Decide on the surface no known consumer reaches: GitHub caches, awsgate, and four pkg/ packages #282

New issue

Open

opened 2026-08-12 21:05:07 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-12 21:05:07 +00:00

Member

Consumer read done 2026-08-12 as input to the rename rationale in coilysiren/inbox#357. The naming conclusions live there. This issue carries the leftover engineering findings, which are not naming questions and should not wait on the rename.

Method, and where it is weak

Read this before acting on anything below.

AOS read from a local checkout. Solid.
Ward read through GitHub code search on the mirror, which caps results. The package list is right, the per-package hit counts are floors.
mcp-beaver read from go.mod, README.md and cmd/ward-mcp/main.go. That mirror is not indexed for code search, so there is no full import census for it.
coily was not read at all. It is a fourth consumer, and this repo's own AGENTS calls these primitives "the load-bearing core that coily and any future consumer depend on." Nothing below is dead until coily is checked.

What the three known consumers use

Current surface is 52 packages: 18 under cli/, 10 under http/, 21 under pkg/, 3 under cmd/.

Ward (v0.130.0) imports 18 packages, all cli/ and pkg/, zero http/. Heaviest are cli/shell, cli/verb, pkg/config, pkg/broker. The process slice.
AOS (v0.132.0) imports nothing. aos-cli/go.mod carries no cli-guard line and aosguard-release/go.mod has no dependencies at all. AOS consumes this repo entirely as a build-time generator through .specgen/guardfiles/ and specverb.lock, and ships zero cli-guard at runtime. The generator slice.
mcp-beaver (v0.131.0) is a thin shell over one package, http/opcore. The request slice.

opcore is the only package two of the three depend on.

Findings worth a decision

1. The GitHub cache trio has no consumer here. http/ghcache, http/ghidcache and http/ghratelimit are GitHub-shaped response, id and rate-limit caches. The fleet is Forgejo-canonical and GitHub is a ten-minute one-way mirror. None of the three consumers is GitHub-facing. Strongest removal candidate on the list.

2. cli/awsgate is duplicated in policy. FEATURES describes it as denying sensitive-glob aws reads. AOS's .specgen/guardfiles/aosguard/aws.kdl hand-writes the same rule as deny-when name matches "*/prod/*" *secret*. One of the two is redundant, and the guardfile one is the one that ships. Worth deciding which layer owns this rather than keeping both.

3. Three pkg/ packages have no consumer among the three: agentclaim, fleetconfig, stepflow. These are plausibly newer than their adopters rather than unused, so this is a "confirm the adopter is coming" item, not a removal one.

4. pkg/agentid is a false positive, and its coupling is invisible to Go tooling. No Go import anywhere, but agentic-os/agentic_os/agent_id.py documents a cross-language contract with the Go port, and an AOS test fails CI on drift. It is live. Nothing in this repo's Go tree records that, so a package comment naming the Python counterpart would stop the next audit flagging it.

5. Six pkg/ packages are Ward-only. FEATURES labels scan, attribution, flock, version, issueref and ownertrust as Ward-lifted helpers. They moved out of Ward into the shared core and Ward is still their only consumer. Not a defect, but the shared core is less shared than the pkg/ layout implies, and docs/architecture.md's downward-only arrow reads stronger than the reality.

Probably coily's, listed so nobody deletes them in a sweep: cli/hook, cli/hookcfg, cmd/cli-guard-hook, cli/shim, cli/doctor, cli/profiles, cli/profile, cli/decision, cli/sudo.

A separate finding, in agentic-os-kai

data/repo-digests/cli-guard.md has been frozen since 2026-05-27. It still names the module github.com/coilysiren/cli-guard, shows flat root packages instead of the cli/ http/ pkg/ split, and lists dispatch, lockdown and mcporter, all three since removed from FEATURES. Any agent routed to that digest gets a picture of this repo that is three months stale and wrong about the import paths.

It is generated by scripts/compile-repo-digests.py, available as ward exec compile-repo-digests with --repo for a single repo and --check for drift, so it wants a regeneration rather than an edit. One thing to check first: the generator reads its member list from catalog-graph.yaml expecting id: coilysiren/<repo>, and this repo now lives under coilyco-flight-deck. That may be why the digest stopped updating rather than merely going stale.

Ownership

Engineer, with DevOps on anything that touches the release surface. The rename in #357 does not block any of this, and none of it blocks the rename.

