Krikri::RoleLoader

Loads a role's defaults/ or vars/ - real Ansible supports EITHER a single main.yml file OR a main/ directory of multiple *.yml files (same convention tasks/main/ uses), merged together in alphabetical filename order (later files win on a key collision - matching real Ansible's own main/ directory loading, which reads files in sorted order and merges each into the accumulated dict). Only ONE of the two forms is ever present for a given role. Real bug found benchmarking kyl191.openvpn (round 160): its own defaults/main/openvpn.yml (no defaults/main.yml at all) was never read - load_vars_file alone always looked for exactly defaults/main.yml, silently returning an empty hash for a role using the directory form - every one of its own defaults (openvpn_server_network, openvpn_server_ipv6_network, ...) came back undefined, tripping the role's own "fail if both tunnel networks are disabled" validation check that real Ansible never reaches (both are non-empty by default).

Loads every entry in a play's roles: list (plus their meta/main.yml dependencies, recursively), in order. Returns {tasks, handlers} to prepend to the play - Ansible runs role tasks before the play's own tasks: (pre_tasks:/post_tasks: aren't implemented).

Loads a single role by name (plus its meta/main.yml dependencies) - used by TaskExecutor#execute_include_role for include_role:, the dynamic (execution-time) counterpart to a static roles: entry. Each call gets its own fresh "seen" set, so - matching include_role's allow_duplicates: true default - repeated include_role calls for the same role name each load it again rather than being silently deduplicated the way a role listed twice under roles: would be. allow_duplicates: false on the include itself isn't honored (dedup only happens within a single call's own meta dependency chain).

Public: TaskExecutor#execute_include_vars loads the same shape of YAML vars file that roles do, and must parse it identically (including Vault decryption of individual values).