Upgrade Olympus mechanism to v0.4.0 (full post-rename migration: .olympus.json + olympus_ref)

[vaderyang]

Goal

Upgrade the Olympus mechanism pin from the current minimal-repoint state to the first Olympus-named release, v0.4.0.

After #165 the wrappers point at Netis/olympus, but they're still on pre-rename tags (@v0.2.0, and review at @v0.3.1) and still use the old agent_ops_ref input + .agent-ops.json. Those frozen tags read the old names and rely on GitHub's git-level redirect of the old repo path. Moving to v0.4.0 puts us on current naming, drops the redirect dependency entirely (v0.4.0 checks out via olympus_repo, default Netis/olympus), and lets us take future mechanism updates.

Good news — the policy content carries over unchanged

I diffed the config schema between v0.3.1 and v0.4.0: the field names are identical. v0.4.0 only adds two optional keys (triage.auto_dispatch, implement.allow_network), both with safe defaults. So this is a mechanical file/input/tag/schema migration — none of your actual policy values change.

Checklist

1. Bump all 5 wrappers to @v0.4.0 and switch the input name

In each of guard.yml, issue-implement.yml, issue-triage.yml, pr-revise.yml, pr-review.yml:

• uses: Netis/olympus/.github/workflows/<x>.yml@v0.4.0 (unifies the split v0.2.0/v0.3.1 pins onto one release)
• change the input agent_ops_ref: … → olympus_ref: v0.4.0

⚠️ The input rename is required: v0.4.0 defines olympus_ref, so passing agent_ops_ref is now an invalid input and the run errors.

2. Rename the policy file (required)

git mv .agent-ops.json .olympus.json

v0.4.0's loader reads ${OLYMPUS_CONFIG:-.olympus.json} with no fallback to .agent-ops.json — if you skip this, config silently reverts to built-in defaults (gates, labels, build_cmd, bot login all revert), which is wrong behavior, not a clean error.

3. Update $schema inside that file

"$schema": "https://raw.githubusercontent.com/Netis/olympus/main/schema/olympus.schema.json"

4. Keep your values; optionally adopt the two new keys

Everything you have today (project, agents, labels, triage.gates, implement.build_cmd, observer, model) is valid as-is. Optional new keys (safe to omit):

• triage.auto_dispatch — default trusted (recommended on this repo): only auto-start the dev agent for issues from write/maintain/admin authors; strangers get a warm reply + a maintainer control. See docs/security.md.
• implement.allow_network — default false: deny the implement agent direct network egress (curl/ssh/…) so a prompt-injected issue can't exfiltrate. Keep false unless your build genuinely needs the agent online.

5. Identities — no action required for the bump (optional follow-up)

Your config explicitly pins review_bot_login: "vivi" and dev_agent_name: "wiwi", and v0.4.0 honors those, so the bump does not require renaming the bot accounts. The Olympus defaults are themis / hephaestus; if you ever want to adopt them, that's a separate operational change (rename/re-provision the GitHub accounts + update AUTO_MERGE_TEAM and any allowlists). The observer.labels: "mara,incident" string is likewise just a label value — keep or change at will.

6. Observer via systemd, if any (operational, out of repo)

There's no observe.yml wrapper in this repo, so this only applies if you run the observer as a systemd unit on a runner: the env prefix changed MARA_* → ARGUS_* (e.g. MARA_HEALTH_URL → ARGUS_HEALTH_URL). The in-repo observer config block needs no change.

7. Secrets — unchanged

v0.4.0 expects exactly what you already provide via secrets: inherit: LITELLM_BASE_URL / LITELLM_API_KEY / LITELLM_NO_PROXY, AGENT_GH_TOKEN, optional AUTO_MERGE_TEAM. None were part of the rebrand — no rename, just confirm they're set.

Self-check

From the repo root, the migration linter prints an exact to-do list and exits non-zero until clean:

bash <(curl -fsSL https://raw.githubusercontent.com/Netis/olympus/main/scripts/lint/check-legacy-naming.sh)

(It will also flag vivi/wiwi/mara as COSMETIC — those are your intentional identity values from step 5, not required for a functional v0.4.0 bump.)

Verify after merge

• Open a no-op PR → guard@v0.4.0 runs green.
• File a throwaway issue → triage replies (and respects auto_dispatch).
• Confirm the dev-agent commit author / review bot login are as expected.

Full mapping + rationale: Olympus docs/migration.md. Context: this follows #164 / #165 (the rename repoint).

[github-actions]

Hey Vader — thanks for this incredibly thorough migration guide. The field-by-field diff between v0.3.1 and v0.4.0, the explicit checklist, and the self-check linter make this about as smooth a bump as we could ask for.

I went through the repo to confirm the current state matches your checklist baseline:

• All 5 wrappers are exactly where you described: four at @v0.2.0 (guard, issue-implement, issue-triage, pr-revise) and pr-review at @v0.3.1, all with agent_ops_ref as the input name.
• .agent-ops.json is present with the old $schema URL — no .olympus.json yet.
• The workflow file comment prose still says "agent-ops" / "Netis/agent-ops" throughout, which is cosmetic but worth cleaning up while we are touching these files so the rename is complete end-to-end.
• ci.yml:86 has a stale comment referencing guard.yml@v0.2.0 that should bump in lockstep.
• _agentops/ is an untracked local directory on this checkout — not tracked in the repo, so nothing to do there.

This is a clean, mechanical migration. All the policy values carry over unchanged. I am queuing this to be picked up — the diff is well under 300 lines and contained entirely to CI config. I will post back here when there is a PR to review.

One thought on verification: beyond the upstream migration linter, I want to add a small inline check (either in ci.yml or guard.yml) that asserts no agent_ops_ref input or .agent-ops.json reference survives in any workflow file, so we catch regressions on future bumps too. That will ship in the same PR.

[github-actions]

Hey Vader — thanks for this incredibly thorough migration guide. The field-by-field diff between v0.3.1 and v0.4.0, the explicit checklist, and the self-check linter make this about as smooth a bump as we could ask for.

I went through the repo to confirm the current state matches your checklist baseline:

• All 5 wrappers are exactly where you described: four at @v0.2.0 (guard, issue-implement, issue-triage, pr-revise) and pr-review at @v0.3.1, all with agent_ops_ref as the input name.
• .agent-ops.json is present with the old $schema URL — no .olympus.json yet.
• The workflow file comment prose still says "agent-ops" / "Netis/agent-ops" throughout, which is cosmetic but worth cleaning up while we are touching these files so the rename is complete end-to-end.
• ci.yml:86 has a stale comment referencing guard.yml@v0.2.0 that should bump in lockstep.
• _agentops/ is an untracked local directory on this checkout — not tracked in the repo, so nothing to do there.

This is a clean, mechanical migration. All the policy values carry over unchanged. I am queuing this to be picked up — the diff is well under 300 lines and contained entirely to CI config. I will post back here when there is a PR to review.

One thought on verification: beyond the upstream migration linter, I want to add a small inline check (either in ci.yml or guard.yml) that asserts no agent_ops_ref input or .agent-ops.json reference survives in any workflow file, so we catch regressions on future bumps too. That will ship in the same PR.