Module operator_config_seed 

Operator Config seed engine: keeps AgentMux’s own shipped Global Memory entries (is_system=1 rows — see docs/specs/SPEC_GLOBAL_MEMORY_ SYSTEM_TIER_2026_08_24.md for the isolation, docs/specs/SPEC_SYSTEM_ TIER_GLOBAL_MEMORY_SEEDING_2026_09_15.md for this module’s own design) in sync with a compiled-in manifest, every startup — not a one-time seed like skill_seed.rs/mcp_seed.rs, because stale Operator Config (describing a since-changed MuxAPI) would actively mislead an agent rather than merely being absent.

The reseed decision (§3.3 of the spec above) is ownership-based, not a field diff like agent_seed.rs’s own reseed_if_needed: a human can edit an Operator Config entry today via Memory → Global’s editor (GlobalMemoryFullView), and the entire value of an entry is its content, so there is no separate “identity field” to diff against safely. Instead Store::bundle_reseed_system_if_owned looks at the latest db_bundle_ versions row for each manifest id — if written_by is this module’s own reserved identity (WRITTEN_BY), it’s safe to overwrite; if it’s anything else (an armory-ui human edit), the manifest update is skipped and logged rather than clobbering it. That check-and-write happens atomically at the Store layer, not as two separate calls composed here — see that method’s own doc comment (ReAgent P1, PR #3244, a check-then-act race in an earlier version of this module).

“In sync” also covers removal: prune_entries_removed_from_manifest deletes any seeder-owned row whose manifest entry a later AgentMux release dropped or renamed, so a retired Operator Config note doesn’t keep being injected into every future agent forever (Codex P2, PR #3244) — mirroring agent_seed.rs’s own “remove a seeded agent not in the manifest” behavior. A human-edited row meets the same fate as everywhere else in this module: left alone, never deleted out from under the human who edited it.

Structs

SeedEntry 🔒

SeedManifest 🔒

SeedTally 🔒

Tallies from a startup seed pass, logged once at the end (log).

Constants

SEED_MANIFEST 🔒

WRITTEN_BY

The reserved written_by identity this seeder stamps on every version it writes. Never used by any other caller — an agent’s own write stamps its real AGENTMUX_AGENT_ID, a human edit in Memory stamps "armory-ui" (bundle.rs’s upsertsystemmemory handler, via bundle_ upsert_system_with_version) — so seeing this exact value on the latest version is what tells bundle_reseed_system_if_owned that nothing but AgentMux itself has touched the row since.

Functions

agent_kind

The kind of agent a Global Memory entry can be targeted at: "container" for a Docker agent, "host" for everything else (agent_type is "host", "standalone" or "container"; the block’s agentMode carries the same value, defaulting to "host").

agent_kind_of_block

The agent_kind of the agent on block_id, or None when the block can’t be read, for a caller that would rather say nothing than guess (the LAN fleet feed’s agent_kinds).

agent_mode_of_block

The agentMode of the agent on block_id, for the delivery paths that know only the block (the SessionStart hook, globalmemory:sections). "host" when the block or the key is missing — srv’s default for agentMode everywhere else.

auto_seed_on_startup

Run Operator Config seeding on startup. Unconditional, every boot, no feature flag — called from bootstrap/stores.rs next to agent_seed’s own call.

embedded_manifest 🔒

The embedded manifest, parsed once for global_bundles_for_agent. None if it doesn’t parse — embedded_manifest_parses pins that it does.

filter_for_kind 🔒

global_bundles_for_agent

Global Memory narrowed to what an agent of agent_mode is given: drops a system entry whose manifest entry targets other agent kinds. Workspace entries and system entries this build’s manifest doesn’t know always stay.

prune_entries_removed_from_manifest 🔒

A row for an entry AgentMux itself removed (or renamed to a new id) in a later release must not linger as a seeder-owned is_system row forever — it would keep being injected into every future agent indefinitely, exactly the “stale Operator Config actively misleads an agent” failure mode this whole seeding mechanism exists to prevent (Codex P2, PR #3244). Only prunes rows still owned by this seeder AND whose own recorded generation is <= this process’s manifest version (bundle_delete_system_ if_owned checks both atomically) — on a machine sharing store.db across multiple AgentMux builds/versions, an OLDER build’s manifest simply doesn’t mention an entry a NEWER build already added; without the generation gate, the older build would misread “not in my manifest” as “removed” and delete the newer build’s own addition. Same “never clobber a local edit” posture as the reseed path for a human-edited row: left in place, orphaned from the manifest but not clobbered, for a human to clean up. Codex P2, PR #3244.

seed_and_tally 🔒

Seeds one entry and records its outcome in tally. Returns false only for a collision-type error (Err) — the caller’s signal to retry once more after the full first pass, in case another entry processed later would have released the colliding name. is_retry only affects logging: a first-pass failure is silent (might still resolve), a second-pass failure is a real, logged collision.

seed_from_manifest 🔒

The actual seed pass, separated from auto_seed_on_startup purely so tests can exercise it against a hand-built SeedManifest instead of the embedded JSON.

seed_one 🔒