create 3 ward-kdl forgejo based builds: readonly, write, admin #240

New issue

Closed

opened 2026-06-23 22:14:34 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-06-23 22:14:34 +00:00

Owner

No description provided.

coilysiren changed title from ~~create 3 ward-kdl forgejo builds: readonly, write, admin~~ to create 3 ward-kdl forgejo based builds: readonly, write, admin

2026-06-23 22:14:41 +00:00

coilyco-ops added the

consult

labels

2026-06-24 04:15:58 +00:00

coilyco-ops commented

2026-06-24 05:55:41 +00:00

Member

Implementation design (layered binaries)

ward-kdl binaries are generated per-guardfile (ward-kdl build --guardfile X --out Y), so the 3 tiers are 3 guardfiles + 3 build calls — no hand-written mains.

Tiers (additive can grants + default-deny, composing the wildcard "*" from cli-guard#159 and inherit from cli-guard#160):

read — can get "*" + can list "*"
write — inherit <read> + can create "*" + can edit "*"
admin — inherit <write> + can delete "*" + admin-only verbs

Why 3 binaries: compile-time deny — ward-kdl-read has no create/delete leaves compiled in, so they cannot be invoked (stronger than a runtime --tier flag; pure deny-by-structure).

Build/packaging (ward): build-ward-kdl builds all three into ward-kdl-{read,write,admin}; install installs three; the homebrew formula ships three.

Dependency chain (do not headless until met)

cli-guard#159 (wildcard "*") — landed (v0.47.0).
cli-guard#160 (inherit primitive) — dispatched.
A cli-guard release carrying #160, then bump ward go.mod's cli-guard pin.
Then this issue is headless-ready (author the 3 guardfiles + build/install/brew wiring).

Staying consult/blocked until step 3.

## Implementation design (layered binaries) ward-kdl binaries are generated per-guardfile (`ward-kdl build --guardfile X --out Y`), so the 3 tiers are 3 guardfiles + 3 build calls — no hand-written mains. **Tiers (additive `can` grants + default-deny, composing the wildcard `"*"` from cli-guard#159 and `inherit` from cli-guard#160):** - `read` — `can get "*"` + `can list "*"` - `write` — `inherit <read>` + `can create "*"` + `can edit "*"` - `admin` — `inherit <write>` + `can delete "*"` + admin-only verbs **Why 3 binaries:** compile-time deny — `ward-kdl-read` has no create/delete leaves *compiled in*, so they cannot be invoked (stronger than a runtime `--tier` flag; pure deny-by-structure). **Build/packaging (ward):** `build-ward-kdl` builds all three into `ward-kdl-{read,write,admin}`; `install` installs three; the homebrew formula ships three. ## Dependency chain (do not headless until met) 1. cli-guard#159 (wildcard `"*"`) — **landed** (v0.47.0). 2. cli-guard#160 (`inherit` primitive) — dispatched. 3. A cli-guard **release** carrying #160, then bump ward `go.mod`'s cli-guard pin. 4. Then this issue is headless-ready (author the 3 guardfiles + build/install/brew wiring). Staying `consult`/blocked until step 3.

coilyco-ops added

headless

and removed

consult

labels

2026-06-24 06:19:46 +00:00

coilyco-ops commented

2026-06-24 06:20:20 +00:00

Member

🔒 Reserved by ward agent --driver claude — container ward-ward-issue-240-claude-b21e0672 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-06-24T06:20:19Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `ward-ward-issue-240-claude-b21e0672` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-06-24T06:20:19Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-06-24 06:44:47 +00:00

feat(ward-kdl): add read/write/admin forgejo permission tiers (ward#240)

coilysiren closed this issue

2026-06-24 06:44:47 +00:00

coilysiren referenced this issue

2026-06-24 06:47:31 +00:00

homebrew-tap: build+install the 3 forgejo tier binaries (follow-up to #240) #246