specverb-gen: dispatch on transport, generate exec-dialect consumers #131

New issue

Closed

opened 2026-06-10 18:22:16 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-10 18:22:16 +00:00

Owner

What

Teach the no-code driver (specverb-gen / specdrv) the exec transport: dispatch on the Guardfile's body (spec+auth -> specverb, exec -> execverb) so an exec-dialect consumer gets the same uv-style gen/lock/build/run surface ward-kdl has - no hand-written Go, no go.mod in the consumer.

Differences from the HTTP path: no swagger lock (the binary embeds only the guardfile), no SSM resolver requirement (auth is the wrapped binary's own), and the generated main.go mounts execverb.Mount under the audit Wrap.

Why

ward's exec surfaces (git, admin/doctor remote-exec, later brew/docker/systemctl) should be authored as committed guardfiles exactly like the HTTP surface, with the reference doc emitted at build time. Follow-up named in docs/execverb.md; consumer ask in coilyco-flight-deck/ward#81.

Part of #123.

## What Teach the no-code driver (`specverb-gen` / specdrv) the exec transport: dispatch on the Guardfile's body (`spec`+`auth` -> specverb, `exec` -> execverb) so an exec-dialect consumer gets the same uv-style gen/lock/build/run surface ward-kdl has - no hand-written Go, no go.mod in the consumer. Differences from the HTTP path: no swagger lock (the binary embeds only the guardfile), no SSM resolver requirement (auth is the wrapped binary's own), and the generated main.go mounts `execverb.Mount` under the audit Wrap. ## Why ward's exec surfaces (git, admin/doctor remote-exec, later brew/docker/systemctl) should be authored as committed guardfiles exactly like the HTTP surface, with the reference doc emitted at build time. Follow-up named in docs/execverb.md; consumer ask in https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/81. Part of https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/issues/123.

coilysiren referenced this issue from coilyco-flight-deck/ward

2026-06-10 18:53:40 +00:00

ward-aws: author the aws CLI surface as an exec-dialect guardfile (open passthrough + aws-read gate) #82

coilysiren referenced this issue

2026-06-15 18:15:26 +00:00

feat(execverb): when/deny-when argv guards in CLI vocabulary (replace opaque aws-read gate) #143

coilysiren added the

label

2026-06-17 07:05:30 +00:00

coilysiren commented

2026-06-17 08:23:17 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:23:17 +00:00