Restore director-completion authority in .ward/ forgejo guardfiles (merge overlay + status reads) #449

Merged

coilysiren merged 3 commits from issue-446 into main

2026-07-10 18:47:46 +00:00

coilyco-ops commented

2026-07-10 18:29:14 +00:00

Member

closes #446

ward.workflow: pull-requests-and-merge

What

PR merge pair - new guardfile.forgejo.merge.kdl carrying can merge pr (repoMergePullRequest) plus the idempotent can is-merged pr (repoPullRequestIsMerged), coily*-owner-scoped, op-pinned, backing the ward agent director merge composite (merge only when the issue thread authorizes it).
Role binding - roles.kdl binds the merge overlay to director and engineer only. advisor and qa keep read/readactions(/write) and still cannot merge - the overlay stays out of the shared tiers they inherit.
Commit combined-status reads - commit status (repoGetCombinedStatusByRef) and commit list-statuses (repoListStatusesByRef) added to guardfile.forgejo.read.kdl and the compatibility monolith. Pure reads, every role.
Actions run status - action-run list (ListActionRuns) and action-run get (ActionRun) added beside the exec bridge, which lists runs but drops the per-run conclusion. Pure reads, every role.
Actions rerun stays out of scope (no rerun operationId in the pinned swagger) - rides agentic-os#434.
Follow-through: regenerated docs/ward-ops-forgejo-reference.md, packaged the new guardfile in the release tar list + check_ward_specs_bundle + bundle tests, merged main (aos#437 lock removal) and resolved docs/ward-specs.md.

Validation

ward doctor all-PASS and ward ops forgejo describe renders every new leaf at the pre-merge commit (d808f0f, lock still present).
On the merged tree, ward doctor (v0.584.0) fails ops bundle: read spec lock - pre-existing on main since aos#437 removed the lock (verified: identical failure at d5079cc). The no-lock fetch path lands with a newer ward.
pre-commit run --all-files green, uv run pytest 455 passed.

Review gate

This is a dialect-1 permission-surface change granting merge authority - it requires Kai's human review and merge, per the issue. The engineer does not self-merge this PR.

closes #446 ward.workflow: pull-requests-and-merge ## What * **PR merge pair** - new [`guardfile.forgejo.merge.kdl`](https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/src/branch/issue-446/.ward/guardfile.forgejo.merge.kdl) carrying `can merge pr` (`repoMergePullRequest`) plus the idempotent `can is-merged pr` (`repoPullRequestIsMerged`), coily*-owner-scoped, op-pinned, backing the `ward agent director merge` composite (merge only when the issue thread authorizes it). * **Role binding** - `roles.kdl` binds the merge overlay to `director` and `engineer` only. `advisor` and `qa` keep read/readactions(/write) and still cannot merge - the overlay stays out of the shared tiers they inherit. * **Commit combined-status reads** - `commit status` (`repoGetCombinedStatusByRef`) and `commit list-statuses` (`repoListStatusesByRef`) added to `guardfile.forgejo.read.kdl` and the compatibility monolith. Pure reads, every role. * **Actions run status** - `action-run list` (`ListActionRuns`) and `action-run get` (`ActionRun`) added beside the exec bridge, which lists runs but drops the per-run conclusion. Pure reads, every role. * **Actions rerun stays out of scope** (no rerun operationId in the pinned swagger) - rides agentic-os#434. * Follow-through: regenerated `docs/ward-ops-forgejo-reference.md`, packaged the new guardfile in the release tar list + `check_ward_specs_bundle` + bundle tests, merged main (aos#437 lock removal) and resolved `docs/ward-specs.md`. ## Validation * `ward doctor` all-PASS and `ward ops forgejo describe` renders every new leaf at the pre-merge commit (d808f0f, lock still present). * On the merged tree, `ward doctor` (v0.584.0) fails `ops bundle: read spec lock` - **pre-existing on main** since aos#437 removed the lock (verified: identical failure at d5079cc). The no-lock fetch path lands with a newer ward. * `pre-commit run --all-files` green, `uv run pytest` 455 passed. ## Review gate This is a **dialect-1 permission-surface change granting merge authority - it requires Kai's human review and merge**, per the issue. The engineer does not self-merge this PR.

coilyco-ops added 3 commits

2026-07-10 18:29:14 +00:00

feat(ward-specs): restore director-completion authority in forgejo guardfiles 48e7b46a8b

Add the PR-merge pair (repoMergePullRequest + repoPullRequestIsMerged) in a
new guardfile.forgejo.merge.kdl bound to the director and engineer roles only
(not advisor, not qa), coily*-owner-scoped, backing the ward agent director
merge composite. Add commit combined-status reads (repoGetCombinedStatusByRef,
repoListStatusesByRef) and status-bearing Actions run reads (ListActionRuns,
ActionRun) to the read tier and the compatibility monolith. Actions rerun
stays out of scope (agentic-os#434). Part of agentic-os#446.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs: regenerate ward ops forgejo reference for the aos#446 surface d808f0f544

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

merge main into issue-446: carry aos#437 no-lock spec bundle forward

ci / gate (pull_request) Successful in 12s

Details

f4d2c27e30

Resolve docs/ward-specs.md around the aos#437 rewrite, package the new
guardfile.forgejo.merge.kdl in the release tar list and the ward-specs-bundle
validator, and pin it in the bundle tests. Part of agentic-os#446.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

coilyco-ops referenced this pull request

2026-07-10 18:30:29 +00:00

Restore director-completion authority in .ward/ forgejo guardfiles: PR merge (director/engineer roles) + commit-status read + action-run status #446