#1 wired swedsl's cmd/vargo-gate into cad-atlas CI — verified end-to-end with a real PR (#7,
closed). It runs on every PR and posts a standalone var-go/oath commit status, but always fails
closed: the candidate it gates against is swedsl's own hardcoded toy fixture
("I add {int} and {int}" / "the total is {int}"), unrelated to any real oath text.
Correction (2026-07-20) — original framing of this issue was wrong
I originally filed this as "blocked on swedsl shipping a real-diff Executor (swedsl#27)." swedsl#27 closed 2026-07-18 and explicitly killed that path — ADR-0002
(mathias/swedsldocs/adr/0002-vargo-strategic-fit.md): "Executor deployment shape — deferred;
var-go stays gate-only... Reviewer — kill the seam." There is no forthcoming Executor to wait for.
What var-go actually is, per that ADR: a general PR-gate primitive — the oath lives in the
Gitea issue, and each consuming repo supplies its own candidate (a Registry[S] of step
implementations for its own oath vocabulary). swedsl's #32 generalized State → Registry[S]
specifically so callers aren't stuck with swedsl's own toy domain.
Unblocked (2026-07-20)
swedsl#35 shipped: module renamed to git.d-ma.be/mathias/swedsl/oath, importable via go get ...@oath/vX.Y.Z. swedsl#38 (Sprint 3 capstone, shipped same day) went further than
expected: cmd/vargo-gate now gates the PR's real candidate module via a sandboxed subprocess
(SubprocessGate, ADR-0003) instead of a hardcoded stub, and resolves the linked oath issue from
a Closes #NN reference in the PR body.
What shipped here
oathcandidate/ — a separate Go module (mirrors swedsl's own oath/testdata/selfcandidate
pattern, so var-go's transitive deps never link into the deployed atlas binary) whose Build()
supplies real steps: parse the committed .gitea/workflows/cd.yml, check it defines a job named oath, check that job's run script invokes cmd/vargo-gate. TDD: oathcandidate/build_test.go
gates the REAL committed workflow file (must pass) and a fixture workflow missing the job (must
fail closed) — both green.
Format footgun discovered writing this (worth flagging broadly, not just here): var-go's
parser requires oath sentences on a single-line paragraph, split by . — not one sentence per
newline — and does not strip Given/When/Then/And keywords before matching. This repo's
older oaths (e.g. #1, and the template below before this edit) use a multi-line, keyword-prefixed
style that was never actually exercised against the real parser (every prior gate run errored
before reaching sentence matching). The oath below uses the format that's actually proven to work.
cmd/vargo-gate's toy invocation was swapped for the real-candidate invocation in the oath job
and confirmed green on a real PR: var-go/oath posted "var-go: oath held" against the genuine oathcandidate/ candidate, real committed CI config, real PR — first time this mechanism has
actually held anywhere.
Closing evidence (2026-07-20)
Branch protection now live on main: var-go/oath is a required status check
(enable_status_check: true, status_check_contexts: ["var-go/oath"]), with direct pushes
allowlisted for mathias (enable_push_whitelist: true, push_whitelist_usernames: ["mathias"])
so the TBD workflow keeps working. Set via Gitea REST API (no MCP write tool for branch
protection existed) — created 201, verified via branch_protection_get (protected: true, push_whitelist: ["mathias"]). Confirmed end-to-end: this issue's own doc update
(docs/INCEPTION-OATH.md, 2f5fca8) pushed directly to the now-protected main and succeeded.
docs/INCEPTION-OATH.md S3 updated to ✅.
Scope
swedsl/oath importable via a real module path (swedsl#35).
cad-atlas writes its own Registry[S] candidate matching its real oath vocabulary
(oathcandidate/, tests green).
Swap cmd/vargo-gate's toy invocation for the real-candidate invocation in the oath job.
Add branch protection requiring var-go/oath once verified green on a real PR.
Update docs/INCEPTION-OATH.md S3 to ✅.
Oath
the CI workflow file ".gitea/workflows/cd.yml" is parsed. it defines a job named "oath". the job named "oath" invokes "cmd/vargo-gate".
