coilyco-flight-deck/infrastructure
Watch
2
0
Code Issues 132 Pull requests Projects Releases Packages Wiki Activity Actions

Retire code-fleet-watch #830

New issue
Open
opened 2026-08-14 06:40:45 +00:00 by coilyco-ops · 2 comments
coilyco-ops commented 2026-08-14 06:40:45 +00:00
Member
Copy link

Outcome

Retire the code-fleet-watch observer completely. Kai selected full teardown: live workload, credentials, SSM parameters, registry package, repository surface, and the managed public issues all go.

Reopened after #831 merged. That PR carried Closes #830 but covered only the repository half, so the auto-close was premature. The live and credential teardown below is still outstanding.

Live

  • Suspend the code-fleet-watch CronJob in namespace forgejo.
  • Delete the CronJob, the code-fleet-watch-runtime, code-fleet-watch-reporter, and code-fleet-watch-registry ExternalSecrets. The workload is applied through a tracked Ward verb rather than Flux, so deletion is not reconciled back. Each ExternalSecret uses creationPolicy: Owner, so its projected Secret is garbage-collected with it.

kubectl delete is absent from the guarded aosguard ops kubectl surface and was denied to the agent, so this step is operator-only:

kubectl delete cronjob code-fleet-watch -n forgejo
kubectl delete externalsecret code-fleet-watch-runtime code-fleet-watch-reporter code-fleet-watch-registry -n forgejo

Credentials

  • Revoke the coilyco-ops PAT code-fleet-watch-issues. No guarded verb exists. The next ward exec coilyco-ops-provision revokes it regardless, because the revoke stage enumerates the bot's live PATs from the API rather than the spec list.
  • Delete SSM /forgejo/coilyco-ops/code-fleet-watch-issue-token.
  • Delete SSM /coilysiren/code-fleet-watch/denylist.
  • Delete the private registry package coilyco-flight-deck/code-fleet-watch. No guarded verb exists.
  • Remove the code-fleet-watch-issue-token row from the coilyco-ops credential-family rotation script.

Both SSM deletions wait on the live step above. Deleting the parameters while their ExternalSecrets exist leaves those ExternalSecrets failing to sync hourly against a missing source. The agent can run these once the cluster resources are gone:

aosguard ops aws ssm delete-parameter --name /forgejo/coilyco-ops/code-fleet-watch-issue-token
aosguard ops aws ssm delete-parameter --name /coilysiren/code-fleet-watch/denylist

The shared /forgejo/coilyco-ops/read-token stays. Flux and ward-mcp consume it. The registry ExternalSecret read the shared registry-read-token, which also stays.

Repository

  • Delete deploy/code-fleet-watch/, the three docs pages, the five scripts/ entries, the five .ward/ward.yaml verbs, and .forgejo/workflows/code-fleet-watch-image.yml.
  • Remove the docs/FEATURES.md entry and the docs/k3s-deploy-notes-ssm-inventory.md denylist line.
  • Remove the two code-fleet-watch entries from coilyco-bridge/agentic-os-kai SSM.md and data/ssm-descriptions.yaml. SSM.md is generated from that YAML joined with the live AWS inventory, so this follows the SSM deletions rather than preceding them.

Landed in #831, which also removed the now-dead issue verification kind and corrected the credential-family size from 15 to 14 in the two places that state it. Git history is the archive. No stub doc remains.

Public surface

Each was commented and closed. The listed findings are unreviewed. Closing records that the scanner is gone, not that the findings were resolved.

Superseded

  • Close #668, the deployment issue.
  • Close #700, the denylist correction. Retirement removes the denylist entirely.

