18b7ab96e7
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
2.2 KiB
Markdown
54 lines
2.2 KiB
Markdown
# Mosaic Fleet Rosters
|
|
|
|
The local fleet canary uses a product-owned roster schema with site-owned roster
|
|
files. Product examples live here; active local rosters should live outside the
|
|
package, normally at:
|
|
|
|
```text
|
|
~/.config/mosaic/fleet/roster.yaml
|
|
```
|
|
|
|
The default tmux socket is `mosaic-fleet` so fleet commands do not touch the
|
|
default tmux server. The roster is the desired-state authority; generated environment files are
|
|
rebuildable projections, never a second source of configuration.
|
|
|
|
## Examples
|
|
|
|
- `examples/minimal.yaml` starts one local canary slot.
|
|
- `examples/local-canary.yaml` starts a small generic dogfood fleet.
|
|
- `examples/operator-interaction.yaml` is an example Pi operator-interaction
|
|
service; replace its example agent name before provisioning.
|
|
|
|
## Operator interaction service
|
|
|
|
`services/operator-interaction.yaml` pins the Pi runtime, GPT-5.6 Sol model,
|
|
high reasoning, and the `operator-interaction` tool policy. The agent identity
|
|
is provisioning data: choose a roster name, generate its per-agent environment
|
|
file, then start the matching generic systemd instance. The service fails before
|
|
launch if the configured identity does not match the instance or any pinned
|
|
policy field drifts.
|
|
|
|
The installed `tools/fleet/print-interaction-effective-policy.sh` prints only
|
|
the resolved name, runtime, model, reasoning, and tool policy. It never reads
|
|
or prints credential variables.
|
|
|
|
## Generated agent environment boundary
|
|
|
|
`mosaic fleet install` writes a private deterministic projection at
|
|
`~/.config/mosaic/fleet/agents/<agent>.env.generated`. It may relocate only approved local machine
|
|
data to `<agent>.env.local`; generated keys, arbitrary commands, secret-like keys, duplicate keys,
|
|
unknown keys, and unsafe permissions fail before a tmux session is created. Legacy `.env` input is
|
|
regenerated, relocated, or quarantined and is not a launch authority.
|
|
|
|
See [`docs/fleet/reference/generated-env-boundary.md`](../../../../docs/fleet/reference/generated-env-boundary.md)
|
|
for allowed local keys and the USC downstream interface evidence.
|
|
|
|
Initialize a roster:
|
|
|
|
```bash
|
|
mosaic fleet init --profile minimal --write
|
|
mosaic fleet install-systemd
|
|
mosaic fleet start
|
|
mosaic fleet verify
|
|
```
|