plans: row 195 brief rewritten as the hub on its own host, host left to Jason (#1693, mos-0998, mos-1005)

docs/plans/2026-10-20_hub-own-uid.md

@@ -1,46 +1,63 @@
-# Brief: Melanie's hub instance under its own Linux user (row 190b)
+# Brief: Melanie's hub instance on its own host (row 195, was 190b)
 
-Sage, 2026-10-20, from Darkwing's draft (agents/darkwing/work/queue-190b/BRIEF-DRAFT.md) for Mos's ruling
-mos-0986 (2026-10-20T18:53:48Z) on row 190 R1. Mos ruled a separate uid per instance a hard precondition of
-federation R8 (mos-0984, mos-0985) and of Case 2 row C2-13. The finding was federation review B5
-(duckworth-0001): on one uid any factory agent can read, write and control Melanie's hub directly, and SSO and
-RBAC don't stop a local process with filesystem access. On the 10-27 MVP path. Gitea #1693.
+Sage, 2026-10-20. Rewritten for Mos's rulings mos-0998 and mos-1005 (Vikunja #418, #419). The first version
+put the hub under its own Linux user on dragon-lin. That form can't pass Duckworth's B7 there, because the
+factory uid's `sudo -n` succeeds on dragon-lin (Mos's recon, brain-redux
+`projects/mosaic-mvp/MELANIE-HOST-RECON.md`). Melanie's own server is ruled out too: it has 1.2 GiB RAM free
+with her two Hermes bots running, and co-tenancy would share her user and her passwordless sudo. The hub runs
+on a separate host. Which host is Jason's decision (#419): hardware outside the cluster, a cluster VM with
+factory PVE root removed, or a cluster VM with that residual accepted. This row is written so the host choice
+doesn't change it. Gitea #1693. On the 10-27 MVP path. Federation R8 (Gizmoduck's design r4, 04a6112be) needs
+this row or nothing.
 
-Owner Darkwing (Opus 5.5), reviewer Duckworth (author of B5; mos-0981 keeps new work off Filbert and Dewey),
-gate owner Sage. Merge-chained on row 190 (Q177): it builds on row 190's candidate and keeps its own review and
-gate. Design first. The first deliverable is `agents/darkwing/work/queue-190b/DESIGN.md`.
+Owner Darkwing (Opus 5.5), reviewer Duckworth (author of B5 and B7), gate owner Sage. Chained on row 190
+(Q177): the hub runs under row 190's config canon. Design first. The first deliverable is
+`agents/darkwing/work/queue-190b/DESIGN.md`.
 
 ## Goal
 
-Melanie's hub instance runs under its own Linux user. No process of the factory instance can read or write the
-hub's config, data root or secrets, or control the hub's units. That covers the bus, role seats and their
-sessions, task runs, the Discord connector and the Console.
+Melanie's hub instance (Case 2, C2-13) runs on its own host. No factory agent can read or write the hub's
+config, data root or secrets, reach its bus socket, or log in to the hub host. Her writing reaches the hub only
+through the existing git.mosaicstack.dev remotes, books repo only.
+
+## Provision (blank until Jason answers #419)
+
+Who provisions the host and how is left open. Sizing from Mos (mos-0998): 4 vCPU, 8 GB RAM, 64 GB disk,
+internal network only. Each agent process measures 300 to 390 MB RSS on dragon-lin. The design takes the host
+as given: a fresh Linux host with a named admin path, reachable by the deploying seat while the row runs.
 
 ## The design must state
 
-1. How operators (Mos, Sage, Jason) deploy, re-pin and roll back the hub. Which commands they run, as which
-   user, and what each one needs.
-2. Each root step Jason runs: useradd, the home and its modes, `loginctl enable-linger`, and any sudoers rule,
-   with the exact command lines.
-3. How the hub reaches the Claude proxy and gets its session env without sharing jwoltje's
-   `claude-session.env`.
-4. Whether real isolation needs the factory instance's seats to run apart from the operators' uid. If yes, say
-   so plainly with its cost. Don't design around it.
-
-It must also cover the copies (shared read-only trees under jwoltje's home, or the hub's own), the human CLI
-wrapper and human proof for the hub's Console, and how the stack-release pointer, log and backups work under
-the second user.
+1. The deploy. Exactly what Darkwing installs on the hub host and how: the stack copy, node, the units, the
+   config dir and data root under row 190's canon (O1: `~/.config/mosaic-NAME`, and "`~` is the home of the OS
+   user that runs the instance"). Which commands run as which user on the hub host, and which need its root.
+2. Re-pin, rollback and backup on the hub host, and who runs them after the deploy key is gone.
+3. How the hub gets model access without a copy of jwoltje's `claude-session.env` or any factory credential.
+   If that needs the credentials row (T1 item 6), say so and name the interim.
+4. The books repo path. Which git.mosaicstack.dev remote, which credential the hub holds for it, and that it
+   can't read or push any other repository.
+5. The admin path and the end state. The host ends with no key the factory uid can read. The design names the
+   admin path that remains (for example the hypervisor console, or a key kept off the factory uid) and who
+   holds it.
+6. The acceptance checks, as a script Duckworth can read: federation R8's separate-host form (the hub's bus
+   socket, data root and config dir don't exist on the factory host, the factory host mounts nothing of the
+   hub's, no factory agent holds a login or key for the hub host), plus B7. From the factory uid, `sudo -n`,
+   `doas -n`, `su`, polkit, and `ssh -o BatchMode=yes` to the hub host must all fail.
 
 ## Boundaries
 
-- Row 190 lands first, as designed: one uid, scratch two-instance tests without root.
-- No agent runs a root step. Every one goes to Jason as an exact command list.
-- No real hub user, unit or data root is created in this row's tests. Tests use scratch roots and stand-ins as
-  row 190 does. Anything that needs a second real uid is a Q173 window with a backup first and a STATE report
-  after.
-- No tunnel or Traefik exposure. That waits for Jason, after Q175 SSO.
+- Provisioning, hypervisor access and any infra or k3s change are Jason's (Q173 exclusions). Mos takes the
+  hypervisor residual (factory root on the PVE nodes, Q172) to Jason. It doesn't block this row.
+- Melanie's server (`[email protected]`) is reference only, read only, under Jason's authorization in
+  mos-0995. Nothing on it changes, and her Hermes bots keep running.
+- No tunnel, Traefik or other exposure outside the internal network. That waits for Jason, after Q175 SSO.
+- No credential value is printed, logged or committed. Keys made for the deploy are removed at the end, and
+  the acceptance script proves it.
+- Tests in the repository use scratch roots and stand-ins. The live deploy and the acceptance run on the hub
+  host are a window with a backup first (where there is state) and a STATE report after.
 
 ## Gate
 
-Duckworth approves DESIGN.md, then the manifest. The cli suite and every `scripts/test-*.sh` are green on
-Sage's gate. The design's mutants are killed.
+Duckworth approves DESIGN.md, then the manifest. Any repository change is green on Sage's gate (cli suite and
+every `scripts/test-*.sh`), with the design's mutants killed. The row is done when the acceptance script passes
+on the hub host from the factory uid, Duckworth reads its output, and Mos confirms.