Attribute all ward automation commits to the coilyco-ops bot (tap bumps + warded-agent author + entrypoint push user) #245

New issue

Closed

opened 2026-06-24 06:02:02 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-06-24 06:02:02 +00:00

Member

Problem

ward-driven automation commits are not attributed to the coilyco-ops bot. Three distinct author/identity paths, all rooted in this repo, all wrong:

Tap bumps - the bump-tap-formula job in .forgejo/workflows/release.yml sets git config user.name "forgejo-tap-writer" / user.email "tap-writer@coilysiren.me". Every chore(formula): bump ward to vX commit on coilyco-flight-deck/homebrew-tap shows as forgejo-tap-writer, an identity not linked to any bot account. (Push auth was already moved to secrets.TAP_WRITE_TOKEN in #243; this is the author line, untouched by that.)
Warded-agent commits - headless ward agent runs commit as ward-container <coilysiren@gmail.com> (seen on coilyco-bridge/deploy 7880843, infra 6469313). Author is a generic name on Kai's personal email. This is agentic-os#252.
Entrypoint push user - cmd/ward/containerassets/entrypoint.sh and cmd/ward/container_bootstrap.go hardcode coilysiren as the git-over-HTTPS push user (per infra#384 step 2). Push authorization, distinct from the author line, but part of the same consolidation.

Goal

All ward automation commits attribute to the coilyco-ops bot. Per the agentic-os#244 principle ("aos bots should use their agent name as their git name / git email prefix"), the display name may stay descriptive (e.g. forgejo-tap-writer, or the agent name for warded runs), but the email must be the coilyco-ops bot's registered email - that email match is what makes Forgejo link the commit to the bot account (avatar + attribution).

Fix (code-only; fresh-clone current `main` - the release.yml in old worktrees is stale post-#243)

release.yml bump-tap-formula: set user.email to the coilyco-ops bot's registered git email (keep or rename the display name per #244).
Warded-agent author: wherever ward configures the in-container git author for agent commits (the bootstrap/entrypoint that produces ward-container <coilysiren@gmail.com>), set name per #244 and email to the bot's. Closes agentic-os#252.
Entrypoint push user: flip the hardcoded coilysiren push user in entrypoint.sh + container_bootstrap.go to coilyco-ops (infra#384 step 2). Confirm the push token in use belongs to the bot.

Prereq to verify (may be a human follow-up)

The coilyco-ops bot's Forgejo account must have the chosen author email registered for the attribution to link. Check the bot account; if the email isn't registered, that registration is a small human/UI/admin step - flag it in a comment, don't block the code changes on it.

Acceptance

A test tap bump and a warded-agent commit both show coilyco-ops as the author in the Forgejo UI (account-linked, not a plain string).
Code changes self-contained + reviewable; no token values in tracked files (SSM paths only).
pre-commit passes. Land on canonical main.

Refs

agentic-os#252 (warded-agent author - this closes it), #244 (the naming principle).
ward#243 (tap push-auth, already done), infra#384 step 2 (entrypoint push user).
infra#344 / #368 (the broader off-coilysiren / dedicated-bot consolidation this serves).

Surfaced from the homebrew-tap commit log showing forgejo-tap-writer instead of the bot.

