From 19bb75c614d01ca42aa8b6f2bcec38fea1dd65cf Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 8 Sep 2026 16:58:22 +0200 Subject: [PATCH] fix(install): refresh Warden source when reinstalling the CLI Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- Makefile | 6 +++--- workplans/WARDEN-WP-0039-explicit-policy-refusal.md | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 0a71247..4f9b5f9 100644 --- a/Makefile +++ b/Makefile @@ -24,12 +24,12 @@ sync: uv sync install-warden: - uv tool install . --force + uv tool install . --force --reinstall-package ops-warden install-memory: @test -d "$(PHASE_MEMORY_REPO)" || (echo "ERROR: phase-memory not found at $(PHASE_MEMORY_REPO). Clone it or set PHASE_MEMORY_REPO."; exit 1) @test -f "$(PHASE_MEMORY_REPO)/pyproject.toml" || (echo "ERROR: $(PHASE_MEMORY_REPO) is not a phase-memory checkout."; exit 1) - uv tool install . --with-editable "$(PHASE_MEMORY_REPO)" --force + uv tool install . --with-editable "$(PHASE_MEMORY_REPO)" --force --reinstall-package ops-warden install: install-warden @@ -46,4 +46,4 @@ test: PYTHONPATH=src:$(PHASE_MEMORY_REPO)/src uv run pytest lint: - uv run ruff check . \ No newline at end of file + uv run ruff check . diff --git a/workplans/WARDEN-WP-0039-explicit-policy-refusal.md b/workplans/WARDEN-WP-0039-explicit-policy-refusal.md index 05920ae..fbedd69 100644 --- a/workplans/WARDEN-WP-0039-explicit-policy-refusal.md +++ b/workplans/WARDEN-WP-0039-explicit-policy-refusal.md @@ -45,6 +45,11 @@ Run the policy and proxy suites, retain a value-free live refusal receipt, publish the reviewed source, and verify the installed CLI refuses before any credential transport. A refusal is not a successful credential-read admission. +The owner installer initially reused a cached wheel despite `--force`, leaving +the pre-fix policy code installed. Both Makefile installation targets now use +`--reinstall-package ops-warden` to refresh this package from the reviewed source. +Verify the installed module as well as the checkout before the live refusal test. + ## Resolve the credential proxy's admitted policy binding ```task