Config-driven ward: channels become download-and-verify of one prebuilt artifact (#650-5) #657

New issue

Closed

opened 2026-07-08 03:33:07 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-08 03:33:07 +00:00

Member

Breakdown of the config-driven ward epic (#650). Can proceed in parallel with the resolve-path issues - this is release infra, not the resolve path. Cross-repo with homebrew-tap.

Do

Settled decision 1: one precompiled binary per platform, byte-identical across GitHub + Forgejo releases, plus scoop and a single brew formula. No build-from-source at install, no per-variant builds, no matrix. Channels download + verify a prebuilt artifact.

Retire the build-from-source tap overlay (homebrew-tap#3, closed): the brew formula stops overlaying the aos bundle before go build. It becomes download-and-verify of the released binary - the bump-tap-formula plumbing that already rewrites the formula url + sha256 to a released artifact (see AGENTS.md Release) stays, any from-source path goes.
Confirm scoop + the single brew formula both point at the byte-identical prebuilt artifact.
Since the neutral default is baked and config resolves live, there is no coilyco variant to build - the artifact is identical for every consumer, and per-user config is entirely WARD_CONFIG_REF at runtime.

Blocker to flag

Decision 1's "byte-identical across GitHub + Forgejo releases" assumes a live mirror. ward#646 reports the GitHub mirror is frozen at v0.5.8 with no live sync path after mirror-to-github removal. The GitHub half of the byte-identical-channels story cannot be verified until #646's human-credential wall is cleared. Coordinate - do not mark this done claiming both forges are current while #646 is open.

Filed from the read-only director surface (she/her).

Breakdown of the [config-driven ward epic (#650)](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/650). **Can proceed in parallel** with the resolve-path issues - this is release infra, not the resolve path. Cross-repo with homebrew-tap. ## Do Settled decision 1: **one precompiled binary per platform, byte-identical across GitHub + Forgejo releases, plus scoop and a single brew formula.** No build-from-source at install, no per-variant builds, no matrix. Channels download + verify a prebuilt artifact. * Retire the **build-from-source tap overlay** (homebrew-tap#3, closed): the brew formula stops overlaying the aos bundle before `go build`. It becomes download-and-verify of the released binary - the `bump-tap-formula` plumbing that already rewrites the formula `url` + `sha256` to a released artifact (see AGENTS.md Release) stays, any from-source path goes. * Confirm scoop + the single brew formula both point at the byte-identical prebuilt artifact. * Since the neutral default is baked and config resolves live, there is **no coilyco variant to build** - the artifact is identical for every consumer, and per-user config is entirely `WARD_CONFIG_REF` at runtime. ## Blocker to flag Decision 1's "byte-identical **across GitHub + Forgejo** releases" assumes a live mirror. **ward#646** reports the GitHub mirror is frozen at v0.5.8 with no live sync path after `mirror-to-github` removal. The GitHub half of the byte-identical-channels story cannot be verified until #646's human-credential wall is cleared. Coordinate - do not mark this done claiming both forges are current while #646 is open. Filed from the read-only director surface (she/her).

coilyco-ops added the

label

2026-07-08 03:33:07 +00:00

coilyco-ops referenced this issue

2026-07-08 03:33:46 +00:00

[epic] Config-driven ward: one precompiled binary, personal config resolved live from a git ref (supersedes the build-variant matrix) #650

coilyco-ops referenced this issue

2026-07-08 04:49:15 +00:00

[epic] Config-driven ward: one precompiled binary, personal config resolved live from a git ref (supersedes the build-variant matrix) #650

coilyco-ops commented

2026-07-08 09:30:42 +00:00

Author

Member

🔒 Reserved by ward agent --harness codex — container engineer-codex-ward-657 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-08T09:30:40Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#657 · branch issue-657 · harness codex · workflow direct-main
Run: engineer-codex-ward-657 · ward v0.449.0 · dispatched 2026-07-08T09:30:40Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Issue body as seeded:

Breakdown of the [config-driven ward epic (#650)](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/650). **Can proceed in parallel** with the resolve-path issues - this is release infra, not the resolve path. Cross-repo with homebrew-tap.

