Observed (SE run #633 production rollout, 2026-08-11)
On all three peer production deploys of a95a868 (newhart, victoria, graybeard), the #569 refusal guard correctly declined to run agent_chat migrations against the production bus as a non-superuser — but its exit 1 aborted the rest of the installer. Graybeard's run confirms cognition steps after the agent_chat section were skipped entirely: turn-context, self-awareness, bootstrap-context, and agent_config_sync were not re-synced/rebuilt. He restarted the gateway manually.
Harmless THIS rollout (none of the skipped components changed in PR #572), but on any future release that touches both agent_chat and later cognition components, per-agent prod installs will silently deploy half the payload and exit 1.
Expected
The refusal guard should refuse the migration step and continue the remaining install steps (skip-and-warn), with a clear summary at the end ("agent_chat migrations skipped: production DB, non-superuser — run centrally"). Exit code policy: arguably still non-zero to signal partial completion, but remaining steps must run.
Refs
Observed (SE run #633 production rollout, 2026-08-11)
On all three peer production deploys of a95a868 (newhart, victoria, graybeard), the #569 refusal guard correctly declined to run agent_chat migrations against the production bus as a non-superuser — but its exit 1 aborted the rest of the installer. Graybeard's run confirms cognition steps after the agent_chat section were skipped entirely: turn-context, self-awareness, bootstrap-context, and agent_config_sync were not re-synced/rebuilt. He restarted the gateway manually.
Harmless THIS rollout (none of the skipped components changed in PR #572), but on any future release that touches both agent_chat and later cognition components, per-agent prod installs will silently deploy half the payload and exit 1.
Expected
The refusal guard should refuse the migration step and continue the remaining install steps (skip-and-warn), with a clear summary at the end ("agent_chat migrations skipped: production DB, non-superuser — run centrally"). Exit code policy: arguably still non-zero to signal partial completion, but remaining steps must run.
Refs