ward launch - session capture #229

Closed
opened 2026-06-23 05:54:04 +00:00 by coilysiren · 3 comments
Owner

ward launch - session capture

Split into the ward launch milestone. The actionable TODOs below are now finely scoped issues (#247-#261). This issue stays as the durable record: the learnings and the field-guide reference. Close it once the milestone work is underway.

Context: working session on positioning, channel strategy, the CLI surface, and the integration demo for the public launch of ward. ward is already open source, so the "release" is the announce-and-find-humans motion, not a first push. Capture is de-duplicated.

Learnings (durable)

  • Repositioning - positioning, ops - ward is a permissions and policy layer for headless devsecops agents that hold credentials and act on live infra, not a coding-agent fan-out tool. The filesystem-plus-git sandbox is insufficient precisely because of ops adjacency (kubectl, terraform, aws, gh, fj).
  • Competitor thesis - positioning - ward's real competition is the cloud-specific hardened permission models that scoped agents inherit (kagent inherits k8s RBAC, Kiro inherits AWS IAM). Cloud-agnostic agents (goose) cannot and do not share a uniform permission system, so they structurally need ward.
  • goose wedge, narrowed - positioning - "the average headless goose user is a good ward user" holds but should be narrowed. goose now ships in-process prompt-injection detection, tool permission controls, and a sandbox mode, so ward's sharp wedge is headless and CI goose deployments plus the smaller permission-less goose-likes, where out-of-process enforcement and an append-only audit are the gap in-process controls cannot cover.
  • The boundary is the product - demo, positioning - any demo or one-liner must show a denial, not just capability. A task that only proves "the agent can deploy" proves nothing ward adds, since bare gptme already does that.
  • Weak local models are a test bench - testing - a small Qwen quant wanders out of policy on its own, so it exercises ward's deny paths for free. That is an adversarial test bench, not a downgrade.
  • Build one integration, not three - launch, headspace - one working example flips the post from "look at my thing" to "here's my thing guarding your thing." Three is the polish-in-private trap. The other two follow room to room.
  • Channel reality - distribution - Reddit is the wrong channel (self-promo bans and AI-tooling bans barely overlap, and the overlap is hype-allergic). The venues that work are the AI agent tools' own communities, whose self-promo channels tolerate agent-built tools. ward is complementary there, not a competitor, which is welcome even where competitor promo is banned.
  • Finding humans is not a channel problem - distribution - broadcast buys impressions, but the goal is a few real conversations. Highest-yield move is DMing two or three maintainers of adjacent tools, not launching at a crowd. Bluesky is weak here (around 200 followers, median 0 likes).
  • Launch as soft publish - headspace - a release is a beginning, not a verdict. ward already has the soft rollout written into it (v0, downstream consumers upgrade on their own schedule). The writeup is interview-grade regardless of adoption, so the floor is high.
  • Naming carries the pitch - cli, positioning - warded gptme "..." reads like sudo, timeout, nice, firejail. An SRE parses it as "firejail for agents" in one token, and it instantiates the "warded agent" noun. run cannot carry that, and it collides with ward exec.

TODOs - split into the ward launch milestone

CLI surface:

  • #247 - ship warded as the public face and ward drive <harness> as the machinery
  • #248 - flag-boundary parsing for warded (harness arg splits ward flags from harness flags)

Integration:

  • #249 - ward driving gptme headless in an ephemeral container (local Qwen adversary)

Demo:

  • #250 - fix the demo task so an out-of-policy ops verb denial is on screen
  • #251 - write the demo script (one happy path plus two danger classes)
  • #252 - per-harness honesty about where the enforcement boundary sits
  • #253 - record the postable artifact (asciinema/transcript with JSONL audit rows)

Writeups:

  • #254 - README comparison: ward vs NVIDIA OpenShell
  • #255 - launch post: the idea and the lesson (doubles as a job-hunt artifact)

Distribution:

