Repository navigation
bug(deploy): provision-fleet fails importing the slm_agent role, and deploy-slm-agent is not exposed — no builtin path to redeploy an agent #14351
Description
Found while trying to refresh a stale agent key through the builtin (#14350).
Problem
POST /api/infrastructure/execute with playbook_id: provision-fleet fails immediately:
The error appears to be in
'/opt/autobot/autobot-slm-backend/ansible/playbooks/provision-fleet-roles.yml':
line 300, column 15
The offending line appears to be:
ansible.builtin.import_role:
name: slm_agent
^ here
[FAILED] Exit code: 1
provision-fleet is one of only 20 playbooks the builtin exposes, and it is the only exposed
one that runs the slm_agent role.
Why this is a blocker rather than an inconvenience
deploy-slm-agent.yml — the playbook the agent's own 401 message tells you to run — is not
exposed through the builtin at all. It is absent from GET /api/infrastructure/playbooks.
So the two routes to the agent role are:
| route | state |
|---|---|
provision-fleet |
exposed, fails at line 300 |
deploy-slm-agent.yml |
works, not exposed |
Which leaves no working path to redeploy an agent through the builtin. CLAUDE.md requires updates
to go through the builtin updater and forbids side-channelling via ad-hoc ansible, so this is a gap
to close rather than route around.
What is needed
- Fix the
import_rolefailure atprovision-fleet-roles.yml:300. The error is a parse/argument
problem at the import itself, not inside the role — the same role imports fine from
update-all-nodes.ymlPlay 2, which is worth diffing against. - Expose
deploy-slm-agent.ymlin the builtin playbook list, since it is the documented remedy for
a 401ing agent and is currently unreachable from the UI. - Consider whether a playbook the agent's own error message names should be reachable by definition
— the message is actionable advice that cannot currently be acted on.
Activity
fix(deploy): resolve playbook, cwd and config from one tree; tighten …
fix(deploy): give the infrastructure stack the repo ansible config an…
mrveiss commentedon Aug 16, 2026
Landed in
Dev_new_guias5ccb6cbf0(PR #14358).Verified in base:
Review blocked the first version and was right to: I had
playbook_pathcoming fromPLAYBOOKS_DIR(the deployed tree) while cwd/config/roles_path resolved against_ansible_dir()(which preferscode_source, hard-reset to origin HEAD on every canonical run). That would have run an old playbook against new roles — the same failure relocated. All four now resolve from one tree, matchingservices/playbook_executor.py.Also from review:
requires_confirmationis now True for the agent redeploy.deploy-slm-agent.ymlhashosts: slm_nodeswith noserial:, unlikeupdate-all-nodes.yml'sserial: 3, andlimit_hostsis optional — so one unconfirmed click would have restarted every agent in the fleet concurrently.Two review findings deliberately not folded in:
ANSIBLE_HOME/ANSIBLE_LOCAL_TEMPpointing at a third location (pre-existing, unchanged here) and_run_playbook's length. Both filed separately rather than widening a blocker fix.Closing.
fix(slm): derive the deploy gate over the role map, and require decla…