Acceptance

  • No code-fleet-watch resource exists in the cluster.
  • Neither SSM parameter resolves and the PAT no longer authorizes.
  • No tracked file in either repository references code-fleet-watch outside this issue and its PRs.
  • The five managed issues are closed with the retirement note.
## Outcome Retire the `code-fleet-watch` observer completely. Kai selected full teardown: live workload, credentials, SSM parameters, registry package, repository surface, and the managed public issues all go. Reopened after #831 merged. That PR carried `Closes #830` but covered only the repository half, so the auto-close was premature. The live and credential teardown below is still outstanding. ## Live * [x] Suspend the `code-fleet-watch` CronJob in namespace `forgejo`. * [ ] Delete the CronJob, the `code-fleet-watch-runtime`, `code-fleet-watch-reporter`, and `code-fleet-watch-registry` ExternalSecrets. The workload is applied through a tracked Ward verb rather than Flux, so deletion is not reconciled back. Each ExternalSecret uses `creationPolicy: Owner`, so its projected Secret is garbage-collected with it. `kubectl delete` is absent from the guarded `aosguard ops kubectl` surface and was denied to the agent, so this step is operator-only: ```text kubectl delete cronjob code-fleet-watch -n forgejo kubectl delete externalsecret code-fleet-watch-runtime code-fleet-watch-reporter code-fleet-watch-registry -n forgejo ``` ## Credentials * [ ] Revoke the `coilyco-ops` PAT `code-fleet-watch-issues`. No guarded verb exists. The next `ward exec coilyco-ops-provision` revokes it regardless, because the revoke stage enumerates the bot's live PATs from the API rather than the spec list. * [ ] Delete SSM `/forgejo/coilyco-ops/code-fleet-watch-issue-token`. * [ ] Delete SSM `/coilysiren/code-fleet-watch/denylist`. * [ ] Delete the private registry package `coilyco-flight-deck/code-fleet-watch`. No guarded verb exists. * [x] Remove the `code-fleet-watch-issue-token` row from the `coilyco-ops` credential-family rotation script. Both SSM deletions wait on the live step above. Deleting the parameters while their ExternalSecrets exist leaves those ExternalSecrets failing to sync hourly against a missing source. The agent can run these once the cluster resources are gone: ```text aosguard ops aws ssm delete-parameter --name /forgejo/coilyco-ops/code-fleet-watch-issue-token aosguard ops aws ssm delete-parameter --name /coilysiren/code-fleet-watch/denylist ``` The shared `/forgejo/coilyco-ops/read-token` stays. Flux and ward-mcp consume it. The registry ExternalSecret read the shared `registry-read-token`, which also stays. ## Repository * [x] Delete `deploy/code-fleet-watch/`, the three docs pages, the five `scripts/` entries, the five `.ward/ward.yaml` verbs, and `.forgejo/workflows/code-fleet-watch-image.yml`. * [x] Remove the `docs/FEATURES.md` entry and the `docs/k3s-deploy-notes-ssm-inventory.md` denylist line. * [ ] Remove the two `code-fleet-watch` entries from `coilyco-bridge/agentic-os-kai` `SSM.md` and `data/ssm-descriptions.yaml`. `SSM.md` is generated from that YAML joined with the live AWS inventory, so this follows the SSM deletions rather than preceding them. Landed in #831, which also removed the now-dead `issue` verification kind and corrected the credential-family size from 15 to 14 in the two places that state it. Git history is the archive. No stub doc remains. ## Public surface * [x] coilyco-flight-deck/ward#1616 * [x] coilyco-flight-deck/umbra#266 * [x] coilyco-flight-deck/mcp-beaver#37 * [x] coilyco-flight-deck/lunch-money-k8s#35 * [x] coilyco-flight-deck/agent-proxy#65 Each was commented and closed. The listed findings are unreviewed. Closing records that the scanner is gone, not that the findings were resolved. ## Superseded * [x] Close #668, the deployment issue. * [x] Close #700, the denylist correction. Retirement removes the denylist entirely. ## Acceptance * No `code-fleet-watch` resource exists in the cluster. * Neither SSM parameter resolves and the PAT no longer authorizes. * No tracked file in either repository references `code-fleet-watch` outside this issue and its PRs. * The five managed issues are closed with the retirement note.
coilyco-ops commented 2026-08-14 06:53:59 +00:00
Author
Member
Copy link

