row 234 (#1740): BUILD.md scope for #436a row a, the split from row b and the section 7 name map

2026-10-20 21:59:02 -05:00
parent 8fede5fc6a
commit 2aa54a67ab
1 changed files with 71 additions and 0 deletions
@@ -0,0 +1,71 @@
+# Row 234 (#436a row a, Gitea #1740): host enrollment, store records and bus schema 3i to 3j
+
+Gizmoduck, 2026-10-21. Reviewer Duckworth, gate owner Sage. Lands by 10-25, before the .53 and .54 installs
+(mos-1134).
+
+- Brief: `docs/plans/2026-10-20_host-credentials.md`, section "Machine grant row a: enrollment, store records
+  and migration 3i-3j", blob 64451be5 (queue rev 2617).
+- Design: `agents/gizmoduck/work/machine-grant/DESIGN.md` r6, f9039682e on `gizmoduck/machine-grant-design`,
+  approved by Duckworth (duckworth-0064, REVIEW-r6.md at 8ea792256). Not reopened here. Cites "r6:" are lines
+  of that file.
+- Grant event rule: #436b section 7, fa5658941 on `megavolt/row199`,
+  `agents/megavolt/work/436b/DESIGN.md:431-490`, file sha256
+  96510b83778e79a71b33d0d5f6fd0c806dfe74f6de315ff4a9f1fbe5620f6c69, approved by Duckworth (duckworth-0067).
+- Base: origin/refactor 8fede5fc6, with rows 199 (cb5fdb064) and 210 (f5753c0e8) landed. Branch
+  `gizmoduck/row234`. Code cites are `path:line` at 8fede5fc6 unless they say otherwise.
+
+## Names: r6 against section 7
+
+r6's `grant.*` and `host.enroll.*` names are `body.action` values on `action.allowed` events, not event
+kinds. The `events` kind CHECK isn't rebuilt. Four r6 names move under `grant.`:
+
+| r6 | This row |
+|---|---|
+| `host.enroll.step` | `grant.host.enroll.step` |
+| `host.enrolled` | `grant.host.enrolled` |
+| `host.checked` | `grant.host.checked` |
+| `host.removed` | `grant.host.removed` |
+
+Only the consume record carries `decision`: `{operation: 'grant.host-enroll', decision}`. Every other
+guarded body names the decision `grantDecision`, so r6's `decision` field in step, enrolled and failed bodies
+is `grantDecision` here. The actor of every guarded event is `actor_role` NULL with `actor_run` 'grant',
+and `body.by` names the caller the broker checked.
+
+## Split (r6 section 12 Q-S4)
+
+Row a builds:
+
+1. **Schema 3i to 3j.** `migrations/3i-3j.sql` adds `hosts` and `host_grants` (r6 S1, primary keys
+   (business, host) and (business, agent, host)) and the guard trigger: an `action.allowed` whose
+   `body.action` or `body.operation` GLOBs `'grant.*'` aborts unless the actor is (NULL, 'grant').
+   `SCHEMA_VERSION` 3j, a migration test with a step that fails partway.
+2. **Grant event writer.** A private session-less broker writer for guarded events. `#event` doesn't change.
+   `recordEvent` refuses `reserved-event` for the guarded namespace.
+3. **The `grant` raise frame.** `decision.raise` takes `grant` only with `credential.mint`, only from the chief
+   (`grant-chief-only`), and in row a only with `method: 'host-enroll'`. Any other method refuses
+   `invalid-request` until row b adds `host`. E1's checks, the `ssh-keyscan` set compare before the raise
+   transaction, and the rendered block.
+4. **Enrollment executor.** `#consumeGrant`, the start on the human's cli yes (X1), E2 steps 1 to 4, the
+   installer key at `<configDir>/secrets/hosts/<business>/<hostId>/installer`, the failure cleanup, and the
+   start reconcile for enrollments: the `registry` step undo, and a resolved-yes unspent enrollment ending
+   `grant.failed interrupted` (X3).
+5. **`hosts.check` and `hosts.remove`** (E4), with `mosaic hosts status|check|remove`.
+6. **`tools/host/`**: `mosaic-keys`, `mosaic-keys-write`, `mosaic-keys.sudoers`, `mosaic-keys.sshd.conf` (E3).
+7. **`host.run` on the store** (X4 first and third bullets): it reads the `hosts` and `host_grants` records
+   and the Approve record check, and at start the runtime gives `Credentials` a reference per `host_grants`
+   record. The loader refuses `hosts` at the top level and in a role (S1). Row 210's tests move to store
+   fixtures.
+8. **Reader filter** (duckworth-0067 N1): every grant-evidence reader in this row (status, the start
+   reconcile, `openGrantDecisions`) filters `kind = 'action.allowed' AND actor_role IS NULL AND actor_run =
+   'grant'`, with a test that an `action.refused` look-alike and a session-written one are ignored.
+
+Row b keeps the `host` method's raise binding (R4), the grant executor (X2), the grant rows of X3, X5,
+`Credentials.register`/`claim`/`abortClaim`, revoke (section 6) and `sweep`. So row a has no way to make a
+`host_grants` record outside a test fixture, and from its landing to row b's no agent holds a host grant
+(r6 N9, the run sheet strips row 210's keys).
+
+Tests in row a (r6 section 10): G1 and G5 for the `host-enroll` raise, G6 and G10 for the enrollment
+executor, G11's enrollment cases, G14, G15, G16, G17, G18, G20, G21 (its `host-line-left` case reads an
+event fixture until row b writes `hostLineLeft`), G25, the migration test, the trigger cases, the reader
+filter test, and row 210's T-tests on store fixtures. Row b: G2 to G4, G7 to G9, G11's grant cases, G12,
+G13, G19, G22 to G24, G26 to G28.