chore: Charm v2, size gate, Cloud CLI, release Gitlink strictness, yaad re-pin by Patel230 · Pull Request #89 · GrayCodeAI/hawk

Patel230 · 2026-07-11T02:32:20Z

Summary

Ship the post-audit hardening batch: Charm v2-only TUI stack, tighter binary
size gate, Hawk Cloud CLI integration, engine pin hygiene, release Gitlink
strictness, and Yaad re-pin after the demo TUI nested-module split.

Why

Dual Charm v1/v2 inflated the binary and dependency graph
Releases must never silently fall back to engine main when a Gitlink is
missing or unreachable
Yaad’s library graph must stay free of Bubble Tea so Hawk does not pay for a
demo TUI

Highlights

Area	Change
TUI	Migrate to `charm.land/*/v2`; fix remaining API incompatibilities
Size	`make size-check` / CI threshold 110MB → 80MB (~75MB verified)
Cloud	CLI login, usage reporting, delivery-context wiring
Pins	Submodule updates + `scripts/check-submodule-release-parity.sh`
Layers	`scripts/check-internal-layer-imports.sh`
Release	`checkout-eyrie` fails closed without Gitlinks; release job verifies pins
Yaad	Re-pin to nested-module TUI split (`b7ee281`)
Docs	Remediation plans updated with acceptance evidence

Depends on

Merge/push yaad PR first (b7ee281 must be reachable on origin)
Then this PR (or push) so public-module CI can resolve the new pseudo-version

Test plan

make size-check → ~75 MB
go list -m all has no charmbracelet/{bubbles,bubbletea,lipgloss} v1 stack
go test ./internal/intelligence/memory/ ./internal/platform/cloud/ ./cmd
make internal-layers-guard
CI green after yaad is published (public-modules, submodule-release-parity)
Manual smoke: REPL, /config, /autonomy pickers (Charm v2)

Rollout

# 1) yaad
cd yaad && git push origin main   # or open PR from docs/PR_BODY.md

# 2) hawk
cd hawk && git push origin main   # or open PR from this body
# if needed after publish:
go mod tidy && git add go.sum && git commit -m "chore: refresh go.sum after yaad publish"

Patel230 · 2026-07-11T02:32:32Z

Merge order: merge yaad#32 first so the Gitlink commit b7ee281 remains reachable and GOWORK=off / submodule-release-parity can resolve the updated pseudo-version after publish.

Release hardening in this PR: checkout-eyrie no longer falls back to branch heads by default; release.yml verifies Gitlink pins before goreleaser.

Patel230 · 2026-07-11T02:34:32Z

CI fix pushed

format — gofumpt on internal/platform/cloud/config.go
public module graph — go.sum now includes yaad @b7ee281 (fetchable from the open yaad PR branch)
submodule parity — script now uses git ls-tree for Gitlinks (no longer depends on external/* working trees being populated, which made every Gitlink look identical)

Local verify: parity all OK + GOWORK=off go build -mod=readonly ./cmd/hawk.

* ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml

#84) - eyrie v0.1.0 -> v0.1.3 (drops phantom tok v0.3.0 + circular hawk dep from module graph) - hawk-core-contracts v0.1.0 -> v0.1.3 - inspect v0.1.0 -> v0.1.3 (now on hawk-mcpkit v0.1.0) - sight v0.1.0 -> v0.1.2 (now on hawk-mcpkit v0.1.0) - tok v0.1.0 -> v0.1.2 - trace v0.1.0 -> v0.1.3 - yaad v0.1.0 -> v0.1.3 - untrack 17MB hawk_bin build artifact, add to .gitignore - purge stale go.sum hashes from re-cut v0.1.0 tags

