role-drift-check reports false drift on a workstation and hands you a CI-breaking fix #1000

New issue

Open

opened 2026-08-19 00:49:47 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-19 00:49:47 +00:00

Member

just role-drift-check gives a different answer on a workstation than it does in CI, for the same commit, and it fails in the direction that invites a wrong fix.

Reproduction

On a pristine main checkout with no local changes:

2026/08/18 15:36:29 a role's selection changed:
  agent/rendered/roles/ai.bundle.txt, agent/rendered/roles/exec.bundle.txt
error: recipe `role-drift-check` failed

main's own CI on the same commit is green, all four jobs.

Cause

agent-compose roster resolves different personalities per host:

workstation - ai = empirical, meticulous, skeptical // exec = outward, grounded, decisive
CI image (agentic-os:release) - ai = curious, meticulous, skeptical // exec = curious, decisive, grounded

Both are agent-compose 2.31.0, and docker/dev-base/full/Dockerfile pins AGENT_COMPOSE_VERSION=2.31.0, so the binary version is not the variable. Something in how the roster resolves differs between the image and a host, even though stage-compose-sources.sh already builds a scratch HOME for hermeticity. engineer, creator, and the rest agree, so the divergence is confined to ai and exec.

Why this is worth fixing rather than documenting

The failure is actively misleading. It reports drift that does not exist, then prints just compose-bundles and just role-snapshot, and following that advice produces a diff CI rejects. I did exactly that in #994 (now closed), and it is the natural thing for anyone to do, because the check states the record is stale and hands you the command to fix it.

The same divergence contaminates a legitimate regeneration. #985 genuinely needed a new engineer.bundle.txt, and regenerating it also rewrote ai and exec into a CI-breaking state, so those two had to be discarded by hand. Anyone who commits all three breaks the build.

Suggestions

Find what the roster reads that differs, and pin it the way AGENT_COMPOSE_VERSION is pinned.
Failing that, have the check name the environment it resolved so a mismatch is visible in the output rather than presenting as repository drift.
A local run that cannot match CI should say so instead of reporting a false positive.

#994 - the wrong fix this produced, closed.
#985 - regenerated engineer.bundle.txt only, for this reason.
deploy#693 - other direction of the same family: a record going stale with nothing to notice.

`just role-drift-check` gives a different answer on a workstation than it does in CI, for the same commit, and it fails in the direction that invites a wrong fix. ## Reproduction On a pristine `main` checkout with no local changes: ``` 2026/08/18 15:36:29 a role's selection changed: agent/rendered/roles/ai.bundle.txt, agent/rendered/roles/exec.bundle.txt error: recipe `role-drift-check` failed ``` `main`'s own CI on the same commit is green, all four jobs. ## Cause `agent-compose roster` resolves different personalities per host: - **workstation** - `ai` = empirical, meticulous, skeptical // `exec` = outward, grounded, decisive - **CI image** (`agentic-os:release`) - `ai` = curious, meticulous, skeptical // `exec` = curious, decisive, grounded Both are agent-compose 2.31.0, and `docker/dev-base/full/Dockerfile` pins `AGENT_COMPOSE_VERSION=2.31.0`, so the binary version is not the variable. Something in how the roster resolves differs between the image and a host, even though `stage-compose-sources.sh` already builds a scratch `HOME` for hermeticity. `engineer`, `creator`, and the rest agree, so the divergence is confined to `ai` and `exec`. ## Why this is worth fixing rather than documenting The failure is actively misleading. It reports drift that does not exist, then prints `just compose-bundles` and `just role-snapshot`, and following that advice produces a diff CI rejects. I did exactly that in #994 (now closed), and it is the natural thing for anyone to do, because the check states the record is stale and hands you the command to fix it. The same divergence contaminates a legitimate regeneration. #985 genuinely needed a new `engineer.bundle.txt`, and regenerating it also rewrote `ai` and `exec` into a CI-breaking state, so those two had to be discarded by hand. Anyone who commits all three breaks the build. ## Suggestions - Find what the roster reads that differs, and pin it the way `AGENT_COMPOSE_VERSION` is pinned. - Failing that, have the check name the environment it resolved so a mismatch is visible in the output rather than presenting as repository drift. - A local run that cannot match CI should say so instead of reporting a false positive. ## Related - #994 - the wrong fix this produced, closed. - #985 - regenerated `engineer.bundle.txt` only, for this reason. - [deploy#693](https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/693) - other direction of the same family: a record going stale with nothing to notice.

coilyco-ops referenced this issue

2026-08-19 00:50:01 +00:00

fix(rendered): record the roster personality swap for ai and exec #994

coilyco-ops added the

labels

2026-08-19 03:38:52 +00:00