P1: Remove first-class deployment semantics from cli-guard; preserve generic stepflow

coilysiren commented

2026-07-05 21:47:55 +00:00

Owner

Decision

This is a P1 removal, not an open-ended design exercise. cli-guard must stop exposing deployment policy as first-class engine behavior. The generic machinery underneath it remains valuable and must be preserved.

This issue does not delete stepflow. Keep the reusable core: ordered step execution, explicit data/output threading, deterministic planning, and fail-closed resolution of every concrete call. Whether that generic package is extracted later is separate from this urgent cleanup.

Remove from the cli-guard model

Compensation / Compensate and automatic reverse-order rollback.
Canary, polling windows, and DegradedWhen / HealthyWhen deployment verdicts.
Guardfile syntax, resolved action state, dry-run/describe output, documentation, and tests that present those as native cli-guard concepts.
Any control path where the guard decides service health or chooses to roll a deployment back.

These policies may be authored later as ordinary pipeline steps or owned by infrastructure scripts. cli-guard should authorize each concrete call, not understand why a caller considers it a health probe or rollback.

Current source evidence

Current main still carries the domain model end to end:

http/guardfile/guardfile.go parses Compensation and Canary.
http/specverb/action_call.go resolves them and calls stepflow.Run with a canary.
pkg/stepflow/stepflow.go owns the reverse compensation stack, health polling, and deployment verdict loop.
http/specverb/describe.go advertises rollback and canary behavior as part of the generated product surface.

The original Ward Eco hardcoded-script consumer described in the earlier issue text is no longer present on current Ward main. Treat that as historical motivation, not as a migration dependency for this patch.

Acceptance

Generic multi-step sequencing and value threading continue to work and retain focused tests.
cli-guard contains no first-class canary, health/degraded verdict, compensation, or automatic rollback API or execution path.
Legacy guardfiles using removed deployment nodes fail closed with a clear diagnostic rather than being silently ignored.
Dry-run, describe/help, Go API docs, examples, and generated documentation no longer advertise the removed semantics.
Repository-wide tests and generation/drift checks pass.
Before removal, search current consumers and record any live compatibility impact on the issue; do not resurrect the stale Ward Eco path as a blocker.

Boundary

Preserve stepflow as a generic sequencing primitive. Do not replace this work with a broad package extraction or a new deployment framework. The P1 outcome is the smaller trustworthy cli-guard boundary.

Parent product context: cli-guard#239.

## Decision This is a **P1 removal**, not an open-ended design exercise. cli-guard must stop exposing deployment policy as first-class engine behavior. The generic machinery underneath it remains valuable and must be preserved. This issue does **not** delete stepflow. Keep the reusable core: ordered step execution, explicit data/output threading, deterministic planning, and fail-closed resolution of every concrete call. Whether that generic package is extracted later is separate from this urgent cleanup. ## Remove from the cli-guard model - `Compensation` / `Compensate` and automatic reverse-order rollback. - `Canary`, polling windows, and `DegradedWhen` / `HealthyWhen` deployment verdicts. - Guardfile syntax, resolved action state, dry-run/describe output, documentation, and tests that present those as native cli-guard concepts. - Any control path where the guard decides service health or chooses to roll a deployment back. These policies may be authored later as ordinary pipeline steps or owned by infrastructure scripts. cli-guard should authorize each concrete call, not understand why a caller considers it a health probe or rollback. ## Current source evidence Current main still carries the domain model end to end: - `http/guardfile/guardfile.go` parses `Compensation` and `Canary`. - `http/specverb/action_call.go` resolves them and calls `stepflow.Run` with a canary. - `pkg/stepflow/stepflow.go` owns the reverse compensation stack, health polling, and deployment verdict loop. - `http/specverb/describe.go` advertises rollback and canary behavior as part of the generated product surface. The original Ward Eco hardcoded-script consumer described in the earlier issue text is no longer present on current Ward main. Treat that as historical motivation, not as a migration dependency for this patch. ## Acceptance - Generic multi-step sequencing and value threading continue to work and retain focused tests. - cli-guard contains no first-class canary, health/degraded verdict, compensation, or automatic rollback API or execution path. - Legacy guardfiles using removed deployment nodes fail closed with a clear diagnostic rather than being silently ignored. - Dry-run, describe/help, Go API docs, examples, and generated documentation no longer advertise the removed semantics. - Repository-wide tests and generation/drift checks pass. - Before removal, search current consumers and record any live compatibility impact on the issue; do not resurrect the stale Ward Eco path as a blocker. ## Boundary Preserve stepflow as a generic sequencing primitive. Do not replace this work with a broad package extraction or a new deployment framework. The P1 outcome is the smaller trustworthy cli-guard boundary. Parent product context: cli-guard#239.