Agent progress

Done:

  • CronJob suspended.
  • All five managed rolling issues commented and closed: ward#1616, umbra#266, mcp-beaver#37, lunch-money-k8s#35, agent-proxy#65.
  • #668 and #700 closed.
  • Repository removal in #831. pre-commit run --all-files and ward doctor pass, and no tracked file references code-fleet-watch after it.

Operator steps

kubectl delete is not in the guarded aosguard ops kubectl surface and was denied to the agent, so the live teardown needs an operator:

kubectl delete cronjob code-fleet-watch -n forgejo
kubectl delete externalsecret code-fleet-watch-runtime code-fleet-watch-reporter code-fleet-watch-registry -n forgejo

Each ExternalSecret uses creationPolicy: Owner, so its projected Secret is garbage-collected with it. No separate Secret deletion is needed.

Also operator-only, with no guarded verb available:

  • Revoke the code-fleet-watch-issues PAT. The next ward exec coilyco-ops-provision run does this on its own, because the revoke stage enumerates the bot's live PATs from the API rather than the spec list, so removing the spec row in #831 does not orphan it. Revoke sooner if the credential should not stay live until the next rotation.
  • Delete the private registry package coilyco-flight-deck/code-fleet-watch.

Deliberately deferred

The two SSM parameters are still present. Deleting them while the three ExternalSecrets exist would leave those ExternalSecrets failing to sync every hour against a missing source. They come out after the cluster resources are gone:

aosguard ops aws ssm delete-parameter --name /forgejo/coilyco-ops/code-fleet-watch-issue-token
aosguard ops aws ssm delete-parameter --name /coilysiren/code-fleet-watch/denylist

coilyco-bridge/agentic-os-kai still carries both entries in SSM.md and data/ssm-descriptions.yaml. SSM.md is generated from that YAML joined with the live AWS inventory, so that cleanup runs after the parameters are actually deleted, not before.

## Agent progress Done: * CronJob suspended. * All five managed rolling issues commented and closed: ward#1616, umbra#266, mcp-beaver#37, lunch-money-k8s#35, agent-proxy#65. * #668 and #700 closed. * Repository removal in #831. `pre-commit run --all-files` and `ward doctor` pass, and no tracked file references `code-fleet-watch` after it. ## Operator steps `kubectl delete` is not in the guarded `aosguard ops kubectl` surface and was denied to the agent, so the live teardown needs an operator: ```text kubectl delete cronjob code-fleet-watch -n forgejo kubectl delete externalsecret code-fleet-watch-runtime code-fleet-watch-reporter code-fleet-watch-registry -n forgejo ``` Each ExternalSecret uses `creationPolicy: Owner`, so its projected Secret is garbage-collected with it. No separate Secret deletion is needed. Also operator-only, with no guarded verb available: * Revoke the `code-fleet-watch-issues` PAT. The next `ward exec coilyco-ops-provision` run does this on its own, because the revoke stage enumerates the bot's live PATs from the API rather than the spec list, so removing the spec row in #831 does not orphan it. Revoke sooner if the credential should not stay live until the next rotation. * Delete the private registry package `coilyco-flight-deck/code-fleet-watch`. ## Deliberately deferred The two SSM parameters are still present. Deleting them while the three ExternalSecrets exist would leave those ExternalSecrets failing to sync every hour against a missing source. They come out after the cluster resources are gone: ```text aosguard ops aws ssm delete-parameter --name /forgejo/coilyco-ops/code-fleet-watch-issue-token aosguard ops aws ssm delete-parameter --name /coilysiren/code-fleet-watch/denylist ``` `coilyco-bridge/agentic-os-kai` still carries both entries in `SSM.md` and `data/ssm-descriptions.yaml`. `SSM.md` is generated from that YAML joined with the live AWS inventory, so that cleanup runs after the parameters are actually deleted, not before.
coilyco-ops commented 2026-08-14 07:13:22 +00:00
Author
Member
Copy link

