VersionControl:PRs/maybelle-config/276

maybelle-config#276: hunter: the emergents' env names, EMERGENTS and EMERGENT_<NAME>_*

State	🟣 merged 2026-11-03 17:24:51
Worked on by	magent, re, blu, justin
Moods	#emergence
Deploy	redeploy hunter
Branch	emergent-env-names → production, by magent-cryptograss
Opened · last pushed	2026-11-03 15:39:32 · 2026-11-03 15:39:26

The emergent rename's env step. `AGENTS` becomes `EMERGENTS`, and `AGENT_<NAME>_*` becomes `EMERGENT_<NAME>_*`, in the compose template that writes them and in `container_startup.py`, which reads them. `agent_homes.py` takes `--emergents` (its tasks/main.yml call changes with it). Builds on #273 (merged).

These env vars carry re's and blu's runner keys, bot passwords and model keys, so **re and blu review this one**.

**Proof that every key lands where it did.** I rendered `docker-compose.yml.j2` for every container in production's inventory, before and after, with each vault variable replaced by its own name as a stand-in (`re_runner_key` → `vault:re_runner_key`). No real value was read or rendered. A swap between re's key and blu's would show up as a changed row, and a dropped key as a missing one. 20 rows, 0 changed:

| container | before | after | value (stand-in) | |
|---|---|---|---|---|
| emergent-blu | `AGENTS` | `EMERGENTS` | the inventory's `emergents:` list, as JSON | ✓ |
| emergent-blu | `AGENT_BLU_KEY_ANTHROPIC_API_KEY` | `EMERGENT_BLU_KEY_ANTHROPIC_API_KEY` | `vault:blu_anthropic_api_key` | ✓ |
| emergent-blu | `AGENT_BLU_KEY_CLAUDE_CODE_OAUTH_TOKEN` | `EMERGENT_BLU_KEY_CLAUDE_CODE_OAUTH_TOKEN` | `vault:blu_claude_code_oauth_token` | ✓ |
| emergent-blu | `AGENT_BLU_KEY_DEEPSEEK_API_KEY` | `EMERGENT_BLU_KEY_DEEPSEEK_API_KEY` | `vault:blu_deepseek_api_key` | ✓ |
| emergent-blu | `AGENT_BLU_KEY_GEMINI_API_KEY` | `EMERGENT_BLU_KEY_GEMINI_API_KEY` | `vault:blu_google_api_key` | ✓ |
| emergent-blu | `AGENT_BLU_KEY_MOONSHOT_API_KEY` | `EMERGENT_BLU_KEY_MOONSHOT_API_KEY` | `vault:blu_moonshotai_api_key` | ✓ |
| emergent-blu | `AGENT_BLU_KEY_OPENAI_API_KEY` | `EMERGENT_BLU_KEY_OPENAI_API_KEY` | `vault:blu_openai_api_key` | ✓ |
| emergent-blu | `AGENT_BLU_KEY_OPENROUTER_API_KEY` | `EMERGENT_BLU_KEY_OPENROUTER_API_KEY` | `vault:blu_openrouter_api_key` | ✓ |
| emergent-blu | `AGENT_BLU_PICKIPEDIA_BOT_PASSWORD` | `EMERGENT_BLU_PICKIPEDIA_BOT_PASSWORD` | `vault:blu_pickipedia_bot_password` | ✓ |
| emergent-blu | `AGENT_BLU_RUNNER_KEY` | `EMERGENT_BLU_RUNNER_KEY` | `vault:blu_runner_key` | ✓ |
| emergent-re | `AGENTS` | `EMERGENTS` | the inventory's `emergents:` list, as JSON | ✓ |
| emergent-re | `AGENT_RE_KEY_ANTHROPIC_API_KEY` | `EMERGENT_RE_KEY_ANTHROPIC_API_KEY` | `vault:re_anthropic_api_key` | ✓ |
| emergent-re | `AGENT_RE_KEY_CLAUDE_CODE_OAUTH_TOKEN` | `EMERGENT_RE_KEY_CLAUDE_CODE_OAUTH_TOKEN` | `vault:re_claude_code_oauth_token` | ✓ |
| emergent-re | `AGENT_RE_KEY_DEEPSEEK_API_KEY` | `EMERGENT_RE_KEY_DEEPSEEK_API_KEY` | `vault:re_deepseek_api_key` | ✓ |
| emergent-re | `AGENT_RE_KEY_GEMINI_API_KEY` | `EMERGENT_RE_KEY_GEMINI_API_KEY` | `vault:re_google_api_key` | ✓ |
| emergent-re | `AGENT_RE_KEY_MOONSHOT_API_KEY` | `EMERGENT_RE_KEY_MOONSHOT_API_KEY` | `vault:re_moonshotai_api_key` | ✓ |
| emergent-re | `AGENT_RE_KEY_OPENAI_API_KEY` | `EMERGENT_RE_KEY_OPENAI_API_KEY` | `vault:re_openai_api_key` | ✓ |
| emergent-re | `AGENT_RE_KEY_OPENROUTER_API_KEY` | `EMERGENT_RE_KEY_OPENROUTER_API_KEY` | `vault:re_openrouter_api_key` | ✓ |
| emergent-re | `AGENT_RE_PICKIPEDIA_BOT_PASSWORD` | `EMERGENT_RE_PICKIPEDIA_BOT_PASSWORD` | `vault:re_pickipedia_bot_password` | ✓ |
| emergent-re | `AGENT_RE_RUNNER_KEY` | `EMERGENT_RE_RUNNER_KEY` | `vault:re_runner_key` | ✓ |

(The model-key rows render `lookup(vars, '<name>_<vendor>_api_key', default=lookup(vars, 'model_<vendor>_api_key'))`. The stand-in shows the first name; the fallback expression is unchanged.)

No vault variable changes its name, and nothing changes in the vault.

**Tests:** `test_container_startup.py` + `scripts/test_agent_homes.py`, 43 passed. Two new tests: `EMERGENTS` is read, and `AGENTS` no longer is.

**Done-mark after deploy** (agreed with re and blu, #emergence 04:16Z): each of re and blu takes one turn (runner key), makes one wiki edit from a full-tools turn (bot password), and lists the vendor *names* in its `~/.config/magenta/agent.env`.

Deploy: redeploy hunter
Worked on by: magent, re, blu, Justin, in #emergence