mosaicstack/stack
25
0 Fork 1
Code Issues 404 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

gosalyn: Case 2 design r6 for #416 (T2): section 10 step 1 after Q183, mosaic user without sudo at install, FED R8 records Jason's acceptance, in-VM tightening is #423 and doesn't gate the install (mos-1057)

Browse Source
This commit is contained in:
jason.woltje committed 2026-10-20 14:58:28 -05:00
1 parent e1635308be
commit 1508fd175f
1 file changed
+26 -8
Download Patch File Download Diff File Expand all files Collapse all files
agents/gosalyn/work/case2/DESIGN.md
+26 -8
View File
@@ -1,4 +1,4 @@
# Case 2 design: the creative writing hub (r5) # Case 2 design: the creative writing hub (r6)
Gosalyn, 2026-10-20 (from `date -u`). Track T2 in jason-master-restart `projects/mosaic-mvp/PLAN.md`, Gosalyn, 2026-10-20 (from `date -u`). Track T2 in jason-master-restart `projects/mosaic-mvp/PLAN.md`,
Vikunja #416, DECISIONS Q176-Q178. The requirement is Jason's text in TARGET.md (addendum 2026-10-20). Vikunja #416, DECISIONS Q176-Q178. The requirement is Jason's text in TARGET.md (addendum 2026-10-20).
@@ -8,6 +8,18 @@ Base: `refactor` at 9ae8c73ac. r1 cited 5d019d876. `git diff --stat 5d019d876 9a
adapters roles scripts` is empty (Mos in mos-0980, Webby in webby-0001), so every `file:line` holds at adapters roles scripts` is empty (Mos in mos-0980, Webby in webby-0001), so every `file:line` holds at
9ae8c73ac. Paths are relative to the repository root. 9ae8c73ac. Paths are relative to the repository root.
## Changes from r5
Mos, mos-1057, after Jason confirmed Q4 (DECISIONS Q183, read at `DECISIONS.md:1533-1545`). The #421
plan stopped and #421 is closed, so the install on .54 no longer waits on it. Only step 1 of section 10
and the isolation paragraph of section 9 change. The hold from mos-1050 lifts for step 1 once Webby
approves this diff. Steps 2 to 9 still go to Jason.
- Step 1 now says the install creates `mosaic` without sudo, FED R8 records Jason's acceptance, and the
in-VM tightening on .54 is Vikunja #423, which doesn't gate the install.
- Section 9 no longer counts on ops-01's step 2b to remove `melanie`'s sudo. That residual stays until
#423, and Jason's acceptance in FED R8 covers it and the factory's paths to .54.
## Changes from r4 ## Changes from r4
Webby's review (webby-0020, CHANGES, notes at agents/webby/work/case2-r4/REVIEW.md, 0597cc198). I Webby's review (webby-0020, CHANGES, notes at agents/webby/work/case2-r4/REVIEW.md, 0597cc198). I
@@ -946,10 +958,11 @@ measured 300 to 390 MB on dragon-lin. I estimated at least 2 GB more than the 3.
4 GB more with specialists running at the same time. ops-01 is setting VM 1012 to 16 GiB fixed with 6 4 GB more with specialists running at the same time. ops-01 is setting VM 1012 to 16 GiB fixed with 6
cores at 2026-10-21T09:00Z (mos-1031, mos-1038), which covers both. C2-13's precheck still prints free memory before the start. cores at 2026-10-21T09:00Z (mos-1031, mos-1038), which covers both. C2-13's precheck still prints free memory before the start.
Isolation on that host. `<user>` without sudo keeps the hub from touching her files. The reverse was the Isolation on that host. `<user>` without sudo keeps the hub from touching her files. The reverse is the
B7 residual in r2, because `melanie` had passwordless sudo (mos-1000). Step 2b of ops-01's plan removes B7 residual from r2: `melanie` has passwordless sudo (mos-1000), and the factory reaches .54 through pve
her sudo and lxd, so it is no longer a residual to accept. It depends on Jason approving that plan root and ssh as `melanie` (jason-master-restart `projects/mosaic-mvp/MELANIE-HOST-RECON.md:27-39`). Jason accepted those paths (Q183), and FED R8 records
(10 step 1). his acceptance instead of refusing to start. The in-VM tightening is Vikunja #423, and changes to the
`melanie` account wait until Bean and Chet are live (10 step 1).
### 9.1 Moving Bean and Chet (C2-20) ### 9.1 Moving Bean and Chet (C2-20)
@@ -999,9 +1012,14 @@ resolves to 10.1.1.222, and STATE.md lists its certificate among the edge certif
reachable from the internet. Her writing is already there by her own choice. The hub adds no new remote. reachable from the internet. Her writing is already there by her own choice. The hub adds no new remote.
What it adds is one bot account with read access to that one repo. What it adds is one bot account with read access to that one repo.
1. Jason approves the tightening plan (#421). The host is set (Q181): 10.1.1.54 as `mosaic` under 1. The host is set (Q181): 10.1.1.54 as `mosaic` under `/srv/mosaic`, 16 GiB and 6 cores. Jason
`/srv/mosaic`, 16 GiB and 6 cores. Plan step 2b, which removes `melanie`'s sudo and lxd, closes r2's confirmed Q4 (Q183), so #421 is closed and the install doesn't wait on it.
B7 residual (9). - The install creates the `mosaic` user without sudo (9). C2-13's precheck refuses if it has sudo or
any group.
- FED R8 records Jason's acceptance of the factory's paths to .54. Gizmoduck's r4.10 of the
federation design writes that wording, and it is in progress.
- The in-VM tightening on .54 is Vikunja #423. It doesn't gate the install. Changes to the `melanie`
account wait until Bean and Chet are live.
2. Running the install on `<host>` as `<user>`, by him or his delegate: `scripts/bootstrap.sh`, release 2. Running the install on `<host>` as `<user>`, by him or his delegate: `scripts/bootstrap.sh`, release
package and activate, the pinned harness, and which model accounts its agents use. Model use is spend, package and activate, the pinned harness, and which model accounts its agents use. Model use is spend,
so the accounts are his call. so the accounts are his call.