build: ship the access check, which merged without its build line #646

Merged

coilyco-ops merged 1 commit from build/ship-the-access-check-claude into main

2026-08-13 17:50:11 +00:00

coilyco-ops commented

2026-08-13 17:48:59 +00:00

Member

closes #644

cmd/sirens-echo-access-check is on main. The Dockerfile does not build it:

$ grep -c access-check Dockerfile
0

The binary exists in source, has tests, and cannot be invoked by the only caller it was written for. Deploy's CI runs against the released image, which is the entire reason #628 asked for it.

What happened

I checked reachability before opening #628's pull request, found the binary was not built, and fixed it in a second commit on the same branch. The pull request merged at the first commit. The command landed and the build line did not.

Same shape as #563 and #609 — a merge capturing a branch state that has moved — and the same mechanism as #568.

Why I filed an issue rather than pushing quietly

This is the defect the tool was written to prevent, in the tool itself. #628 exists because a bad access policy is only caught after it goes live; its fix shipped in a state where it cannot run.

It is also the fourth instance today of the class in #618, and the only one I introduced after writing #592, which names it. I checked the property once and did not check that the check survived.

Checking a property once is not the same as the property holding.

Two lines: built beside the other commands, copied into the runtime image rather than only the build stage.

ward exec gate green.

closes #644 `cmd/sirens-echo-access-check` is on `main`. The `Dockerfile` does not build it: ``` $ grep -c access-check Dockerfile 0 ``` The binary exists in source, has tests, and **cannot be invoked by the only caller it was written for.** Deploy's CI runs against the released image, which is the entire reason #628 asked for it. ## What happened I checked reachability before opening #628's pull request, found the binary was not built, and fixed it in a second commit on the same branch. **The pull request merged at the first commit.** The command landed and the build line did not. Same shape as #563 and #609 — a merge capturing a branch state that has moved — and the same mechanism as #568. ## Why I filed an issue rather than pushing quietly This is the defect the tool was written to prevent, **in the tool itself**. #628 exists because a bad access policy is only caught after it goes live; its fix shipped in a state where it cannot run. It is also the fourth instance today of the class in #618, and the only one I introduced *after* writing #592, which names it. I checked the property once and did not check that the check survived. **Checking a property once is not the same as the property holding.** Two lines: built beside the other commands, copied into the runtime image rather than only the build stage. `ward exec gate` green.

coilyco-ops added 1 commit

2026-08-13 17:48:59 +00:00

build: ship the access check, which merged without its build line

ci / image-build (pull_request) Successful in 23s

Details

ci / test (pull_request) Successful in 40s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

ci / publish-observed (pull_request) Has been skipped

Details

25fdcb1dfe

cmd/sirens-echo-access-check is on main and the Dockerfile does not build it,
so the binary exists in source, has tests, and cannot be invoked by the only
caller it was written for. Deploy's CI runs against the released image.

I caught this before opening the pull request and fixed it in a second commit
on the same branch. The pull request merged at the first commit.

That makes it the fourth instance today of a capability built, tested, and
unreachable, and the only one introduced after I wrote the document naming the
class. Checking a property once is not the same as the property holding.

Two lines. Built beside the other commands, copied into the runtime image
rather than only the build stage.

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-13 17:48:59 +00:00

coilyco-ops merged commit f94e5ae294 into main

2026-08-13 17:50:11 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-13 17:50:12 +00:00

Merge pull request 'build: ship the access check, which merged without its build line' (#646) from build/ship-the-access-check-claude into main

coilyco-ops referenced this pull request

2026-08-18 20:39:11 +00:00

Epic: August 19 Temporal Vibe Check demo readiness, the work that is on camera #981