## Summary
- add a generic rostered Pi operator-interaction systemd service pinned to GPT-5.6 Sol high
- carry the chosen agent name as roster/environment data; the committed product name is example-only
- expose a credential-safe effective policy and fail fast on identity or policy drift
## Verification
- pnpm typecheck
- pnpm lint
- pnpm format:check
- pnpm test
- fleet systemd and launcher shell suites
- Codex code and security reviews: approved, no findings
Refs #708
VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head c58e86e2b9
Evidence:
Exact PR/branch head verified: c58e86e2b944b76461b6f8cbfff07a0c9d8e5bf2.
PR CI green on exact head: ci/woodpecker/pr/ci pipeline 1728 success.
NAME-AS-CONFIG invariant holds: implementation/service/schema/tool files use generic interaction / operator-interaction naming and carry identity as data (MOSAIC_AGENT_NAME, %i, roster env, agentName). No implementation default/source constant/schema key/service identifier hardcodes tess as the agent identity; Tess is confined to the example roster and test/doc references.
Nova case exists and is meaningful: tess-service-profile.test.ts provisions Nova, verifies roster agent + effective policy, rewrites the example roster from Tess to Nova, runs the effective-policy script, and would fail if the service/profile were hardcoded to one agent name.
AC-TESS-03 verified: runtime pi, model openai/gpt-5.6-sol, reasoning high, and tool policy operator-interaction are pinned by profile/startup checks; bad/missing model/reasoning/policy fails fast instead of silently defaulting.
Observable effective policy is credential-safe: print-interaction-effective-policy.sh emits only agentName/runtime/model/reasoning/toolPolicy and does not inspect or output credential variables.
Launch hardening rejects unsafe agent names, mismatched service instance identity, model/runtime/reasoning/tool-policy drift, and invalid reasoning before tmux launch.
git diff --check clean; no live credential material in diff.
VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head c58e86e2b944b76461b6f8cbfff07a0c9d8e5bf2
Evidence:
- Exact PR/branch head verified: `c58e86e2b944b76461b6f8cbfff07a0c9d8e5bf2`.
- PR CI green on exact head: `ci/woodpecker/pr/ci` pipeline 1728 success.
- NAME-AS-CONFIG invariant holds: implementation/service/schema/tool files use generic `interaction` / `operator-interaction` naming and carry identity as data (`MOSAIC_AGENT_NAME`, `%i`, roster env, `agentName`). No implementation default/source constant/schema key/service identifier hardcodes `tess` as the agent identity; `Tess` is confined to the example roster and test/doc references.
- Nova case exists and is meaningful: `tess-service-profile.test.ts` provisions `Nova`, verifies roster agent + effective policy, rewrites the example roster from `Tess` to `Nova`, runs the effective-policy script, and would fail if the service/profile were hardcoded to one agent name.
- AC-TESS-03 verified: runtime `pi`, model `openai/gpt-5.6-sol`, reasoning `high`, and tool policy `operator-interaction` are pinned by profile/startup checks; bad/missing model/reasoning/policy fails fast instead of silently defaulting.
- Observable effective policy is credential-safe: `print-interaction-effective-policy.sh` emits only agentName/runtime/model/reasoning/toolPolicy and does not inspect or output credential variables.
- Launch hardening rejects unsafe agent names, mismatched service instance identity, model/runtime/reasoning/tool-policy drift, and invalid reasoning before tmux launch.
- `git diff --check` clean; no live credential material in diff.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Verification
Refs #708
VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head
c58e86e2b9Evidence:
c58e86e2b944b76461b6f8cbfff07a0c9d8e5bf2.ci/woodpecker/pr/cipipeline 1728 success.interaction/operator-interactionnaming and carry identity as data (MOSAIC_AGENT_NAME,%i, roster env,agentName). No implementation default/source constant/schema key/service identifier hardcodestessas the agent identity;Tessis confined to the example roster and test/doc references.tess-service-profile.test.tsprovisionsNova, verifies roster agent + effective policy, rewrites the example roster fromTesstoNova, runs the effective-policy script, and would fail if the service/profile were hardcoded to one agent name.pi, modelopenai/gpt-5.6-sol, reasoninghigh, and tool policyoperator-interactionare pinned by profile/startup checks; bad/missing model/reasoning/policy fails fast instead of silently defaulting.print-interaction-effective-policy.shemits only agentName/runtime/model/reasoning/toolPolicy and does not inspect or output credential variables.git diff --checkclean; no live credential material in diff.