mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.8
08a6dd157c
Requirement 034 inverts the isolation model of the other agent roles: the boundary is the whole machine rather than a kernel boundary inside it. Adding this role to a device switches the agent from isolated to embodied. The agent then runs privileged with exactly the devices from ROBOT_DEVICE_ALLOWLIST bound into its container, and the kernel-isolating runtime is dropped, because a microVM between the agent and the hardware it is meant to drive defeats the purpose. The allowlist lives in group_vars so the agent templates can read it; a role variable is not visible across roles. The admission checks run inside the agent role before it deploys rather than in this role afterwards. The agent is declared shared, so the service loader brings it up during the constructor stage while svc-ai roles only run at the following step; a check placed here would sit behind the deployment it exists to prevent. The dedicated-device check now compares against something group_names actually carries: any other web-app role on the host. The previous list held Docker node labels, which are a different namespace from Ansible inventory groups, so that intersection could never match and the failure message always blamed a multi-node swarm. Which agent embodies the device follows from the topology: both agent flags take the dynamic in-group_names form, Hermes Agent wins when both are present, and the matrix pins one per round so neither path rots. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
6 lines
119 B
YAML
6 lines
119 B
YAML
---
|
|
- include_tasks: 00_core.yml
|
|
when: run_once_svc_ai_robot is not defined
|
|
vars:
|
|
application_id: svc-ai-robot
|