Migrate ward-kdl -> ward: track remaining references (verb gaps, guardfile specs, repo internals)

coilysiren commented

2026-07-03 01:24:27 +00:00

Owner

Context

We're collapsing ward-kdl into ward ("migrating to just ward"). ward ops and ward agents already subsume most of the old surface. This issue tracks the remaining ward-kdl references that are not safe to mechanically rename yet, so they don't get lost.

Discovered while fixing a live breakage on kai-server: the forgejo git credential helper (agentic-os-kai/scripts/git-credential-forgejo-ssm.sh) called ward-kdl ops aws ssm, which silently returned no token (ward-kdl not installed — the ward formula ships only ward+warded), blocking every private-forgejo clone. Fixed to ward ops aws ssm.

Already done (safe consumer renames, this pass)

ward-kdl ops {aws,kubectl} / bare-noun mentions → ward … across, leaving commits to Kai:

agentic-os-kai: scripts/git-credential-forgejo-ssm.sh
infrastructure: AGENTS.md, ansible roles (agent-compose, fleet-reachability, o11y-telegram), scripts/{install-fdr-remake,provision-ci-release-token,provision-github-app,provision-tap-bump-token,thermal-heartbeat-install,claude-session-watcher-install-mac}.sh, several docs/+deploy/+terraform/ READMEs, skills/ops-investigation-k3s-pod-eviction/SKILL.md
agentic-os: scripts/rotate-{dep-bump,registry}-token.sh
deploy: services/atlas/scripts/rollout.sh, services/fleet-reachability/deploy/README.md, services/ser8-observability/docs/ser8-k3s.md

Blocked / skipped — needs real migration work

1. Verb gap: `ward ops` is missing verbs consumers still call

ward ops today exposes only forgejo, aws, forgejo-key, kubectl. Still under ward-kdl only:

ward-kdl ops tailscale — infrastructure/scripts/tailscale-entity-rollup.sh
ward-kdl ops signoz — deploy/services/ser8-observability/*, agentic-os ward-specs/ward-kdl.signoz.guardfile.kdl
ward-kdl ops glitchtip — referenced in agentic-os-kai/data/ssm-descriptions.yaml

Mount these under ward ops first, then migrate their callers. Renaming callers now would break them.

2. Guardfile specs + generated docs (agentic-os)

ward-specs/ward-kdl.{forgejo,ollama,signoz}.guardfile.kdl — wrap ward-kdl ops … mount definitions, plus the ward-kdl.* filenames.
docs/ward-ops-forgejo-reference.md — generated from the forgejo guardfile by scripts/gen-ward-ops-reference.sh; regenerate after the guardfile migrates, don't hand-edit (60+ ward-kdl ops forgejo headers).
ward-specs/signoz.openapi.lock.json title/description strings.

3. ward repo internals + cli-guard

~1426 hits in ward itself and ~132 in cli-guard — the actual package/binary/build-target rename (make build-ward-kdl, cmd/ward-kdl, docs). Owned in-repo, not a cross-repo sweep.

4. Residual prose

Noun-form ward-kdl mentions in agentic-os (.forgejo/workflows/issue-corpus.yml, docker/dev-base/Dockerfile, shell/common.sh), deploy/.ward/ward.yaml, coilysiren (5), and scattered comments. Low priority; sweep once the command surface is unified.

Suggested sequence

Land the ward-repo/cli-guard internal rename + keep ward-kdl as an alias during transition (so consumers don't hard-break).
Mount tailscale/signoz/glitchtip under ward ops.
Migrate the guardfile specs + regenerate the forgejo reference doc.
Final residual-prose sweep + drop the ward-kdl alias.

