dc83cb2117
5 _roles/*.toml per locked §Initial role inventory:
- read-only → tools::read-only + output::report-format + severity-grade
- explorer → read-only caps + tools::cargo-only-bash
- edit-local → no-git-ops + scope::files-{white,deny}list + quality::*
+ safety::no-dep-bump + output::report-format
- edit-shared → edit-local caps + relaxed SSoT whitelist (task-time param)
+ escalation tightened to orchestrator-notify
- git-ops → spawnable = false, documentation-only
All 11 capability names referenced match phase-1 deliverable path
_capabilities/<cat>/<slug>/ (cross-ref verified before commit).
docs/AGENT-ROLES.md (223 LOC) — human-readable matrix: per-role sections
+ cross-role capability matrix + explicit non-spawnable-git-ops block.
Drift note for orchestrator integration review: edit-local/edit-shared
use inline bash-patterns-allowed = ['^cargo( |$)', '^mkdir( |$)',
'^rm -rf /tmp/'] instead of composing with tools::cargo-only-bash
capability (extra patterns not in that atom). Agent footnoted —
resolution deferred to post-integration (either parameterize the cap
or introduce tools::cargo-plus-basic-bash variant).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
29 lines
1.1 KiB
TOML
29 lines
1.1 KiB
TOML
[role]
|
|
name = "edit-shared"
|
|
display-name = "code-implementer (shared-SSoT edit scope)"
|
|
description = "Same baseline as edit-local, with one relaxed scope entry permitting edits to a task-specified SSoT path (e.g. workspace Cargo.toml, registry file). The relaxation is configured per task via `[scope].files-whitelist` in task.toml."
|
|
spawnable = true
|
|
|
|
[capabilities]
|
|
# Ordered list — text.md fragments concatenated in this order
|
|
# Identical to edit-local; the SSoT relaxation rides on scope::files-whitelist
|
|
# parameterization in task.toml, not on a separate capability.
|
|
required = [
|
|
"policy::no-git-ops",
|
|
"scope::files-whitelist",
|
|
"scope::files-denylist",
|
|
"quality::constructor-pattern",
|
|
"quality::cargo-check-green",
|
|
"quality::tests-green",
|
|
"safety::no-dep-bump",
|
|
"output::report-format",
|
|
]
|
|
|
|
[tools]
|
|
# Tool allowlist — anything not in this list is denied
|
|
allowed = ["Read", "Write", "Edit", "Glob", "Grep", "Bash"]
|
|
bash-patterns-allowed = ['^cargo( |$)', '^mkdir( |$)', '^rm -rf /tmp/']
|
|
|
|
[escalation]
|
|
# Tightened vs edit-local: SSoT edits notify orchestrator on any unclear case
|
|
policy = "orchestrator-notify"
|