Separate read-only director storage from merge authority

coilysiren commented

2026-07-14 10:45:00 +00:00

Owner

Outcome

Make Ward and its director doctrine distinguish local filesystem writability from workflow authority.

A read-only director clone cannot edit, commit, or push repository content. An authorized director may still inspect an eligible pull request and merge it through Ward's native, workflow-gated PR surface when the issue thread, review state, and workflow permit the merge.

Required behavior

Define read-only as a storage and local-mutation boundary, not a blanket ban on brokered workflow actions.
Keep local Git writes and direct pushes unavailable from the director clone.
Expose the gated PR status and merge path to an authorized director.
Make merge authority derive from the issue workflow, trusted outcome records, required review or QA, and current PR status.
Update director seed text, command help, and canonical documentation so the distinction is explicit.
Use direct wording in the owning surfaces. Do not introduce a prompt-template framework for this correction.

Acceptance criteria

A read-only director plan cannot write to or push from its local clone.
The same director can discover and invoke the Ward merge path for an eligible pull request.
An ineligible workflow or missing trusted evidence remains merge-blocked.
Regression coverage proves read-only storage and merge authority are evaluated independently.
Product documentation explains the distinction once in the canonical director or workflow contract.

Blocked by

None. The doctrine is settled and does not depend on #1343.

Supersedes

Rewrites #1273 as a bounded behavior correction. The prompt-templating prerequisite proposed by #1343 is declined.

## Outcome Make Ward and its director doctrine distinguish local filesystem writability from workflow authority. A read-only director clone cannot edit, commit, or push repository content. An authorized director may still inspect an eligible pull request and merge it through Ward's native, workflow-gated PR surface when the issue thread, review state, and workflow permit the merge. ## Required behavior * Define read-only as a storage and local-mutation boundary, not a blanket ban on brokered workflow actions. * Keep local Git writes and direct pushes unavailable from the director clone. * Expose the gated PR status and merge path to an authorized director. * Make merge authority derive from the issue workflow, trusted outcome records, required review or QA, and current PR status. * Update director seed text, command help, and canonical documentation so the distinction is explicit. * Use direct wording in the owning surfaces. Do not introduce a prompt-template framework for this correction. ## Acceptance criteria * A read-only director plan cannot write to or push from its local clone. * The same director can discover and invoke the Ward merge path for an eligible pull request. * An ineligible workflow or missing trusted evidence remains merge-blocked. * Regression coverage proves read-only storage and merge authority are evaluated independently. * Product documentation explains the distinction once in the canonical director or workflow contract. ## Blocked by None. The doctrine is settled and does not depend on #1343. ## Supersedes Rewrites #1273 as a bounded behavior correction. The prompt-templating prerequisite proposed by #1343 is declined.

coilysiren changed title from ~~Agents think "readonly director surface" means that they should not merge~~ to Agents incorrectly think "readonly director surface" means that they should not merge

2026-07-14 10:45:12 +00:00

coilysiren commented

2026-07-14 10:45:21 +00:00

Author

Owner

This probably looks like a prompt update

coilysiren referenced this issue

2026-07-14 15:27:09 +00:00

director should emit colorized, space buffered, visually distinct messages about the categories of actions its performing on startup #1283

coilyco-ops added the

labels

2026-07-15 04:51:16 +00:00

coilyco-ops added this to the warded control plane coherence milestone

2026-07-15 05:14:50 +00:00

coilyco-ops added the

coherence-core

label

2026-07-15 05:28:20 +00:00

coilyco-ops removed this from the warded control plane coherence milestone

2026-07-15 07:09:09 +00:00

coilyco-ops added

and removed

labels

2026-07-15 07:09:34 +00:00

coilyco-ops added

and removed

labels

2026-07-29 06:27:17 +00:00

coilyco-ops changed title from ~~Agents incorrectly think "readonly director surface" means that they should not merge~~ to Separate read-only director storage from merge authority

2026-07-31 08:10:15 +00:00

coilyco-ops referenced this issue

2026-07-31 08:12:44 +00:00

Design prompt and seed-text config sources with lightweight templating #1343

coilyco-ops commented

2026-07-31 09:03:39 +00:00

Owner

Closing during the Ward v1 seal. Do not expand the read-only director surface with a distinct brokered merge authority through this ticket. Reopen only if a concrete workflow proves the retained guarded surfaces cannot complete landing without it.

coilyco-ops closed this issue

2026-07-31 09:03:46 +00:00

Rows
Columns

Separate read-only director storage from merge authority #1273

Outcome

Required behavior

Acceptance criteria

Blocked by

Supersedes