chore(aosguard): pin specgen 0.134.0 for raw response bodies #998

Merged

coilysiren merged 1 commit from aos/claude/specgen-0134 into main

2026-08-12 05:19:45 +00:00

coilyco-ops commented

2026-08-12 05:07:45 +00:00

Owner

Bumps SPECGEN_VERSION from 0.132.0 to 0.134.0. Two lines, both pin sites.

Why

cli-guard 0.134.0 carries coilyco-flight-deck/cli-guard#278, which makes the engine honor an operation`s declared response media type instead of parsing every response as JSON.

That is the last thing between the Forgejo 16 upgrade and reading CI logs from an agent:

$ aosguard ops forgejo action-job logs coilyco-gaming sirens-echo 27514
aosguard: invalid character `-` after top-level value

The log body opens with an ISO timestamp, so the decoder read 2026 as a number and choked on the hyphen. curl against the same endpoint returned HTTP 200 and 23935 bytes.

No guardfile change is needed

Worth stating, because the obvious guess is that a grant is missing. It is not:

can logs action-job and can logs action-run already exist in forgejo.kdl, already annotated "(Forgejo 16)".
The vendored 16.0.1 snapshot already declares produces: ["text/plain"] for the job log and application/zip for the run log.
The installed binary already exposes both verbs.

Everything named the contract correctly. Only the engine ignored it.

Both sites move together

aos-cli/release.env and docker/dev-base/full/Dockerfile are bumped in the same commit so a dev-base image and a release bundle cannot disagree about which specgen built them.

Verified before pushing

v0.134.0 exists with all nine release assets published, including specgen-linux-amd64, specgen-darwin-arm64, and SHA256SUMS, so neither the Dockerfile fetch nor the release build will 404.
ward exec pre-commit-all passes.
No other file in the repo pins 0.132.0 or 0.133.0.

What lands on merge

The docker/** path filter selects the Dockerfile change, so dev-base-publish rebuilds the image graph, and the AOS CLI release train picks up release.env. After that, brew upgrade on a host gets an aosguard whose action-job logs returns bytes.

🤖 Generated with Claude Code

Bumps `SPECGEN_VERSION` from 0.132.0 to 0.134.0. Two lines, both pin sites. ## Why cli-guard 0.134.0 carries `coilyco-flight-deck/cli-guard#278`, which makes the engine honor an operation`s declared response media type instead of parsing every response as JSON. That is the last thing between the Forgejo 16 upgrade and reading CI logs from an agent: ``` $ aosguard ops forgejo action-job logs coilyco-gaming sirens-echo 27514 aosguard: invalid character `-` after top-level value ``` The log body opens with an ISO timestamp, so the decoder read `2026` as a number and choked on the hyphen. `curl` against the same endpoint returned HTTP 200 and 23935 bytes. ## No guardfile change is needed Worth stating, because the obvious guess is that a grant is missing. It is not: * `can logs action-job` and `can logs action-run` already exist in `forgejo.kdl`, already annotated "(Forgejo 16)". * The vendored 16.0.1 snapshot already declares `produces: ["text/plain"]` for the job log and `application/zip` for the run log. * The installed binary already exposes both verbs. Everything named the contract correctly. Only the engine ignored it. ## Both sites move together `aos-cli/release.env` and `docker/dev-base/full/Dockerfile` are bumped in the same commit so a dev-base image and a release bundle cannot disagree about which specgen built them. ## Verified before pushing * `v0.134.0` exists with all nine release assets published, including `specgen-linux-amd64`, `specgen-darwin-arm64`, and `SHA256SUMS`, so neither the Dockerfile fetch nor the release build will 404. * `ward exec pre-commit-all` passes. * No other file in the repo pins 0.132.0 or 0.133.0. ## What lands on merge The `docker/**` path filter selects the Dockerfile change, so `dev-base-publish` rebuilds the image graph, and the AOS CLI release train picks up `release.env`. After that, `brew upgrade` on a host gets an aosguard whose `action-job logs` returns bytes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 1 commit

2026-08-12 05:07:45 +00:00

chore(aosguard): pin specgen 0.134.0 for raw response bodies

ci / ward-doctor (pull_request) Successful in 14s

Details

ci / aos-cli-tests (pull_request) Successful in 28s

Details

ci / gate (pull_request) Successful in 53s

Details

dev-base-pr / build (pull_request) Successful in 10m26s

Details

fff34dbecd

cli-guard 0.134.0 carries coilyco-flight-deck/cli-guard#278, which makes
the engine honor an operation's declared response media type instead of
parsing every body as JSON.

That is what stands between the Forgejo 16 upgrade and reading CI logs
from an agent. Forgejo serves the job-log endpoint and the vendored spec
already declares text/plain, but aosguard failed on it:

  aosguard ops forgejo action-job logs <owner> <repo> <job>
  -> invalid character '-' after top-level value

No guardfile change is needed. `can logs action-job` and `can logs
action-run` already exist and the vendored 16.0.1 snapshot already
declares text/plain and application/zip. Only the engine was wrong.

Both pin sites move together so a dev-base image and a release bundle
cannot disagree about which specgen built them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-12 05:07:45 +00:00