arkaos 4.14.2 → 4.14.3

package/VERSION

@@ -1 +1 @@
-4.14.2
+4.14.3

package/config/agent-roster.json

@@ -0,0 +1,36 @@
+{
+  "_meta": {
+    "generator": "core/agents/roster_manifest.py",
+    "purpose": "every specialist-gate owner resolves to a dispatchable agent source; installer/skill-deploy.js deploys these"
+  },
+  "gate_owners": {
+    "architect": {
+      "compiled": false,
+      "source": "departments/dev/agents/architect.md"
+    },
+    "backend-dev": {
+      "compiled": true,
+      "source": "config/claude-agents/backend-dev.md"
+    },
+    "dba": {
+      "compiled": true,
+      "source": "config/claude-agents/dba.md"
+    },
+    "devops-eng": {
+      "compiled": true,
+      "source": "config/claude-agents/devops-eng.md"
+    },
+    "frontend-dev": {
+      "compiled": false,
+      "source": "departments/dev/agents/frontend-dev.md"
+    },
+    "security-eng": {
+      "compiled": true,
+      "source": "config/claude-agents/security-eng.md"
+    },
+    "senior-dev": {
+      "compiled": false,
+      "source": "departments/dev/agents/senior-dev.md"
+    }
+  }
+}

package/core/agents/roster_manifest.py

@@ -0,0 +1,114 @@
+"""Agent roster manifest — every gate owner must be dispatchable.
+
+Root cause this kills (operator incident, 2026-07-12): the specialist
+gate blocked a lead from writing ``app/Http/Controllers/`` and told it
+to dispatch ``senior-dev`` or ``backend-dev`` — but 4 of the 7 owners
+named in ``config/agent-ownership.yaml`` (backend-dev, dba, devops-eng,
+security-eng) were NOT dispatchable on real machines: they exist only
+as department YAML, and the installer's agent deploy only ships ``.md``
+files. A gate that demands an owner nobody can invoke is a dead end,
+and dead ends teach sessions to rationalize bypasses.
+
+This module is the single writer of ``config/agent-roster.json``:
+
+    python -m core.agents.roster_manifest
+
+For every owner the ownership rules name, it resolves a dispatchable
+source — a hand-authored ``departments/*/agents/<slug>.md`` (legacy,
+wins because it may be hand-tuned) or the compiled
+``config/claude-agents/<slug>.md`` (generated from the agent YAML by
+the behavioral compiler) — and REFUSES to emit when neither exists:
+a missing source is a build-time failure, never a runtime dead end.
+``installer/skill-deploy.js`` reads the manifest and deploys every
+gate owner; ``tests/python/test_agent_roster.py`` drift-gates it.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+import yaml
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+OWNERSHIP_YAML = REPO_ROOT / "config" / "agent-ownership.yaml"
+COMPILED_DIR = REPO_ROOT / "config" / "claude-agents"
+DEPARTMENTS_DIR = REPO_ROOT / "departments"
+ROSTER_JSON = REPO_ROOT / "config" / "agent-roster.json"
+
+_NAME_RE = re.compile(r"^name:\s*(\S+)\s*$", re.MULTILINE)
+
+
+def gate_owners() -> list[str]:
+    """Every owner slug the ownership rules can demand (never ``*``)."""
+    config = yaml.safe_load(OWNERSHIP_YAML.read_text(encoding="utf-8"))
+    return sorted({
+        owner
+        for rule in config["ownership"]
+        for owner in (rule.get("owners") or [])
+        if owner != "*"
+    })
+
+
+def _frontmatter_name(md_path: Path) -> str | None:
+    match = _NAME_RE.search(md_path.read_text(encoding="utf-8")[:2000])
+    return match.group(1) if match else None
+
+
+def _resolve_source(slug: str) -> Path | None:
+    """Dispatchable source for a slug: hand-authored dept .md wins,
+    compiled claude-agents .md is the generated fallback."""
+    for candidate in sorted(DEPARTMENTS_DIR.glob(f"*/agents/{slug}.md")):
+        if _frontmatter_name(candidate) == slug:
+            return candidate
+    compiled = COMPILED_DIR / f"{slug}.md"
+    if compiled.is_file() and _frontmatter_name(compiled) == slug:
+        return compiled
+    return None
+
+
+def build_roster() -> dict:
+    owners = gate_owners()
+    entries: dict[str, dict] = {}
+    ghosts: list[str] = []
+    for slug in owners:
+        source = _resolve_source(slug)
+        if source is None:
+            ghosts.append(slug)
+            continue
+        entries[slug] = {
+            "source": str(source.relative_to(REPO_ROOT)),
+            "compiled": source.parent == COMPILED_DIR,
+        }
+    if ghosts:
+        raise ValueError(
+            f"ownership rules demand owners with NO dispatchable source: "
+            f"{ghosts} — author the agent (YAML + compiler run) or fix "
+            f"config/agent-ownership.yaml; a gate must never demand an "
+            f"owner nobody can invoke"
+        )
+    return {
+        "_meta": {
+            "generator": "core/agents/roster_manifest.py",
+            "purpose": (
+                "every specialist-gate owner resolves to a dispatchable "
+                "agent source; installer/skill-deploy.js deploys these"
+            ),
+        },
+        "gate_owners": entries,
+    }
+
+
+def render() -> str:
+    return json.dumps(build_roster(), indent=2, sort_keys=True) + "\n"
+
+
+def main() -> int:
+    ROSTER_JSON.write_text(render(), encoding="utf-8")
+    print(f"agent roster written: {ROSTER_JSON}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/installer/skill-deploy.js