  • #256 - post sequence step 1: ed3d #promote-your-stuff
  • #257 - post sequence step 2: the agent-tool communities
  • #258 - post sequence step 3: idea-post on HN or Lobsters
  • #259 - post sequence step 4: DM two or three maintainers of adjacent tools
  • #260 - seed long-tail integration targets (gptme, AI Shell Agent, sre-agent, devops)

Positioning:

  • #261 - track competitors (NVIDIA OpenShell, container-use, agentgateway)

Reference (field-guide facts worth keeping)

  • Closest analog - competitor - NVIDIA OpenShell (GTC 2026, around 7.2k stars, Rust, Apache-2.0, alpha). A driver that is policy-first, but heavyweight (K3s in a container), kernel-enforcement-centric (Landlock, OPA/Rego, Seccomp), NVIDIA-flavored, aimed at long-running coding agents. ward shares the quadrant and differs on weight, enforcement layer, and target. Its existence validates the category and leaves ward's lightweight cloud-agnostic ops niche open.
  • Agent-driver space shape - competitor - mostly coding fan-out (Conductor, Crystal now Nimbalyst, Vibe Kanban which shut down Apr 2026, Claude Squad, container-use from Dagger). Gateways sit in the path not the driver seat (agentgateway donated to Linux Foundation, Invariant acquired by Snyk, MCP gateways). Frameworks are build-your-own (kagent). Skyflo is a policy-first agent, not a driver. ward is in nearly open space as a lightweight, terminal-first, cloud-agnostic, verb-gating ops agent driver.
  • Warmest ward adoption targets - integration - ranked: gptme (flagship), AI Shell Agent (small, Python, MIT, HITL only), agenticsorg/devops (autonomous multi-cloud, verify maintenance), fuzzylabs/sre-agent (around 57 stars, holds AWS creds, no policy), rawdog and butterfish (right shape, dormant), aichat (around 10k, Rust, big enough to self-serve). Avoid as targets because already solved or read-only: Skyflo, HolmesGPT, k8sgpt, kagent.
  • Niche finding - market - below 1k stars there is no dedicated popular "headless cross-system infra orchestrator" project. People assemble it from goose or gptme plus MCP servers. The category is nascent, which favors ward.
  • Headless ops executors to know - landscape - goose (current pick, general shell-plus-MCP executor), kagent with khook (CNCF Sandbox, event-triggered k8s remediation, the headless-on-alert primitive), kubectl-ai (Google, --quiet one-shot kubectl agent). MCP ops servers are the hands (kubernetes-mcp-server with --read-only and --disable-destructive, AWS API MCP with IAM scope plus READ_OPERATIONS_ONLY). Their built-in gates are coarse, which is ward's opening.
  • Benchmark signal - market - ITBench-AA (May 2026) puts frontier models below 50% on k8s SRE diagnosis tasks, and more reasoning turns do not help. Autonomous ops is unsolved, which is the argument that guardrails matter.
  • Ecosystem churn - landscape - block/goose became aaif-goose under the Linux Foundation Agentic AI Foundation (Dec 2025). Continue acquired and shut by Cursor. Roo Code archived, migrate to Kilo. Amazon Q CLI dormant, replaced by Kiro CLI. Avoid GPT-Pilot and Pythagora (supply-chain compromise).
  • Headspace resource - headspace - Austin Kleon, Show Your Work, for the embarrassment-of-promoting-your-own-thing feeling. Book, blog at austinkleon.com, recorded talks.
# ward launch - session capture > **Split into the [ward launch](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/milestone/7) milestone.** The actionable TODOs below are now finely scoped issues (#247-#261). This issue stays as the durable record: the learnings and the field-guide reference. Close it once the milestone work is underway. Context: working session on positioning, channel strategy, the CLI surface, and the integration demo for the public launch of ward. ward is already open source, so the "release" is the announce-and-find-humans motion, not a first push. Capture is de-duplicated. ## Learnings (durable) * **Repositioning** - positioning, ops - ward is a permissions and policy layer for headless devsecops agents that hold credentials and act on live infra, not a coding-agent fan-out tool. The filesystem-plus-git sandbox is insufficient precisely because of ops adjacency (kubectl, terraform, aws, gh, fj). * **Competitor thesis** - positioning - ward's real competition is the cloud-specific hardened permission models that scoped agents inherit (kagent inherits k8s RBAC, Kiro inherits AWS IAM). Cloud-agnostic agents (goose) cannot and do not share a uniform permission system, so they structurally need ward. * **goose wedge, narrowed** - positioning - "the average headless goose user is a good ward user" holds but should be narrowed. goose now ships in-process prompt-injection detection, tool permission controls, and a sandbox mode, so ward's sharp wedge is headless and CI goose deployments plus the smaller permission-less goose-likes, where out-of-process enforcement and an append-only audit are the gap in-process controls cannot cover. * **The boundary is the product** - demo, positioning - any demo or one-liner must show a denial, not just capability. A task that only proves "the agent can deploy" proves nothing ward adds, since bare gptme already does that. * **Weak local models are a test bench** - testing - a small Qwen quant wanders out of policy on its own, so it exercises ward's deny paths for free. That is an adversarial test bench, not a downgrade. * **Build one integration, not three** - launch, headspace - one working example flips the post from "look at my thing" to "here's my thing guarding your thing." Three is the polish-in-private trap. The other two follow room to room. * **Channel reality** - distribution - Reddit is the wrong channel (self-promo bans and AI-tooling bans barely overlap, and the overlap is hype-allergic). The venues that work are the AI agent tools' own communities, whose self-promo channels tolerate agent-built tools. ward is complementary there, not a competitor, which is welcome even where competitor promo is banned. * **Finding humans is not a channel problem** - distribution - broadcast buys impressions, but the goal is a few real conversations. Highest-yield move is DMing two or three maintainers of adjacent tools, not launching at a crowd. Bluesky is weak here (around 200 followers, median 0 likes). * **Launch as soft publish** - headspace - a release is a beginning, not a verdict. ward already has the soft rollout written into it (v0, downstream consumers upgrade on their own schedule). The writeup is interview-grade regardless of adoption, so the floor is high. * **Naming carries the pitch** - cli, positioning - `warded gptme "..."` reads like sudo, timeout, nice, firejail. An SRE parses it as "firejail for agents" in one token, and it instantiates the "warded agent" noun. `run` cannot carry that, and it collides with `ward exec`. ## TODOs - split into the [ward launch milestone](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/milestone/7) CLI surface: * [ ] #247 - ship `warded` as the public face and `ward drive <harness>` as the machinery * [ ] #248 - flag-boundary parsing for `warded` (harness arg splits ward flags from harness flags) Integration: * [ ] #249 - ward driving gptme headless in an ephemeral container (local Qwen adversary) Demo: * [ ] #250 - fix the demo task so an out-of-policy ops verb denial is on screen * [ ] #251 - write the demo script (one happy path plus two danger classes) * [ ] #252 - per-harness honesty about where the enforcement boundary sits * [ ] #253 - record the postable artifact (asciinema/transcript with JSONL audit rows) Writeups: * [ ] #254 - README comparison: ward vs NVIDIA OpenShell * [ ] #255 - launch post: the idea and the lesson (doubles as a job-hunt artifact) Distribution: * [ ] #256 - post sequence step 1: ed3d `#promote-your-stuff` * [ ] #257 - post sequence step 2: the agent-tool communities * [ ] #258 - post sequence step 3: idea-post on HN or Lobsters * [ ] #259 - post sequence step 4: DM two or three maintainers of adjacent tools * [ ] #260 - seed long-tail integration targets (gptme, AI Shell Agent, sre-agent, devops) Positioning: * [ ] #261 - track competitors (NVIDIA OpenShell, container-use, agentgateway) ## Reference (field-guide facts worth keeping) * **Closest analog** - competitor - NVIDIA OpenShell (GTC 2026, around 7.2k stars, Rust, Apache-2.0, alpha). A driver that is policy-first, but