Description
Every developer is assumed to be Claude Code: Terraform creates a Cognito user per developer, render.py gives every dev container the gateway dependency, managed settings and claude volumes, the gateway pushes the AGENTO11Y_* env, and dev-session/dev-loop/dev-reseed/entrypoint.sh are Claude-specific. Each new agent needs the same seams, so they are built once here and the agent tasks plug into them. This task owns agent-host/render/render.py, agent-host/SEAM.md, terraform/variables.tf, terraform/locals.tf, terraform/aws-cognito.tf and the shared parts of apps/dev-workstation (entrypoint.sh, bin/dev-loop, bin/dev-session); other subtasks of AIO-0005 add agent-specific pieces through it. render.py is in the host bundle, so its edits replace the host on apply: do not apply this alone, it ships in the single rollout (AIO-0005.08). See doc-0002 “Cross-cutting facts”.
Acceptance Criteria
- #1 terraform developers objects take agent = optional(string, “claude-code”) validated against the supported set, and an all-Claude roster produces no plan change other than the new secret/config keys
- #2 Cognito users, passwords, group memberships and gateway spend caps are created only for claude-code developers, and agent_host_config tolerates developers without a Cognito sub
- #3 render.py renders a non-Claude developer service without the gateway dependency, managed-settings mount, CA mounts or claude volumes, with its own home volume and file secrets, and renderer tests show an all-Claude roster renders byte-identical compose
- #4 The AGENTO11Y_* env block that gateway_config builds is factored into one source used for both the gateway and non-Claude containers, and non-Claude containers receive it as ~/.config/agento11y/config.env with static AGENTO11Y_TAGS (service.namespace, team) and per-developer AGENTO11Y_USER_ID; auto coding-agent repo and branch tags stay off
- #5 Prompt picking, recent-prompt dedupe, follow-up, abandon, PII-burst and the event=dev_session result line are shared code with an agent field, so an agent runner only implements one turn and its result parsing
- #6 SEAM.md documents developers[].agent and the new config and secret keys, and changes together with terraform/aws-agent-host.tf
- #7 A single agent-name convention for non-Claude agents is chosen and recorded (no slash per the plugin READMEs, or slash with the evidence that it works), weighing guard scoping against roll-up in the Coding agents view
Definition of Done
- #1 just check
Implementation Plan
Implement backward-compatible agent selection, Claude-only identity/spend resources, shared telemetry configuration and agent-neutral session orchestration. Add renderer/session integration checks that exercise the shipped paths, preserve the all-Claude compose output, and freeze the runner contract before agent implementations.
Implementation Notes
Mixed-roster producer/consumer render and session checks, Claude byte baseline, separate identity/spend filters, config.env and static names, shared runner and seam documentation pass. Remaining criterion 1 needs final explicit all-Claude plan comparison; do not substitute golden compose for Terraform plan proof.
All-Claude plan comparison first attempt hit transient Grafana permission-check timeouts/HTTP522 while refreshing stored guards. Retrying the configuration-only comparison with refresh disabled and serial provider calls; this proves config equivalence, not a fresh live drift check. Neither plan is applied.
Real OpenTofu config-plan comparison with refresh disabled: all-Claude roster omitting agent versus explicit agent=claude-code yielded zero resource-change differences. This isolates the backwards-compatible roster contract; render bundle/image updates still intentionally create/replace the host and are not claimed as no-op deployment changes.
Final Summary
Multi-agent foundation delivered: default-compatible Terraform roster, Claude-only identity/spend resources, isolated non-Claude services/secrets, common telemetry config, shared session runner and agent naming. Golden Claude bytes, real configuration-plan equivalence, renderer/runtime tests, local gate and live adapters verified.