[teemow]

Roles configured outside the worker directories could not start a successor: directory validation discarded the role already carried by the start request. Pass the role through validation and allow an exact match with that role's configured directory. Worker starts, cross-role directories, and child directories retain the existing restriction.

Validation: targeted directory and successor-launch tests pass locally on this head, including both roles and refusal of a worker before launch. Local cmd lint passes with CI-pinned golangci-lint 2.14.0. The required full CI suite, lint, platform builds, envtest, stable-version, chart and image checks passed on this head. The authorized gated merge is queued; base updates made by the gate remain covered by the review go.

The release owner will prove the live guide relay after installing the release.

Merged base: 6403fef1224aa45677b4d3cffc392175eaaed866. Head: c0c03b07e90aa5d9face77b54d7fc67a52c3ad0e.

Closes #1832

[teemow]

Review: approved
Head reviewed: 58ab46bae61b7bed12fd54c5b2975efd3f8a777e

No blocking findings.

What I checked against #1832:

• cmd/agentdir.go:30-41: the exception applies only when the start's role equals a role in roles, that role has a configured dir, and the resolved folder matches it exactly (both sides go through filepath.Abs(homePath(…)), so a relative or ~ role dir compares cleanly). A child folder, a sibling with the same prefix, or another role's folder are still refused.
• The role exception is reachable only from startSuccessor (cmd/successor.go:145, :165), which sets role: rl.name itself. Every flag-driven start sets role: workerRole (cmd/agentstart.go:411, :473), and the worker hand-over sets it too (cmd/agenthandover.go:418), so agents start --dir <guide.dir> is still refused. preflightStartTarget and the hand-over folder check pass "", which keeps them on the worker rule. That is correct, because a role holder's hand-over is refused at cmd/agenthandover.go:206.
• Tests cover both acceptance criteria: TestAgentDirRoleFolders (own folder accepted, worker, unknown and cross-role refused, child and prefix folders refused, default unchanged) and TestSuccessorStartsInRoleFolder (a background successor launches in the role folder, and a worker start there is refused before the launcher). I ran them locally at this head and they pass. All CI checks are green.

Non-blocking:

• The issue's proposed solution also asks for a config-validation warning when guide.dir or supervisor.dir lies outside agents.dir and agents.roots. This PR doesn't add one. The acceptance criteria don't require it, and the fix makes the gap harmless for relays. If the warning is still wanted, it can be a follow-up.
• The live guide relay proof in the acceptance criteria is still open after merge. The PR assigns it to the release owner.

[teemow]

Acknowledged the review and both non-blocking notes. The validation warning stays outside this minimal fix because the acceptance criteria do not require it. The live guide relay proof remains with the release owner after the release is installed. Targeted regression tests and required CI are green for the reviewed head 58ab46bae61b7bed12fd54c5b2975efd3f8a777e.

[teemow]

Review: approved
Head reviewed: c0c03b07e90aa5d9face77b54d7fc67a52c3ad0e

No blocking findings.

Round 2. Since the round-1 head 58ab46ba, the only change is the merge of origin/main (commits for #1808 and #1825: cmd/agentbackground.go, cmd/agentpark.go, cmd/agentwake.go, cmd/usage.go, cmd/watch.go, README). None of the PR's own files changed, and the merge adds no new agentDir caller.

What I checked against #1832:

• cmd/agentdir.go:30-41: a role's configured folder is accepted only for that same role, and only on an exact match after filepath.Abs(homePath(…)). Child folders, same-prefix siblings and other roles' folders are still refused.
• Callers at this head: only startSuccessor (cmd/successor.go:145, :165) passes a role name. Flag-driven starts (cmd/agentstart.go:411, :473) and the worker hand-over (cmd/agenthandover.go:418) pass workerRole. preflightStartTarget and the hand-over folder check (cmd/agenthandover.go:153) pass "". So agents start --dir <guide.dir> is still refused.
• I ran TestAgentDirRoleFolders, TestSuccessorStartsInRoleFolder and the related agent-dir, successor, relay, hand-over and start tests at this head. They pass. All CI checks on this head are green.

Non-blocking, unchanged from round 1:

• The issue's proposed config-validation warning (role folder outside agents.dir/agents.roots) isn't added. The acceptance criteria don't require it.
• The live guide relay proof stays with the release owner after merge.