coilyco-flight-deck/ward

Watch

Keep Forgejo credentials behind the native director broker #1612

New issue

Closed

opened 2026-07-28 20:05:30 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-28 20:05:30 +00:00

Member

Outcome

A warded director uses Ward's existing native Forgejo broker without receiving the raw Forgejo credential in the agent process.

The primary implementation belongs in Ward. The AOS repository may need a small deployment-binding or documentation adjustment so the exact composed launch continues to work:

aos --composed --guarded --warded --role director --agent codex

Ward remains a public product. Ward must not depend on AOSGuard, AOS-specific policy, or the AOS deployment's credential source.

Current boundary

Ward currently seeds FORGEJO_TOKEN into ephemeral containers for authenticated Forgejo and Git paths. An arbitrary-shell agent can therefore print or reuse the transferable token. The exposure is no longer hypothetical: coilyco-bridge/agentic-os-kai#776 tracks rotation of a bot token printed into a private agent transcript, and #1582 tracks transcript-wide redaction.

Ward already has the narrower mechanism this change needs. The native director broker performs Forgejo-backed inventory, capture, and dispatch operations outside the dropped director process. During the incident recorded in #1530, brokered Forgejo access continued while the director's injected credential failed.

AOSGuard is a separate AOS operator tool generated by specgen. Specgen's credential mounts and standalone AOSGuard behavior remain valid and independent of Ward.

Ward change

Route the director's native Forgejo reads and writes through the existing per-run Ward broker.
Keep the credential only in the privileged broker side of the run. The director harness process must not inherit FORGEJO_TOKEN or receive an equivalent token-bearing file.
Reapply Ward's role, operation, owner, and repository checks in the broker. The broker must not trust client-side validation.
Keep authenticated operation output bounded and free of authorization headers or credential material.
Return a clear degraded-auth error when the broker credential is invalid. The first version may require recycling the director instead of refreshing a credential in place.
Tear down the credential-bearing broker state with the run.
Preserve existing engineer Git clone and push behavior. This issue does not redesign Git authentication.

AOS follow-through

AOS owns only Kai's deployment bindings and the composed launch adapter.

Adjust the AOS .ward/ role binding, launch projection, or role-surface documentation only where Ward's new broker boundary requires it.
Keep .specgen/aosguard/ unchanged.
Keep standalone AOSGuard credential mounting unchanged.
Do not make Ward import, execute, configure, or require AOSGuard.
Do not add AWS, SSM, or another cloud provider to Ward's public product contract.

If the Ward change works through the existing provider-neutral launch contract without an AOS code change, record that result and limit AOS follow-through to any documentation that became inaccurate.

Acceptance

The exact composed director launch starts successfully with the selected Codex harness.
The director agent environment and projected home contain no FORGEJO_TOKEN or equivalent transferable Forgejo credential.
Focused automated coverage proves one allowed Forgejo read and one allowed Forgejo write succeed through the native broker using synthetic credential material.
Focused automated coverage proves a disallowed operation or scope fails before any upstream request.
Synthetic credential values never appear in agent argv, environment snapshots, projected files, transcripts, logs, or rendered errors.
Broker authentication failure is visibly distinct from network failure and policy denial.
Broker teardown removes its per-run credential state.
Engineer, QA, Git push, and non-director credential behavior remain unchanged.
Standalone AOSGuard still resolves specgen-declared credential mounts without Ward.
Ward contains no AOSGuard dependency or AOS-specific credential-source knowledge.
Ward's repository-declared tests and pre-commit suite pass. AOS runs its own declared checks if AOS files change.

Non-goals

A generic secret-discovery or credential-broker product
A general HTTP proxy
A new cloud-provider abstraction
Changes to specgen or AOSGuard
Tea or another third-party Forgejo CLI
Git authentication changes
Other Ward roles
Hot credential rotation, durable replay, or pending-brief recovery from #1530
General transcript redaction from #1582
Moving reusable broker machinery into cli-guard

The operator must complete the live token rotation in coilyco-bridge/agentic-os-kai#776 before any live verification. Engineering and QA must use synthetic credentials and local fixtures rather than probing live Forgejo behavior.

