Consume the aos role-tier bindings at surface bring-up (surface-check + role-bound overlay mounts) #1072

New issue

Open

opened 2026-07-10 18:26:01 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-10 18:26:01 +00:00

Member

Follow-up from agentic-os#447 (the 2026-07-10 permissions-rollback tier right-size). The aos .ward/ bundle now authors the intended per-role surface tiers (agentic-os docs/role-surface-tiers.md), but three seams need ward-side wiring for the acceptance to be fully live:

Mount role-bound overlay guardfiles at runtime. ward ops forgejo mounts only the hardcoded guardfile.forgejo.kdl monolith (actions logs is ward-native Go), so the bundle's role-bound overlays never reach a live surface: guardfile.forgejo.runnertoken.kdl (actions generate-runner-token, the infrastructure#539 restore path), the readactions actions runs/actions tasks exec leaves, and the new guardfile.tailscale.kdl observe surface (ward ops tailscale ...). Related: ward#92 phase 2.
Run the bundle's surface self-check at container bring-up. .ward/surface-check.sh (rides the bundle) asserts a surface matches its WARD_ROLE tier and fails loud listing every miss. Invoking it during bring-up (and surfacing the failure) is what turns capability drift into a bring-up error instead of a mid-incident discovery.
Reconcile bring-up provisioning with the role tiers. Per ward#578 tailnet + ~/.aws reach are per-role guardfile sets; the director/advisor/ops tiers in the aos bundle now bind guardfile.aws.kdl / guardfile.tailscale.kdl / guardfile.kubectl.kdl, and bring-up should land the matching binaries (ops image tier), creds (~/.aws, kubeconfig), and daemons (tailscaled) for those roles.

Layer-ownership map and intended tiers: agentic-os docs/role-surface-tiers.md.

Follow-up from agentic-os#447 (the 2026-07-10 permissions-rollback tier right-size). The aos `.ward/` bundle now authors the intended per-role surface tiers (agentic-os `docs/role-surface-tiers.md`), but three seams need ward-side wiring for the acceptance to be fully live: - **Mount role-bound overlay guardfiles at runtime.** `ward ops forgejo` mounts only the hardcoded `guardfile.forgejo.kdl` monolith (`actions logs` is ward-native Go), so the bundle's role-bound overlays never reach a live surface: `guardfile.forgejo.runnertoken.kdl` (`actions generate-runner-token`, the infrastructure#539 restore path), the readactions `actions runs`/`actions tasks` exec leaves, and the new `guardfile.tailscale.kdl` observe surface (`ward ops tailscale ...`). Related: ward#92 phase 2. - **Run the bundle's surface self-check at container bring-up.** `.ward/surface-check.sh` (rides the bundle) asserts a surface matches its `WARD_ROLE` tier and fails loud listing every miss. Invoking it during bring-up (and surfacing the failure) is what turns capability drift into a bring-up error instead of a mid-incident discovery. - **Reconcile bring-up provisioning with the role tiers.** Per ward#578 tailnet + `~/.aws` reach are per-role guardfile sets; the director/advisor/ops tiers in the aos bundle now bind `guardfile.aws.kdl` / `guardfile.tailscale.kdl` / `guardfile.kubectl.kdl`, and bring-up should land the matching binaries (ops image tier), creds (`~/.aws`, kubeconfig), and daemons (`tailscaled`) for those roles. Layer-ownership map and intended tiers: agentic-os `docs/role-surface-tiers.md`.

coilyco-ops added the

interactive

labels

2026-07-14 06:50:13 +00:00