Skip to content

Remove per-repo fullsend-vertex-ai.yaml to inherit upstream profile #16

Open

Description

@fullsend-ai-retro

What happened

PR #15 added **/claude.exe to .fullsend/profiles/fullsend-vertex-ai.yaml — the same 1-line fix previously applied to node-api#13, rhdh-plugins#12, and overlays#13/#14. The root cause was that this repo maintains a local copy of the Vertex AI profile that shadows the upstream version in fullsend-ai/agents. When Claude Code 2.1+ changed its binary name from claude to claude.exe, the upstream profile was not updated yet (agents#1118 is still open), and each per-repo override also needed a manual patch.

Comparing the per-repo profile to upstream main: the per-repo version is a subset of upstream. It has api.anthropic.com and *.googleapis.com endpoints (upstream has both plus allow_uninspected_credentials), and binaries **/claude, **/claude.exe, **/node (upstream has those plus **/pi). The per-repo override adds nothing beyond what upstream provides — it is a stale copy with local patches applied over time.

What could go better

When the upstream profile evolves (new binaries, new endpoints, new flags), this repo's local override silently diverges. The next binary name change, endpoint addition, or security flag will require another per-repo PR — multiplied across every rhdh-parasol repo that maintains a local copy. This is the same pattern that caused 5 independent PRs for the claude.exe fix.

Confidence is high that the per-repo override is unintentional drift rather than a deliberate divergence: the file content is a strict subset of upstream main, the PR history shows it was copied early and patched locally, and there is no comment or documentation explaining why a local override is needed. The only risk is if a future upstream change includes something this repo explicitly does not want (e.g., **/pi binary access), but that would be better handled by filing an upstream issue than by maintaining a shadow copy.

Proposed change

After fullsend-ai/agents#1118 merges and a new agents release is cut (post-v0.37.0), delete .fullsend/profiles/fullsend-vertex-ai.yaml from this repo so the harness falls back to the upstream profile. Verify that the upstream profile at the new release tag is a superset of the current per-repo file before deleting. If the repo needs to exclude specific binaries or endpoints, use a targeted per-repo policy override rather than copying the entire profile.

The same evaluation should be done for other rhdh-parasol repos that maintain local copies of this profile (node-api, rhdh-plugins, rhdh-plugin-export-overlays).

Validation criteria

After the per-repo profile is removed: (1) the next refine agent dispatch on this repo succeeds without policy_denied errors — claude.exe access to sts.googleapis.com is allowed by the inherited upstream profile; (2) future upstream profile changes (e.g., adding new binaries or endpoints) are inherited automatically without per-repo PRs; (3) no new fullsend-vertex-ai.yaml override is re-created in the next 3 agent releases.


Generated by retro agent from #15

Activity

  1. fullsend-ai-triage commented on Sep 1, 2026

    @fullsend-ai-triage

    🤖 Finished Triage · ✅ Success · Started 5:52 PM UTC · Completed 5:56 PM UTC

    Commit: 0a81563 · View workflow run →

    Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.68

  2. fullsend-ai-triage commented on Sep 1, 2026

    @fullsend-ai-triage

    This issue is blocked on an upstream dependency. The upstream PR to add claude.exe to the Vertex AI profile in fullsend-ai/agents is still open. Until that PR merges and a new agents release is cut, deleting the local profile override would cause policy_denied errors because the inherited upstream profile would not yet include the **/claude.exe binary entry.

    Once the upstream PR merges and a release is available, the proposed change is straightforward: verify the upstream profile is a superset of the local file, then delete .fullsend/profiles/fullsend-vertex-ai.yaml.

    Note: the same evaluation applies to sibling repos (node-api, rhdh-plugins, rhdh-plugin-export-overlays) that maintain local copies of this profile.

    Blocked by:


    Labels: Enhancement to remove stale config override in favor of upstream inheritance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions