Consume the aos role-tier bindings at surface bring-up (surface-check + role-bound overlay mounts) #1072

Closed

opened 2026-07-10 18:26:01 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-10 18:26:01 +00:00

Owner

Follow-up from agentic-os#447 (the 2026-07-10 permissions-rollback tier right-size). The aos .ward/ bundle now authors the intended per-role surface tiers (agentic-os docs/role-surface-tiers.md), but three seams need ward-side wiring for the acceptance to be fully live:

Mount role-bound overlay guardfiles at runtime. ward ops forgejo mounts only the hardcoded guardfile.forgejo.kdl monolith (actions logs is ward-native Go), so the bundle's role-bound overlays never reach a live surface: guardfile.forgejo.runnertoken.kdl (actions generate-runner-token, the infrastructure#539 restore path), the readactions actions runs/actions tasks exec leaves, and the new guardfile.tailscale.kdl observe surface (ward ops tailscale ...). Related: ward#92 phase 2.
Run the bundle's surface self-check at container bring-up. .ward/surface-check.sh (rides the bundle) asserts a surface matches its WARD_ROLE tier and fails loud listing every miss. Invoking it during bring-up (and surfacing the failure) is what turns capability drift into a bring-up error instead of a mid-incident discovery.
Reconcile bring-up provisioning with the role tiers. Per ward#578 tailnet + ~/.aws reach are per-role guardfile sets; the director/advisor/ops tiers in the aos bundle now bind guardfile.aws.kdl / guardfile.tailscale.kdl / guardfile.kubectl.kdl, and bring-up should land the matching binaries (ops image tier), creds (~/.aws, kubeconfig), and daemons (tailscaled) for those roles.

Layer-ownership map and intended tiers: agentic-os docs/role-surface-tiers.md.

Follow-up from agentic-os#447 (the 2026-07-10 permissions-rollback tier right-size). The aos `.ward/` bundle now authors the intended per-role surface tiers (agentic-os `docs/role-surface-tiers.md`), but three seams need ward-side wiring for the acceptance to be fully live: - **Mount role-bound overlay guardfiles at runtime.** `ward ops forgejo` mounts only the hardcoded `guardfile.forgejo.kdl` monolith (`actions logs` is ward-native Go), so the bundle's role-bound overlays never reach a live surface: `guardfile.forgejo.runnertoken.kdl` (`actions generate-runner-token`, the infrastructure#539 restore path), the readactions `actions runs`/`actions tasks` exec leaves, and the new `guardfile.tailscale.kdl` observe surface (`ward ops tailscale ...`). Related: ward#92 phase 2. - **Run the bundle's surface self-check at container bring-up.** `.ward/surface-check.sh` (rides the bundle) asserts a surface matches its `WARD_ROLE` tier and fails loud listing every miss. Invoking it during bring-up (and surfacing the failure) is what turns capability drift into a bring-up error instead of a mid-incident discovery. - **Reconcile bring-up provisioning with the role tiers.** Per ward#578 tailnet + `~/.aws` reach are per-role guardfile sets; the director/advisor/ops tiers in the aos bundle now bind `guardfile.aws.kdl` / `guardfile.tailscale.kdl` / `guardfile.kubectl.kdl`, and bring-up should land the matching binaries (ops image tier), creds (`~/.aws`, kubeconfig), and daemons (`tailscaled`) for those roles. Layer-ownership map and intended tiers: agentic-os `docs/role-surface-tiers.md`.

coilyco-ops added the

priority

autonomy

live-collab

labels

2026-07-14 06:50:13 +00:00

coilyco-ops referenced this issue from coilyco-flight-deck/agentic-os

2026-07-23 11:45:15 +00:00

Compose infrastructure-owned private-network access into AOS agent surfaces #642

coilyco-ops referenced this issue

2026-07-29 03:23:24 +00:00

Remove flexible roles and KDL runtime configuration from Ward #1615

coilyco-ops commented

2026-07-31 07:29:31 +00:00

Author

Owner

Closing as superseded by #1622. Ward will no longer consume AOS-authored role tiers, surface checks, overlay guardfiles, or runtime provisioning policy.

coilyco-ops closed this issue

2026-07-31 07:29:33 +00:00

Commenting is not possible because the repository is archived.

No milestone

No project

No assignees

1 participant

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/ward#1072

No description provided.

Rows
Columns