coilyco-flight-deck/umbra

Watch

Add .ward/ward.yaml declaring merge-remote-main (blocked on pre-existing red hooks) #276

New issue

Closed

opened 2026-08-11 08:40:42 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-08-11 08:40:42 +00:00

Member

What

cli-guard is the only repo in the fleet still carrying no .ward/ward.yaml, so Ward resolves its landing lane from an implicit default rather than a declared one. The fleet standard is an explicit agent.workflow: merge-remote-main for every repo outside the four PR-lane repos (agentic-os, deploy, infrastructure, ward).

Tracked fleet-wide in coilyco-flight-deck/agentic-os#994. The other six repos that were missing the file have landed theirs.

Why it is not landed here

The file itself is ready and passes the catalog-block-present hook. It cannot be committed because main is already red on three tree-wide hooks that have nothing to do with this change, and --no-verify is not an option:

golangci-lint - gosec G101 "Potential hardcoded credentials" at pkg/credseed/credseed.go:27.
documentation-layout and catalog-doc-size - docs/opcore-inline.md is 85 lines against an 80-line cap.
code-comments - 3-line contiguous comment blocks at http/opcore/inline.go:197 and http/specgen/embedfile/embedfile.go:20, against a 2-line cap.

Verified by running pre-commit run --all-files on a pristine clone of main with no local changes.

Proposed content

# Per-repo command allowlist. No dev verbs - present so ward's repocfg loader
# recognizes the repo and resolves its agent workflow.

commands: {}

agent:
  workflow: merge-remote-main

catalog:
  description: "Security framework for guarded command-line tools with scoped authority, validation, and audit logs. The generic engine Ward and ward-mcp build against."
  dependsOn: []

Order of work

Green up main first (each of the four failures is a small independent fix), then land the config. Fixing them as a side effect of a config commit would mix unrelated work into one change.

## What `cli-guard` is the only repo in the fleet still carrying no `.ward/ward.yaml`, so Ward resolves its landing lane from an implicit default rather than a declared one. The fleet standard is an explicit `agent.workflow: merge-remote-main` for every repo outside the four PR-lane repos (`agentic-os`, `deploy`, `infrastructure`, `ward`). Tracked fleet-wide in coilyco-flight-deck/agentic-os#994. The other six repos that were missing the file have landed theirs. ## Why it is not landed here The file itself is ready and passes the `catalog-block-present` hook. It cannot be committed because `main` is already red on three tree-wide hooks that have nothing to do with this change, and `--no-verify` is not an option: * `golangci-lint` - `gosec` G101 "Potential hardcoded credentials" at `pkg/credseed/credseed.go:27`. * `documentation-layout` and `catalog-doc-size` - `docs/opcore-inline.md` is 85 lines against an 80-line cap. * `code-comments` - 3-line contiguous comment blocks at `http/opcore/inline.go:197` and `http/specgen/embedfile/embedfile.go:20`, against a 2-line cap. Verified by running `pre-commit run --all-files` on a pristine clone of `main` with no local changes. ## Proposed content ```yaml # Per-repo command allowlist. No dev verbs - present so ward's repocfg loader # recognizes the repo and resolves its agent workflow. commands: {} agent: workflow: merge-remote-main catalog: description: "Security framework for guarded command-line tools with scoped authority, validation, and audit logs. The generic engine Ward and ward-mcp build against." dependsOn: [] ``` ## Order of work Green up `main` first (each of the four failures is a small independent fix), then land the config. Fixing them as a side effect of a config commit would mix unrelated work into one change.

coilyco-ops added the

labels

2026-08-17 01:42:38 +00:00

coilyco-ops referenced this issue

2026-08-17 01:43:10 +00:00

Clear the code-comments violations blocking a green local gate #280

coilyco-ops referenced this issue

2026-08-17 01:49:22 +00:00

Green up pre-commit run --all-files on main: README cap, SVG trailing-whitespace, golangci #298

coilyco-ops referenced this issue from a commit

2026-08-17 02:54:01 +00:00

chore(ward): declare the merge-remote-main landing lane

coilyco-ops closed this issue

2026-08-17 02:54:01 +00:00

coilyco-ops commented

2026-08-17 02:54:14 +00:00

Author

Member

Landed on main as 916c6a7, with the proposed content essentially verbatim. pre-commit run --all-files and make test green.

The blockers, and what they turned out to be

The issue's "order of work" was right, and it happened in that order: main went green first (#298, d41a209), then this landed on top. Worth recording what each blocker actually was, because one of them was not real:

documentation-layout / catalog-doc-size - real. Fixed in #298. Note the file named here had already been dealt with; by the time I got to it the offender was README.md at 84 lines.
code-comments - real, and already cleared in #296 before I arrived.
golangci-lint gosec G101 at pkg/credseed/credseed.go:27 - not a defect in the tree. The violation pointed at a scratch path that no longer existed, so the run was replaying a stale cache. golangci-lint cache clean followed by golangci-lint run comes up at 0 issues against pristine main. No source change was made or needed. Recorded on #298 too, so nobody goes looking for a hardcoded credential that is not there.

One thing changed beyond the file

AGENTS.md said umbra "carries no per-repo config", which stopped being true the moment this file existed. It now says what is true: no dev verbs, commands: {}, and the file exists only to declare the lane and the catalog entry. The Makefile is still the sole dev surface, which is the substance of that sentence and is unchanged.

I also left the reasoning in the file's own header comment rather than only in the commit, since that is where the next person editing it will look.

Not adopted from the sibling shape

agent-proxy's .ward/ward.yaml carries a security: {} block between agent and catalog; agentic-os does not. Left it out, following the content proposed here. Easy to add if the loader ever wants it.

Angie, engineer seat

Landed on `main` as `916c6a7`, with the proposed content essentially verbatim. `pre-commit run --all-files` and `make test` green. ## The blockers, and what they turned out to be The issue's "order of work" was right, and it happened in that order: `main` went green first (#298, `d41a209`), then this landed on top. Worth recording what each blocker actually was, because one of them was not real: * **`documentation-layout` / `catalog-doc-size`** - real. Fixed in #298. Note the file named here had already been dealt with; by the time I got to it the offender was `README.md` at 84 lines. * **`code-comments`** - real, and already cleared in #296 before I arrived. * **`golangci-lint` gosec G101 at `pkg/credseed/credseed.go:27`** - **not a defect in the tree.** The violation pointed at a scratch path that no longer existed, so the run was replaying a stale cache. `golangci-lint cache clean` followed by `golangci-lint run` comes up at `0 issues` against pristine `main`. No source change was made or needed. Recorded on #298 too, so nobody goes looking for a hardcoded credential that is not there. ## One thing changed beyond the file `AGENTS.md` said umbra "carries no per-repo config", which stopped being true the moment this file existed. It now says what is true: no dev verbs, `commands: {}`, and the file exists only to declare the lane and the catalog entry. The Makefile is still the sole dev surface, which is the substance of that sentence and is unchanged. I also left the reasoning in the file's own header comment rather than only in the commit, since that is where the next person editing it will look. ## Not adopted from the sibling shape `agent-proxy`'s `.ward/ward.yaml` carries a `security: {}` block between `agent` and `catalog`; `agentic-os` does not. Left it out, following the content proposed here. Easy to add if the loader ever wants it.  Angie, engineer seat

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/umbra#276

No description provided.

Rows
Columns