role-drift-check clones the catalog at an unpinned main, so an upstream merge turns every pull request red with no commit here #1157

New issue

Open

opened 2026-08-26 02:55:38 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-26 02:55:38 +00:00

Owner

What

scripts/task.sh resolves the catalog for role-drift-check as:

git clone --depth 1 --branch "${AOS_CATALOG_REF:-main}" \
  https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os.git "$catalog"

Unpinned. The check compares this repo's committed agent/rendered/roles/*.bundle.txt against whatever agentic-os main holds at the moment CI runs, so a merge in another repository invalidates this repository's committed record with no commit here.

It already fired

agentic-os main took the Core Roster v2 seat retitles. The recorded roster here is the old naming:

ai creator design director engineer exec librarian ops qa

A bake against the catalog as it stands now produces devrel, eval, frontend, gamedev, platform, sysadmin, tpm. So role-drift-check fails on every pull request opened from now on, whatever it changes. Observed on #1156, a branch that touches only AGENTS.md.

main is green only because it has not re-run since the upstream merge. This is the silent-failure shape: the breaking change is already in, and the first person to learn it is whoever opens the next unrelated pull request and reads a roster diff they did not cause.

Two separable pieces

The record is stale. Rebake and commit the new roster. That is the seat-rename migration, and it wants an owner who knows which catalog state this repo intends to sit on.
The ref is unpinned. Even after the rebake, the next upstream composed-source change re-breaks it the same way. Pin AOS_CATALOG_REF to a tag or commit and bump it deliberately, so the drift check compares against a version this repo chose. A release tag exists on the catalog side. The image build already speaks of "a pinned ref" in the comment directly above the clone, so the intent is there and the default is what leaks.

Pinning also makes the failure legible when it does come: a bump commit names the upstream version, instead of a red pull request that mentions roles nobody touched.

## What `scripts/task.sh` resolves the catalog for `role-drift-check` as: ``` git clone --depth 1 --branch "${AOS_CATALOG_REF:-main}" \ https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os.git "$catalog" ``` Unpinned. The check compares this repo's committed `agent/rendered/roles/*.bundle.txt` against whatever agentic-os `main` holds at the moment CI runs, so a merge in another repository invalidates this repository's committed record with no commit here. ## It already fired agentic-os `main` took the Core Roster v2 seat retitles. The recorded roster here is the old naming: ``` ai creator design director engineer exec librarian ops qa ``` A bake against the catalog as it stands now produces `devrel`, `eval`, `frontend`, `gamedev`, `platform`, `sysadmin`, `tpm`. So `role-drift-check` fails on every pull request opened from now on, whatever it changes. Observed on https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/pulls/1156, a branch that touches only `AGENTS.md`. `main` is green only because it has not re-run since the upstream merge. This is the silent-failure shape: the breaking change is already in, and the first person to learn it is whoever opens the next unrelated pull request and reads a roster diff they did not cause. ## Two separable pieces * **The record is stale.** Rebake and commit the new roster. That is the seat-rename migration, and it wants an owner who knows which catalog state this repo intends to sit on. * **The ref is unpinned.** Even after the rebake, the next upstream composed-source change re-breaks it the same way. Pin `AOS_CATALOG_REF` to a tag or commit and bump it deliberately, so the drift check compares against a version this repo chose. A release tag exists on the catalog side. The image build already speaks of "a pinned ref" in the comment directly above the clone, so the intent is there and the default is what leaks. Pinning also makes the failure legible when it does come: a bump commit names the upstream version, instead of a red pull request that mentions roles nobody touched.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-08-26 03:01:42 +00:00

feat(scripts): add the git-workflow block bulk migration #943

coilyco-ops referenced this issue from coilyco-flight-deck/agentic-os

2026-08-26 03:06:08 +00:00

feat(hooks): add git-workflow to the fleet hook set #1262

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-08-26 03:07:58 +00:00

AGENTS.md tells agents the merge is director-gated, which inverts the pull-request-and-merge lane and strands finished work #937