Fail the build on an allowlist entry naming no roster role

coilyco-ops commented

2026-08-24 00:14:04 +00:00

Owner

Closes the guard half of #1147. The mapping half stays open and is not mine.

What this does

roles.kdl is purely additive: the roster decides which roles exist, and the file grants skills to a role that already does. An entry naming a role the roster does not have therefore grants its skills to nothing, and is indistinguishable from a seat deliberately left bare. Both are silent, and the difference is the whole capability of a lane.

The build now refuses it.

community.CheckGraphRoles reports every graph role absent from a given roster.
sirens-echo-compose --check-roster <comma-list> exposes it and exits.
stage-compose-sources.sh runs it once both the core and community rosters are known, before any bake.

A roster role with no entry stays legal. That is what librarian is, and the test pins it.

Why now

Not hypothetical. agent-compose reflowed its Core Roster to seven bonded seats in 12c7198, and the two entries this file carries, engineer and creator, both name roles that reflow removed. Run against the current roster:

$ sirens-echo-compose --compose-dir agent/compose \
    --check-roster "platform,sysadmin,eval,frontend,gamedev,tpm,devrel,librarian"
role graph grants skills to creator, engineer, which the roster does not have: ...
exit 1

Against the roster the pinned image still bakes, it passes.

#955 measured what the bare state costs: 6 skills and 0 sources against creator's 24 and 48,398 bytes.

Expect this to go red, and that is the point

The image bases on agentic-os:release, so the roster comes from whatever agent-compose that image ships. If it already carries the reflow, this PR's image build fails on the new check, naming creator and engineer.

That failure is the alarm rather than a defect in this change. Kai approved a failed image build as the outcome. If CI goes red exactly there, this should wait on the roles.kdl remapping in #1147 rather than be merged past or weakened.

If the release image is still pre-reflow, CI passes and the alarm fires later, at the rebuild that would otherwise have silently shipped eight bare agents.

Not in scope

Which of the seven seats inherits which allowlist. That is a mapping decision for this repository, tracked on #1147.

Refs #1147, #955, #1129

Closes the guard half of #1147. The mapping half stays open and is not mine. ## What this does `roles.kdl` is purely additive: the roster decides which roles exist, and the file grants skills to a role that already does. An entry naming a role the roster does not have therefore grants its skills to nothing, and is indistinguishable from a seat deliberately left bare. Both are silent, and the difference is the whole capability of a lane. The build now refuses it. * `community.CheckGraphRoles` reports every graph role absent from a given roster. * `sirens-echo-compose --check-roster <comma-list>` exposes it and exits. * `stage-compose-sources.sh` runs it once both the core and community rosters are known, before any bake. A roster role with no entry stays legal. That is what `librarian` is, and the test pins it. ## Why now Not hypothetical. agent-compose reflowed its Core Roster to seven bonded seats in `12c7198`, and the two entries this file carries, `engineer` and `creator`, both name roles that reflow removed. Run against the current roster: ``` $ sirens-echo-compose --compose-dir agent/compose \ --check-roster "platform,sysadmin,eval,frontend,gamedev,tpm,devrel,librarian" role graph grants skills to creator, engineer, which the roster does not have: ... exit 1 ``` Against the roster the pinned image still bakes, it passes. `#955` measured what the bare state costs: 6 skills and 0 sources against creator's 24 and 48,398 bytes. ## Expect this to go red, and that is the point The image bases on `agentic-os:release`, so the roster comes from whatever agent-compose that image ships. **If it already carries the reflow, this PR's image build fails on the new check**, naming `creator` and `engineer`. That failure is the alarm rather than a defect in this change. Kai approved a failed image build as the outcome. If CI goes red exactly there, this should wait on the `roles.kdl` remapping in #1147 rather than be merged past or weakened. If the release image is still pre-reflow, CI passes and the alarm fires later, at the rebuild that would otherwise have silently shipped eight bare agents. ## Not in scope Which of the seven seats inherits which allowlist. That is a mapping decision for this repository, tracked on #1147. Refs #1147, #955, #1129

coilyco-ops added 1 commit

2026-08-24 00:14:04 +00:00

feat(compose): fail the build on an allowlist entry naming no roster role

ci / image-build (pull_request) Failing after 48s

Details

ci / test (pull_request) Failing after 1m1s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

ci / publish-observed (pull_request) Has been skipped

Details

339418f1c7

roles.kdl is purely additive and the roster decides which roles exist, so
an entry for a role the roster does not have grants its skills to nothing
and is indistinguishable from a seat deliberately left bare. Both states
are silent, and the difference is the whole capability of a lane.

That is not hypothetical. agent-compose reflowed its Core Roster to seven
bonded seats in 12c7198, and both entries this file carries, engineer and
creator, name roles that reflow removed. On the next rebuild against a
current agent-compose every bundle would compose the roster identity
alone. sirens-echo#955 measured that state at 6 skills and 0 sources
against creator's 24 and 48,398 bytes.

CheckGraphRoles refuses it, cmd/sirens-echo-compose exposes it as
--check-roster, and stage-compose-sources.sh runs it once both the core
and community rosters are known, before any bake.

A roster role with no entry stays legal, which is what librarian is.

docs/sirens-echo-compose.md sits near its 8,000-char cap, so two adjacent
clauses were tightened to make room. No meaning changed.

Refs #1147

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops referenced this pull request

2026-08-24 01:31:38 +00:00

docs: dedupe the See-also block and group it by what a reader wants #1149

coilyco-ops referenced this pull request

2026-08-25 08:38:24 +00:00

Both roles.kdl entries name roles the reflowed roster no longer has, so every core role will compose bare when the image catches up #1147

coilyco-ops referenced this pull request

2026-08-25 08:47:20 +00:00

fix(compose): follow the composed-source renames the roster reflow made #1151

coilyco-ops referenced this pull request

2026-08-25 08:48:37 +00:00

Both roles.kdl entries name roles the reflowed roster no longer has, so every core role will compose bare when the image catches up #1147