POODR map T8: Write-guard scopes (test-only / production-only / read-only) + table-driven tests

jared commented

2026-08-21 16:21:42 +00:00

Owner

Map: #458
Blocked by #463
Blocked by #464
Blocked by #465

Extend WriteGuard so test-writer writes tests only, programmer/refactorer roles write production only, judges write nothing. Table-driven role×path allow/deny tests.

Spec: docs/os-sdlc-rebuild/poodr-map-spec.md (ticket 8); blueprint sections cited there are authoritative.

Map: #458 Blocked by #463 Blocked by #464 Blocked by #465 Extend WriteGuard so test-writer writes tests only, programmer/refactorer roles write production only, judges write nothing. Table-driven role×path allow/deny tests. Spec: docs/os-sdlc-rebuild/poodr-map-spec.md (ticket 8); blueprint sections cited there are authoritative.

jared added the

plugin/os-sdlc

label

2026-08-21 16:21:42 +00:00

jared referenced this issue

2026-08-21 16:21:47 +00:00

POODR map T9: supervised end-to-end drive of the POODR map #467

jared added the

wayfinder:task

label

2026-08-21 16:22:31 +00:00

jared commented

2026-08-21 18:11:57 +00:00

Author

Owner

Work started via /loop build session (spec §7 ticket 8). Extending the Write guard to three enforced scopes with table-driven tests.

jared referenced this issue

2026-08-21 18:21:55 +00:00

Align green_assert_failure_sidecar.rb test-path matching to the segment-anchored convention #469

jared commented

2026-08-21 18:22:04 +00:00

Author

Owner

Resolution

Done: Extended lib/os_sdlc/write_guard.rb from the single programmer create-intent rule to three enforced scopes: test-only writes for test-writer, production-only writes for programmer/refactorer (programmer-repair covered automatically — same agent), and deny-all writes for the seven judge roles. Role detection reuses the os-sdlc: prefix-stripping convention; test_path resolves from Project.load, fail-open to inert when unknown (matches the hook's never-crash-a-session contract). Path matching is segment-anchored ((^|/)test_path(/|$)) after include? substring matching false-matched tmpdir prefixes in the red phase. Added table-driven tests/write_guard_scope_test.rb (role × path → allow/deny); existing write_guard_test.rb preserved verbatim.

Evidence: Commit 3f1f61f. Suite: 998 runs, 2547 assertions, 0 failures. Rubocop: 3 files, no offenses. No runner-schema change; no committee escalation needed. Guard diff reviewed by the orchestrator.

Follow-ups: R4 live proof deferred to ticket #467 per spec §5 (not a new capture). Segment-anchored matching for green_assert_failure_sidecar.rb captured as #469 with skeptic verdict CREATE.

## Resolution **Done:** Extended lib/os_sdlc/write_guard.rb from the single programmer create-intent rule to three enforced scopes: test-only writes for test-writer, production-only writes for programmer/refactorer (programmer-repair covered automatically — same agent), and deny-all writes for the seven judge roles. Role detection reuses the os-sdlc: prefix-stripping convention; test_path resolves from Project.load, fail-open to inert when unknown (matches the hook's never-crash-a-session contract). Path matching is segment-anchored ((^|/)test_path(/|$)) after include? substring matching false-matched tmpdir prefixes in the red phase. Added table-driven tests/write_guard_scope_test.rb (role × path → allow/deny); existing write_guard_test.rb preserved verbatim. **Evidence:** Commit 3f1f61f. Suite: 998 runs, 2547 assertions, 0 failures. Rubocop: 3 files, no offenses. No runner-schema change; no committee escalation needed. Guard diff reviewed by the orchestrator. **Follow-ups:** R4 live proof deferred to ticket #467 per spec §5 (not a new capture). Segment-anchored matching for green_assert_failure_sidecar.rb captured as #469 with skeptic verdict CREATE.

jared closed this issue

2026-08-21 18:22:04 +00:00

jared referenced this issue

2026-08-21 19:18:12 +00:00

Prove the map runner live: hook-driven end-to-end drive #454

jared referenced this issue

2026-08-21 19:18:20 +00:00

WriteGuard covers only the Write tool; Edit and Bash bypass the role scopes #474

jared referenced this issue from a commit

2026-08-21 20:00:42 +00:00

feat(os-sdlc): #466 extend WriteGuard to three enforced role scopes (#458)