coilyco-ops added the

labels

2026-07-07 04:07:55 +00:00

coilysiren referenced this issue

2026-07-07 07:36:53 +00:00

feat(specverb): transport-neutral engine core + inline-operation source, so ward-mcp (and any non-CLI consumer) drives the same spec/guard engine #196

coilyco-ops referenced this issue

2026-07-07 08:22:01 +00:00

feat(specverb): transport-neutral engine core + inline-operation source, so ward-mcp (and any non-CLI consumer) drives the same spec/guard engine #196

coilysiren referenced this issue

2026-07-07 08:28:32 +00:00

feat(specverb): transport-neutral engine core + inline-operation source, so ward-mcp (and any non-CLI consumer) drives the same spec/guard engine #196

coilysiren referenced this issue from a commit

2026-07-07 08:59:50 +00:00

feat(opcore) [PR1/3 of #196]: extract urfave/cli-free engine core + self-guarding Operation.Execute

coilyco-ops added

and removed

labels

2026-07-10 08:59:46 +00:00

coilysiren referenced this issue from coilyco-flight-deck/ward

2026-07-14 15:27:09 +00:00

director should emit colorized, space buffered, visually distinct messages about the categories of actions its performing on startup #1283

coilyco-ops changed title from ~~cli-guard grew an ops-orchestration engine (stepflow health/canary/rollback) it should not own; eco-server spec reaches infra by hardcoded host path~~ to P1: Remove first-class deployment semantics from cli-guard; preserve generic stepflow

2026-07-23 05:54:23 +00:00

coilyco-ops added

and removed

labels

2026-07-23 05:54:24 +00:00

coilyco-ops commented

2026-07-23 06:04:27 +00:00

Member

Compatibility check: Forgejo repository search found only Ward as a live in-forge consumer. Ward main pins cli-guard v0.103.0 in go.mod; its tracked tree has no Guardfile/KDL consumer configuration, so this removal has no observed live Guardfile migration impact. Downstream Go callers using the removed exported deployment API will need to move that policy into their own pipeline steps.

coilyco-ops referenced this issue from a commit

2026-07-23 06:06:38 +00:00

remove deployment semantics from stepflow

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-23 06:06:47 +00:00

Remove deployment semantics from cli-guard stepflow #241

coilyco-ops closed this issue

2026-07-23 06:10:44 +00:00

coilyco-ops commented

2026-07-23 06:11:06 +00:00

Member

WARDED_WORKFLOW: coilyco-flight-deck/cli-guard#241

details

Review gate: intentionally skipped (temporary Ward default pending brokered QA).

workflow: pull-request-and-merge; review summary: intentionally skipped (temporary Ward default pending brokered QA)

Felt: focused boundary cleanup; the shared sequence core stayed small and direct.

Confidence: high — PR #241 merged after green test, lint, and secrets checks.

Surprise: local MkDocs was unavailable, while repository documentation-link checks passed.

Follow-up: consumers that relied on the removed exported deployment API should own that policy in their pipeline steps.

WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/pulls/241 <details><summary>details</summary> Review gate: intentionally skipped (temporary Ward default pending brokered QA). workflow: pull-request-and-merge; review summary: intentionally skipped (temporary Ward default pending brokered QA) Felt: focused boundary cleanup; the shared sequence core stayed small and direct. Confidence: high — PR #241 merged after green test, lint, and secrets checks. Surprise: local MkDocs was unavailable, while repository documentation-link checks passed. Follow-up: consumers that relied on the removed exported deployment API should own that policy in their pipeline steps. </details>

coilyco-ops commented

2026-07-23 06:11:12 +00:00

Member

WARDED_WORKFLOW: reservation-released

release details

Run finished with WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/pulls/241.

ward container reap released container engineer-codex-cli-guard-190 (--harness codex): the terminal outcome supersedes the reservation, so a later redispatch no longer needs --override-reservation.

Outcome summary: coilyco-flight-deck/cli-guard#241

— Codex, via ward agent

WARDED_WORKFLOW: reservation-released <details><summary>release details</summary> Run finished with `WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/pulls/241`. `ward container reap` released container `engineer-codex-cli-guard-190` (`--harness codex`): the terminal outcome supersedes the reservation, so a later redispatch no longer needs `--override-reservation`. **Outcome summary:** https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/pulls/241 </details>  — Codex, via `ward agent`

Rows
Columns

P1: Remove first-class deployment semantics from cli-guard; preserve generic stepflow #190

Decision

Remove from the cli-guard model

Current source evidence

Acceptance

Boundary