row 210 (#1707): round 5, rebase onto ad95c888c after row 237's broker.mjs landing (sage-1657), broker cites +3 from :1056, manifest broker hash, bus 499/0 (Gizmoduck)
This commit is contained in:
@@ -1,4 +1,4 @@
|
||||
# Row 210 round 4 (#424, Gitea #1707): agent host access with sudo through the credential store
|
||||
# Row 210 round 5 (#424, Gitea #1707): agent host access with sudo through the credential store
|
||||
|
||||
Gizmoduck, 2026-10-20. Reviewer Duckworth, gate owner Sage.
|
||||
|
||||
@@ -23,6 +23,13 @@ Gizmoduck, 2026-10-20. Reviewer Duckworth, gate owner Sage.
|
||||
- Round 4 answers sage-1617 B1 on the same branch and base. See "Round 4" below. `candidate-manifest.sha256`
|
||||
is regenerated from the round-4 tree: 23 files, the 20 before plus `project-runtime.test.mjs` and the two
|
||||
role contracts.
|
||||
- Rebase onto ad95c888c (sage-1657): row 237 landed d7d943199 and added 3 lines to broker.mjs after :1055
|
||||
(the publish-busy check in checkPublish). It is the only one of the 23 manifest paths that changed after
|
||||
cb5fdb064. Branch `gizmoduck/row210-r5` carries the nine commits cb5fdb064..c43008749 onto ad95c888c with
|
||||
`git rebase --onto`, no conflict, and `git range-diff` shows all nine identical (`=`). broker.mjs comes out
|
||||
at sha256 610af0c4207bbd805a2a8826daa32b8cdb423937f793c32fd4241f6addfabfda, Sage's merge. The other 22 paths
|
||||
keep their round-4 hashes. `gizmoduck/row210-r3` is kept at c43008749, not force-pushed or deleted. Every
|
||||
broker cite in this file from :1056 on is three higher than in round 4. Checks are under "Checks".
|
||||
- Candidate: the commit that adds this file. `candidate-manifest.sha256` lists the code and test files.
|
||||
- Scope (sage-1468): the `host.run` broker op, the grant check, the executor and the receipts, over
|
||||
`broker.sock`. No `packages/harness` change. The `host_run` tool is Sage's follow-up row.
|
||||
@@ -35,8 +42,8 @@ Gizmoduck, 2026-10-20. Reviewer Duckworth, gate owner Sage.
|
||||
| D2 value check, one unencrypted ed25519 key | bus credentials.mjs:26 (`parseHostKey`), used at :227 | T4 |
|
||||
| D3 registry, own-machine refusal, grant, key reference | hosts.mjs:35-127, business.mjs:124-131, 154, 210-211, 271 | T1, T2, T26 |
|
||||
| D3 `organization.set`, `limits.set` and `instances.set` refuse `hosts` | broker `keys()` (199) | T3 |
|
||||
| D4 `host.sudo` action, decision bound to host, argv and stdin, spent once | vocabulary.mjs:28, broker.mjs:100-101, 796, 829, 1955-2005 | T9, T25 |
|
||||
| D5 `host.run` verb, check order, events | broker.mjs:95, 1714-1765, server.mjs:12-13, 113-116, resolve.mjs:90, bus business.mjs:21 | T5, T6, T8, T20, T22 |
|
||||
| D4 `host.sudo` action, decision bound to host, argv and stdin, spent once | vocabulary.mjs:28, broker.mjs:100-101, 796, 829, 1958-2008 | T9, T25 |
|
||||
| D5 `host.run` verb, check order, events | broker.mjs:95, 1717-1768, server.mjs:12-13, 113-116, resolve.mjs:90, bus business.mjs:21 | T5, T6, T8, T20, T22 |
|
||||
| D6 argv shape, literal prefix, refused runners, quoting, `sudo -n --` | hosts.mjs:20-33, 92-112, vocabulary.mjs:121-144, host-run.mjs:25-26 | T7, T8, T10, T11, T26 |
|
||||
| D6 exit, signal, timeout, output cap | host-run.mjs:95-145 | T12, T13 |
|
||||
| D7 run dir, ssh-agent, `ssh-add -t`, `--pdeathsig`, pinned known_hosts, pids with start times | host-run.mjs:17-84, 147-187 | T14, T15, T18, T19, T27 |
|
||||
@@ -56,7 +63,7 @@ The rest are in `packages/bus/tests/host-run.test.mjs`, against a scratch sshd o
|
||||
edited in place to `/nonexistent/sshd` (backup, restored, sha checked), the file exits 1: tests 21, pass 8,
|
||||
fail 13, skipped 0. The binary test and all 12 executor tests fail with "/nonexistent/sshd is missing".
