coilyco-flight-deck/ward

Fork 0

Adopt execverb: admin/doctor remote-exec + git slice as exec-dialect guardfiles #81

New issue

Closed

opened 2026-06-10 18:22:15 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-10 18:22:15 +00:00

Owner

What

Adopt cli-guard v0.11.0's execverb (the KDL exec dialect, coilyco-flight-deck/cli-guard#130) in ward:

forgejo admin/doctor - replace the 4 kubectl-exec leaves (admin user list/create, admin auth list, doctor check) with an exec-dialect guardfile pinning exec ssh { argv-prefix "kai@kai-server" "k3s" "kubectl" "-n" "forgejo" "exec" "deploy/forgejo" "--" "forgejo" }. This completes the last non-HTTP slice of the 40-leaf surface (#75).
git slice - express ward's audited git verbs as wrap ward git { exec git ... } grants with deny-flag "--no-verify", proving the dialect on the highest-traffic surface.

Open questions

Mounting: ward proper links cli-guard as a library, so execverb.Mount slots beside the existing tree; the no-code driver path (specverb-gen learning the exec transport) is the follow-up that would let ward-kdl carry these too.
The concurrency-safe commit (private GIT_INDEX_FILE) stays a ward-Go special until the env-policy M1 lands.

Part of the coily->ward merge; ward is the surviving operator binary.

## What Adopt cli-guard v0.11.0's execverb (the KDL exec dialect, https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/issues/130) in ward: 1. **forgejo admin/doctor** - replace the 4 kubectl-exec leaves (admin user list/create, admin auth list, doctor check) with an exec-dialect guardfile pinning `exec ssh { argv-prefix "kai@kai-server" "k3s" "kubectl" "-n" "forgejo" "exec" "deploy/forgejo" "--" "forgejo" }`. This completes the last non-HTTP slice of the 40-leaf surface (https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/75). 2. **git slice** - express ward's audited git verbs as `wrap ward git { exec git ... }` grants with deny-flag "--no-verify", proving the dialect on the highest-traffic surface. ## Open questions * Mounting: ward proper links cli-guard as a library, so `execverb.Mount` slots beside the existing tree; the no-code driver path (specverb-gen learning the exec transport) is the follow-up that would let ward-kdl carry these too. * The concurrency-safe commit (private GIT_INDEX_FILE) stays a ward-Go special until the env-policy M1 lands. Part of the coily->ward merge; ward is the surviving operator binary.

coilysiren referenced this issue from coilyco-flight-deck/cli-guard

2026-06-10 18:22:16 +00:00

specverb-gen: dispatch on transport, generate exec-dialect consumers #131

coilysiren referenced this issue from coilyco-flight-deck/cli-guard

2026-06-10 18:48:42 +00:00

execverb: wildcard passthrough grant + aws-read gate (the aws CLI in KDL) #132

coilysiren referenced this issue

2026-06-10 18:53:40 +00:00

ward-aws: author the aws CLI surface as an exec-dialect guardfile (open passthrough + aws-read gate) #82

coilysiren referenced this issue

2026-06-15 15:22:05 +00:00

Epic: coily -> ward -> ward-kdl consolidation (umbrella) #91

coilysiren referenced this issue

2026-06-15 15:22:39 +00:00

Migrate the forgejo verb surface (40 leaves) into ward-kdl (supersedes coily#186) #75

coilysiren added this to the coily to ward to ward-kdl consolidation milestone

2026-06-15 15:31:11 +00:00

coilysiren added the

label

2026-06-17 07:05:37 +00:00

coilysiren added

and removed

labels

2026-06-17 08:39:36 +00:00

coilysiren added the

consult

label

2026-06-18 06:22:35 +00:00

coilyco-ops added

headless

and removed

consult

labels

2026-06-24 04:11:46 +00:00

coilyco-ops commented

2026-06-24 04:36:13 +00:00

Member

🔒 Reserved by ward agent claude — container ward-ward-issue-81-claude-78062749 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-06-24T04:36:12Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent claude` — container `ward-ward-issue-81-claude-78062749` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-06-24T04:36:12Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-06-24 04:54:43 +00:00

feat(ops-forgejo): adopt execverb for the admin/doctor remote-exec slice (ward#81)

coilysiren closed this issue

2026-06-24 04:54:43 +00:00