homebrew-tap: build+install the 3 forgejo tier binaries (follow-up to #240) #246

New issue

Closed

opened 2026-06-24 06:47:31 +00:00 by coilysiren · 3 comments

coilysiren commented

2026-06-24 06:47:31 +00:00

Owner

Follow-up to ward#240, which landed the three permission-tiered forgejo binaries (ward-kdl-read, ward-kdl-write, ward-kdl-admin) plus the in-repo build wiring: make build-ward-kdl now builds all three via the new build-ward-kdl-forgejo-tiers target.

The remaining piece is cross-repo and was out of scope for the ward#240 container: the coilyco-flight-deck/homebrew-tap ward formula must build and install the three tier binaries alongside ward (the design called for "the homebrew formula ships three").

Context:

ward-kdl binaries are built from source (dev make build-ward-kdl, prod the brew formula), not published as ward release assets, so no release.yml change was needed in ward.
The formula already sets GOPROXY=direct / GOSUMDB=off for the cli-guard pseudo-version fetch (see docs/homebrew-build.md); the tier builds use the same specverb-gen driver, so they fit the existing sandbox.
Per-tier invocation: run specverb-gen lock --guardfile cmd/ward-kdl-forgejo/ward-kdl.forgejo.admin.guardfile.kdl once (the widest slice), then build --guardfile cmd/ward-kdl-forgejo/ward-kdl.forgejo.{read,write,admin}.guardfile.kdl --out <bin>.

No closes trailer here on purpose: this tracks the tap-side work.

Follow-up to ward#240, which landed the three permission-tiered forgejo binaries (`ward-kdl-read`, `ward-kdl-write`, `ward-kdl-admin`) plus the in-repo build wiring: `make build-ward-kdl` now builds all three via the new `build-ward-kdl-forgejo-tiers` target. The remaining piece is **cross-repo** and was out of scope for the ward#240 container: the `coilyco-flight-deck/homebrew-tap` `ward` formula must build and install the three tier binaries alongside `ward` (the design called for "the homebrew formula ships three"). Context: - ward-kdl binaries are built from source (dev `make build-ward-kdl`, prod the brew formula), not published as ward release assets, so no `release.yml` change was needed in ward. - The formula already sets `GOPROXY=direct` / `GOSUMDB=off` for the cli-guard pseudo-version fetch (see `docs/homebrew-build.md`); the tier builds use the same specverb-gen driver, so they fit the existing sandbox. - Per-tier invocation: run `specverb-gen lock --guardfile cmd/ward-kdl-forgejo/ward-kdl.forgejo.admin.guardfile.kdl` once (the widest slice), then `build --guardfile cmd/ward-kdl-forgejo/ward-kdl.forgejo.{read,write,admin}.guardfile.kdl --out <bin>`. No `closes` trailer here on purpose: this tracks the tap-side work.

coilyco-ops added the

interactive

labels

2026-06-24 17:20:03 +00:00

coilyco-ops commented

2026-06-24 17:27:41 +00:00

Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

P2 - Cross-repo homebrew follow-up to build/install the 3 tier binaries, concrete next-tier packaging.
interactive - Release-packaging build with exact commands given, agent works it then a human verifies the install.

**Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P2** - Cross-repo homebrew follow-up to build/install the 3 tier binaries, concrete next-tier packaging. - **interactive** - Release-packaging build with exact commands given, agent works it then a human verifies the install.

coilyco-ops commented

2026-06-24 17:30:01 +00:00

Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

P2 - Cross-repo homebrew follow-up to build/install the 3 tier binaries, concrete next-tier packaging.
interactive - Release-packaging build with exact commands given, agent works it then a human verifies the install.

coilysiren added

consult

and removed

interactive

labels

2026-07-01 04:29:51 +00:00

coilyco-ops commented

2026-07-01 23:57:04 +00:00

Member

Closing as mooted by #455: the tier binaries are leaving the public-facing published artifacts entirely, so the tap should not build/install them. Recorded by Claude Code (Fable) during the 2026-07-01 ward launch triage session with Kai.

coilyco-ops closed this issue

2026-07-01 23:57:05 +00:00

coilysiren referenced this issue

2026-07-04 09:34:03 +00:00

Wire the automation-mode ceiling into ward's real dispatch path (ward agent / warded) #607

coilysiren referenced this issue from a commit

2026-07-04 17:37:48 +00:00

feat(agent): enforce the automation-mode ceiling on ward's own dispatch path