plans: row 190b brief, Melanie's hub under its own Linux user (#1693, Darkwing, reviewer Duckworth), mos-0986

docs/plans/2026-10-20_hub-own-uid.md

@@ -0,0 +1,46 @@
+# Brief: Melanie's hub instance under its own Linux user (row 190b)
+
+Sage, 2026-10-20, from Darkwing's draft (agents/darkwing/work/queue-190b/BRIEF-DRAFT.md) for Mos's ruling
+mos-0986 (2026-10-20T18:53:48Z) on row 190 R1. Mos ruled a separate uid per instance a hard precondition of
+federation R8 (mos-0984, mos-0985) and of Case 2 row C2-13. The finding was federation review B5
+(duckworth-0001): on one uid any factory agent can read, write and control Melanie's hub directly, and SSO and
+RBAC don't stop a local process with filesystem access. On the 10-27 MVP path. Gitea #1693.
+
+Owner Darkwing (Opus 5.5), reviewer Duckworth (author of B5; mos-0981 keeps new work off Filbert and Dewey),
+gate owner Sage. Merge-chained on row 190 (Q177): it builds on row 190's candidate and keeps its own review and
+gate. Design first. The first deliverable is `agents/darkwing/work/queue-190b/DESIGN.md`.
+
+## Goal
+
+Melanie's hub instance runs under its own Linux user. No process of the factory instance can read or write the
+hub's config, data root or secrets, or control the hub's units. That covers the bus, role seats and their
+sessions, task runs, the Discord connector and the Console.
+
+## The design must state
+
+1. How operators (Mos, Sage, Jason) deploy, re-pin and roll back the hub. Which commands they run, as which
+   user, and what each one needs.
+2. Each root step Jason runs: useradd, the home and its modes, `loginctl enable-linger`, and any sudoers rule,
+   with the exact command lines.
+3. How the hub reaches the Claude proxy and gets its session env without sharing jwoltje's
+   `claude-session.env`.
+4. Whether real isolation needs the factory instance's seats to run apart from the operators' uid. If yes, say
+   so plainly with its cost. Don't design around it.
+
+It must also cover the copies (shared read-only trees under jwoltje's home, or the hub's own), the human CLI
+wrapper and human proof for the hub's Console, and how the stack-release pointer, log and backups work under
+the second user.
+
+## Boundaries
+
+- Row 190 lands first, as designed: one uid, scratch two-instance tests without root.
+- No agent runs a root step. Every one goes to Jason as an exact command list.
+- No real hub user, unit or data root is created in this row's tests. Tests use scratch roots and stand-ins as
+  row 190 does. Anything that needs a second real uid is a Q173 window with a backup first and a STATE report
+  after.
+- No tunnel or Traefik exposure. That waits for Jason, after Q175 SSO.
+
+## Gate
+
+Duckworth approves DESIGN.md, then the manifest. The cli suite and every `scripts/test-*.sh` are green on
+Sage's gate. The design's mutants are killed.