heavyweight (K3s in a container), kernel-enforcement-centric (Landlock, OPA/Rego, Seccomp), NVIDIA-flavored, aimed at long-running coding agents. ward shares the quadrant and differs on weight, enforcement layer, and target. Its existence validates the category and leaves ward's lightweight cloud-agnostic ops niche open. * **Agent-driver space shape** - competitor - mostly coding fan-out (Conductor, Crystal now Nimbalyst, Vibe Kanban which shut down Apr 2026, Claude Squad, container-use from Dagger). Gateways sit in the path not the driver seat (agentgateway donated to Linux Foundation, Invariant acquired by Snyk, MCP gateways). Frameworks are build-your-own (kagent). Skyflo is a policy-first agent, not a driver. ward is in nearly open space as a lightweight, terminal-first, cloud-agnostic, verb-gating ops agent driver. * **Warmest ward adoption targets** - integration - ranked: gptme (flagship), AI Shell Agent (small, Python, MIT, HITL only), agenticsorg/devops (autonomous multi-cloud, verify maintenance), fuzzylabs/sre-agent (around 57 stars, holds AWS creds, no policy), rawdog and butterfish (right shape, dormant), aichat (around 10k, Rust, big enough to self-serve). Avoid as targets because already solved or read-only: Skyflo, HolmesGPT, k8sgpt, kagent. * **Niche finding** - market - below 1k stars there is no dedicated popular "headless cross-system infra orchestrator" project. People assemble it from goose or gptme plus MCP servers. The category is nascent, which favors ward. * **Headless ops executors to know** - landscape - goose (current pick, general shell-plus-MCP executor), kagent with khook (CNCF Sandbox, event-triggered k8s remediation, the headless-on-alert primitive), kubectl-ai (Google, `--quiet` one-shot kubectl agent). MCP ops servers are the hands (kubernetes-mcp-server with `--read-only` and `--disable-destructive`, AWS API MCP with IAM scope plus `READ_OPERATIONS_ONLY`). Their built-in gates are coarse, which is ward's opening. * **Benchmark signal** - market - ITBench-AA (May 2026) puts frontier models below 50% on k8s SRE diagnosis tasks, and more reasoning turns do not help. Autonomous ops is unsolved, which is the argument that guardrails matter. * **Ecosystem churn** - landscape - block/goose became aaif-goose under the Linux Foundation Agentic AI Foundation (Dec 2025). Continue acquired and shut by Cursor. Roo Code archived, migrate to Kilo. Amazon Q CLI dormant, replaced by Kiro CLI. Avoid GPT-Pilot and Pythagora (supply-chain compromise). * **Headspace resource** - headspace - Austin Kleon, Show Your Work, for the embarrassment-of-promoting-your-own-thing feeling. Book, blog at austinkleon.com, recorded talks.
Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

  • P3 - Launch session-capture record, the durable field guide, kept until the milestone drains.
  • consult - A record to read, not work to dispatch, human-owned.
<!-- goose-triage --> **Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P3** - Launch session-capture record, the durable field guide, kept until the milestone drains. - **consult** - A record to read, not work to dispatch, human-owned.
Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

  • P3 - Launch session-capture record, the durable field guide, kept until the milestone drains.
  • consult - A record to read, not work to dispatch, human-owned.
<!-- goose-triage --> **Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P3** - Launch session-capture record, the durable field guide, kept until the milestone drains. - **consult** - A record to read, not work to dispatch, human-owned.
coilysiren added
P4
and removed
P3
labels 2026-07-01 04:29:51 +00:00
Author
Owner

Superseded. The concrete session-capture and demo follow-ups were spun out into the #247-261 range. Closing the umbrella.

(automated triage prune, coilyco-ops director session)

Superseded. The concrete session-capture and demo follow-ups were spun out into the #247-261 range. Closing the umbrella. (automated triage prune, coilyco-ops director session)
Sign in to join this conversation.
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
coilyco-flight-deck/ward#229
No description provided.