execverb: env policy resolved through value providers #152

New issue

Closed

opened 2026-06-17 23:02:00 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-17 23:02:00 +00:00

Owner

Add an env <NAME> { value <provider> "<addr>" } block (child of exec, sibling of argv-prefix), plus env "NAME" "literal" for committed values. The value resolves at exec time through a value provider, so an opaque OLLAMA_HOST comes from SSM rather than the guardfile.

To share the consumer's one provider registry across both engines, the Provider type + built-ins (env/file/literal) + Merge/Resolve move to a new pkg/valuesource; specverb.Provider becomes an alias. The generator wires the registry into mountExec (the AWS/SSM resolver block now triggers off exec members too), and execverb.Describe surfaces each env var's source (never the resolved value).

Implements the env-policy follow-up named in docs/execverb.md. Drives the OLLAMA_HOST-to-tower override for ward-kdl agents ollama.

The exec dialect could not set environment variables on the wrapped process, so an exec launcher could only reach whatever the inherited env pointed at (e.g. ollama's localhost OLLAMA_HOST), never a tailnet host - and an opaque host can't be hardcoded in the committed guardfile. Add an `env <NAME> { value <provider> "<addr>" }` block (child of `exec`, sibling of `argv-prefix`), plus `env "NAME" "literal"` for committed values. The value resolves at exec time through a value provider, so an opaque `OLLAMA_HOST` comes from SSM rather than the guardfile. To share the consumer's one provider registry across both engines, the Provider type + built-ins (env/file/literal) + Merge/Resolve move to a new `pkg/valuesource`; `specverb.Provider` becomes an alias. The generator wires the registry into `mountExec` (the AWS/SSM resolver block now triggers off exec members too), and `execverb.Describe` surfaces each env var's source (never the resolved value). Implements the env-policy follow-up named in docs/execverb.md. Drives the OLLAMA_HOST-to-tower override for `ward-kdl agents ollama`.

coilysiren referenced this issue from a commit

2026-06-17 23:03:24 +00:00

feat(execverb): resolve env-policy through shared value providers

coilysiren closed this issue

2026-06-17 23:03:24 +00:00

coilysiren referenced this issue from a commit

2026-06-17 23:21:01 +00:00

docs(features): note execverb argv overrides + env policy, add valuesource