fix(compat): a fresh install's first agent stops reporting must-fix findings from Trinity's own starters (#2899)

[obasilakis]

Summary

• A fresh install's first screen showed a red "3 compatibility issues (2 must-fix)" banner on every acme-* agent. The two must-fix findings were T-004/T-005 complaining that scout/sage/scribe declare no resources: — which is the supported shape: the agent inherits the admin's fleet-wide default (RES-001), and a template-level block would override both that default and the values default-system.yaml asks for. bug(templates): sage/scout/scribe ship no .gitignore — every agent created from them is born with 4 hard security findings #1908 parked this behind a two-check waiver as a product decision; the decision is inherit, so the checks are re-graded and the waiver is gone.
• The panel also headlined advisory findings in warning tone and, with no Anthropic key, rendered 30 "AI check skipped" rows out of 89.

Changes

• compatibility/static_checks.py — T-004/T-005 pass on an absent/null/empty declaration (message names the default). A declared value is validated by the create path's own normalize_cpu/normalize_memory, so the check accepts exactly what creation accepts (4G, unquoted cpu: 2) and rejects exactly what it rejects — the old T-005 regex passed 512m, which normalize_memory 400s. Values are _clipped before reaching a message (template.yaml is agent-writable). A non-mapping resources: fails T-004 and skips T-005: one malformed block, one finding. X-004 exempts the platform-injected trinity server in the template.yaml-only direction.
• tests/unit/test_1908_bundled_template_gitignore.py — _KNOWN_FAILING_CHECKS is now EMPTY, so the existing guard holds every visible bundled template to every HARD static check with nothing exempt. This is the CI gate the issue's AC fix: add missing logging_config.py to backend Dockerfile #4 asks for; it existed already and only these two ids were waived.
• routers/settings/generic.py — the catch-all refuses agent_default_cpu/agent_default_memory (422 → the dedicated validated route). Unvalidated, a junk default 400s every creation that relies on it.
• CompatibilityPanel.vue — headline counts must-fix only: "N must-fix compatibility issues" (danger) · "No must-fix issues · N recommendations" (neutral) · "Compatible" only at zero. Neutral rather than success on the advisory arm: the API still calls that state issues, and soft covers S-006/S-008. Skipped AI checks collapse to one line per reason. Dead infoCount/failing computeds removed. Raw-colour counts unchanged (35), so no baseline re-freeze.
• Docs — validation spec (including X-004's type column, which said AI for a STATIC check), the agent guide's "Resource limits (required)", requirements §4.1.1, feature flow.

Test Plan

• pytest tests/unit/test_compatibility_checks.py — 143 pass, incl. a table asserting each resources row against the create path's own verdict, and a clipped-message check
• pytest tests/unit/test_1908_bundled_template_gitignore.py — 94 pass with the waiver removed
• pytest tests/unit/test_2899_resource_defaults_blocklist.py — new guard on the catch-all
• npm run test:unit — 3153 pass, incl. the new mounted compatibilityPanel.spec.js (7)
• Verified on a fresh DigitalOcean droplet built from the v0.9.5 marketplace image, then rebuilt from this branch. Before: acme-scout/sage/scribe each hard=2 soft=1 info=5. After: hard=0, T-004/T-005 pass with "resources.cpu is not declared — the platform default applies"; banner reads "No must-fix issues · 1 recommendation"; the 30 AI rows are one line. cornelius X-004 now names only the real playwright gap, not trinity. Light and dark both checked.

Notes

• Upgrade behaviour: a stopped agent replays its last persisted report, so it keeps showing the old counts until it is started and the panel reopened.
• The stricter value set turns 512m/3g/64g from pass into must-fix — correct, since creation rejects them.
• Out of scope, filed: bug(canary): the slow canary agent cannot be created — sleep-echo pins memory 512m, which the create path rejects #2903 (canary slow agent pins 512m, so it cannot be created), refactor(templates): MCP server names are declared in up to three places and drift — derive them from .mcp.json.template #2904 (MCP server names declared in three places), Seeded Cornelius shows 5 advisory compatibility findings on a fresh Trinity install cornelius#9 (that repo's own findings).

Fixes #2899

🤖 Generated with Claude Code

[vybe]

merge-train: batch validated on train/20260921-1418 (#2934).