## Context We're collapsing `ward-kdl` into `ward` ("migrating to just ward"). `ward ops` and `ward agents` already subsume most of the old surface. This issue tracks the remaining `ward-kdl` references that are **not** safe to mechanically rename yet, so they don't get lost. Discovered while fixing a live breakage on kai-server: the forgejo git credential helper (`agentic-os-kai/scripts/git-credential-forgejo-ssm.sh`) called `ward-kdl ops aws ssm`, which silently returned no token (`ward-kdl` not installed — the ward formula ships only `ward`+`warded`), blocking every private-forgejo clone. Fixed to `ward ops aws ssm`. ## Already done (safe consumer renames, this pass) `ward-kdl ops {aws,kubectl}` / bare-noun mentions → `ward …` across, leaving commits to Kai: - **agentic-os-kai**: `scripts/git-credential-forgejo-ssm.sh` - **infrastructure**: `AGENTS.md`, ansible roles (`agent-compose`, `fleet-reachability`, `o11y-telegram`), `scripts/{install-fdr-remake,provision-ci-release-token,provision-github-app,provision-tap-bump-token,thermal-heartbeat-install,claude-session-watcher-install-mac}.sh`, several `docs/`+`deploy/`+`terraform/` READMEs, `skills/ops-investigation-k3s-pod-eviction/SKILL.md` - **agentic-os**: `scripts/rotate-{dep-bump,registry}-token.sh` - **deploy**: `services/atlas/scripts/rollout.sh`, `services/fleet-reachability/deploy/README.md`, `services/ser8-observability/docs/ser8-k3s.md` ## Blocked / skipped — needs real migration work ### 1. Verb gap: `ward ops` is missing verbs consumers still call `ward ops` today exposes only `forgejo`, `aws`, `forgejo-key`, `kubectl`. Still under `ward-kdl` only: - `ward-kdl ops tailscale` — `infrastructure/scripts/tailscale-entity-rollup.sh` - `ward-kdl ops signoz` — `deploy/services/ser8-observability/*`, agentic-os `ward-specs/ward-kdl.signoz.guardfile.kdl` - `ward-kdl ops glitchtip` — referenced in `agentic-os-kai/data/ssm-descriptions.yaml` **Mount these under `ward ops` first**, then migrate their callers. Renaming callers now would break them. ### 2. Guardfile specs + generated docs (agentic-os) - `ward-specs/ward-kdl.{forgejo,ollama,signoz}.guardfile.kdl` — `wrap ward-kdl ops …` mount definitions, plus the `ward-kdl.*` **filenames**. - `docs/ward-ops-forgejo-reference.md` — **generated** from the forgejo guardfile by `scripts/gen-ward-ops-reference.sh`; regenerate after the guardfile migrates, don't hand-edit (60+ `ward-kdl ops forgejo` headers). - `ward-specs/signoz.openapi.lock.json` title/description strings. ### 3. ward repo internals + cli-guard ~1426 hits in **ward** itself and ~132 in **cli-guard** — the actual package/binary/build-target rename (`make build-ward-kdl`, `cmd/ward-kdl`, docs). Owned in-repo, not a cross-repo sweep. ### 4. Residual prose Noun-form `ward-kdl` mentions in `agentic-os` (`.forgejo/workflows/issue-corpus.yml`, `docker/dev-base/Dockerfile`, `shell/common.sh`), `deploy/.ward/ward.yaml`, `coilysiren` (5), and scattered comments. Low priority; sweep once the command surface is unified. ## Suggested sequence 1. Land the ward-repo/cli-guard internal rename + keep `ward-kdl` as an alias during transition (so consumers don't hard-break). 2. Mount `tailscale`/`signoz`/`glitchtip` under `ward ops`. 3. Migrate the guardfile specs + regenerate the forgejo reference doc. 4. Final residual-prose sweep + drop the `ward-kdl` alias.

