Demo: fix the task so an out-of-policy ops verb denial is on screen

coilyco-ops commented

2026-06-24 06:51:35 +00:00

Member

Fix the demo task - replace or augment "deploy static site to netlify" so an out-of-policy ops verb denial is on screen.

Either pick a task that reaches a real ops verb, or keep netlify and script one out-of-policy poke so the log shows an allow and a deny. A task that only proves "the agent can deploy" proves nothing ward adds, since bare gptme already does that.

Split out from the ward launch session capture: coilyco-flight-deck/ward#229. Launch theme: the boundary is the product - every demo and one-liner must show a denial, not just capability.

**Fix the demo task** - replace or augment "deploy static site to netlify" so an out-of-policy ops verb denial is on screen. Either pick a task that reaches a real ops verb, or keep netlify and script one out-of-policy poke so the log shows an allow and a deny. A task that only proves "the agent can deploy" proves nothing ward adds, since bare gptme already does that. --- Split out from the ward launch session capture: coilyco-flight-deck/ward#229. Launch theme: the boundary is the product - every demo and one-liner must show a denial, not just capability.

coilyco-ops added this to the ward launch milestone

2026-06-24 06:51:35 +00:00

coilyco-ops added the

P2

label

2026-06-24 06:51:35 +00:00

coilyco-ops referenced this issue

2026-06-24 06:52:42 +00:00

ward launch - session capture #229

coilyco-ops added

P1

interactive

and removed

P2

labels

2026-06-24 17:20:05 +00:00

coilyco-ops commented

2026-06-24 17:27:44 +00:00

Author

Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

P1 - Fix the demo task so a denial is on screen, first domino of the launch demo, clear next thing.
interactive - Agent reworks the task but Kai approves which out-of-policy verb is shown.

**Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P1** - Fix the demo task so a denial is on screen, first domino of the launch demo, clear next thing. - **interactive** - Agent reworks the task but Kai approves which out-of-policy verb is shown.

coilyco-ops commented

2026-06-24 17:30:04 +00:00

Author

Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

P1 - Fix the demo task so a denial is on screen, first domino of the launch demo, clear next thing.
interactive - Agent reworks the task but Kai approves which out-of-policy verb is shown.

**Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P1** - Fix the demo task so a denial is on screen, first domino of the launch demo, clear next thing. - **interactive** - Agent reworks the task but Kai approves which out-of-policy verb is shown.

coilysiren added

P2

and removed

P1

labels

2026-07-01 04:29:51 +00:00

coilyco-ops added

headless

and removed

interactive

labels

2026-07-01 23:57:43 +00:00

coilyco-ops commented

2026-07-01 23:59:26 +00:00

Author

Member

DECISION - headless: agent fixes the demo task so an out-of-policy ops-verb denial lands on screen, per the #255 doctrine. Recorded by Claude Code (Fable) during the 2026-07-01 ward launch triage session with Kai.

coilyco-ops referenced this issue

2026-07-01 23:59:27 +00:00

Demo: record the postable artifact (asciinema/transcript with JSONL audit rows) #253

coilyco-ops referenced this issue

2026-07-02 00:01:42 +00:00

meta: jul 1st evening sprint - launch burndown session 1 #492

coilyco-ops commented

2026-07-06 18:12:44 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-250 on host KAI-DESKTOP-TOWER is carrying this issue (reserved 2026-07-06T18:12:39Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#250 · branch issue-250 · driver claude · workflow direct-main
Run: engineer-claude-ward-250 · ward v0.414.0 · dispatched 2026-07-06T18:12:39Z
Comment thread: 3 included in the pre-flight read, 0 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-06-24T17:27:44Z), @coilyco-ops (2026-06-24T17:30:04Z), @coilyco-ops (2026-07-01T23:59:26Z)

Issue body as seeded:

**Fix the demo task** - replace or augment "deploy static site to netlify" so an out-of-policy ops verb denial is on screen.

Either pick a task that reaches a real ops verb, or keep netlify and script one out-of-policy poke so the log shows an allow and a deny. A task that only proves "the agent can deploy" proves nothing ward adds, since bare gptme already does that.


---
Split out from the ward launch session capture: coilyco-flight-deck/ward#229. Launch theme: the boundary is the product - every demo and one-liner must show a denial, not just capability.

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.414.0).