Consumer read done 2026-08-12 as input to the rename rationale in https://forgejo.coilysiren.me/coilysiren/inbox/issues/357. The naming conclusions live there. This issue carries the leftover engineering findings, which are not naming questions and should not wait on the rename. ## Method, and where it is weak Read this before acting on anything below. * **AOS** read from a local checkout. Solid. * **Ward** read through GitHub code search on the mirror, which caps results. The package list is right, the per-package hit counts are floors. * **mcp-beaver** read from `go.mod`, `README.md` and `cmd/ward-mcp/main.go`. That mirror is not indexed for code search, so there is **no full import census** for it. * **coily was not read at all.** It is a fourth consumer, and this repo's own AGENTS calls these primitives "the load-bearing core that coily and any future consumer depend on." Nothing below is dead until coily is checked. ## What the three known consumers use Current surface is 52 packages: 18 under `cli/`, 10 under `http/`, 21 under `pkg/`, 3 under `cmd/`. * **Ward** (`v0.130.0`) imports 18 packages, all `cli/` and `pkg/`, zero `http/`. Heaviest are `cli/shell`, `cli/verb`, `pkg/config`, `pkg/broker`. The process slice. * **AOS** (`v0.132.0`) imports **nothing**. `aos-cli/go.mod` carries no cli-guard line and `aosguard-release/go.mod` has no dependencies at all. AOS consumes this repo entirely as a build-time generator through `.specgen/guardfiles/` and `specverb.lock`, and ships zero cli-guard at runtime. The generator slice. * **mcp-beaver** (`v0.131.0`) is a thin shell over one package, `http/opcore`. The request slice. `opcore` is the only package two of the three depend on. ## Findings worth a decision **1. The GitHub cache trio has no consumer here.** `http/ghcache`, `http/ghidcache` and `http/ghratelimit` are GitHub-shaped response, id and rate-limit caches. The fleet is Forgejo-canonical and GitHub is a ten-minute one-way mirror. None of the three consumers is GitHub-facing. Strongest removal candidate on the list. **2. `cli/awsgate` is duplicated in policy.** FEATURES describes it as denying sensitive-glob aws reads. AOS's `.specgen/guardfiles/aosguard/aws.kdl` hand-writes the same rule as `deny-when name matches "*/prod/*" *secret*`. One of the two is redundant, and the guardfile one is the one that ships. Worth deciding which layer owns this rather than keeping both. **3. Three `pkg/` packages have no consumer among the three:** `agentclaim`, `fleetconfig`, `stepflow`. These are plausibly newer than their adopters rather than unused, so this is a "confirm the adopter is coming" item, not a removal one. **4. `pkg/agentid` is a false positive, and its coupling is invisible to Go tooling.** No Go import anywhere, but `agentic-os/agentic_os/agent_id.py` documents a cross-language contract with the Go port, and an AOS test fails CI on drift. It is live. Nothing in this repo's Go tree records that, so a package comment naming the Python counterpart would stop the next audit flagging it. **5. Six `pkg/` packages are Ward-only.** FEATURES labels `scan`, `attribution`, `flock`, `version`, `issueref` and `ownertrust` as Ward-lifted helpers. They moved out of Ward into the shared core and Ward is still their only consumer. Not a defect, but the shared core is less shared than the `pkg/` layout implies, and `docs/architecture.md`'s downward-only arrow reads stronger than the reality. **Probably coily's, listed so nobody deletes them in a sweep:** `cli/hook`, `cli/hookcfg`, `cmd/cli-guard-hook`, `cli/shim`, `cli/doctor`, `cli/profiles`, `cli/profile`, `cli/decision`, `cli/sudo`. ## A separate finding, in agentic-os-kai `data/repo-digests/cli-guard.md` has been frozen since 2026-05-27. It still names the module `github.com/coilysiren/cli-guard`, shows flat root packages instead of the `cli/` `http/` `pkg/` split, and lists `dispatch`, `lockdown` and `mcporter`, all three since removed from FEATURES. Any agent routed to that digest gets a picture of this repo that is three months stale and wrong about the import paths. It is generated by `scripts/compile-repo-digests.py`, available as `ward exec compile-repo-digests` with `--repo` for a single repo and `--check` for drift, so it wants a regeneration rather than an edit. **One thing to check first:** the generator reads its member list from `catalog-graph.yaml` expecting `id: coilysiren/<repo>`, and this repo now lives under `coilyco-flight-deck`. That may be why the digest stopped updating rather than merely going stale. ## Ownership Engineer, with DevOps on anything that touches the release surface. The rename in #357 does not block any of this, and none of it blocks the rename.

coilyco-ops referenced this issue

2026-08-14 01:28:22 +00:00

Make specgen's value providers pluggable through pkg/valuesource instead of baking ssm/tailscale into codegen #283

coilyco-ops referenced this issue from a commit

2026-08-14 02:17:08 +00:00

chore: remove 17 dead packages

coilyco-ops referenced this issue from a commit

2026-08-14 02:17:08 +00:00

chore: strip vendor knowledge - gh, aws, and the deprecated agentid

coilyco-ops referenced this issue

2026-08-14 02:18:35 +00:00

chore: remove 20 dead packages and strip gh/aws vendor knowledge #284