## Context
#1 wired swedsl's `cmd/vargo-gate` into cad-atlas CI — verified end-to-end with a real PR (#7,
closed). It runs on every PR and posts a standalone `var-go/oath` commit status, but always fails
closed: the candidate it gates against is swedsl's own hardcoded toy fixture
("I add {int} and {int}" / "the total is {int}"), unrelated to any real oath text.
## Correction (2026-07-20) — original framing of this issue was wrong
I originally filed this as "blocked on swedsl shipping a real-diff Executor (swedsl#27)."
**swedsl#27 closed 2026-07-18 and explicitly killed that path** — ADR-0002
(`mathias/swedsl` `docs/adr/0002-vargo-strategic-fit.md`): "Executor deployment shape — deferred;
var-go stays gate-only... Reviewer — kill the seam." There is no forthcoming Executor to wait for.
What var-go actually is, per that ADR: a **general PR-gate primitive** — the oath lives in the
Gitea issue, and each consuming repo supplies its **own candidate** (a `Registry[S]` of step
implementations for its own oath vocabulary). swedsl's `#32` generalized `State` → `Registry[S]`
specifically so callers aren't stuck with swedsl's own toy domain.
## Unblocked (2026-07-20)
`swedsl#35` shipped: module renamed to `git.d-ma.be/mathias/swedsl/oath`, importable via
`go get ...@oath/vX.Y.Z`. `swedsl#38` (Sprint 3 capstone, shipped same day) went further than
expected: `cmd/vargo-gate` now gates the PR's **real candidate module** via a sandboxed subprocess
(`SubprocessGate`, ADR-0003) instead of a hardcoded stub, and resolves the linked oath issue from
a `Closes #NN` reference in the PR body.
## What shipped here
`oathcandidate/` — a separate Go module (mirrors swedsl's own `oath/testdata/selfcandidate`
pattern, so var-go's transitive deps never link into the deployed atlas binary) whose `Build()`
supplies real steps: parse the committed `.gitea/workflows/cd.yml`, check it defines a job named
`oath`, check that job's run script invokes `cmd/vargo-gate`. TDD: `oathcandidate/build_test.go`
gates the REAL committed workflow file (must pass) and a fixture workflow missing the job (must
fail closed) — both green.
**Format footgun discovered writing this** (worth flagging broadly, not just here): var-go's
parser requires oath sentences on a **single-line paragraph**, split by `.` — not one sentence per
newline — and does **not** strip `Given`/`When`/`Then`/`And` keywords before matching. This repo's
older oaths (e.g. #1, and the template below before this edit) use a multi-line, keyword-prefixed
style that was **never actually exercised** against the real parser (every prior gate run errored
before reaching sentence matching). The oath below uses the format that's actually proven to work.
`cmd/vargo-gate`'s toy invocation was swapped for the real-candidate invocation in the `oath` job
and confirmed green on a real PR: `var-go/oath` posted "var-go: oath held" against the genuine
`oathcandidate/` candidate, real committed CI config, real PR — first time this mechanism has
actually held anywhere.
## Closing evidence (2026-07-20)
Branch protection now live on `main`: `var-go/oath` is a required status check
(`enable_status_check: true`, `status_check_contexts: ["var-go/oath"]`), with direct pushes
allowlisted for `mathias` (`enable_push_whitelist: true`, `push_whitelist_usernames: ["mathias"]`)
so the TBD workflow keeps working. Set via Gitea REST API (no MCP write tool for branch
protection existed) — created 201, verified via `branch_protection_get` (`protected: true`,
`push_whitelist: ["mathias"]`). Confirmed end-to-end: this issue's own doc update
(`docs/INCEPTION-OATH.md`, 2f5fca8) pushed directly to the now-protected `main` and succeeded.
`docs/INCEPTION-OATH.md` S3 updated to ✅.
## Scope
- [x] swedsl/oath importable via a real module path (swedsl#35).
- [x] cad-atlas writes its own `Registry[S]` candidate matching its real oath vocabulary
(`oathcandidate/`, tests green).
- [x] Swap `cmd/vargo-gate`'s toy invocation for the real-candidate invocation in the `oath` job.
- [x] Add branch protection requiring `var-go/oath` once verified green on a real PR.
- [x] Update `docs/INCEPTION-OATH.md` S3 to ✅.
## Oath
```var
the CI workflow file ".gitea/workflows/cd.yml" is parsed. it defines a job named "oath". the job named "oath" invokes "cmd/vargo-gate".
```
mathias
changed title from Require var-go/oath in branch protection once swedsl ships a real-diff Executor to Write cad-atlas's own vargo-gate candidate, once swedsl/oath is importable2026-07-20 10:15:26 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Context
#1 wired swedsl's
cmd/vargo-gateinto cad-atlas CI — verified end-to-end with a real PR (#7,closed). It runs on every PR and posts a standalone
var-go/oathcommit status, but always failsclosed: the candidate it gates against is swedsl's own hardcoded toy fixture
("I add {int} and {int}" / "the total is {int}"), unrelated to any real oath text.
Correction (2026-07-20) — original framing of this issue was wrong
I originally filed this as "blocked on swedsl shipping a real-diff Executor (swedsl#27)."
swedsl#27 closed 2026-07-18 and explicitly killed that path — ADR-0002
(
mathias/swedsldocs/adr/0002-vargo-strategic-fit.md): "Executor deployment shape — deferred;var-go stays gate-only... Reviewer — kill the seam." There is no forthcoming Executor to wait for.
What var-go actually is, per that ADR: a general PR-gate primitive — the oath lives in the
Gitea issue, and each consuming repo supplies its own candidate (a
Registry[S]of stepimplementations for its own oath vocabulary). swedsl's
#32generalizedState→Registry[S]specifically so callers aren't stuck with swedsl's own toy domain.
Unblocked (2026-07-20)
swedsl#35shipped: module renamed togit.d-ma.be/mathias/swedsl/oath, importable viago get ...@oath/vX.Y.Z.swedsl#38(Sprint 3 capstone, shipped same day) went further thanexpected:
cmd/vargo-gatenow gates the PR's real candidate module via a sandboxed subprocess(
SubprocessGate, ADR-0003) instead of a hardcoded stub, and resolves the linked oath issue froma
Closes #NNreference in the PR body.What shipped here
oathcandidate/— a separate Go module (mirrors swedsl's ownoath/testdata/selfcandidatepattern, so var-go's transitive deps never link into the deployed atlas binary) whose
Build()supplies real steps: parse the committed
.gitea/workflows/cd.yml, check it defines a job namedoath, check that job's run script invokescmd/vargo-gate. TDD:oathcandidate/build_test.gogates the REAL committed workflow file (must pass) and a fixture workflow missing the job (must
fail closed) — both green.
Format footgun discovered writing this (worth flagging broadly, not just here): var-go's
parser requires oath sentences on a single-line paragraph, split by
.— not one sentence pernewline — and does not strip
Given/When/Then/Andkeywords before matching. This repo'solder oaths (e.g. #1, and the template below before this edit) use a multi-line, keyword-prefixed
style that was never actually exercised against the real parser (every prior gate run errored
before reaching sentence matching). The oath below uses the format that's actually proven to work.
cmd/vargo-gate's toy invocation was swapped for the real-candidate invocation in theoathjoband confirmed green on a real PR:
var-go/oathposted "var-go: oath held" against the genuineoathcandidate/candidate, real committed CI config, real PR — first time this mechanism hasactually held anywhere.
Closing evidence (2026-07-20)
Branch protection now live on
main:var-go/oathis a required status check(
enable_status_check: true,status_check_contexts: ["var-go/oath"]), with direct pushesallowlisted for
mathias(enable_push_whitelist: true,push_whitelist_usernames: ["mathias"])so the TBD workflow keeps working. Set via Gitea REST API (no MCP write tool for branch
protection existed) — created 201, verified via
branch_protection_get(protected: true,push_whitelist: ["mathias"]). Confirmed end-to-end: this issue's own doc update(
docs/INCEPTION-OATH.md,2f5fca8) pushed directly to the now-protectedmainand succeeded.docs/INCEPTION-OATH.mdS3 updated to ✅.Scope
Registry[S]candidate matching its real oath vocabulary(
oathcandidate/, tests green).cmd/vargo-gate's toy invocation for the real-candidate invocation in theoathjob.var-go/oathonce verified green on a real PR.docs/INCEPTION-OATH.mdS3 to ✅.Oath
Require var-go/oath in branch protection once swedsl ships a real-diff Executorto Write cad-atlas's own vargo-gate candidate, once swedsl/oath is importable