Remove the last kubectl policy residues after the operator split

coilyco-ops commented

2026-07-23 06:51:39 +00:00

Member

Problem

Ward's operator split already removed its Kubernetes commands, guardfiles, credentials, bootstrap behavior, generated assets, and product documentation. The active tree now retains only a few Kubernetes-specific policy and test references:

Ward's own .ward/ward.yaml still names kubectl as a protected binary and routes it to AOSguard.
operator_isolation_test.go still names kubectl as a command Ward must omit.
The toy example still carries a kubectl deny and route hint, but #1621 will delete that example.

Those residues make Ward retain provider knowledge after AOSguard became the operator-policy owner.

Contract

Land #1621 first. It deletes the toy example, so this issue must not edit or preserve that example.
Remove the kubectl protected-binary entry and route hint from .ward/ward.yaml. Operator routing belongs to AOSguard, not Ward repository policy.
Remove the Kubernetes-specific negative assertion from operator_isolation_test.go. Keep the generic operator-surface boundary coverage.
Add no compute-substrate abstraction, credential fixture, compatibility shim, replacement policy, or cross-repository implementation.
Do not update FEATURES or architecture documentation. Kubernetes is not a shipped Ward feature and the existing public boundary is already Docker plus native Ward control-plane behavior.

Acceptance

After #1621 lands, a case-insensitive search of active tracked source, configuration, tests, examples, and product documentation finds no Kubernetes, k8s, kubectl, or kubeconfig references.
Historical Git commits and closed tracker issues are outside the search boundary.
Ward's existing repository validation passes.
Non-Kubernetes dev verbs, operator isolation, dispatch, and container behavior remain unchanged.

Execution boundary

This is repository-only cleanup. Do not access a cluster, inspect kubeconfig, add live verification, or move compatibility code elsewhere.

Depends on #1621.

## Problem Ward's operator split already removed its Kubernetes commands, guardfiles, credentials, bootstrap behavior, generated assets, and product documentation. The active tree now retains only a few Kubernetes-specific policy and test references: * Ward's own .ward/ward.yaml still names kubectl as a protected binary and routes it to AOSguard. * operator_isolation_test.go still names kubectl as a command Ward must omit. * The toy example still carries a kubectl deny and route hint, but #1621 will delete that example. Those residues make Ward retain provider knowledge after AOSguard became the operator-policy owner. ## Contract * Land #1621 first. It deletes the toy example, so this issue must not edit or preserve that example. * Remove the kubectl protected-binary entry and route hint from .ward/ward.yaml. Operator routing belongs to AOSguard, not Ward repository policy. * Remove the Kubernetes-specific negative assertion from operator_isolation_test.go. Keep the generic operator-surface boundary coverage. * Add no compute-substrate abstraction, credential fixture, compatibility shim, replacement policy, or cross-repository implementation. * Do not update FEATURES or architecture documentation. Kubernetes is not a shipped Ward feature and the existing public boundary is already Docker plus native Ward control-plane behavior. ## Acceptance * After #1621 lands, a case-insensitive search of active tracked source, configuration, tests, examples, and product documentation finds no Kubernetes, k8s, kubectl, or kubeconfig references. * Historical Git commits and closed tracker issues are outside the search boundary. * Ward's existing repository validation passes. * Non-Kubernetes dev verbs, operator isolation, dispatch, and container behavior remain unchanged. ## Execution boundary This is repository-only cleanup. Do not access a cluster, inspect kubeconfig, add live verification, or move compatibility code elsewhere. Depends on #1621.

coilyco-ops added the

labels

2026-07-29 03:47:18 +00:00

coilyco-ops referenced this issue

2026-07-31 07:40:46 +00:00

Design Kubernetes Job-backed warded runs as the Docker replacement path #1264

coilyco-ops referenced this issue

2026-07-31 08:13:39 +00:00

Heavy release-branch test: goose one-shots a ticket inside k3s before the tag #1135

coilyco-ops added

and removed

labels

2026-07-31 08:29:33 +00:00

coilyco-ops referenced this issue

2026-07-31 09:25:31 +00:00

code-fleet-watch: policy findings #1616

coilyco-ops referenced this issue

2026-08-05 09:48:55 +00:00

code-fleet-watch: policy findings #1616

coilyco-ops added

and removed

labels

2026-08-05 10:26:07 +00:00

coilyco-ops changed title from ~~Remove Kubernetes-specific knowledge from Ward core~~ to Remove the last kubectl policy residues after the operator split

2026-08-05 18:22:21 +00:00

coilyco-ops added

and removed

labels

2026-08-05 18:22:23 +00:00

coilyco-ops commented

2026-08-05 18:22:26 +00:00

Author

Member

Design settled on 2026-08-05. This is residual cleanup only. Land #1621 first, then remove the remaining Ward-owned kubectl policy and negative-test references without adding a replacement abstraction or documentation surface.

coilyco-ops referenced this issue from a commit

2026-08-06 00:06:44 +00:00

refactor: remove kubectl policy residue

coilyco-ops closed this issue

2026-08-06 00:06:44 +00:00

coilyco-ops commented

2026-08-06 00:06:54 +00:00

Author

Member

Landed and closed on canonical main in 1dee25de.

Removed the kubectl protected-binary rule, AOSguard route, bare-binary entry, and Kubernetes-specific negative assertion.
Kept the generic Docker and operator-surface boundary coverage unchanged.
Active tracked source, configuration, tests, examples, and product docs now contain no case-insensitive Kubernetes, k8s, kubectl, or kubeconfig references.
No cluster, kubeconfig, or live operator surface was accessed.
ward doctor, full tests, lint, vet, build, format, and full pre-commit passed.

Landed and closed on canonical main in `1dee25de`. * Removed the kubectl protected-binary rule, AOSguard route, bare-binary entry, and Kubernetes-specific negative assertion. * Kept the generic Docker and operator-surface boundary coverage unchanged. * Active tracked source, configuration, tests, examples, and product docs now contain no case-insensitive Kubernetes, k8s, kubectl, or kubeconfig references. * No cluster, kubeconfig, or live operator surface was accessed. * `ward doctor`, full tests, lint, vet, build, format, and full pre-commit passed.

Rows
Columns

Remove the last kubectl policy residues after the operator split #1528

Problem

Contract

Acceptance

Execution boundary