…ontext Adds fail-open, best-effort Hawk Cloud integration to the CLI agent: - internal/platform/cloud: isolated HTTP client for Hawk Cloud with device login flow (start/poll), usage event recording, and delivery context sync. All calls are best-effort and never affect local execution. - cmd/cloud.go: 'hawk cloud connect' and 'hawk cloud login' commands with interactive device authorization flow - cmd/cloud_context.go: 'hawk cloud context' command to report delivery context (repository, branch, CI run, deployment) to Hawk Cloud - cmd/exec.go: fire-and-forget usage event sent after each exec completes - ADR-0002: architecture decision record formalizing Hawk Cloud as the Hawk-specific control plane, separate from GrayCode identity layer - examples/github/hawk-delivery-context.yml: reusable GitHub Actions workflow for CI delivery context reporting

… 110MB → 80MB refactor(make): sync size-check threshold to 80MB docs: add ecosystem-remediation-plan.md for deferred complex refactors

Update all charmbracelet dependencies to v2 module paths: - charmbracelet/bubbles v1.0.0 -> charm.land/bubbles/v2 v2.1.0 - charmbracelet/bubbletea v1.3.10 -> charm.land/bubbletea/v2 v2.0.7 - charmbracelet/lipgloss v1.1.0 -> charm.land/lipgloss/v2 v2.0.3 Fix lipgloss v2 API: - lipgloss.AdaptiveColor -> compat.AdaptiveColor - lipgloss.Color (type) -> lipgloss.Style - lipgloss.SetHasDarkBackground -> lipgloss.AdaptiveColor{} probing Fix bubbletea v2 API: - msg.Type -> msg.Key().Code / msg.String() - tea.KeyMsg -> key.KeyMsg - tea.MouseEvent -> Mouse() method - rand.Intn -> rand.IntN - m.input.SetCursor -> m.input.SetCursorColumn Fix Go module paths for charmbracelet v2: - github.com/charmbracelet/* -> charm.land/* (where v2 exists) - Keep github.com/charmbracelet/ sub-packages where v2 not yet released Add architecture documentation and ecosystem boundary checks: - docs/architecture/ecosystem-architecture.md - docs/plans/ecosystem-architecture-remediation.md - scripts/check-internal-layer-imports.sh - scripts/check-submodule-release-parity.sh This completes the charmbracelet v2 migration documented in scripts/check-ecosystem-boundaries.sh

Move remediation docs to done for charm v2 and yaad TUI isolation, and point external/yaad + go.mod at the commit that drops Bubble Tea from the core library graph. Publish yaad before relying on GOWORK=off parity.

Disable branch-head fallback by default in checkout-eyrie, verify Gitlink pins before goreleaser, and refresh the architecture remediation checklist with source-level evidence for contracts, metering, and auth matrices.

- gofumpt internal/platform/cloud/config.go - add go.sum for yaad b7ee281 so GOWORK=off builds - read Gitlinks via git ls-tree so parity works without submodule checkout

History rewrite changed commit SHAs; update Gitlinks and go.mod so public-module CI and submodule parity resolve against current origin/main.

Re-point Gitlinks and go.mod to v0.1.4 tags published after the Co-authored-by history rewrite so public-module CI and submodule parity resolve consistently.

Patel230

Review (ecosystem-hardening PR)

Status checks done locally

Working tree clean; no Co-authored-by trailers on PR commits
Rebased onto current main (merge conflicts resolved)
Engines re-pinned to v0.1.4 (post history-rewrite tags)
scripts/check-submodule-release-parity.sh → all OK

Change summary (LGTM direction)

Area	Assessment
Charm v2 migration	Correct move to `charm.land/*/v2`; removes dual v1/v2 stack
Size gate 110→80MB	Aligns with smaller TUI deps
Hawk Cloud client	Fail-open usage/delivery reporting; short HTTP timeout; optional when unconfigured
Gitlink fail-closed	Good release hygiene; `allow_branch_fallback` opt-in only
Skill distiller adapter	Real Chat/Store wiring instead of stub
Submodule/go.mod pins	v0.1.4 after rewrite — required for public-module CI

Residual risks / follow-ups

Proxy lag: brand-new v0.1.4 tags may take a few minutes on proxy.golang.org / sumdb; CI public-module job should use direct fallback or retry if first run flakes.
Hawk Cloud: device token in env/config — confirm secrets never logged (client looks clean).
Manual smoke still listed open: REPL / /config / /autonomy on Charm v2.

