mathiasandClaude Sonnet 5
62955c998d
Build & Import (run #68) failed: mathias/cad is PRIVATE (unlike mcp-chassis, the only other internal module a cad-* Dockerfile has fetched so far, which is public) — 'go mod download' inside the Docker build had no credential and died on 'terminal prompts disabled'. Fix mirrors this repo's own existing GIT_ASKPASS pattern (cd.yml's oathcandidate step, for the private swedsl dependency): a BuildKit secret mount feeds a GIT_ASKPASS helper for the one RUN that needs it. The token is never written to a persisted layer — the askpass script and its reference to /run/secrets/gitea_token are created and removed within the same RUN instruction. cd.yml writes the token to a file only for build-image.sh's subprocess and passes it via BUILD_SECRETS (the script's existing mechanism — 'the caller writes the secret to PATH itself'). Verified by running build-image.sh's actual buildctl invocation locally against the real koala buildkitd (same daemon CI uses) with a real token — 'go mod download' completes in 1.9s, full build succeeds. Reproduced the CI failure log before writing this fix, per house discipline. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
cad-atlas
A visual atlas of the Continuous Agentic Development (CAD) workflow — from a captured signal to a deployed k3s pod.
One screen, reel-style: Signals → TELOS → Strategic session → Spec/Oath → Human gate → agentsquad → CI → CD → pod, looping back to TELOS. It renders the CAD audit chain, which doubles as the regulated-industry audit artifact.
The CAD audit chain is the visualization data. Phase C renders it once and serves two masters: observability + compliance.
Phases
- A — static hero viz (current): self-contained
internal/web/static/cad-atlas.html, served at/. SVG spine, animated pulse, dashed feedback bus, replay/slow-mo. - B — generated-from-source: render from brain docs + workflows + infra manifests (no drift).
- C — live trace viewer: hydrate from the
assessor-loopledger +session_log+ Gitea run API + Flux events.
Quickstart
task check # lint + vet + test (CI gate)
task run # → http://localhost:8080
Context
Full project context, the 9-stage workflow, the three governance gates, the dogfooding model, and all brain deep-links + external references live in .context/PROJECT.md. Any clean agent session should read that first (brain_get <path> for the linked notes).
Governance (dogfooded)
This repo is built through the workflow it depicts: dispatch-allow-enabled, build increments governed by a var-go Oath in their spec issues. Bootstrapping honesty: the Oath is defined but cmd/vargo-gate is not yet wired into this repo's CI — advisory until it is. See PROJECT.md.