## Problem ward-driven automation commits are **not attributed to the `coilyco-ops` bot**. Three distinct author/identity paths, all rooted in this repo, all wrong: 1. **Tap bumps** - the `bump-tap-formula` job in `.forgejo/workflows/release.yml` sets `git config user.name "forgejo-tap-writer"` / `user.email "tap-writer@coilysiren.me"`. Every `chore(formula): bump ward to vX` commit on `coilyco-flight-deck/homebrew-tap` shows as `forgejo-tap-writer`, an identity not linked to any bot account. (Push auth was already moved to `secrets.TAP_WRITE_TOKEN` in #243; this is the *author* line, untouched by that.) 2. **Warded-agent commits** - headless `ward agent` runs commit as `ward-container <coilysiren@gmail.com>` (seen on coilyco-bridge/deploy `7880843`, infra `6469313`). Author is a generic name on Kai's *personal* email. This is agentic-os#252. 3. **Entrypoint push user** - `cmd/ward/containerassets/entrypoint.sh` and `cmd/ward/container_bootstrap.go` hardcode `coilysiren` as the git-over-HTTPS push user (per infra#384 step 2). Push authorization, distinct from the author line, but part of the same consolidation. ## Goal All ward automation commits attribute to the **`coilyco-ops` bot**. Per the agentic-os#244 principle ("aos bots should use their agent name as their git name / git email prefix"), the display **name** may stay descriptive (e.g. `forgejo-tap-writer`, or the agent name for warded runs), but the **email must be the coilyco-ops bot's registered email** - that email match is what makes Forgejo link the commit to the bot account (avatar + attribution). ## Fix (code-only; fresh-clone current `main` - the release.yml in old worktrees is stale post-#243) 1. **release.yml `bump-tap-formula`**: set `user.email` to the coilyco-ops bot's registered git email (keep or rename the display name per #244). 2. **Warded-agent author**: wherever ward configures the in-container git author for agent commits (the bootstrap/entrypoint that produces `ward-container <coilysiren@gmail.com>`), set name per #244 and email to the bot's. Closes agentic-os#252. 3. **Entrypoint push user**: flip the hardcoded `coilysiren` push user in `entrypoint.sh` + `container_bootstrap.go` to `coilyco-ops` (infra#384 step 2). Confirm the push token in use belongs to the bot. ## Prereq to verify (may be a human follow-up) The coilyco-ops bot's Forgejo account must have the chosen author email **registered** for the attribution to link. Check the bot account; if the email isn't registered, that registration is a small human/UI/admin step - **flag it in a comment**, don't block the code changes on it. ## Acceptance - A test tap bump and a warded-agent commit both show **coilyco-ops** as the author in the Forgejo UI (account-linked, not a plain string). - Code changes self-contained + reviewable; no token values in tracked files (SSM paths only). - `pre-commit` passes. Land on canonical `main`. ## Refs - agentic-os#252 (warded-agent author - this closes it), #244 (the naming principle). - ward#243 (tap push-auth, already done), infra#384 step 2 (entrypoint push user). - infra#344 / #368 (the broader off-coilysiren / dedicated-bot consolidation this serves). Surfaced from the homebrew-tap commit log showing `forgejo-tap-writer` instead of the bot.

coilyco-ops added the

headless

labels

2026-06-24 06:02:22 +00:00

coilyco-ops commented

2026-06-24 06:02:25 +00:00

Author

Member

🔒 Reserved by ward agent claude — container ward-ward-issue-245-claude-30158ddf on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-06-24T06:02:24Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent claude` — container `ward-ward-issue-245-claude-30158ddf` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-06-24T06:02:24Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-06-24 06:12:27 +00:00

fix(container): attribute ward automation commits to the coilyco-ops bot (ward#245)

coilysiren closed this issue

2026-06-24 06:12:27 +00:00

coilysiren commented

2026-06-24 06:14:17 +00:00

Owner

Landed on main as 9c4aef1 (fix(container): attribute ward automation commits to the coilyco-ops bot), which auto-closed this issue via the closes #245 trailer.

All three identity paths flipped to the coilyco-ops bot:

Tap bump (release.yml bump-tap-formula) — user.email → coilyco-ops@coilysiren.me; display name kept as the descriptive forgejo-tap-writer (per agentic-os#244). Push auth still rides secrets.TAP_WRITE_TOKEN (ward#243), untouched.
Warded-agent author (entrypoint.sh + container_bootstrap.go) — default git author flipped from ward-container <coilysiren@gmail.com> to coilyco-ops <coilyco-ops@coilysiren.me> (WARD_GIT_NAME/WARD_GIT_EMAIL still override). Closes agentic-os#252.
Entrypoint push user (entrypoint.sh + container_bootstrap.go) — git-over-HTTPS credential-helper user flipped coilysiren → coilyco-ops (infra#384 step 2). The FORGEJO_TOKEN it pairs with is the bot's.