|
||||
- N1. A `host.sudo` raise now checks the raiser's own grant for the target and the argv prefix before it asks the
|
||||
human (broker.mjs:1963-1966). It uses the same check `host.run` uses (:1731-1734). T5 to T8 now raise for an
|
||||
human (broker.mjs:1966-1969). It uses the same check `host.run` uses (:1734-1737). T5 to T8 now raise for an
|
||||
ungranted host (`host-not-granted`) and an argv outside the grant (`command-not-granted`), and count zero
|
||||
`host.sudo` decisions after. T9 grants web2 through a new `coderWeb2` fixture option. `hard-waits.test.mjs`
|
||||
raised `host.sudo` from a coder with no grant, so its fixture now grants web1 `systemctl status`.
|
||||
@@ -109,7 +116,7 @@ The rest are in `packages/bus/tests/host-run.test.mjs`, against a scratch sshd o
|
||||
as a prefix (hosts.mjs:20-28).
|
||||
4. `runGit` isn't shared. Its shape doesn't fit an agent socket and a stdin pipe, so host-run.mjs has its own
|
||||
spawn with the same group-kill shape.
|
||||
5. The `host-busy` check runs before the decision is spent (broker.mjs:1740), so a busy refusal leaves the
|
||||
5. The `host-busy` check runs before the decision is spent (broker.mjs:1743), so a busy refusal leaves the
|
||||
decision usable. T20 checks that the held decision runs after the first call ends. The executor checks
|
||||
again under its own map (credentials.mjs:355).
|
||||
6. T15's HOME part. ssh reads the passwd home, not `$HOME`, so a planted `~/.ssh/config` in a scratch HOME
|
||||
@@ -123,7 +130,7 @@ The rest are in `packages/bus/tests/host-run.test.mjs`, against a scratch sshd o
|
||||
10. T12. ssh exits 255 when it gets SIGTERM, so a timed-out call answers `signal: 'SIGTERM'` from the
|
||||
timeout flag and exit 255. That matches D6's "answers `signal`".
|
||||
11. T3 runs at the broker. The writer not being called stands in for "the file is unchanged". `organization.set`
|
||||
reaches the writer as `limits.set` (broker.mjs:1378). The nested paths can't carry a host grant:
|
||||
reaches the writer as `limits.set` (broker.mjs:1381). The nested paths can't carry a host grant:
|
||||
launch-settings.mjs:172 takes only a string model key and instance-settings.mjs:101 writes only
|
||||
`{definition, vars}`.
|
||||
12. T24's use-site list is `host-run.mjs`, `runtime.mjs` and `tasks/adapter.mjs`. It walks the
|
||||
@@ -157,6 +164,10 @@ the files restored at the end, and exits 1 on any survivor or missed anchor.
|
||||
|
||||
## Checks
|
||||
|
||||
Round 5 on ad95c888c (sage-1657): bus suite whole 499 pass, 0 fail, 0 skipped (the one more than round 4 is
|
||||
237's). Seat sandbox.test 10/0/0 and bus project-runtime.test 3/0/0, each run whole. Sage's slot runs the rest
|
||||
on this tree.
|
||||
|
||||
Round 4 on cb5fdb064, the final tree, after the role contract edit. Counts are awk sums over the logs.
|
||||
|
||||
- Suites, each run whole: business 198 pass, 0 fail, seat 164 pass, 0 fail, bus 498 pass, 0 fail, all 0
|
||||
|
||||
@@ -6,7 +6,7 @@ ab5f7dc38a2ca5978b02d257068f4f82706db847cf0d6400f7cd548f8f6abe43 packages/busin
|
||||
77c432e879f8611a077feb2fb7c9b67e826ade558e41dcf01433fc2cdab2e0fa packages/business/src/vocabulary.mjs
|
||||
6a2c9b371fc9236bb0730ed108cbd770e9487b8ba733dbebccd11891ccba6f17 packages/business/tests/hard-waits.test.mjs
|
||||
9ef8b8be3c290f072e7c943b176a1ec688fda03fab4ba114d31213caf2216e42 packages/business/tests/hosts.test.mjs
|
||||
fcaf50728e4599e5f10875f01c22b03610044b634c999830ef9684ef74cc62f3 packages/bus/src/broker.mjs
|
||||
610af0c4207bbd805a2a8826daa32b8cdb423937f793c32fd4241f6addfabfda packages/bus/src/broker.mjs
|
||||
ff927da3cf22fbacc9ace77b2e8b803bffc2953fb58cf7ab4e5f6f6493732996 packages/bus/src/business.mjs
|
||||
27d2ae155a2919788d7ad02da10a7056c23f5b71228e9af406b1b8aa0de55efc packages/bus/src/credentials.mjs
|
||||
86b4321dd436b97e389101873197dbab95b3d2202e5ef7da712c4978f4f9159f packages/bus/src/credential-verbs.mjs
|
||||
|
||||
Reference in New Issue
Block a user