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-250` on host `KAI-DESKTOP-TOWER` is carrying this issue (reserved 2026-07-06T18:12:39Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#250` · branch `issue-250` · driver `claude` · workflow `direct-main` - **Run:** `engineer-claude-ward-250` · ward `v0.414.0` · dispatched `2026-07-06T18:12:39Z` - **Comment thread:** 3 included in the pre-flight read, 0 stripped (ward's own automated comments). - included: @coilyco-ops (2026-06-24T17:27:44Z), @coilyco-ops (2026-06-24T17:30:04Z), @coilyco-ops (2026-07-01T23:59:26Z) **Issue body as seeded:** ``` **Fix the demo task** - replace or augment "deploy static site to netlify" so an out-of-policy ops verb denial is on screen. Either pick a task that reaches a real ops verb, or keep netlify and script one out-of-policy poke so the log shows an allow and a deny. A task that only proves "the agent can deploy" proves nothing ward adds, since bare gptme already does that. --- Split out from the ward launch session capture: coilyco-flight-deck/ward#229. Launch theme: the boundary is the product - every demo and one-liner must show a denial, not just capability. ``` Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.414.0). </details>  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-07-06 18:19:47 +00:00

feat(demo): add hard out-of-policy ops-verb denial as Beat 4 (closes #250)

coilysiren closed this issue

2026-07-06 18:19:47 +00:00

coilysiren commented

2026-07-06 18:20:11 +00:00

Owner

WARD-OUTCOME: done - added Beat 4 to examples/demo.sh: ward ops forgejo pr refused denied by policy, a hard, credential-free out-of-policy ops-verb denial on screen.

The interesting part was that the fix wasn't code, it was finding the right denial. The demo already had two refusals, but neither was a real operator verb: Beat 2 is the argv gate and Beat 3 is honestly disclaimed as the claude-only fail-open hint. The thing the issue actually wanted - an ops verb refused by policy - turned out to already exist and be perfect: ward ops forgejo pr list answers "pull requests are not exposed through ward; read them in the web UI" with exit 2, no token or endpoint touched. So it runs in the credential-free demo unchanged, which is exactly what a launch demo needs.

What surprised me: the destructive verbs I'd have reached for first (aws s3 rm, kubectl delete) are withheld from the surface entirely rather than denied - they just print "no help topic", a weak on-screen story. The pr denial is the only one that is both hard and a real ops verb with an explicit message, so that asymmetry (denied-by-policy vs absent-at-compile-time) became a teaching point in the doc rather than a footnote.

Confident in the result: it's docs plus a shell demo, I ran the full script and the beat renders live, and pre-commit is green. Rough edge worth a possible follow-up: the runnable demo still can't show an allowed audited ops verb (those need real creds), so the "log carries both allow and deny" claim leans on narration plus Beat 1's exec audit row rather than a live allowed ops call. Fine for a credential-free demo, but a recorded asciinema against real endpoints would close that gap.

WARD-OUTCOME: done - added Beat 4 to examples/demo.sh: `ward ops forgejo pr` refused `denied by policy`, a hard, credential-free out-of-policy ops-verb denial on screen. The interesting part was that the fix wasn't code, it was finding the *right* denial. The demo already had two refusals, but neither was a real operator verb: Beat 2 is the argv gate and Beat 3 is honestly disclaimed as the claude-only fail-open hint. The thing the issue actually wanted - an ops verb refused by policy - turned out to already exist and be perfect: `ward ops forgejo pr list` answers "pull requests are not exposed through ward; read them in the web UI" with exit 2, no token or endpoint touched. So it runs in the credential-free demo unchanged, which is exactly what a launch demo needs. What surprised me: the destructive verbs I'd have reached for first (`aws s3 rm`, `kubectl delete`) are *withheld* from the surface entirely rather than denied - they just print "no help topic", a weak on-screen story. The pr denial is the only one that is both hard *and* a real ops verb with an explicit message, so that asymmetry (denied-by-policy vs absent-at-compile-time) became a teaching point in the doc rather than a footnote. Confident in the result: it's docs plus a shell demo, I ran the full script and the beat renders live, and pre-commit is green. Rough edge worth a possible follow-up: the runnable demo still can't show an *allowed* audited ops verb (those need real creds), so the "log carries both allow and deny" claim leans on narration plus Beat 1's exec audit row rather than a live allowed ops call. Fine for a credential-free demo, but a recorded asciinema against real endpoints would close that gap.

Rows
Columns

Demo: fix the task so an out-of-policy ops verb denial is on screen #250