coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(install): refresh Warden source when reinstalling the CLI
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 16:58:22 +02:00
parent 31d9b6671c
commit 19bb75c614
2 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Makefile
View file

@ -24,12 +24,12 @@ sync:
uv sync
install-warden:
uv tool install . --force
uv tool install . --force --reinstall-package ops-warden
install-memory:
@test -d "$(PHASE_MEMORY_REPO)" || (echo "ERROR: phase-memory not found at $(PHASE_MEMORY_REPO). Clone it or set PHASE_MEMORY_REPO."; exit 1)
@test -f "$(PHASE_MEMORY_REPO)/pyproject.toml" || (echo "ERROR: $(PHASE_MEMORY_REPO) is not a phase-memory checkout."; exit 1)
uv tool install . --with-editable "$(PHASE_MEMORY_REPO)" --force
uv tool install . --with-editable "$(PHASE_MEMORY_REPO)" --force --reinstall-package ops-warden
install: install-warden
@ -46,4 +46,4 @@ test:
PYTHONPATH=src:$(PHASE_MEMORY_REPO)/src uv run pytest
lint:
uv run ruff check .
uv run ruff check .

5
workplans/WARDEN-WP-0039-explicit-policy-refusal.md
View file

@ -45,6 +45,11 @@ Run the policy and proxy suites, retain a value-free live refusal receipt,
publish the reviewed source, and verify the installed CLI refuses before any
credential transport. A refusal is not a successful credential-read admission.
The owner installer initially reused a cached wheel despite `--force`, leaving
the pre-fix policy code installed. Both Makefile installation targets now use
`--reinstall-package ops-warden` to refresh this package from the reviewed source.
Verify the installed module as well as the checkout before the live refusal test.
## Resolve the credential proxy's admitted policy binding
```task