## Outcome A warded director uses Ward's existing native Forgejo broker without receiving the raw Forgejo credential in the agent process. The primary implementation belongs in Ward. The AOS repository may need a small deployment-binding or documentation adjustment so the exact composed launch continues to work: `aos --composed --guarded --warded --role director --agent codex` Ward remains a public product. Ward must not depend on AOSGuard, AOS-specific policy, or the AOS deployment's credential source. ## Current boundary Ward currently seeds `FORGEJO_TOKEN` into ephemeral containers for authenticated Forgejo and Git paths. An arbitrary-shell agent can therefore print or reuse the transferable token. The exposure is no longer hypothetical: coilyco-bridge/agentic-os-kai#776 tracks rotation of a bot token printed into a private agent transcript, and #1582 tracks transcript-wide redaction. Ward already has the narrower mechanism this change needs. The native director broker performs Forgejo-backed inventory, capture, and dispatch operations outside the dropped director process. During the incident recorded in #1530, brokered Forgejo access continued while the director's injected credential failed. AOSGuard is a separate AOS operator tool generated by specgen. Specgen's credential mounts and standalone AOSGuard behavior remain valid and independent of Ward. ## Ward change * Route the director's native Forgejo reads and writes through the existing per-run Ward broker. * Keep the credential only in the privileged broker side of the run. The director harness process must not inherit `FORGEJO_TOKEN` or receive an equivalent token-bearing file. * Reapply Ward's role, operation, owner, and repository checks in the broker. The broker must not trust client-side validation. * Keep authenticated operation output bounded and free of authorization headers or credential material. * Return a clear degraded-auth error when the broker credential is invalid. The first version may require recycling the director instead of refreshing a credential in place. * Tear down the credential-bearing broker state with the run. * Preserve existing engineer Git clone and push behavior. This issue does not redesign Git authentication. ## AOS follow-through AOS owns only Kai's deployment bindings and the composed launch adapter. * Adjust the AOS `.ward/` role binding, launch projection, or role-surface documentation only where Ward's new broker boundary requires it. * Keep `.specgen/aosguard/` unchanged. * Keep standalone AOSGuard credential mounting unchanged. * Do not make Ward import, execute, configure, or require AOSGuard. * Do not add AWS, SSM, or another cloud provider to Ward's public product contract. If the Ward change works through the existing provider-neutral launch contract without an AOS code change, record that result and limit AOS follow-through to any documentation that became inaccurate. ## Acceptance * The exact composed director launch starts successfully with the selected Codex harness. * The director agent environment and projected home contain no `FORGEJO_TOKEN` or equivalent transferable Forgejo credential. * Focused automated coverage proves one allowed Forgejo read and one allowed Forgejo write succeed through the native broker using synthetic credential material. * Focused automated coverage proves a disallowed operation or scope fails before any upstream request. * Synthetic credential values never appear in agent argv, environment snapshots, projected files, transcripts, logs, or rendered errors. * Broker authentication failure is visibly distinct from network failure and policy denial. * Broker teardown removes its per-run credential state. * Engineer, QA, Git push, and non-director credential behavior remain unchanged. * Standalone AOSGuard still resolves specgen-declared credential mounts without Ward. * Ward contains no AOSGuard dependency or AOS-specific credential-source knowledge. * Ward's repository-declared tests and pre-commit suite pass. AOS runs its own declared checks if AOS files change. ## Non-goals * A generic secret-discovery or credential-broker product * A general HTTP proxy * A new cloud-provider abstraction * Changes to specgen or AOSGuard * Tea or another third-party Forgejo CLI * Git authentication changes * Other Ward roles * Hot credential rotation, durable replay, or pending-brief recovery from #1530 * General transcript redaction from #1582 * Moving reusable broker machinery into cli-guard ## Sequencing and related work The operator must complete the live token rotation in coilyco-bridge/agentic-os-kai#776 before any live verification. Engineering and QA must use synthetic credentials and local fixtures rather than probing live Forgejo behavior. Related: #1530, #1582, #239, coilyco-bridge/agentic-os-kai#776.

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-28 20:05:30 +00:00

coilyco-ops referenced this issue from a commit

2026-07-28 20:36:22 +00:00

feat(director): broker native Forgejo credentials

coilyco-ops referenced this issue from a commit

2026-07-28 20:36:27 +00:00

docs(ward): clarify director credential boundary

coilyco-ops commented

2026-07-28 20:40:05 +00:00

Author

Member

WARD-OUTCOME: implementation landed, live acceptance pending

Ward commit 8a18fec8 lands the native director Forgejo broker. The broker alone receives the raw credential, rechecks role, operation, owner, and repository policy server-side, attaches authentication upstream, bounds request and response bodies, scrubs the held token from upstream output, and returns distinct auth, network, and policy failures. The director harness receives only the broker capability. Existing engineer, QA, and Git credential behavior is unchanged.

