Catch role snapshot drift beside the other gates, not at step 26 #799

Merged

coilysiren merged 1 commit from aos/claude/yt58-role-snapshot-gate into main

2026-08-15 15:36:25 +00:00

coilyco-ops commented

2026-08-15 15:29:27 +00:00

Member

Closes #788.

What moved

The test job now runs ward exec role-drift-check: it bakes the same bundles the image build bakes, from the same floating agentic-os catalogue ref, and runs the same sirens-echo-prompt --check over them. Drift now shows up beside vet and test-skips instead of two thirds of the way through a 40-step image build.

The Dockerfile check at step 26 stays. That one gates what actually ships, over the bundles that actually ship. The new step is the early warning, not a replacement.

The message now names something that runs

Old:

a role's selection changed: ...
run `ward exec role-snapshot` against baked bundles and commit the result

role-snapshot reads agent/bundles, which is untracked and absent on an ordinary checkout, so that instruction died before it could help. New:

a role's selection changed: agent/rendered/roles/qa.bundle.txt
  if this branch predates a composed-sources change, merge main first:
  the record it wants is already committed there
  if the change is yours, rebake and record it:
    ward exec compose-bundles
    ward exec role-snapshot

The merge goes first because it was the real remedy in every instance the issue traced (#771, #777, #779). compose-bundles is named because it is the step that creates the directory role-snapshot reads.

A missing bundle directory also says which verb creates it, instead of open agent/bundles: no such file or directory.

Why the new verb bakes out of tree

role-drift-check stages into a scratch directory and removes it. Baking into agent/bundles makes the later pre-commit step fail: documentation-layout and dead-cross-links walk the filesystem, and a baked bundle is a tree of skill files those hooks then read as this repository's own. That is pre-existing for ward exec compose-bundles and is filed separately.

Verified

ward exec role-drift-check green through both paths, an AOS_CATALOG checkout and the clone fallback CI takes. Both bake identical selections.
Bake plus check is ~3s locally with a warm Go cache.
Drift message confirmed by appending a line to agent/rendered/roles/qa.bundle.txt; missing-directory message confirmed with agent/bundles removed.
ward exec gate green, pre-commit included.

Closes #788. ## What moved The `test` job now runs `ward exec role-drift-check`: it bakes the same bundles the image build bakes, from the same floating `agentic-os` catalogue ref, and runs the same `sirens-echo-prompt --check` over them. Drift now shows up beside `vet` and `test-skips` instead of two thirds of the way through a 40-step image build. The Dockerfile check at step 26 stays. That one gates what actually ships, over the bundles that actually ship. The new step is the early warning, not a replacement. ## The message now names something that runs Old: ``` a role's selection changed: ... run `ward exec role-snapshot` against baked bundles and commit the result ``` `role-snapshot` reads `agent/bundles`, which is untracked and absent on an ordinary checkout, so that instruction died before it could help. New: ``` a role's selection changed: agent/rendered/roles/qa.bundle.txt if this branch predates a composed-sources change, merge main first: the record it wants is already committed there if the change is yours, rebake and record it: ward exec compose-bundles ward exec role-snapshot ``` The merge goes first because it was the real remedy in every instance the issue traced (#771, #777, #779). `compose-bundles` is named because it is the step that creates the directory `role-snapshot` reads. A missing bundle directory also says which verb creates it, instead of `open agent/bundles: no such file or directory`. ## Why the new verb bakes out of tree `role-drift-check` stages into a scratch directory and removes it. Baking into `agent/bundles` makes the later `pre-commit` step fail: `documentation-layout` and `dead-cross-links` walk the filesystem, and a baked bundle is a tree of skill files those hooks then read as this repository's own. That is pre-existing for `ward exec compose-bundles` and is filed separately. ## Verified - `ward exec role-drift-check` green through both paths, an `AOS_CATALOG` checkout and the clone fallback CI takes. Both bake identical selections. - Bake plus check is ~3s locally with a warm Go cache. - Drift message confirmed by appending a line to `agent/rendered/roles/qa.bundle.txt`; missing-directory message confirmed with `agent/bundles` removed. - `ward exec gate` green, pre-commit included.

coilyco-ops added 1 commit

2026-08-15 15:29:27 +00:00

fix(ci): catch role snapshot drift beside the other gates, not at step 26

ci / test (pull_request) Successful in 42s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

ci / publish-observed (pull_request) Has been skipped

Details

ci / image-build (pull_request) Successful in 36s

Details

1acf2b213c

A branch cut before a composed-sources change failed `image-build` two
thirds of the way through, and the message it printed named a verb that
dies on a checkout with no baked bundles.

The `test` job now bakes the same bundles the image build bakes and runs
the same check, so the drift surfaces in seconds. The Dockerfile check
stays: it is what stops a bad image, and this is what says so early.

The drift message names the merge first, because a branch behind `main`
was the cause in every instance so far, and names `compose-bundles`
before `role-snapshot` so the rebake path actually runs. A missing
bundle directory now says which verb creates it.

`role-drift-check` bakes out of tree. pre-commit walks the filesystem,
so bundles under `agent/bundles` read as this repository's own skills.

Closes #788

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-15 15:29:27 +00:00

coilyco-ops commented

2026-08-15 15:30:17 +00:00

Author

Member

The pre-existing compose-bundles hazard the "Why the new verb bakes out of tree" section refers to is now #800.

The pre-existing `compose-bundles` hazard the "Why the new verb bakes out of tree" section refers to is now #800.

coilyco-ops referenced this pull request

2026-08-15 15:30:26 +00:00

Role snapshot drift is only caught at Dockerfile step 26, and the message names a verb that cannot run #788