feat(config): add role_sync.role_source flag (proposal 010 PR-1) - #75
Merged
Merged
Conversation
Lands the foundational config flag for proposal 010 — bi-directional file ↔ CRD sync for role definitions. PR-1 is intentionally inert: no behaviour change in the operator reconciler or role_loader. This PR adds the surface so PR-2/PR-3/PR-4 can switch on it. Changes: * New `RoleSyncConfig` Pydantic model in `acc/config.py` with three fields: `role_source: files | crd | mirror | auto`, `conflict_window_s: float = 2.0`, `events_subject: str = "acc.role.sync"`. * Attached to `ACCConfig` as `role_sync: RoleSyncConfig`. * `_resolve_role_source` model-validator replaces the literal `auto` with the deploy-mode default — `standalone → files`, `edge → mirror`, `rhoai → crd`. Resolution table is a module-level constant (`_ROLE_SOURCE_BY_DEPLOY_MODE`) so it's observable and testable. * Three env-var overrides: `ACC_ROLE_SOURCE`, `ACC_ROLE_SYNC_CONFLICT_WINDOW_S`, `ACC_ROLE_SYNC_EVENTS_SUBJECT`. * The TUI Configuration screen (pane 8) surfaces the resolved value read-only — operators see e.g. "Role sync: files (deploy_mode=standalone; proposal 010)" under the LLM backend summary. Test coverage: 12 new tests in `tests/test_config.py` covering default resolution per deploy_mode, explicit-override preservation, env-var roundtrip, invalid-value rejection, and a meta-test that fails if a future deploy_mode gets added without updating the resolver table. Plus an assertion in the existing Configuration pilot test that the new "Role sync" label is rendered. Total: +251 / -2 LOC across 5 files. Well under the 800-LOC PR budget. Risk: low — additive field with safe default, no existing caller broken. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced May 14, 2026
flg77
added a commit
that referenced
this pull request
Jun 15, 2026
…lidation (#75) * feat(operator): assistant concierge by default + hybrid role-catalogue validation (023b) Every AgentCollective now ships an `assistant` by default — the mutating webhook injects it into spec.agents when absent (opt out via spec.disableAssistant). It is the governed entry point for onboarding, catalogue queries and PROPOSE_INFUSE routing (proposal 023 §4b / 021 C3). Injecting `assistant` surfaced a latent bug: the validating webhook hard-rejected any role not in the compiled-in known_roles.txt, but that file (a) predated the ecosystem-split cutover — still listing the 43 movable pack roles, which validated only by accident — and (b) was missing 3 in-tree CONTROL roles (assistant, orchestrator, reviewer), so declaring `reviewer` was rejected. Naively re-running gen-catalogue would have shrunk the catalogue to the in-tree set and rejected ALL pack roles. Fix = HYBRID validation: regenerate known_roles.txt from in-tree roles/ (the 7 built-in CONTROL roles); a spec.agents role is accepted if it is a built-in, hard-rejected only if it is a near-typo of a built-in (edit-distance <= 2 via rolecatalogue.NearestWithin), and allowed with an admission warning otherwise (plausibly provided by an installed package — the operator cannot know the pack set at admission time). Scaling overrides no longer re-check catalogue membership (only that the target is declared in spec.agents). Deferred to the A2A-serving slice: Kagenti AgentCard label default-on for the assistant + per-role card Service (premature until the A2A adapter serves /.well-known/agent-card.json and SPIRE signs it — see kagenti.go). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(operator): regen deepcopy + CRD for disableAssistant (023b, acc1) controller-gen object + manifests output for the new AgentCollectiveSpec.DisableAssistant field. Generated in the acc1 ubi10/go-toolset:10.0 gate. Only the deepcopy block and the agentcollectives CRD changed; config/rbac/role.yaml is hand-curated (make manifests clobbers it) and the acccatalogs/accpackageinstalls CRD drift is pre-existing and unrelated, so both are deliberately left out of this PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
flg77
added a commit
that referenced
this pull request
Jun 15, 2026
0.2.0 rolls up the RHOAI-maturity wave merged to main today: - #79 agent podspec SCC-compatible (drops pinned runAsUser:1001) → unblocks agent pods on OpenShift restricted-v2 (the 0-agent-pods finding) - #80 AccPackageInstall execs `python3 -m acc.cli` → fixes pack infusion (bare acc-cli console script is not on the non-login kubectl-exec $PATH) - #76 CollectiveStatus.SharedModel surfacing ("model: shared from acc-system") - #75 assistant concierge default-injection + hybrid role-catalogue validation - #74 acc-webgui (Keycloak OIDC) + acc-tui — spec.webgui/spec.tui instantiable CSV name/version → v0.2.0, replaces v0.1.6, image refs → :0.2.0. acc1 builds the image + bundle + index (FROM_INDEX 0.1.6) and redeploys on sandbox1154 to clear the agent pods and the pack-install failures. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First PR of proposal 010 — bi-directional file ↔ CRD sync for role definitions. This PR is intentionally inert: it lands the config surface only. PR-2/PR-3/PR-4 will switch on the resolved
role_sourceto actually enable the sync paths.Adds:
RoleSyncConfigPydantic model withrole_source(files | crd | mirror | auto),conflict_window_s,events_subject._resolve_role_sourcemodel-validator replacesautowith the per-deploy_modedefault:deploy_moderole_sourcestandalonefilesedgemirrorrhoaicrdThree env-var overrides:
ACC_ROLE_SOURCE,ACC_ROLE_SYNC_CONFLICT_WINDOW_S,ACC_ROLE_SYNC_EVENTS_SUBJECT.The TUI Configuration screen surfaces the resolved value read-only under the LLM backend summary.
Test plan
pytest tests/test_config.py -v— 42/42 green (12 new)pytest tests/test_configuration_screen_pilot.py tests/test_tui_screens.py— 39/39 green_ROLE_SOURCE_BY_DEPLOY_MODEmatches §4 of proposal 010Proposal 010 reference
Vault path:
C:\Users\micro\Documents\Notes\Notes\Development\AgenticCellCorpus\ACC Implementation\010 - Bi-directional file-CRD sync for role definitions.mdStatus: Signed off 2026-05-14.
🤖 Generated with Claude Code