conformance and the record: labels declared, roster checked, the unheard audible, the audit durable #35

Merged

larandar merged 1 commit from agent.teyla/Jostoph:tango/28-steward-conformance into main

2026-08-11 20:26:42 +00:00

agent.teyla commented

2026-08-11 16:52:13 +00:00

Contributor

In scope — the four steward-scope conformance tickets, one theme: the steward can now notice what the forge is missing, and remember what it decided.

#28 — nix/forgejo.nix declares the label vocabulary the law reads (curated, law 13's states in-progress/in-review/conflicted, overlays blocked/needs-decision) as org labels, in Forgejo's own CreateLabelOption shape inside the desired-state document the provider already reconciles. nix/policy.nix now refuses at eval time to read a label the estate does not declare. README's silent-squash warning updated: declared, reconcile pending.
#29 — jostoph roster: repo collaborators + org members vs the policy's memberships, both directions of drift, read-only, exit 1 when a person is needed. Module gains an optional oneshot-on-a-timer (services.jostoph.conformance) holding the read-only token the answering service never sees.
#30 — jostoph kinds: every kind the audit record has heard vs Policy::kinds_read() (kept beside the rules so a new rule cannot silently be missed). An empty record — a webhook that never fired — is the loudest finding; the first real approval delivery identifies the surviving approval_kinds spelling.
#31 — FileSink: append-only JSON lines, newest-first read-back, torn final lines skipped without poisoning the record before them. serve --audit-log tees it behind the ring so /v1/audit answers across a restart; StateDirectory=jostoph is the one write the hardened unit gains. This is the record the executor (#26) starts from.

Out of scope — performing anything (still answers-only), the executor (#26), law-13 label transitions (#25), rotation/retention beyond append-only.

Boundary — the answering service still holds no token; the roster's token lives in its own oneshot unit. One new crate (ureq, rustls) for the one-shot read.

Acceptance, as it ran — cargo test 40 passed (9 new); clippy -D warnings and fmt clean; nix flake check all green (policy-drift and module-eval included). Live: jostoph roster against jo.et0.pw named agent.teyla active-but-undeclared — the exact drift #29 was filed about; jostoph kinds over a one-push record reported push: 1 seen and both approval spellings never heard, exit 1.

Closes #28
Closes #29
Closes #30
Closes #31

**In scope** — the four steward-scope conformance tickets, one theme: the steward can now notice what the forge is missing, and remember what it decided. - **#28** — `nix/forgejo.nix` declares the label vocabulary the law reads (`curated`, law 13's states `in-progress`/`in-review`/`conflicted`, overlays `blocked`/`needs-decision`) as org labels, in Forgejo's own `CreateLabelOption` shape inside the desired-state document the provider already reconciles. `nix/policy.nix` now refuses at eval time to read a label the estate does not declare. README's silent-squash warning updated: declared, reconcile pending. - **#29** — `jostoph roster`: repo collaborators + org members vs the policy's `memberships`, both directions of drift, read-only, exit 1 when a person is needed. Module gains an optional oneshot-on-a-timer (`services.jostoph.conformance`) holding the read-only token the answering service never sees. - **#30** — `jostoph kinds`: every kind the audit record has heard vs `Policy::kinds_read()` (kept beside the rules so a new rule cannot silently be missed). An empty record — a webhook that never fired — is the loudest finding; the first real approval delivery identifies the surviving `approval_kinds` spelling. - **#31** — `FileSink`: append-only JSON lines, newest-first read-back, torn final lines skipped without poisoning the record before them. `serve --audit-log` tees it behind the ring so `/v1/audit` answers across a restart; `StateDirectory=jostoph` is the one write the hardened unit gains. This is the record the executor (#26) starts from. **Out of scope** — performing anything (still answers-only), the executor (#26), law-13 label *transitions* (#25), rotation/retention beyond append-only. **Boundary** — the answering service still holds no token; the roster's token lives in its own oneshot unit. One new crate (`ureq`, rustls) for the one-shot read. **Acceptance, as it ran** — `cargo test` 40 passed (9 new); clippy `-D warnings` and fmt clean; `nix flake check` all green (policy-drift and module-eval included). Live: `jostoph roster` against jo.et0.pw named `agent.teyla` active-but-undeclared — the exact drift #29 was filed about; `jostoph kinds` over a one-push record reported `push: 1` seen and both approval spellings never heard, exit 1. Closes #28 Closes #29 Closes #30 Closes #31

larandar force-pushed tango/28-steward-conformance from 28c51ab5b0 to a9a4627f2b

2026-08-11 20:23:48 +00:00

Compare