665f7f6313
Part 4 of 4 — terminal step of the org.yaml scalability refactor. Each role in the molecule-dev template now owns its own workspace.yaml file, colocated with the existing system-prompt.md / initial-prompt.md / idle-prompt.md / schedules/*.md. Team files shrink to a leader's own definition plus a list of !include refs. ## Platform change `resolveYAMLIncludes` now uses a TWO-ROOT model: - Path resolution is relative to the INCLUDING file's directory (natural sibling + cousin refs, C-include / Sass @import convention). - Security bound is the ORIGINAL org root (`rootDir`), preserved across all recursion depths. Sibling-dir refs like `../my-role/workspace.yaml` from a team file are now allowed (they stay inside the org template); refs that escape the root still error. Regression coverage: new `TestResolveYAMLIncludes_SiblingDirAccess` reproduces the Phase 4 pattern (team file at `teams/x.yaml` referencing `../<role>/workspace.yaml`) — fails without the fix, passes with. ## Template change Atomized 15 child workspaces across 3 team files: - `teams/research.yaml`: 58 → 30 lines; 3 children now !include refs - `teams/dev.yaml`: 222 → 38 lines; 6 children now !include refs - `teams/marketing.yaml`: 143 → 28 lines; 6 children now !include refs Each role now has `<role>/workspace.yaml` colocated with its prompts. Example `frontend-engineer/` directory: frontend-engineer/ ├── workspace.yaml (24 lines — name/role/tier/canvas/plugins/...) ├── system-prompt.md (from earlier phases) ├── initial-prompt.md ├── idle-prompt.md └── (no schedules for this role — but if added, schedules/<slug>.md) ## File-size progression across all 4 phases | State | org.yaml | total `.yaml` in tree | |---|---:|---:| | Before (main) | 1801 lines / 108 KB | 1801 / 108 KB (one file) | | After Phase 1 (#389) | 1687 | 1687 / 101 KB | | After Phase 2 (#390) | 676 | 676 / 35 KB | | After Phase 3 (#393) | 114 | 683 (1 + 6 teams) / 33 KB | | **After this PR** | **114** | **~698** (1 + 6 + 15 workspace) / 35 KB | Aggregate size is flat — the decrease came from prompt externalization in Phases 1/2; Phases 3/4 reorganize structure without adding content. The win is readability and ownership: - Every individual file fits on 1-2 screens. - Adding a new role is now: create `<role>/` dir, add `workspace.yaml` + `system-prompt.md` + prompts, add ONE `!include` line to the team file. No touching of aggregated mega-YAML. - Team files can be reviewed + merged independently. ## Tests All 10 `TestResolveYAMLIncludes_*` tests pass, including the real-template integration test (`TestResolveYAMLIncludes_RealMoleculeDev`) which now walks org.yaml → teams/pm.yaml → teams/research.yaml → ../market-analyst/ workspace.yaml and validates the full 21-role tree unmarshals cleanly. Plus all existing `TestResolvePromptRef` + `TestOrgYAML` + `TestInitialPrompt` suites stay green. ## Ops followup After merging all 4 phases and deploying, the `POST /org/import` endpoint should produce a workspace tree byte-identical to the pre-refactor state. Verify with: diff <(curl POST /org/import before) <(curl POST /org/import after) or by spot-checking: - `/configs/config.yaml` bodies across all 21 workspaces - `workspace_schedules.prompt` row values The externalization is lossless — YAML literal to file and back recovers the same string modulo trailing-whitespace normalization. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
45 lines
2.0 KiB
YAML
45 lines
2.0 KiB
YAML
name: DevOps Engineer
|
|
role: >-
|
|
Owns the container build pipeline: Dockerfiles for all six
|
|
runtime images (langgraph, claude-code, openclaw, crewai,
|
|
autogen, deepagents), docker-compose.infra.yml for the local
|
|
dev stack, and build-all.sh hygiene. Manages GitHub Actions
|
|
CI (platform-build, canvas-build, python-lint,
|
|
mcp-server-build), coverage thresholds, and secrets hygiene
|
|
in the pipeline. Keeps infra/scripts/setup.sh and nuke.sh
|
|
in sync whenever migrations or services change. Escalates to
|
|
Backend Engineer for schema/runtime-config changes and to
|
|
Frontend Engineer for canvas build failures. "Done" means:
|
|
all CI jobs green, all images buildable from a clean checkout,
|
|
no *.log or .env files leaked into image layers.
|
|
tier: 3
|
|
model: opus
|
|
files_dir: devops-engineer
|
|
# #266: HITL gate — DevOps Engineer's scope covers fly deploys,
|
|
# registry pushes, CI pipeline mutations. Any of these going
|
|
# wrong affects every tenant; @requires_approval before
|
|
# destructive infra ops is the point.
|
|
# #280: molecule-skill-code-review — self-review rubric for
|
|
# Dockerfiles, CI workflows, infra scripts before PR.
|
|
# #322: molecule-freeze-scope — lock edits to infra/** during
|
|
# risky operations (CI migrations, fly secret rotations, image
|
|
# rebuilds). Plugin was an orphan for 3 weekly audits; DevOps
|
|
# is the natural home.
|
|
plugins: [molecule-hitl, molecule-skill-code-review, molecule-freeze-scope]
|
|
# #247: notify on build-break — DevOps routes CI failures + infra
|
|
# alerts via Telegram so they're not invisible until morning review.
|
|
channels:
|
|
- type: telegram
|
|
config:
|
|
bot_token: ${TELEGRAM_BOT_TOKEN}
|
|
chat_id: ${TELEGRAM_CHAT_ID}
|
|
enabled: true
|
|
idle_interval_seconds: 600
|
|
schedules:
|
|
- name: Hourly channel expansion survey
|
|
cron_expr: "47 * * * *"
|
|
enabled: true
|
|
prompt_file: schedules/hourly-channel-expansion-survey.md
|
|
initial_prompt_file: initial-prompt.md
|
|
idle_prompt_file: idle-prompt.md
|