coilysiren referenced this issue from a commit

2026-07-03 02:00:28 +00:00

fix(git-credential): call 'ward ops' not 'ward-kdl ops' for forgejo token

coilysiren referenced this issue from a commit

2026-07-03 02:00:29 +00:00

refactor: rename 'ward-kdl ops aws' -> 'ward ops aws' in rotate scripts

coilysiren referenced this issue from a commit

2026-07-03 02:00:30 +00:00

refactor: rename 'ward-kdl ops aws' -> 'ward ops aws' in service scripts/docs

coilysiren referenced this issue from a commit

2026-07-03 02:04:51 +00:00

refactor: rename 'ward-kdl ops' -> 'ward ops' across roles, scripts, docs

coilysiren referenced this issue

2026-07-03 05:45:17 +00:00

warded director: grant a read-only eco / kai-server observe capability #547

coilyco-ops added the

labels

2026-07-03 17:30:02 +00:00

coilyco-ops referenced this issue

2026-07-07 21:57:36 +00:00

Land the #503 flip residual: wire the release.yml aos-bundle overlay (no-op, tree stays coilyco) #644

coilyco-ops referenced this issue

2026-07-07 22:21:46 +00:00

Land the #503 flip residual: wire the release.yml aos-bundle overlay (no-op, tree stays coilyco) #644

coilyco-ops referenced this issue

2026-07-07 23:40:21 +00:00

[epic] Config-driven ward: one precompiled binary, personal config resolved live from a git ref (supersedes the build-variant matrix) #650

coilyco-ops referenced this issue

2026-07-08 03:33:07 +00:00

Config-driven ward: topology fold (container consts) into the bundle, staged (#650-3) #655

coilyco-ops referenced this issue

2026-07-08 03:33:46 +00:00

[epic] Config-driven ward: one precompiled binary, personal config resolved live from a git ref (supersedes the build-variant matrix) #650

coilyco-ops commented

2026-07-08 03:33:58 +00:00

Owner

Cross-link: the config-driven ward epic (#650) and its topology-fold issue (#655) overlap this migration. aos#332 (landed 2026-07-08) already homed the signoz/ollama/glitchtip guardfiles into aos's .ward/ bundle, moving part of section-2 forward. #655's container-consts fold should be sequenced against this issue's verb-gap work (mount tailscale/signoz/glitchtip under ward ops) so they do not collide. Keeping this open - it is broader than the epic. Filed from the read-only director surface (she/her).

Cross-link: the config-driven ward epic (#650) and its topology-fold issue (**#655**) overlap this migration. aos#332 (landed 2026-07-08) already homed the signoz/ollama/glitchtip guardfiles into aos's `.ward/` bundle, moving part of section-2 forward. #655's container-consts fold should be sequenced against this issue's verb-gap work (mount tailscale/signoz/glitchtip under `ward ops`) so they do not collide. Keeping this open - it is broader than the epic. Filed from the read-only director surface (she/her).

coilyco-ops referenced this issue

2026-07-08 03:40:46 +00:00

ward agent: accept both --harness and --agent for the harness pick (retire --driver to deprecated alias) #660

coilyco-ops referenced this issue

2026-07-10 00:36:27 +00:00

Remove coilyco ward-kdl specs from ward's baked default bundle #893

coilyco-ops added

and removed

labels

2026-07-29 06:27:28 +00:00

coilyco-ops commented

2026-07-31 07:29:50 +00:00

Owner

Closing as superseded by the current Ward boundary and #1622. Ward main no longer carries ward-kdl product-tree references, and remaining AOS or AOSguard coupling is being removed rather than migrated into Ward.

coilyco-ops closed this issue

2026-07-31 07:29:53 +00:00

Rows
Columns

Migrate ward-kdl -> ward: track remaining references (verb gaps, guardfile specs, repo internals) #539

Context

Already done (safe consumer renames, this pass)

Blocked / skipped — needs real migration work

1. Verb gap: ward ops is missing verbs consumers still call

2. Guardfile specs + generated docs (agentic-os)

3. ward repo internals + cli-guard

4. Residual prose

Suggested sequence

1. Verb gap: `ward ops` is missing verbs consumers still call