Programmatically manage per-agent config files (~/.codex/config.toml, etc.) via ansible #254

New issue

Closed

opened 2026-06-07 03:00:49 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-07 03:00:49 +00:00

Owner

Problem

Per-agent harness config files are currently hand-managed and drift across the fleet. The agent-compose role only converges the markdown load points (~/.claude/CLAUDE.md, ~/.codex/AGENTS.md symlinks into COMPOSED.md). The actual config files - the knobs that change agent behavior - have no declarative source:

~/.codex/config.toml, ~/.codex/hooks.json
~/.claude/settings.json (today regenerated by coily lockdown/coily setup, not ansible)
gemini / openclaw / future-harness equivalents (~/.gemini/*, etc.)

These land per-host through setup scripts, manual edits, or coily renders. There is no single ansible-converged source of truth, so a fresh checkout or a new fleet node starts inconsistent, and a change to one agent's config has to be replayed by hand on every box.

Goal

A completely programmatically managed, ansible-converged path for per-agent config files, fleet-wide. One declarative source per agent, rendered/templated per host (host-specific values via group_vars/host_vars), idempotent under --check.

Scope sketch

New role (or extend agent-compose) that templates each per-agent config from a fleet-static base + per-host overlay, mirroring how agent-compose already splits public base + private overlay.
Cover at least: codex (config.toml, hooks.json), claude (whatever is not the coily-owned lockdown surface), and a pluggable list so gemini/openclaw slot in later.
Respect the coily-managed lockdown boundary. ~/.claude/settings.json and .claude/lockdown-deny.sh are regenerated by coily lockdown/coily setup and an agent must never own them - ansible must not fight coily over those files. Decide the seam explicitly: either ansible templates everything except the lockdown surface, or it invokes coily to render that surface. Document which.
Secrets/opaque values stay in SSM and are resolved at converge time, never templated as literals (per the SSM doctrine).
Idempotent, check-mode clean, and a docs/ansible.md walkthrough section like the other roles have.

Open questions

Single role vs. per-agent roles vs. extending agent-compose?
Source-of-truth location: fleet-static defaults in the role + overlay in agentic-os-kai, matching agent-compose_sources?
How to reconcile with coily for the lockdown-owned files - exclude vs. delegate-to-coily.

Authoring lives here in infrastructure/ansible; this is the rollout half of the authoring/rollout split.

## Problem Per-agent harness **config** files are currently hand-managed and drift across the fleet. The `agent-compose` role only converges the markdown load points (`~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md` symlinks into `COMPOSED.md`). The actual config files - the knobs that change agent behavior - have no declarative source: * `~/.codex/config.toml`, `~/.codex/hooks.json` * `~/.claude/settings.json` (today regenerated by `coily lockdown`/`coily setup`, not ansible) * gemini / openclaw / future-harness equivalents (`~/.gemini/*`, etc.) These land per-host through setup scripts, manual edits, or coily renders. There is no single ansible-converged source of truth, so a fresh checkout or a new fleet node starts inconsistent, and a change to one agent's config has to be replayed by hand on every box. ## Goal A **completely programmatically managed**, ansible-converged path for per-agent config files, fleet-wide. One declarative source per agent, rendered/templated per host (host-specific values via `group_vars`/`host_vars`), idempotent under `--check`. ## Scope sketch * New role (or extend `agent-compose`) that templates each per-agent config from a fleet-static base + per-host overlay, mirroring how `agent-compose` already splits public base + private overlay. * Cover at least: codex (`config.toml`, `hooks.json`), claude (whatever is *not* the coily-owned lockdown surface), and a pluggable list so gemini/openclaw slot in later. * **Respect the coily-managed lockdown boundary.** `~/.claude/settings.json` and `.claude/lockdown-deny.sh` are regenerated by `coily lockdown`/`coily setup` and an agent must never own them - ansible must not fight coily over those files. Decide the seam explicitly: either ansible templates everything *except* the lockdown surface, or it invokes coily to render that surface. Document which. * Secrets/opaque values stay in SSM and are resolved at converge time, never templated as literals (per the SSM doctrine). * Idempotent, check-mode clean, and a `docs/ansible.md` walkthrough section like the other roles have. ## Open questions * Single role vs. per-agent roles vs. extending `agent-compose`? * Source-of-truth location: fleet-static defaults in the role + overlay in `agentic-os-kai`, matching `agent-compose_sources`? * How to reconcile with coily for the lockdown-owned files - exclude vs. delegate-to-coily. Authoring lives here in `infrastructure/ansible`; this is the rollout half of the authoring/rollout split.

coilysiren added the

label

2026-06-17 07:05:35 +00:00

coilysiren commented

2026-06-17 08:22:36 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:22:36 +00:00