Verdict

Approve to merge once required CI checks are green. Intent and release/pin hygiene look correct.

Patel230 force-pushed the chore/ecosystem-hardening-charm-yaad-release branch from 598189c to 2af9727 Compare July 11, 2026 05:00

Patel230 added 12 commits July 11, 2026 10:39

chore: add dependabot.yml for dependency updates (#73)

26cdb9b

* ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml

refactor(ci): tighten binary size check with ldflags, lower threshold…

2992bf5

… 110MB → 80MB refactor(make): sync size-check threshold to 80MB docs: add ecosystem-remediation-plan.md for deferred complex refactors

Update external submodule references

638267b

Update external/yaad submodule

cff0aa6

charmbracelet v2: fix remaining API incompatibilities

6d9c733

chore: re-pin yaad after TUI nested-module split

46ba7b1

Move remediation docs to done for charm v2 and yaad TUI isolation, and point external/yaad + go.mod at the commit that drops Bubble Tea from the core library graph. Publish yaad before relying on GOWORK=off parity.

docs: note yaad publish prerequisite for GOWORK=off parity

b87d9e8

fix(ci): fail closed on missing engine Gitlinks for release

5237e50

Disable branch-head fallback by default in checkout-eyrie, verify Gitlink pins before goreleaser, and refresh the architecture remediation checklist with source-level evidence for contracts, metering, and auth matrices.

fix(ci): gofumpt cloud config, go.sum yaad, fix release-parity gitlinks

6e79f91

- gofumpt internal/platform/cloud/config.go - add go.sum for yaad b7ee281 so GOWORK=off builds - read Gitlinks via git ls-tree so parity works without submodule checkout

Patel230 force-pushed the chore/ecosystem-hardening-charm-yaad-release branch from 2af9727 to 6e79f91 Compare July 11, 2026 05:09

Patel230 added 2 commits July 11, 2026 10:44

chore: re-pin engines to post-rewrite main SHAs

57dfa3b

History rewrite changed commit SHAs; update Gitlinks and go.mod so public-module CI and submodule parity resolve against current origin/main.

chore: pin engines to v0.1.4 post-rewrite releases

1b64cd9

Re-point Gitlinks and go.mod to v0.1.4 tags published after the Co-authored-by history rewrite so public-module CI and submodule parity resolve consistently.

Patel230 commented Jul 11, 2026

View reviewed changes

Patel230 merged commit 38341f1 into main Jul 11, 2026
20 checks passed

Patel230 deleted the chore/ecosystem-hardening-charm-yaad-release branch July 11, 2026 05:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: Charm v2, size gate, Cloud CLI, release Gitlink strictness, yaad re-pin#89

chore: Charm v2, size gate, Cloud CLI, release Gitlink strictness, yaad re-pin#89
Patel230 merged 14 commits into
mainfrom
chore/ecosystem-hardening-charm-yaad-release

Patel230 commented Jul 11, 2026

Uh oh!

Patel230 commented Jul 11, 2026

Uh oh!

Patel230 commented Jul 11, 2026

Uh oh!

Patel230 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Patel230 commented Jul 11, 2026

Summary

Why

Highlights

Depends on

Test plan

Rollout

Uh oh!

Patel230 commented Jul 11, 2026

Uh oh!

Patel230 commented Jul 11, 2026

Uh oh!

Patel230 left a comment

Choose a reason for hiding this comment

Review (ecosystem-hardening PR)

Status checks done locally

Change summary (LGTM direction)

Residual risks / follow-ups

Verdict

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant