From 13a98bfd0833e0d10d3db08e7f54c5d90da9ad80 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 15:38:32 -0500 Subject: [PATCH] gosalyn: Case 2 C2-13 brief takes row 195's asks: --profile factory|library, node 24 and bwrap precheck lines, copy id as the one varying ExecStart part (darkwing) --- docs/plans/2026-10-20_case2-rows.md | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/docs/plans/2026-10-20_case2-rows.md b/docs/plans/2026-10-20_case2-rows.md index d7e729728..8ccb98ed5 100644 --- a/docs/plans/2026-10-20_case2-rows.md +++ b/docs/plans/2026-10-20_case2-rows.md @@ -734,10 +734,24 @@ path. It runs as `` through `sudo -u mosaic -H` from `localadmin`, and `mo doesn't create `` and writes no unit file. Root does those in design 10 steps 2a and 2c. Every host value is an input, so a later host move changes only inputs. +Row 195 runs these scripts by input for Case 1 on 10.1.1.53 (darkwing to gosalyn, design at +`agents/darkwing/work/queue-195/DESIGN.md` section 2). They don't copy them. So the install and the +precheck take `--profile factory|library`, default `library`: +- `library` is everything this brief lists. +- `factory` skips the library mapping, the persona files and digests, the token slot, and + `library.sync` and `library.status`. It requires `bus.tester` on, because Case 1's acceptance uses the + tester. +- `factory` refuses a business file that has a `kind: "library"` project, with + `profile-library-business`. So Case 2 can't reach a tester-on check through a wrong flag. +- `library` refuses with `bus.tester` on, as before. + `case2-unit.sh` is the 2c step. Root runs it from a root-owned checkout of the reviewed commit outside `/srv/mosaic`, never from the release, because `mosaic` can write the release. It does the following: -- It renders the unit from the checkout's template, with the user and home as inputs. -- It refuses unless `User=`, `Group=`, `ExecStart=` and the hardening lines match fixed values. +- It renders the unit from the checkout's template, with the user, the home and the copy id as inputs. +- It refuses unless `User=`, `Group=`, `ExecStart=` and the hardening lines match fixed values. The + copy id is the one part of `ExecStart=` that varies, so a re-pin to a new copy can re-render the + unit (row 195). It must be exactly 40 lowercase hex characters naming an existing directory directly + under ``'s copies dir. Anything else refuses before the render. - It refuses any `PermissionsStartOnly=`, and any `Exec*=` value whose leading run of prefix characters (`@`, `-`, `:`, `+`, `!`) holds a `+` or `!`. systemd takes those prefixes in any order, so `-+/srv/mosaic/x` runs as root even with `User=mosaic`. The named-line check doesn't read these @@ -754,6 +768,11 @@ The precheck refuses unless all of these hold: - The business file, `.history`, `changes.jsonl` and persona files have the modes in design 4, and each persona digest matches. - The run root is 0700. +- `node --version` is 24 or later, because every package's `engines` field says `>=24` (row 195: .53 + has v22.22.2). +- `bwrap --unshare-all --ro-bind / / true` exits 0 as ``. Without it no session starts. Row 195 + found no bwrap on .53, and `kernel.apparmor_restrict_unprivileged_userns=1`, and .54 may be the same. + On a refusal, the precheck prints the sysctl's value and whether `bwrap` is on PATH. - One marker prompt run through the host's claude with `--system-prompt-file` shows that it replaces the default prompt. The claude version is printed. - `library.sync` fetches her repo read-only, and `library.status` lists R-problems. @@ -770,7 +789,11 @@ claude check runs against a fake claude that appends rather than replaces, and t - a symlink at the unit path - a template with `ExecStartPre=+/srv/mosaic/x` - a template with `ExecStartPre=-+/srv/mosaic/x` +- a copy id that is short, uppercase, holds `/` or `..`, or names no directory +Precheck cases for the new lines: a fake `node` printing v22 refuses, and a fake `bwrap` that exits 1 +refuses. `--profile factory` passes with the tester on and no library items, and refuses a business +file with a library project. `--profile library` refuses with the tester on. A clean render writes a 0644 file. A test checks the script for `systemctl link`. ### Out of scope