@@ -135,13 +135,47 @@ export function deploySkills({
 
   // ── Agent personas ──────────────────────────────────────────────────
   if (agentsBase) {
-    counts.agents = deployAgents(deptRoot, agentsBase);
+    const written = new Set();
+    counts.agents = deployAgents(deptRoot, agentsBase, written);
+    // Gate owners (F2 specialist-gate P0): every owner the ownership
+    // rules can demand MUST be dispatchable. 4 of 7 owners existed only
+    // as department YAML (never deployed — the agent loop above ships
+    // .md only), so the gate told sessions to dispatch agents nobody
+    // could invoke. The generated config/agent-roster.json maps each
+    // owner to a dispatchable source; hand-authored dept .md files win
+    // (already deployed above), compiled ones fill the gaps.
+    counts.agents += deployGateOwners(repoRoot, agentsBase, written);
   }
 
   log(counts);
   return counts;
 }
 
+function deployGateOwners(repoRoot, agentsBase, written) {
+  let roster;
+  try {
+    roster = JSON.parse(readFileSync(
+      join(repoRoot, "config", "agent-roster.json"), "utf-8"));
+  } catch {
+    return 0; // older core without the roster — dept loop already ran
+  }
+  let deployed = 0;
+  for (const [slug, entry] of Object.entries(roster.gate_owners || {})) {
+    const target = `arka-${slug}.md`;
+    if (written.has(target)) continue; // dept .md won this run
+    const src = join(repoRoot, entry.source);
+    if (!existsSync(src)) continue;
+    try {
+      copyFileSync(src, join(agentsBase, target));
+      written.add(target);
+      deployed++;
+    } catch {
+      // One unreadable agent must not break the deploy.
+    }
+  }
+  return deployed;
+}
+
 function loadCuratedFilter(repoRoot) {
   try {
     const manifest = JSON.parse(readFileSync(
@@ -156,14 +190,14 @@ function loadCuratedFilter(repoRoot) {
   }
 }
 
-function deployAgents(deptRoot, agentsBase) {
+function deployAgents(deptRoot, agentsBase, written = new Set()) {
   mkdirSync(agentsBase, { recursive: true });
   let deployed = 0;
   for (const dept of listSubdirs(deptRoot)) {
     const agentsSrc = join(deptRoot, dept, "agents");
     if (!existsSync(agentsSrc)) continue;
     try {
-      deployed += deployDeptAgents(agentsSrc, agentsBase);
+      deployed += deployDeptAgents(agentsSrc, agentsBase, written);
     } catch {
       // Unreadable agents dir — skip the department, not the deploy.
     }
@@ -171,7 +205,7 @@ function deployAgents(deptRoot, agentsBase) {
   return deployed;
 }
 
-function deployDeptAgents(agentsSrc, agentsBase) {
+function deployDeptAgents(agentsSrc, agentsBase, written) {
   let deployed = 0;
   for (const file of readdirSync(agentsSrc)) {
     if (!file.endsWith(".md")) continue;
@@ -181,8 +215,9 @@ function deployDeptAgents(agentsSrc, agentsBase) {
     } catch {
       continue;
     }
-    copyFileSync(
-      srcFile, join(agentsBase, `arka-${file.replace(/\.md$/, "")}.md`));
+    const target = `arka-${file.replace(/\.md$/, "")}.md`;
+    copyFileSync(srcFile, join(agentsBase, target));
+    written.add(target);
     deployed++;
   }
   return deployed;

package/knowledge/skills-manifest.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "generator": "scripts/marketplace_gen.py",
-    "version": "4.14.2",
+    "version": "4.14.3",
     "marketplace": "arkaos"
   },
   "structural": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "4.14.2",
+  "version": "4.14.3",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "4.14.2"
+version = "4.14.3"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}