honker: row 194 PRD 1.7 draft, REQ-CRED-3 agent host access with sudo through the credential store, Q183 and Q184 sources, who grants left open (sage-1422, mos-1067, Vikunja #424)

agents/honker/work/queue-194/PRD-1.7-DRAFT.md

@@ -1,4 +1,5 @@
-# PRD 1.7 draft: the chief of staff's hire and fire authority, and the coder's push to its fork
+# PRD 1.7 draft: the chief of staff's hire and fire authority, the coder's push to its fork, and agent
+# host access through the credential store
 
 Draft by Honker for row 194 (#1692), under Mos's ruling mos-1017 (through Sage, sage-1365). Not approved.
 It changes nothing until Jason approves it as a `prd.approve` decision in the Console. Sage opens that
@@ -10,7 +11,9 @@ Row 194 adds `role.hire` and `role.fire` to the vocabulary, and row 199 adds `gi
 REQ-WAIT-3 all three are hard waits, so today Jason resolves every hire, every fire and every push to a
 remote. This version routes hire and fire for the chief of staff within fixed bounds, so the chief hires
 and fires as needed and the user's per-agent forbid still holds. It routes `git.push.remote` for the coder
-only (Mos, mos-1028 item 3). One `prd.approve` decision covers all three (Vikunja #420).
+only (Mos, mos-1028 item 3). It adds agent host access with sudo through the credential store for
+agents with a grant (Q183, Q184, Vikunja #424, due 2026-10-27). One `prd.approve` decision covers it all
+(Vikunja #420).
 
 When this version lands, a reviewed commit:
 
@@ -24,6 +27,8 @@ When this version lands, a reviewed commit:
 4. states, for a `git.push.remote` with no decision, where the source commit comes from: the latest work
    commit the bus recorded for the coder's task. The check still matches it against the work ref tip and
    the push sends it by oid (row 199, duckworth-0022 N9).
+5. adds the host credential grant check and the stack's ssh and sudo for a granted agent (REQ-CRED-3,
+   Vikunja #424).
 
 Every other check stays as rows 194 and 199 build it. Filling `hireable` stays a separate reviewed role
 file commit in `roles/`.
@@ -33,12 +38,20 @@ file commit in `roles/`.
 Status line, appended to the current paragraph:
 
 > Version 1.7 routes the chief of staff's hire and fire actions and the coder's push to its own fork,
-> approved by Jason in decision <prd.approve decision id>.
+> and adds agent host access through the credential store, approved by Jason in decision
+> <prd.approve decision id>.
 
 Source, a new bullet above "Version 1.6 source":
 
 > - Version 1.7 source, TARGET.md line 66: "Chief of staff agent has hire/fire authority for agents as
->   needed; unless user forbids per agent"
+>   needed; unless user forbids per agent". And Jason through Mos (mos-1067), DECISIONS Q183, in part: "I will
+>   still want to allow infra agent(s) on my .53 instance to access other servers, etc. However, not all
+>   agents will need to have that access. I envision a credential store within Mosaic Stack that works
+>   as some sort of variable for the agent to call. The system will enforce access to the credentials to
+>   keep the agents sandboxed with proper security. I need to be able to trust my agents with assisting
+>   me. This will require sudo access to several systems. If we can utilize the credential store in
+>   Mosaic Stack and allow agents to perform their jobs with NOPASSWD sudo on various machines, I am a
+>   happy man." DECISIONS Q184, on whether that is in place by 10-27: "Q5: by 10.27"
 
 Under "Added in version 1.2", after REQ-COS-2:
 
@@ -92,6 +105,16 @@ Under "Landing", after REQ-LAND-1:
 >
 >   Every push is logged with the remote, the ref, the commit and, when one was given, the decision.
 
+Under "Credentials", after REQ-CRED-2:
+
+> Added in version 1.7:
+>
+> - **REQ-CRED-3.** An agent with a grant can run commands with sudo on another host. The agent asks
+>   for the host credential by name. The stack checks that a grant exists for that agent and that host,
+>   then does the ssh and the sudo for the agent. The agent never sees the key or any other secret value
+>   (REQ-CRED-1, REQ-VAR-2). An agent without a grant for that host is refused. Not every agent gets a
+>   grant. Jason grants one through a reviewed role or config change.
+
 REQ-WAIT-3, appended:
 
 > `role.hire` and `role.fire` were added as hard waits and route under REQ-COS-3 since version 1.7.
@@ -125,5 +148,10 @@ REQ-WAIT-3, appended:
   `hireable` list stays a reviewed commit in `roles/`.
 - The credentials bound names no row number, so the text doesn't go stale when row 199 lands. A later
   version lifts it.
+- REQ-CRED-3 states only what Jason said in Q183 and Q184 (sage-1422). Open point: Q183 doesn't say
+  who grants host access or how. The text leaves it as Jason through a reviewed role or config change
+  and defines no mechanism. The design for #424 settles it, and Duckworth reviews that design because
+  it gives agents sudo on hosts (Q184, Mos's reading). Where the build goes, row 199 or a row on top of
+  it, is Sage and Megavolt's call.
 - This draft follows the PRD's own style: plain words, no semicolons in new sentences, and the status
   paragraph never edited in place except to append.