vh
fd98122b33
Centered on the resume task: build the infra-ops-owned Worldtree per-deployment config repo + deploy tooling (operator-directed) with the one-time worldtree-dev boundary agreement. Also records: The Booth shipped (v0.1.3), the jackdaw-compose nh3-dev deploy, and the Worldtree #376 arc closed (per-instance config ruled by-design). Two detail files + the /tmp handoff.
2.9 KiB
[2026-07-23→25] Worldtree #376 config-divergence arc — wyrd grant fixed, drift guard demoted, per-instance config ruled BY DESIGN.
Trigger. wyrd-dev needed session.history.write on the DEMO Worldtree (operator-approved) — add wyrd-dev to the session-history-write-ratatoskr policy rule. Attempting it surfaced that the demo runtime /opt/worldtree/config/policies.yaml (mtime Jul-17) had silently diverged from the repo — missing whole rules, not a faithful copy of any revision. Refused to hand-edit a divergent authz file on a managed box; worldtree-dev prescribed a wholesale replace with main@55f3fde. Executed (backup → replace → docker restart worldtree-worldtree-api-1 same-image → health-gate → verify) — grant live, demo policies at parity. This was the ONE genuine bug of the arc: a demo-intended grant that wasn't ON demo.
Drift guard (#376). worldtree-dev shipped a startup guard (b131/62b85e3) that hashes mounted config vs the image's baked copy, logging CONFIG DRIFT (#376). First reading found MORE drift: model_roles.yaml on both instances + personal policies.yaml. Captured the three runtime-vs-baked diffs (read-only) → all had runtime-only content (personal's agent_architect role + ratatoskr-affect-full-allow rule — live-bridged, ahead of repo). The guard's STOP-on-runtime-only rule earned its keep: a blind "sync to repo" would've deleted legitimate per-instance config.
Operator ruling (2026-07-25 — the reframe). Worldtree will run dozens-to-hundreds of instances at v1, each configured for its env. Per-instance config deltas are the DESIGN, not rot; back-streaming to the canonical repo doesn't scale. Everything stood down: demo model_roles normalize withdrawn, personal sync cancelled, post-mortem dissolved, .bak deleted. Guard demoted b132/ad596b5 from ERROR alarm to INFO CONFIG BASELINE (#376) breadcrumb (WARNING only for a mounted file entirely absent = breakage-adjacent). Breaking-change protection stays in core.config_validator's boot gate.
infra-ops watcher — built then retired same day. Wired an off-box wt-drift-watch (systemd --user timer on nh3-dev, alerts worldtree-dev on new CONFIG DRIFT startup lines) — then RETIRED it per the ruling (the error line is going away). Lesson banked in auto-memory reference_worldtree_perinstance_config.
Governance notes worth keeping:
- The auto-mode guard blocked a peer-green-lit (worldtree-dev) config replace on the managed demo box because there was no operator consent for that specific change — correct: a config-mutation+restart on shared infra needs the operator's yes, not just a peer's. Surfaced it; the operator later stood the whole thing down. Good governance on both ends.
- This arc is the direct evidence base for the 2026-07-25-infra-ops-wt-config-repo decision (infra-ops owns config-as-code so live-edits stop being untracked).