. `restrict` is wrap-level, so a `create label` scoped to `coilysiren` cannot be a leaf inside `forgejo.kdl`. The ward#107 deny there is untouched and still answers for itself: ``` $ aosguard ops forgejo label create coilyco-flight-deck agentic-os aosguard: repo-level label create is policy-disabled (ward#107): it mints labels that duplicate and shadow the org P0-P4 taxonomy. Create org labels with `create org-label`. $ aosguard ops forgejo-admin label create --help USAGE: aosguard ops forgejo-admin label create [options] <owner> <repo> --name (required) --color (required) --description --exclusive --is_archived ``` Both built with the pinned specgen 0.185.0 and probed, not read. ## The cost, which is the real content of this PR This wrapper **loses its vendored `.swagger.v1.json.gz`.** A vendored snapshot is pruned to the operations declared when it was written, so it cannot grow a new one. `issueCreateLabel` is in live Forgejo (506 operations) and absent from the committed 88-operation copy, and `specgen lock` reads the snapshot rather than fetching. There is no specgen verb that refreshes one - `gen`, `lock`, `skew`, `build`, `run`, none writes a `.v1.json.gz`. Dropping it makes `lock` fetch live for this guardfile. That costs hermetic locking here, and is why `forgejo.kdl` keeps its snapshot: the two are now inconsistent on purpose rather than by accident. Kai picked this over dropping both or building a refresh step first, and `references/aosguard.md` records the reasoning so the next reader does not restore the file as a missing safety net. 769 tests pass, full pre-commit suite green. Closes #1377

coilyco-ops added 1 commit

2026-08-29 13:07:49 +00:00

feat(aosguard): add repo-label create on the admin wrapper

ci / aos-cli-tests (pull_request) Successful in 27s

Details

ci / gate (pull_request) Successful in 55s

Details

a5df9f73e7

Forgejo mints labels per organization and coilysiren is a user account, so
its six repositories including the tracker cannot receive a new label
through any guarded path. coilysiren/inbox already carries 19 repo-level
labels, hand-maintained outside the surface; only the create verb was
missing.

It lands on forgejo-admin because that wrapper is exactly "operations
Forgejo refuses to coilyco-ops", and a user-owned repo needs the admin PAT
anyway. The ward#107 deny on the ordinary wrapper is untouched and still
answers with its own message.

This wrapper loses its vendored .swagger.v1.json.gz. A snapshot is pruned
to the operations declared when it was written, so it cannot grow one:
issueCreateLabel is in live Forgejo (506 ops) and absent from the committed
88-op copy. Locking this guardfile now fetches live, which costs hermetic
locking for it and is why forgejo.kdl keeps its snapshot. Kai's call.

Closes coilyco-flight-deck/agentic-os#1377

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops merged commit 33f909efdb into main

2026-08-29 13:10:58 +00:00

coilyco-ops deleted branch aos/claude/ee98-repolabel3

2026-08-29 13:10:58 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-29 13:10:59 +00:00

Add repo-label create on the admin wrapper (#1413)