Neutralize consumer names in engine comments + test fixtures (read tool-agnostic) #163

New issue

Closed

opened 2026-06-24 07:46:14 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-06-24 07:46:14 +00:00

Member

The audit confirmed cli-guard is a clean standalone engine - the only smell is that consumer names are baked into examples/fixtures, so a fresh reader can infer it was carved from ward:

cli/execverb/describe.go, cli/execverb/guardfile.go: example comments say ward/ward-kdl/wrap ward git -> use a generic <cli> placeholder.
cli/catalog/catalog_test.go, cli/allowlist/allowlist_test.go, cli/profiles/profiles_test.go: fixtures named ward.yaml/coily.yaml/.ward -> neutral names (production code is already generic).
cli/repocfg/security.go:52 "kap, ward" comment -> generic.
No production behaviour change.

From the 2026-06-24 ward/cli-guard boundary audit. See ward docs/architecture.md (the 3-layer model: cli-guard engine / ward-kdl generator / ward product). Related: ward#194, ward#200, cli-guard#139.

The audit confirmed cli-guard is a clean standalone engine - the only smell is that consumer names are baked into examples/fixtures, so a fresh reader can infer it was carved from ward: - `cli/execverb/describe.go`, `cli/execverb/guardfile.go`: example comments say `ward`/`ward-kdl`/`wrap ward git` -> use a generic `<cli>` placeholder. - `cli/catalog/catalog_test.go`, `cli/allowlist/allowlist_test.go`, `cli/profiles/profiles_test.go`: fixtures named `ward.yaml`/`coily.yaml`/`.ward` -> neutral names (production code is already generic). - `cli/repocfg/security.go:52` "kap, ward" comment -> generic. No production behaviour change. From the 2026-06-24 ward/cli-guard boundary audit. See ward docs/architecture.md (the 3-layer model: cli-guard engine / ward-kdl generator / ward product). Related: ward#194, ward#200, cli-guard#139.

coilyco-ops added the

headless

labels

2026-06-24 07:46:15 +00:00

coilyco-ops commented

2026-06-25 04:51:07 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container ward-cli-guard-issue-163-claude-367d80a2 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-06-25T04:51:05Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `ward-cli-guard-issue-163-claude-367d80a2` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-06-25T04:51:05Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-06-25 04:55:09 +00:00

refactor: neutralize consumer names in engine comments + test fixtures

coilysiren closed this issue

2026-06-25 04:55:09 +00:00

coilysiren referenced this issue from a commit

2026-06-25 04:55:09 +00:00

Merge issue-163: neutralize consumer names in engine comments + test fixtures (closes #163)

coilysiren commented

2026-06-25 04:55:46 +00:00

Owner

Retrospective: this one was mechanically small but had a couple of teeth.

The scrub itself was exactly as scoped - swap ward/ward-kdl/coily/kap for a generic <cli> in doc comments and rename the ward.yaml/coily.yaml/.ward fixtures to neutral myapp.yaml/legacy.yaml/.myapp. No production code touched, so no behaviour to break.

Two things fought back. First, the comment edits land on exported struct fields, so godoc-current.txt drifted - the pinning hook would have failed if I had not regenerated it, which is the hook doing its job. Second, the code-comments discipline hook flagged a pre-existing 3-line block in guardfile.go the moment my commit touched that file, so I condensed it to two lines in passing. Mildly annoying but fair.

One honesty note: golangci-lint and trufflehog are not installed in this container, so I committed with SKIP=golangci-lint,trufflehog rather than --no-verify - every other hook ran and passed, and CI runs both anyway. The pre-existing sandbox/seccomp test failures (TestSetupDenied, the two TestSecurityClaim_*) reproduce on a clean tree too - they need a kernel feature this box lacks, unrelated to this change.

Confidence is high - it is comments and tempdir fixture names. Worth a follow-up someday: a grep-based hook that fails on consumer names leaking into the engine, so this stays scrubbed without a manual audit.

Retrospective: this one was mechanically small but had a couple of teeth. The scrub itself was exactly as scoped - swap `ward`/`ward-kdl`/`coily`/`kap` for a generic `<cli>` in doc comments and rename the `ward.yaml`/`coily.yaml`/`.ward` fixtures to neutral `myapp.yaml`/`legacy.yaml`/`.myapp`. No production code touched, so no behaviour to break. Two things fought back. First, the comment edits land on exported struct fields, so `godoc-current.txt` drifted - the pinning hook would have failed if I had not regenerated it, which is the hook doing its job. Second, the `code-comments` discipline hook flagged a pre-existing 3-line block in `guardfile.go` the moment my commit touched that file, so I condensed it to two lines in passing. Mildly annoying but fair. One honesty note: `golangci-lint` and `trufflehog` are not installed in this container, so I committed with `SKIP=golangci-lint,trufflehog` rather than `--no-verify` - every other hook ran and passed, and CI runs both anyway. The pre-existing sandbox/seccomp test failures (`TestSetupDenied`, the two `TestSecurityClaim_*`) reproduce on a clean tree too - they need a kernel feature this box lacks, unrelated to this change. Confidence is high - it is comments and tempdir fixture names. Worth a follow-up someday: a grep-based hook that fails on consumer names leaking into the engine, so this stays scrubbed without a manual audit.

coilysiren referenced this issue from a commit

2026-06-25 04:59:35 +00:00

Merge ward-salvage/cli-guard-4fc321b4: passthrough work already on main (closes #161)

coilysiren referenced this issue

2026-06-25 04:59:59 +00:00

[ward-salvage] cli-guard: unmerged container work on ward-salvage/cli-guard-4fc321b4 #161