oathcandidate/ is a separate Go module (mirrors swedsl's own
oath/testdata/selfcandidate pattern, keeping var-go's transitive deps
out of the deployed atlas binary) whose Build() parses the committed
.gitea/workflows/cd.yml and checks the "oath" job exists and invokes
cmd/vargo-gate. TDD: passes against the real file, fails closed on a
fixture missing the job.
Rewires the oath CI job to go-run vargo-gate from its real module path
(git.d-ma.be/mathias/swedsl/oath/cmd/vargo-gate@oath/v0.28.0, unblocked
by swedsl#35/#38) against VARGO_CANDIDATE_DIR=oathcandidate, instead of
checking out swedsl and gating its hardcoded toy fixture. Private-module
auth via a short-lived GIT_ASKPASS script (token never in argv, never
written to git config, matches act_runner's env:-block-with-secrets
gotcha).
Discovered along the way: var-go's parser needs single-line,
period-separated oath sentences with no Given/When/Then/And keyword
stripping — this repo's older oaths (incl. #1) used an unverified
multi-line keyword-prefixed style. #8's oath uses the proven format.
Still not required by branch protection pending a real-PR confirmation.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
swedsl#27 (var-go strategic-fit ADR) closed 2026-07-18 and killed the
Executor/Reviewer path entirely — var-go is gate-only by design, each
consuming repo supplies its own candidate. The real blocker for
enforcement here is swedsl/oath's non-importable module path
(swedsl#35), not a nonexistent Executor. Corrects PROJECT.md,
INCEPTION-OATH.md, and the cd.yml comment to match.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds an oath job to cd.yml: on pull_request, checks out swedsl (the
vargo-gate source — its oath submodule isn't go-installable, module
path isn't a real import path) and runs cmd/vargo-gate against this
repo's linked issue, posting a var-go/oath commit status.
Deliberately NOT required by branch protection: vargo-gate's candidate
is still a hardcoded toy self-test registry (swedsl's own #9 fixture),
not a real PR-diff checker, so it fails closed against any real oath
until swedsl ships an Executor (swedsl#27). Requiring it now would
permanently block every cad-atlas PR. Disclosed in the CI config
comment, PROJECT.md, and docs/INCEPTION-OATH.md (honest-stub
discipline).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Add docs/INCEPTION-OATH.md — the sprint's acceptance contract (general +
cad-atlas-specific clauses, tagging as the closing act). S3 (var-go/oath
enforcing cad-atlas PRs) is descoped to a tracked fast-follow (#1): var-go v1's
candidate is a hardcoded self-test and its module is not cross-repo consumable,
so a green status would prove wiring, not verification. Honesty rule: a clause
blocked by an external dependency is descoped and tracked, never claimed.
Methodology persisted: brain wiki/homelab/decisions/inception-sprint-and-oath.md
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Wire the reel-style CAD workflow atlas (signal→pod) as the served page via
go:embed. Fill PROJECT.md/README with the 9-stage workflow, three governance
gates (Ed25519 admission / dispatch-allow / var-go Oath), phase map A→C,
dogfooding model, brain deep-links and external references.
Fixes two template-go-web latent bugs surfaced by dogfooding:
- templ version skew: go.mod pinned v0.2.778 vs templ@latest generator
- .gitignore pattern *.templ.go did not match generated *_templ.go
Verified: go build · vet · golangci-lint (0 issues) · go test green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mathias
mathiasandClaude Sonnet 5