CI is red on main: the compose layer is still keyed on pre-v3 role slugs #1155

New issue

Closed

opened 2026-08-25 19:05:11 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-25 19:05:11 +00:00

Owner

ci / test and ci / image-build both fail on every run since the dev-base agentic-os:release image picked up a post-v3 agent-compose. Last green run on main was 2026-08-23 02:09, before that refresh. Nothing in this repo changed to cause it.

What the runs show

Run 1602 (ci / test job 43227, ci / image-build job 43228) both die on the same check:

a role's selection changed: agent/rendered/roles/devrel.bundle.txt, eval, frontend,
  gamedev, platform, sysadmin, tpm

The bake now produces the v3 seven (platform, sysadmin, eval, frontend, gamedev, tpm, devrel) plus librarian. The tracked records under agent/rendered/roles/ are the pre-v3 nine (engineer, ops, ai, design, creator, director, exec, qa, librarian), so every core role reads as drifted.

Three separate breaks, one root

scripts/stage-compose-sources.sh takes the role list from the installed agent-compose roster, so the v3 reflow renamed every slug out from under this repo's compose layer.

The tracked records are stale. Nine pre-v3 files, seven post-v3 roles. This is what reddens both jobs.
Every allowlist grants nothing. The image-build log prints role platform: 0 sources admitted and the same for all seven. agent/compose/roles.kdl keys its composed-skill grants on engineer and creator, and neither slug exists in the roster now, so the Dowel and Deep lanes compose the roster identity alone.
The Echo seat override is dead. seat_identity() in scripts/stage-compose-sources.sh:84 matches ops. That slug is now sysadmin, so the override never fires and the sysadmin bundle bakes with the core roster seat instead of Echo (it). That override exists precisely to stop a core seat name reaching Echo's prompt, and it is the case agent-compose docs/identity.md uses as its worked example.

Deployment is not down: the image build fails, so no new image publishes and the running lanes keep the last good one. It is blocked rather than broken, and it stays blocked until this lands.

Also affected

SIRENS_ECHO_ROLE values in the deploy manifests select a baked bundle by slug. The deployed pairings recorded in docs/sirens-echo-identity.md are Echo ops, Deep creator, Dowel engineer, and none of those bundles is baked any more.

Ordering, and why not now

agent-compose #344 (landed 2026-08-25) renamed three seats and retitled four: Olaf to Vera, Lucia to Evie, Saiya to Portia, and new titles for platform, eval, frontend, and tpm. The tracked records carry seat names, so regenerating them against today's image would produce a record that goes stale again the moment the image picks up that release.

So regenerate after the dev-base image carries an agent-compose containing #344, not before. Doing it twice is the only way to get it wrong.

Done condition

agent/compose/roles.kdl grants keyed on the v3 slugs
seat_identity() keyed on sysadmin
deploy manifests and docs/sirens-echo-identity.md naming the v3 slugs for Echo, Deep, and Dowel
just role-drift-check green from a clean checkout
ci / test and ci / image-build green on main

coilyco-gaming/sirens-echo#1154 is a two-line comment change blocked behind this, and merges once main is green.

Refs coilyco-flight-deck/agent-compose#344

`ci / test` and `ci / image-build` both fail on every run since the dev-base `agentic-os:release` image picked up a post-v3 agent-compose. Last green run on `main` was 2026-08-23 02:09, before that refresh. Nothing in this repo changed to cause it. ## What the runs show Run 1602 (`ci / test` job 43227, `ci / image-build` job 43228) both die on the same check: ``` a role's selection changed: agent/rendered/roles/devrel.bundle.txt, eval, frontend, gamedev, platform, sysadmin, tpm ``` The bake now produces the v3 seven (`platform`, `sysadmin`, `eval`, `frontend`, `gamedev`, `tpm`, `devrel`) plus `librarian`. The tracked records under `agent/rendered/roles/` are the pre-v3 nine (`engineer`, `ops`, `ai`, `design`, `creator`, `director`, `exec`, `qa`, `librarian`), so every core role reads as drifted. ## Three separate breaks, one root `scripts/stage-compose-sources.sh` takes the role list from the installed agent-compose roster, so the v3 reflow renamed every slug out from under this repo's compose layer. 1. **The tracked records are stale.** Nine pre-v3 files, seven post-v3 roles. This is what reddens both jobs. 2. **Every allowlist grants nothing.** The image-build log prints `role platform: 0 sources admitted` and the same for all seven. `agent/compose/roles.kdl` keys its `composed-skill` grants on `engineer` and `creator`, and neither slug exists in the roster now, so the Dowel and Deep lanes compose the roster identity alone. 3. **The Echo seat override is dead.** `seat_identity()` in `scripts/stage-compose-sources.sh:84` matches `ops`. That slug is now `sysadmin`, so the override never fires and the `sysadmin` bundle bakes with the core roster seat instead of `Echo (it)`. That override exists precisely to stop a core seat name reaching Echo's prompt, and it is the case agent-compose `docs/identity.md` uses as its worked example. Deployment is not down: the image build fails, so no new image publishes and the running lanes keep the last good one. It is blocked rather than broken, and it stays blocked until this lands. ## Also affected `SIRENS_ECHO_ROLE` values in the deploy manifests select a baked bundle by slug. The deployed pairings recorded in `docs/sirens-echo-identity.md` are Echo `ops`, Deep `creator`, Dowel `engineer`, and none of those bundles is baked any more. ## Ordering, and why not now agent-compose `#344` (landed 2026-08-25) renamed three seats and retitled four: `Olaf` to `Vera`, `Lucia` to `Evie`, `Saiya` to `Portia`, and new titles for `platform`, `eval`, `frontend`, and `tpm`. The tracked records carry seat names, so regenerating them against today's image would produce a record that goes stale again the moment the image picks up that release. So regenerate **after** the dev-base image carries an agent-compose containing `#344`, not before. Doing it twice is the only way to get it wrong. ## Done condition * `agent/compose/roles.kdl` grants keyed on the v3 slugs * `seat_identity()` keyed on `sysadmin` * deploy manifests and `docs/sirens-echo-identity.md` naming the v3 slugs for Echo, Deep, and Dowel * `just role-drift-check` green from a clean checkout * `ci / test` and `ci / image-build` green on `main` `coilyco-gaming/sirens-echo#1154` is a two-line comment change blocked behind this, and merges once `main` is green. Refs coilyco-flight-deck/agent-compose#344

coilyco-ops referenced this issue

2026-08-25 19:05:17 +00:00

docs(comments): name the renamed seats in two test comments #1154

coilyco-ops referenced this issue from a commit

2026-08-25 20:31:24 +00:00

build(dev-base): take agent-compose 2.51.0, carrying the seat retitles

coilyco-ops referenced this issue from coilyco-flight-deck/agentic-os

2026-08-25 20:31:35 +00:00

build(dev-base): take agent-compose 2.51.0, carrying the seat retitles #1239

coilyco-ops referenced this issue from a commit

2026-08-26 02:56:59 +00:00

fix(compose): rekey the compose layer onto the v3 roster slugs