From 54beff000137aed5b0ffdf24a926fe935a7d1d61 Mon Sep 17 00:00:00 2001
From: fullsend-code
 <278716306+fullsend-ai-coder[bot]@users.noreply.github.com>
Date: Tue, 1 Sep 2026 09:57:13 +0000
Subject: [PATCH] docs(#6840): remove stale e2e role from user-facing docs

PR #6771 removed the e2e row from the Role Permissions Matrix in
infrastructure-reference.md but two other user-facing docs still
listed e2e as a valid role value:

- bring-your-own-agent.md: removed e2e from the valid-values list
  for the roles config field, since e2e is not user-selectable
- mint.md: removed e2e from the --roles flag example and added a
  note that e2e is internal-only

The structural fix of consolidating role definitions to prevent
future drift is tracked in #2449.

Closes #6840
---
 docs/cli/mint.md                         | 2 +-
 docs/guides/user/bring-your-own-agent.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/cli/mint.md b/docs/cli/mint.md
index c9229ed898..b1afa79541 100644
--- a/docs/cli/mint.md
+++ b/docs/cli/mint.md
@@ -105,7 +105,7 @@ Example: `--per-repo-wif-repos=` clears `PER_REPO_WIF_REPOS` without requiring `
 | `--region` | `us-central1` | Cloud region for the function (GCP only) |
 | `--pem-dir` | | Directory containing `{role}.pem` files for PEM bootstrap |
 | `--app-set` | `fullsend-ai` | App set name for PEM bootstrap |
-| `--roles` | _(default roles)_ | Comma-separated role names to bootstrap with `--pem-dir`. Overrides the default set. Example: `--roles=fullsend,triage,coder,review,retro,prioritize,e2e` |
+| `--roles` | _(default roles)_ | Comma-separated role names to bootstrap with `--pem-dir`. Overrides the default set. Example: `--roles=fullsend,triage,coder,review,retro,prioritize`. The `e2e` role is internal-only and not intended for user configuration |
 | `--public` | `false` | Deploy public mint (`PER_REPO_WIF_REPOS=*`). Mutually exclusive with `--per-repo-wif-repos` on Cloudflare |
 | `--status-auth` | `oidc` | Comma-separated status auth modes. Each non-oidc mode selects a Go build tag. Modes: `oidc`, `github`. `oidc` is always compiled in; `github` requires `--status-github-group` |
 | `--status-github-group` | | `ORG/TEAM` slug for GitHub status auth (required when `github` mode enabled). Example: `--status-github-group=acme/platform-team` |
diff --git a/docs/guides/user/bring-your-own-agent.md b/docs/guides/user/bring-your-own-agent.md
index bda86de138..02ac27bd76 100644
--- a/docs/guides/user/bring-your-own-agent.md
+++ b/docs/guides/user/bring-your-own-agent.md
@@ -335,7 +335,7 @@ allowed_remote_resources:
 ```
 
 **Notes:**
-- `roles` controls which built-in agent roles are enabled. Valid values: `fullsend`, `triage`, `coder`, `review`, `fix`, `retro`, `prioritize`, `e2e`. Custom agents registered via `agents:` do not need to appear in this list.
+- `roles` controls which built-in agent roles are enabled. Valid values: `fullsend`, `triage`, `coder`, `review`, `fix`, `retro`, `prioritize`. Custom agents registered via `agents:` do not need to appear in this list.
 - URL entries are automatically pinned with `#sha256=...` by `fullsend agent add`.
 - URLs must be covered by `allowed_remote_resources` in the same config.
 - On name collision, config-registered agents take precedence over built-in agents.