## Do

Settled decision 1: **one precompiled binary per platform, byte-identical across GitHub + Forgejo releases, plus scoop and a single brew formula.** No build-from-source at install, no per-variant builds, no matrix. Channels download + verify a prebuilt artifact.

* Retire the **build-from-source tap overlay** (homebrew-tap#3, closed): the brew formula stops overlaying the aos bundle before `go build`. It becomes download-and-verify of the released binary - the `bump-tap-formula` plumbing that already rewrites the formula `url` + `sha256` to a released artifact (see AGENTS.md Release) stays, any from-source path goes.
* Confirm scoop + the single brew formula both point at the byte-identical prebuilt artifact.
* Since the neutral default is baked and config resolves live, there is **no coilyco variant to build** - the artifact is identical for every consumer, and per-user config is entirely `WARD_CONFIG_REF` at runtime.

## Blocker to flag

Decision 1's "byte-identical **across GitHub + Forgejo** releases" assumes a live mirror. **ward#646** reports the GitHub mirror is frozen at v0.5.8 with no live sync path after `mirror-to-github` removal. The GitHub half of the byte-identical-channels story cannot be verified until #646's human-credential wall is cleared. Coordinate - do not mark this done claiming both forges are current while #646 is open.

Filed from the read-only director surface (she/her).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.449.0).

— Codex, via ward agent

🔒 Reserved by `ward agent --harness codex` — container `engineer-codex-ward-657` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-08T09:30:40Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#657` · branch `issue-657` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-ward-657` · ward `v0.449.0` · dispatched `2026-07-08T09:30:40Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). **Issue body as seeded:** ``` Breakdown of the [config-driven ward epic (#650)](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/650). **Can proceed in parallel** with the resolve-path issues - this is release infra, not the resolve path. Cross-repo with homebrew-tap. ## Do Settled decision 1: **one precompiled binary per platform, byte-identical across GitHub + Forgejo releases, plus scoop and a single brew formula.** No build-from-source at install, no per-variant builds, no matrix. Channels download + verify a prebuilt artifact. * Retire the **build-from-source tap overlay** (homebrew-tap#3, closed): the brew formula stops overlaying the aos bundle before `go build`. It becomes download-and-verify of the released binary - the `bump-tap-formula` plumbing that already rewrites the formula `url` + `sha256` to a released artifact (see AGENTS.md Release) stays, any from-source path goes. * Confirm scoop + the single brew formula both point at the byte-identical prebuilt artifact. * Since the neutral default is baked and config resolves live, there is **no coilyco variant to build** - the artifact is identical for every consumer, and per-user config is entirely `WARD_CONFIG_REF` at runtime. ## Blocker to flag Decision 1's "byte-identical **across GitHub + Forgejo** releases" assumes a live mirror. **ward#646** reports the GitHub mirror is frozen at v0.5.8 with no live sync path after `mirror-to-github` removal. The GitHub half of the byte-identical-channels story cannot be verified until #646's human-credential wall is cleared. Coordinate - do not mark this done claiming both forges are current while #646 is open. Filed from the read-only director surface (she/her). ``` Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.449.0). </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a commit

2026-07-08 09:48:21 +00:00

feat(release): switch ward channels to release binaries

coilyco-ops closed this issue

2026-07-08 09:48:21 +00:00

coilyco-ops commented

2026-07-08 09:48:58 +00:00

Author

Member

WARD-OUTCOME: done - ward now downloads verified release binaries from the tap, and the release workflow rewrites the tap pins directly.
The agent had to absorb a moving origin/main in both repos while the change was in flight, which was the main friction. The tap conversion was otherwise straightforward once the source-build assumptions were removed. Confidence is high on the Forgejo path; #646 still blocks any honest GitHub-mirror parity claim.

WARD-OUTCOME: done - ward now downloads verified release binaries from the tap, and the release workflow rewrites the tap pins directly. The agent had to absorb a moving origin/main in both repos while the change was in flight, which was the main friction. The tap conversion was otherwise straightforward once the source-build assumptions were removed. Confidence is high on the Forgejo path; #646 still blocks any honest GitHub-mirror parity claim.

coilyco-ops referenced this issue

2026-07-08 09:51:57 +00:00

[epic] Config-driven ward: one precompiled binary, personal config resolved live from a git ref (supersedes the build-variant matrix) #650