fix(forgejo): make guard honour the surface its caller passes #935

Merged

coilyco-ops merged 1 commit from aos/claude/label-taxonomy-guard-surface into main

2026-08-25 20:37:42 +00:00

coilyco-ops commented

2026-08-25 20:36:37 +00:00

Member

Fixes the second failure, and the converge has now run successfully against all three orgs.

What was wrong

#934 added a WRITE constant and passed it into guard(). guard() went on hardcoding "forgejo" and ignoring the argument, so the invocation became aosguard ops forgejo forgejo-admin org-label edit ... and aosguard answered No help topic for 'forgejo-admin'.

My patch half-applied and I did not check that it had.

Why the tests did not catch it

This is the part worth reading. #934's tests asserted write_argv's output and the two surface constants. They never asserted the command line those two combine into. The only piece that was wrong was the only piece nothing covered, which is the same shape as the bug #934 set out to fix, one layer down.

Five tests now assert the full argv handed to subprocess.run:

the whole edit command line, end to end
the whole read command line, end to end
a write dispatches to forgejo-admin, a read to forgejo
no surface name leaks into the verb position

Negative control run, because a test that has never failed proves nothing: reintroducing the exact bug fails two of them, and removing it turns all 30 green.

The converge ran

=== coilyco-gaming
  rename role/ai -> role/eval
  rename role/creator -> role/devrel
  rename role/design -> role/frontend
  rename role/director -> role/tpm
  rename role/engineer -> role/platform
  rename role/ops -> role/sysadmin
  create role/gamedev
  undeclared, left alone: role/exec, role/qa

Identical on coilyco-bridge and coilyco-flight-deck. Exit 0.

No issue lost its label

Verified structurally rather than by counting. Every renamed label kept its id: role/engineer 360 to role/platform 360 in gaming, 382 to 382 in flight-deck, and so on for all six in both orgs sampled. Issue-label association is by id, so a rename cannot drop one.

The apparent count shortfall against my pre-rename baseline is entirely issues in coilysiren user-owned repositories. Those carry their own repo-level labels, were explicitly out of scope, and still hold the retired names. Every per-label gap reconciles against them exactly. That is agent-compose#343, which now has a number attached: 18 issues stranded on retired label names.

Refs coilyco-flight-deck/agent-compose#342

Fixes the second failure, and **the converge has now run successfully** against all three orgs. ## What was wrong #934 added a `WRITE` constant and passed it into `guard()`. `guard()` went on hardcoding `"forgejo"` and ignoring the argument, so the invocation became `aosguard ops forgejo forgejo-admin org-label edit ...` and aosguard answered `No help topic for 'forgejo-admin'`. My patch half-applied and I did not check that it had. ## Why the tests did not catch it This is the part worth reading. #934's tests asserted `write_argv`'s output and the two surface constants. They never asserted the command line those two combine into. **The only piece that was wrong was the only piece nothing covered**, which is the same shape as the bug #934 set out to fix, one layer down. Five tests now assert the full argv handed to `subprocess.run`: * the whole edit command line, end to end * the whole read command line, end to end * a write dispatches to `forgejo-admin`, a read to `forgejo` * no surface name leaks into the verb position **Negative control run**, because a test that has never failed proves nothing: reintroducing the exact bug fails two of them, and removing it turns all 30 green. ## The converge ran ``` === coilyco-gaming rename role/ai -> role/eval rename role/creator -> role/devrel rename role/design -> role/frontend rename role/director -> role/tpm rename role/engineer -> role/platform rename role/ops -> role/sysadmin create role/gamedev undeclared, left alone: role/exec, role/qa ``` Identical on `coilyco-bridge` and `coilyco-flight-deck`. Exit 0. ## No issue lost its label Verified structurally rather than by counting. Every renamed label **kept its id**: `role/engineer` 360 to `role/platform` 360 in gaming, 382 to 382 in flight-deck, and so on for all six in both orgs sampled. Issue-label association is by id, so a rename cannot drop one. The apparent count shortfall against my pre-rename baseline is entirely issues in `coilysiren` user-owned repositories. Those carry their own repo-level labels, were explicitly out of scope, and still hold the retired names. Every per-label gap reconciles against them exactly. That is agent-compose#343, which now has a number attached: **18 issues stranded on retired label names.** Refs coilyco-flight-deck/agent-compose#342

coilyco-ops added 1 commit

2026-08-25 20:36:37 +00:00

fix(forgejo): make guard honour the surface its caller passes

TruffleHog / Scan for secrets (pull_request) Successful in 6s

Details

CI / lint (pull_request) Successful in 49s

Details

582c0b9432

#934 added a WRITE constant and passed it into guard(), but guard() went on
hardcoding "forgejo" and ignoring the argument. So the surface name landed as
the first argument to the wrong verb group and the converge failed on its first
write with "No help topic for 'forgejo-admin'".

The tests added in #934 asserted write_argv's output and the two surface
constants. They never asserted the command line those two combine into, so the
piece that was wrong was the only piece nothing covered. That is the same shape
as the bug #934 set out to fix, one layer down.

Five tests now assert the full argv handed to subprocess.run, including the
exact edit and read command lines end to end, that a write dispatches to
forgejo-admin, that a read dispatches to forgejo, and that no surface name leaks
into the verb position. Verified as a negative control: reintroducing the exact
bug fails two of them, and removing it turns them green.

The converge then ran clean against all three orgs: six renames and one create
each, with role/exec and role/qa reported and left alone.

Verified afterwards that no issue lost its label. Every renamed label kept its
id (role/engineer 360 -> role/platform 360 in gaming, 382 -> 382 in
flight-deck, and so on), and issue-label association is by id, so a rename
cannot drop one. The apparent count shortfall is entirely issues in coilysiren
user-owned repositories, which carry their own repo-level labels, are out of
scope for this converge, and still hold the retired names. That is
agent-compose#343, now with a number: 18.

Refs coilyco-flight-deck/agent-compose#342

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: tpm