From 216302d65f229ec1f8845d159f21694ca4a0fc10 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 15:00:07 -0500 Subject: [PATCH] webby: Case 2 design r6 step 1 review (#416), changes B1, and session line --- agents/webby/work/case2-r6/REVIEW.md | 34 ++++++++++++++++++++++++++++ docs/SESSIONS.md | 1 + 2 files changed, 35 insertions(+) create mode 100644 agents/webby/work/case2-r6/REVIEW.md diff --git a/agents/webby/work/case2-r6/REVIEW.md b/agents/webby/work/case2-r6/REVIEW.md new file mode 100644 index 000000000..2862fe86d --- /dev/null +++ b/agents/webby/work/case2-r6/REVIEW.md @@ -0,0 +1,34 @@ +# Webby review: Case 2 design r6, section 10 step 1 (Vikunja #416) + +Webby, 2026-10-20T19:59Z (from `date -u`). Author: Gosalyn. Subject: `git diff e1635308b 1508fd175` of +`agents/gosalyn/work/case2/DESIGN.md` (r5 blob fd5df75ce635, approved in webby-0021, to r6 blob 80893dd4cff1). +Static review. I checked the cites in jason-master-restart at 1c378b4 (read only): DECISIONS.md Q183 and +projects/mosaic-mvp/MELANIE-HOST-RECON.md:27-39. Both say what r6 says they say. + +## Verdict: CHANGES + +The Q183 reading is right. #421 is closed, FED R8 records Jason's acceptance, in-VM tightening is +allowed and is #423, and each VM gets a `mosaic` user without sudo. Section 9's isolation paragraph +(DESIGN.md:961-965) states the residual as it is now, with the recon cite. + +## Blocker + +B1. Step 1 has lost the owner of the root steps on .54. Until r5, ops-01's plan section 3 (#421) created +`mosaic`, `/srv/mosaic` at 0700, and the unit (DESIGN.md:947-950 still cites it). That plan stopped. r6 +step 1 (:1017) says "the install creates the `mosaic` user". But step 2 (:1023) runs the install "as +``", and C2-13 runs as ``. A user can't create itself, and `mosaic` without sudo can't +write a system unit `mosaic-stack.service` (:948). So nothing names who does the root part, with which +access, or under whose go. The only root paths into .54 today are pve root and `melanie`'s sudo +(MELANIE-HOST-RECON.md:31, :35-36), and using either one is an act on Melanie's machine. + +Fix: list the root steps as their own item: create `mosaic` (system user, no sudo, no groups, no keys), +create `/srv/mosaic` at 0700 owned by it, and install and enable the unit. Name who runs them (Jason, or +ops-01 under his go), and through which path (melanie's sudo or pve). Say that this is step 2's go and not +step 1's. C2-13's precheck then checks the result, as it already does (rows brief a0ce2ffb8:729). Also +re-cite :950: the user spec now rests on Q183, not on the stopped #421 plan. + +## Non-blocking + +N1. :1018 says the precheck "refuses if it has sudo or any group". A system user still has its own +primary group. Say "no supplementary groups", and check `id -G` has one entry, or the precheck refuses +every real install. The rows brief (:729) uses the same words, so fix both. diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index fe4451a69..2b94c65dc 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1380,3 +1380,4 @@ are never rewritten or removed; corrections are new entries. 2026-10-20T19:52:33Z | Webby (Opus 5.5, reviewer seat) | Case 2 design r4 for Gosalyn (#416, 5fc296e70 blob 7c62c40cbbb5), static | CHANGES: B1 human reaches launch.models via limits.set (DESIGN.md:29-30, :545-548), test missing; r3 B1 fixed; N1-N2; row 192 r1 recorded in queue rev 2303 (comment 29553); notes agents/webby/work/case2-r4/REVIEW.md 2026-10-20T19:54:11Z | Webby (Opus 5.5, reviewer seat) | Case 2 design r5 review for Gosalyn (#416, e1635308b), static | APPROVE, r4 B1 N1 N2 fixed; notes agents/webby/work/case2-r5/REVIEW.md 2026-10-20T19:58:32Z | Webby (Opus 5.5, reviewer seat) | row 192 r2 review for Launchpad (#1690, 37582e820, manifest 6f8cee14), static plus a node probe | APPROVE, r1 B1 fixed, mutant 23 equivalent; notes agents/webby/work/queue-192/REVIEW-r2.md +2026-10-20T20:00:07Z | Webby (Opus 5.5, reviewer seat) | Case 2 design r6 step 1 review for Gosalyn (#416, 1508fd175), static | CHANGES B1 root steps on .54 have no owner after #421 stopped; notes agents/webby/work/case2-r6/REVIEW.md