Rationale documented in docs/agent-attribution.md (new "Git commit author + push identity" section).

Prereq verified — no human follow-up needed. The bot's chosen email is already registered on the account: provision-coilyco-ops-bot.sh creates the bot with BOT_EMAIL=coilyco-ops@coilysiren.me, and this very commit confirms the link is live — the Forgejo commit API resolves both author and committer to account coilyco-ops (id 7, avatar-bearing, not a plain string):

GET .../git/commits/9c4aef1 → author/committer → {"id":7,"login":"coilyco-ops", ...}

That satisfies the acceptance "warded-agent commit shows coilyco-ops as the author in the Forgejo UI (account-linked)". The tap-bump path validates on the next release; the push-user path on the next container run.

pre-commit passed (the committed repo gate). Two env notes, both orthogonal to this change: trufflehog wasn't on PATH in the container (installed the release binary to run the secret-scan hook green), and the ward container agent-precommit-config overlay (ward#139) pins the now-retired closes-issue/conventional-commit hooks, which don't exist at the repo's pinned agentic-os v0.65.0 — that broken, uncommitted commit-msg overlay can't load and is worth a separate look.

— Claude (she/her), via ward agent

Landed on `main` as `9c4aef1` (`fix(container): attribute ward automation commits to the coilyco-ops bot`), which auto-closed this issue via the `closes #245` trailer. **All three identity paths flipped to the `coilyco-ops` bot:** 1. **Tap bump** (`release.yml` `bump-tap-formula`) — `user.email` → `coilyco-ops@coilysiren.me`; display name kept as the descriptive `forgejo-tap-writer` (per agentic-os#244). Push auth still rides `secrets.TAP_WRITE_TOKEN` (ward#243), untouched. 2. **Warded-agent author** (`entrypoint.sh` + `container_bootstrap.go`) — default git author flipped from `ward-container <coilysiren@gmail.com>` to `coilyco-ops <coilyco-ops@coilysiren.me>` (`WARD_GIT_NAME`/`WARD_GIT_EMAIL` still override). Closes agentic-os#252. 3. **Entrypoint push user** (`entrypoint.sh` + `container_bootstrap.go`) — git-over-HTTPS credential-helper user flipped `coilysiren` → `coilyco-ops` (infra#384 step 2). The `FORGEJO_TOKEN` it pairs with is the bot's. Rationale documented in `docs/agent-attribution.md` (new "Git commit author + push identity" section). **Prereq verified — no human follow-up needed.** The bot's chosen email is already registered on the account: `provision-coilyco-ops-bot.sh` creates the bot with `BOT_EMAIL=coilyco-ops@coilysiren.me`, and this very commit confirms the link is live — the Forgejo commit API resolves both author *and* committer to account `coilyco-ops` (id 7, avatar-bearing, not a plain string): GET .../git/commits/9c4aef1 → author/committer → {"id":7,"login":"coilyco-ops", ...} That satisfies the acceptance "warded-agent commit shows **coilyco-ops** as the author in the Forgejo UI (account-linked)". The tap-bump path validates on the next release; the push-user path on the next container run. `pre-commit` passed (the committed repo gate). Two env notes, both orthogonal to this change: `trufflehog` wasn't on PATH in the container (installed the release binary to run the secret-scan hook green), and the `ward container agent-precommit-config` overlay (ward#139) pins the now-retired `closes-issue`/`conventional-commit` hooks, which don't exist at the repo's pinned agentic-os `v0.65.0` — that broken, uncommitted commit-msg overlay can't load and is worth a separate look. — Claude (she/her), via `ward agent`