AOS commit 34971f60 documents the deployment binding and the compatibility boundary. Ward does not depend on AOSGuard or specgen. Standalone AOSGuard retains its specgen-owned credential mounts.

Local verification passed:

ward exec test-policy-boundary
ward exec test
ward exec build
ward exec vet
ward exec lint
ward exec cover
ward exec pre-commit
AOS ward exec aos-test
AOS ward exec pre-commit-all

Release workflow run #2526 failed after the Ward push: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/actions/runs/2526. The read-only run metadata reports status failure. The approved AOSGuard job-log route returned 404 for this run, so the engineer did not speculate or rerun live CI. A director or ops run must inspect that workflow failure and return the failing job evidence.

Live credential acceptance remains intentionally unperformed while coilyco-bridge/agentic-os-kai#776 is open. After #776 rotates the exposed token and a refreshed Ward release is installed, the operator acceptance is:

Kai launches aos --composed --guarded --warded --role director --agent codex.
Kai confirms the director process has no FORGEJO_TOKEN in its environment, home, argv, logs, or errors without printing any secret value.
Kai exercises one native Forgejo read and one controlled disposable issue write through the broker.
Kai ends the run and confirms the sibling broker exits and its credential environment files are removed.

The issue stays open with its interactive gate until both the release workflow and post-rotation acceptance are green.

WARD-OUTCOME: implementation landed, live acceptance pending Ward commit 8a18fec8 lands the native director Forgejo broker. The broker alone receives the raw credential, rechecks role, operation, owner, and repository policy server-side, attaches authentication upstream, bounds request and response bodies, scrubs the held token from upstream output, and returns distinct auth, network, and policy failures. The director harness receives only the broker capability. Existing engineer, QA, and Git credential behavior is unchanged. AOS commit 34971f60 documents the deployment binding and the compatibility boundary. Ward does not depend on AOSGuard or specgen. Standalone AOSGuard retains its specgen-owned credential mounts. Local verification passed: * ward exec test-policy-boundary * ward exec test * ward exec build * ward exec vet * ward exec lint * ward exec cover * ward exec pre-commit * AOS ward exec aos-test * AOS ward exec pre-commit-all Release workflow run #2526 failed after the Ward push: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/actions/runs/2526. The read-only run metadata reports status failure. The approved AOSGuard job-log route returned 404 for this run, so the engineer did not speculate or rerun live CI. A director or ops run must inspect that workflow failure and return the failing job evidence. Live credential acceptance remains intentionally unperformed while coilyco-bridge/agentic-os-kai#776 is open. After #776 rotates the exposed token and a refreshed Ward release is installed, the operator acceptance is: 1. Kai launches `aos --composed --guarded --warded --role director --agent codex`. 2. Kai confirms the director process has no `FORGEJO_TOKEN` in its environment, home, argv, logs, or errors without printing any secret value. 3. Kai exercises one native Forgejo read and one controlled disposable issue write through the broker. 4. Kai ends the run and confirms the sibling broker exits and its credential environment files are removed. The issue stays open with its `interactive` gate until both the release workflow and post-rotation acceptance are green.

coilyco-ops referenced this issue from a commit

2026-07-29 02:33:59 +00:00

fix(director): unblock broker promotion, refs #1612

coilyco-ops commented

2026-07-29 02:38:42 +00:00

Author

Member

Verified complete in Ward v0.854.0. Commit 29e04f87 repaired the broker promotion tests and comment gate. Promote run 2529 and release run 2530 passed. The installed Homebrew binary now reports v0.854.0, and aos --composed --warded --guarded --role director --agent codex -- --print completed a brokered 16-repository Forgejo backlog read without FORGEJO_TOKEN.

Verified complete in Ward v0.854.0. Commit 29e04f87 repaired the broker promotion tests and comment gate. Promote run 2529 and release run 2530 passed. The installed Homebrew binary now reports v0.854.0, and aos --composed --warded --guarded --role director --agent codex -- --print completed a brokered 16-repository Forgejo backlog read without FORGEJO_TOKEN.

coilyco-ops closed this issue

2026-07-29 02:38:43 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/ward#1612

No description provided.

Rows
Columns