feat: enforce required agent roles at creation and role immutability in registry

.agents/skills/lib.sh

@@ -305,6 +305,8 @@ def _validate(d):
             raise SystemExit(f"VALIDATE: tmux_sessions[{i}] not a mapping")
         if not s.get('name') or not s.get('status'):
             raise SystemExit(f"VALIDATE: tmux_sessions[{i}] missing name/status")
+        if s.get('role') is not None and (not isinstance(s['role'], str) or not s['role'].strip()):
+            raise SystemExit(f"VALIDATE: tmux_sessions[{i}] {s.get('name')!r} role must be a non-empty string")
         if s['status'] not in valid:
             raise SystemExit(f"VALIDATE: tmux_sessions[{i}] {s.get('name')!r} bad status {s['status']!r}")
         if not isinstance(s.get('pane'), dict):
@@ -366,10 +368,17 @@ try:
         d['tmux_sessions'] = []
 
     old_terminals = get_terminal_set(d)
+    old_roles = {s.get('name'): s.get('role') for s in db_sessions if s.get('role')}
 
     # --- caller mutation (module scope: sees d, yaml, os, glob, subprocess) ---
     exec(compile(os.environ['AGENT_SESSIONS_MUTATION'], '<mutation>', 'exec'), globals())
 
+    # Role immutability check
+    for s in d.get('tmux_sessions', []):
+        name = s.get('name')
+        if name in old_roles and s.get('role') != old_roles[name]:
+            raise SystemExit(f"VALIDATE: role of session {name!r} cannot be modified from {old_roles[name]!r} to {s.get('role')!r}")
+
     _validate(d)
 
     # Separate globals and sessions for normalization

.agents/skills/multi-agent-mux-create/SKILL.md

@@ -173,7 +173,7 @@ Use the `agent-sessions-yaml-edit` script in `scripts/` to safely append (preser
 
 ```bash
 bash .agents/skills/multi-agent-mux-create/scripts/create_session.sh \
-  --workspace "$WORKSPACE" --agent "$AGENT" --session "$SESSION_NAME"
+  --workspace "$WORKSPACE" --agent "$AGENT" --role "$ROLE" --session "$SESSION_NAME"
 ```
 
 The script handles the YAML append, pane capture, and the `last_visible_status` placeholder.

.agents/skills/multi-agent-mux-create/scripts/create_session.sh

@@ -23,11 +23,12 @@ source "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/lib.sh"
 
 usage() {
   cat <<EOF
-Usage: $0 --workspace <path> --agent <claude|agy|hermes|cline> [options]
+Usage: $0 --workspace <path> --agent <claude|agy|hermes|cline> --role <role> [options]
 
 Options:
   --workspace PATH    project directory (required)
   --agent AGENT       claude | agy | hermes | cline (required)
+  --role ROLE         assigned role (required)
   --session NAME      tmux session name (default: derived from workspace)
   --wrapper           force use of ~/.local/bin/<session> wrapper even if not present
   --dry-run           print commands without executing
@@ -39,6 +40,7 @@ EOF
 
 WORKSPACE=""
 AGENT=""
+ROLE=""
 SESSION_NAME=""
 USE_WRAPPER=0
 DRY_RUN=0
@@ -49,6 +51,7 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --workspace) WORKSPACE="$2"; shift 2 ;;
     --agent)     AGENT="$2";     shift 2 ;;
+    --role)      ROLE="$2";      shift 2 ;;
     --session)   SESSION_NAME="$2"; shift 2 ;;
     --wrapper)   USE_WRAPPER=1; shift ;;
     --dry-run)   DRY_RUN=1; shift ;;
@@ -66,6 +69,7 @@ fi
 # Preflight
 [ -n "$WORKSPACE" ] || { echo "ERROR: --workspace required" >&2; usage; exit 2; }
 [ -n "$AGENT" ]    || { echo "ERROR: --agent required" >&2; usage; exit 2; }
+[ -n "$ROLE" ]     || { echo "ERROR: --role required" >&2; usage; exit 2; }
 [ -d "$WORKSPACE" ] || { echo "ERROR: workspace $WORKSPACE not a directory" >&2; exit 1; }
 command -v tmux >/dev/null || { echo "ERROR: tmux not installed" >&2; exit 1; }
 command -v "$AGENT" >/dev/null || { echo "ERROR: $AGENT CLI not in PATH" >&2; exit 1; }
@@ -212,9 +216,10 @@ atomic_dump_yaml "$AGENT_SESSIONS_YAML" \
   TMUX_EPOCH="$TMUX_EPOCH" PANE_PID="$PANE_PID" PANE_CWD="$PANE_CWD" \
   CMD_FULL="$CMD_FULL" START_CMD="$START_CMD" CHILD_PID="$CHILD_PID" \
   TMUX_SERVER_NAME="${TMUX_SERVER_NAME:-default}" \
-  DELEGATE_JOB_ID="$DELEGATE_JOB_ID" <<'PYEOF'
+  DELEGATE_JOB_ID="$DELEGATE_JOB_ID" ROLE="$ROLE" <<'PYEOF'
 name = os.environ['SESSION_NAME']
 agent = os.environ['AGENT']
+role = os.environ['ROLE']
 pid = os.environ.get('PANE_PID', '')
 epoch = os.environ.get('TMUX_EPOCH', '')
 server_name = os.environ.get('TMUX_SERVER_NAME', 'default')
@@ -233,6 +238,7 @@ sessions[:] = [s for s in sessions if s.get('name') != name]
 entry = {
     'name': name,
     'status': 'running',
+    'role': role,
     'tmux_session_created_at': os.environ['NOW_ISO'],
     'tmux_session_epoch': int(epoch) if epoch.isdigit() else 0,
     'tmux_server': server_name,