fix(compose): rekey the compose layer onto the v3 roster slugs #1158

Merged

coilyco-ops merged 1 commit from aos/claude/vk48-roster-v3 into main

2026-08-26 02:59:38 +00:00

coilyco-ops commented

2026-08-26 02:57:22 +00:00

Owner

Closes #1155.

CI has been red on every pull request since the dev-base image picked up an
agent-compose carrying the Core Roster v3 reflow. Ten of ten runs, across six
unrelated branches, with zero push runs on main in that window. Nothing in
this repository changed.

The bake takes its role list from the installed roster, which now yields
platform, sysadmin, eval, frontend, gamedev, tpm, devrel plus this
repository's librarian, while the tracked records were the pre-v3 nine. Every
core role read as drifted, reddening ci / test and ci / image-build alike
and blocking the image from publishing.

Three breaks, one root

Every allowlist granted nothing. roles.kdl keyed its grants on
engineer and creator, so both lanes composed the roster identity alone.
Now keyed on platform and devrel, with the three dead patterns renamed to
tooling-sysadmin-*, tooling-eval-* and tooling-devrel-* (the renames
from #1151, which this absorbs).
Echo's seat override was dead. seat_identity() matched ops. Now
matches sysadmin, and the baked bundle reads Seat: Echo (it) again.
The records were stale. Eight v3 bundles in, the pre-v3 nine out.

Admission counts are back where they belong: platform 53 sources, devrel
19, sysadmin 0 because Echo has no roles.kdl entry by design.

One thing that needed a translation, not a rename

boundary-omit named modify-live-system, which v3 spells
modify-live-backend. Renaming it was not enough: agent-compose refuses it,
because v3 platform holds that boundary within a scope rather than
deferring it. The omission exists to drop what the role defers, and v3
platform defers only suggest-external-comms, so it narrows from two to one.

The Echo pairing, named plainly

ops was the operator charter and sysadmin is the infrastructure one, so
Echo is the one pairing the reflow could not preserve. Kai chose it over
keeping a repo-owned ops role. It is bounded: Echo takes no roles.kdl
grants and its neutral profile governs its voice, so what changes is the
doctrine behind that voice, and a meld that loses reflective. That fact did
not fit under sirens-echo-identity.md's 8000-char cap, so it lives here.

promptBudgets raises Echo by 5 bytes, exactly the width sysadmin adds over
ops.

How the records were produced

Baked with agent-compose v2.51.0, matching what the dev-base image carries,
against a catalogue verified identical to the main the image build clones.
Not with the host's v2.47.0, which would have recorded the wrong thing.

v2.52.0 exists and differs by one skill digest, so a dev-base bump to it will
re-drift one role. I deliberately did not bump dev-base here, because doing so
would manufacture exactly the second rebake #1155 warns against.

Verified: just role-drift-check green from a clean checkout, full Go suite,
full pre-commit.

Still open after this

SIRENS_ECHO_ROLE in coilyco-bridge/deploy still names ops, creator and
engineer, none of which bake any more. That is a separate change against a
different repository and it moves production, so it is not in here.

🤖 Generated with Claude Code

Closes #1155. CI has been red on **every** pull request since the dev-base image picked up an agent-compose carrying the Core Roster v3 reflow. Ten of ten runs, across six unrelated branches, with zero push runs on `main` in that window. Nothing in this repository changed. The bake takes its role list from the installed roster, which now yields `platform, sysadmin, eval, frontend, gamedev, tpm, devrel` plus this repository's `librarian`, while the tracked records were the pre-v3 nine. Every core role read as drifted, reddening `ci / test` and `ci / image-build` alike and blocking the image from publishing. ## Three breaks, one root * **Every allowlist granted nothing.** `roles.kdl` keyed its grants on `engineer` and `creator`, so both lanes composed the roster identity alone. Now keyed on `platform` and `devrel`, with the three dead patterns renamed to `tooling-sysadmin-*`, `tooling-eval-*` and `tooling-devrel-*` (the renames from #1151, which this absorbs). * **Echo's seat override was dead.** `seat_identity()` matched `ops`. Now matches `sysadmin`, and the baked bundle reads `Seat: Echo (it)` again. * **The records were stale.** Eight v3 bundles in, the pre-v3 nine out. Admission counts are back where they belong: `platform` 53 sources, `devrel` 19, `sysadmin` 0 because Echo has no `roles.kdl` entry by design. ## One thing that needed a translation, not a rename `boundary-omit` named `modify-live-system`, which v3 spells `modify-live-backend`. Renaming it was not enough: agent-compose refuses it, because v3 `platform` **holds** that boundary within a scope rather than deferring it. The omission exists to drop what the role defers, and v3 `platform` defers only `suggest-external-comms`, so it narrows from two to one. ## The Echo pairing, named plainly `ops` was the operator charter and `sysadmin` is the infrastructure one, so Echo is the one pairing the reflow could not preserve. Kai chose it over keeping a repo-owned `ops` role. It is bounded: Echo takes no `roles.kdl` grants and its neutral profile governs its voice, so what changes is the doctrine behind that voice, and a meld that loses `reflective`. That fact did not fit under `sirens-echo-identity.md`'s 8000-char cap, so it lives here. `promptBudgets` raises Echo by 5 bytes, exactly the width `sysadmin` adds over `ops`. ## How the records were produced Baked with **agent-compose v2.51.0**, matching what the dev-base image carries, against a catalogue verified identical to the `main` the image build clones. Not with the host's v2.47.0, which would have recorded the wrong thing. `v2.52.0` exists and differs by one skill digest, so a dev-base bump to it will re-drift one role. I deliberately did not bump dev-base here, because doing so would manufacture exactly the second rebake #1155 warns against. Verified: `just role-drift-check` green from a clean checkout, full Go suite, full pre-commit. ## Still open after this `SIRENS_ECHO_ROLE` in `coilyco-bridge/deploy` still names `ops`, `creator` and `engineer`, none of which bake any more. That is a separate change against a different repository and it moves production, so it is not in here. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 1 commit

2026-08-26 02:57:22 +00:00

fix(compose): rekey the compose layer onto the v3 roster slugs

ci / image-build (pull_request) Successful in 54s

Details

ci / test (pull_request) Successful in 1m9s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

ci / publish-observed (pull_request) Has been skipped

Details

99fceae406

Closes #1155.

CI has been red on every pull request since the dev-base image picked up an
agent-compose carrying the Core Roster v3 reflow. Nothing in this repository
changed. The bake takes its role list from the installed roster, which now
yields platform, sysadmin, eval, frontend, gamedev, tpm and devrel plus this
repository's librarian, while the tracked records were the pre-v3 nine. Every
core role read as drifted, which reddened `ci / test` and `ci / image-build`
alike and blocked the image from publishing.

Three breaks, one root:

* `agent/compose/roles.kdl` keyed its grants on `engineer` and `creator`, so
  every allowlist granted nothing and both lanes composed the roster identity
  alone. Now keyed on `platform` and `devrel`, with the three dead patterns
  renamed to `tooling-sysadmin-*`, `tooling-eval-*` and `tooling-devrel-*`.
* `seat_identity()` matched `ops`, so Echo's seat override never fired and the
  bundle carried the core seat name. Now matches `sysadmin`, and the baked
  bundle reads `Seat: Echo (it)` again.
* The tracked records are regenerated: eight v3 bundles in, the pre-v3 nine out.

The boundary omission needed a translation rather than a rename. `engineer`
deferred both boundaries Dowel dropped, while v3 `platform` defers only
`suggest-external-comms` and holds the other two within a scope, which
agent-compose refuses to omit. The omission narrows to the one deferral.

The deployed pairing Echo `ops` was the operator charter and `sysadmin` is the
infrastructure one, so that pairing is the one the reflow could not preserve.
Kai chose it over keeping a repo-owned `ops` role. Echo takes no roles.kdl
grants and its neutral profile governs its voice, so the change is bounded to
the doctrine behind that voice and a meld that loses `reflective`.

promptBudgets raises Echo by 5 bytes, exactly the width `sysadmin` adds over
`ops` in the rendered prompt.

Baked with agent-compose v2.51.0, matching what the dev-base image carries, and
against a catalogue identical to the `main` the image build clones. Verified
with `just role-drift-check` green from a clean checkout, the full Go suite, and
the whole pre-commit run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops merged commit 0854f2188c into main

2026-08-26 02:59:38 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-26 02:59:39 +00:00

fix(compose): rekey the compose layer onto the v3 roster slugs (#1158)

coilyco-ops referenced this pull request

2026-08-26 03:01:29 +00:00

Both roles.kdl entries name roles the reflowed roster no longer has, so every core role will compose bare when the image catches up #1147

coilyco-ops referenced this pull request

2026-08-26 03:01:47 +00:00

fix(compose): follow the composed-source renames the roster reflow made #1151

coilyco-ops referenced this pull request