Teardown complete

Kai ran the two kubectl delete commands. Verified afterwards: no CronJob, ExternalSecret, Secret, or Job named code-fleet-watch remains in the forgejo namespace. The projected Secrets were garbage-collected by their owning ExternalSecrets as expected, so no separate cleanup was needed.

Both SSM parameters are deleted and confirmed ParameterNotFound:

  • /coilysiren/code-fleet-watch/denylist
  • /forgejo/coilyco-ops/code-fleet-watch-issue-token

The inventory cleanup is coilyco-bridge/agentic-os-kai#873. Regenerating SSM.md also swept in seven unrelated parameters that had appeared in AWS since the last run. The file is generator-owned, so they came along rather than being hand-trimmed. They land undocumented and want descriptions from whoever owns them.

Remaining

Two items, neither blocking and neither with a guarded verb:

  • Revoke the code-fleet-watch-issues PAT. Still live. The next ward exec coilyco-ops-provision revokes it on its own.
  • Delete the private registry package coilyco-flight-deck/code-fleet-watch. Storage only, no credential exposure.

The merged branch retire-code-fleet-watch-830 is also still on the remote, since the repository does not delete branches after merge.

This issue can close once the PAT is revoked and the package is gone, or sooner if those are acceptable to leave to the next rotation.

## Teardown complete Kai ran the two `kubectl delete` commands. Verified afterwards: no CronJob, ExternalSecret, Secret, or Job named `code-fleet-watch` remains in the `forgejo` namespace. The projected Secrets were garbage-collected by their owning ExternalSecrets as expected, so no separate cleanup was needed. Both SSM parameters are deleted and confirmed `ParameterNotFound`: * `/coilysiren/code-fleet-watch/denylist` * `/forgejo/coilyco-ops/code-fleet-watch-issue-token` The inventory cleanup is coilyco-bridge/agentic-os-kai#873. Regenerating `SSM.md` also swept in seven unrelated parameters that had appeared in AWS since the last run. The file is generator-owned, so they came along rather than being hand-trimmed. They land undocumented and want descriptions from whoever owns them. ## Remaining Two items, neither blocking and neither with a guarded verb: * Revoke the `code-fleet-watch-issues` PAT. Still live. The next `ward exec coilyco-ops-provision` revokes it on its own. * Delete the private registry package `coilyco-flight-deck/code-fleet-watch`. Storage only, no credential exposure. The merged branch `retire-code-fleet-watch-830` is also still on the remote, since the repository does not delete branches after merge. This issue can close once the PAT is revoked and the package is gone, or sooner if those are acceptable to leave to the next rotation.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
ops/393-aos-pin-rollout
ops/708-o11y-telegram-per-host-cache
chore/claude-permissions-allow-all
fix/comfyui-preflight-whatif
fix/comfyui-supervisor-job-object
fix/forgejo-creds-windows-ssm
fix/comfyui-orphan-on-refused-restart
fix/windows-projects-root
fix/comfyui-restart-race
windows-tasks-s4u
windows-attribution-bash-shim-python
fix/comfyui-whatif-verification
windows-terminal-kai-tower-3026
fix/setup-git-lfs-windows-path
chore/drop-ward-yaml
fix/terraform-docs-action-arg
fix/mint-key-orphan
feat/public-asset-host
aos/claude/ka54-failclosed
aos/claude/ka54-cleanup
aos/claude/ka54
aos/claude/uq98-unattended-forgejo
aos/claude/uq98-disk-domains
aos/claude/xk58
aos/claude/aw85-bands
aos/claude/ym96-docs-band
aos/claude/wt57-alerts-to-mapper
aos/claude/xu59-role-trailer
aos/claude/ym96-verb-convert
aos/claude/ym96-token-cleanup
aos/claude/ym96-label-sync
aos/claude/wt57-atlas-cleanup
fix/mirror-unskip-sirens-echo
aos/claude/uz86-session-name
retire-code-fleet-watch-830
codex/alacritty-link-rollout
chore/mcp-beaver-fleet-watch
aos/claude/attribution-interpreter
aos/claude/mg96-fm
aos/claude/js44
coilyco-ops/deprovision-tangled-knot
aos/claude/mg96
aos/claude/zv96
outdated-branch-815
aos/claude/agent-proxy-publisher-runner
aos/claude/git-attribution-pin-interpreter
aos/claude/restore-tag-quarantine
aos/claude/mirror-workflows-permission
aos/claude/forgejo-16
aos/claude/dind-mtu
aos/claude/precommit-egress-proxy
aos/claude/qa57-branch-protection
chore/egress-proxy-open
chore/egress-allow-code-forgejo
aos/claude/qa57
chore/aos-precommit-v0.18-bump
aos/claude/ck67
infra/claude/ser8-runner-force-pull
aos/claude/runner-scratch-10gi
aos/claude/runner-recycle-selector
aos/claude/xk86
aos/codex/20260806t002312z-7943-00371332
codex/sirens-echo-deepseek-tailnet-20260805
codex/daily-aos-sync
issue-756-remove-role-provider-symlink
aos/codex/sirens-echo-runner-rename
aos/codex/20260731t171534z-9817-e7959fba
issue-697-aos-check-config
issue-694-aos-convergence
ops/remove-mac-models-launchd-20260729
ops/remove-mac-models-20260729
tailscale-proxy-converge-self-heal
issue-587
backup/issue-785-first-person
issue-785-first-person
ops/galaxy-gen-registry-rotate
ops/website-deploy-runner
codex/history-derived-skill-20260728
ops/k3s-pod-capacity-config
ops/publisher-runners
codex/code-fleet-watch-v2
codex/code-fleet-watch
recovery/2026-07-28-triaged-branch-archive
recovery/2026-07-27-local-work
recovery/machine-exit-20260727
issue-653-registry-retirement
issue-593
fix/aws-iam-ssm-import
feat/warded-ssm-identity
issue-500
No results found.
Labels
Clear labels   
burndown-2026-06
Backlog burndown June 2026

  
autonomy
async-consult
 A human needs to consult on the issue to upgrade it to headless

  
autonomy
epic
 This issue has many units of sub work - its size makes it meaningfully exclusive with other autonomy types

  
autonomy
headless
 The agent can perform the work on its own

  
autonomy
live-collab
 The agent and the human need to work together in realtime

  
coherence-core
Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  
priority
P0
 priority tier

  
priority
P1
 priority tier

  
priority
P2
 priority tier

  
priority
P3
 priority tier

  
priority
P4
 priority tier

  
qa-fixture
Disposable issue admitted to the bounded Ward QA verification lane.

  
role/ai
requires work from the AI Engineer role

  
role/creator
requires work from Content Creator role

  
role/design
requires work from the design role

  
role/director
requires work from the director role

  
role/engineer
requires work from the engineer role

  
role/exec
requires work from the exec role

  
role/human
requires a person, and specifically not an agent seat

  
role/ops
requires work from the ops role

  
role/qa
requires work from the QA role

No labels
burndown-2026-06
autonomy
async-consult
autonomy
epic
autonomy
headless
autonomy
live-collab
coherence-core
priority
P0
priority
P1
priority
P2
priority
P3
priority
P4
qa-fixture
role/ai
role/creator
role/design
role/director
role/engineer
role/exec
role/human
role/ops
role/qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
coilyco-flight-deck/infrastructure#830
No description provided.