From 883f78f148a15d05a1c7b8e0a9d6f7a5ddac6437 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Thu, 22 Oct 2026 12:29:57 -0500 Subject: [PATCH] gosalyn: Case 2 C2-03b round 3 for Webby webby-0156 R4: the fetch fallback reads the append-only events table for any GRANT_EVIDENCE event with method gitea and agent the chief, never gitea_grants, whose row a revoke and a grant-lost delete. It names no project, since grant.applied and grant.revoked carry none, so a chief grant on any project ends the fallback and fails safe. The revoked and fired tests go through grants.revoke and instance.fire and assert the row is gone before the fetch --- docs/plans/2026-10-20_case2-rows.md | 33 ++++++++++++++++++----------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/docs/plans/2026-10-20_case2-rows.md b/docs/plans/2026-10-20_case2-rows.md index 5254e360c..3a5ed91a4 100644 --- a/docs/plans/2026-10-20_case2-rows.md +++ b/docs/plans/2026-10-20_case2-rows.md @@ -1893,12 +1893,18 @@ Design 7.2's C2-03b paragraph: for the fetch, or slot `library-human` with her Gitea user for her save. The helper reads the file with the same checks as `readSecretFile` in `gitea-grant.mjs`: no symlink, the bus's uid, mode 0600. It still answers only the exact Username and Password prompts for the configured host and that one user. -- The fetch falls back to slot `library-gitea` only while no gitea grant record for the chief on the - library project has ever existed, in any state, so an install that runs before C2-21 still syncs. Once - a record exists, a revoked or `held` grant, or a fired chief, refuses the fetch with - `library-fetch-no-grant` and the slot is never read. A write, a revert and a save never fall back to - the slot. `library.status` names which credential the last fetch used, by kind and user, never the - value, and shows `library-fetch-no-grant` when the fetch refuses (webby-0151 R3). +- The fetch falls back to slot `library-gitea` only while the bus has never recorded a gitea grant event + for the chief. The check reads the events table for any event matching `GRANT_EVIDENCE` + (`broker.mjs:246` at aca16404c) with `method` `gitea` and `agent` equal to the chief, of any action. It + never reads `gitea_grants`. A revoke deletes that row (`broker.mjs:2785`), so does grant-lost (`:2609`), + and the table has no state column (`packages/bus/schema.sql:469-480`). The events table is append-only + (`schema.sql:131-132`), so the check survives a revoke, a grant-lost and a fire. It names no project, + since `grant.applied` and `grant.revoked` carry none (`:2469`, `:2787`). A chief grant on any project + ends the fallback, which fails safe (webby-0156 R4). An install that runs before C2-21 still syncs. Once + such an event exists, a revoked or `held` grant, or a fired chief, refuses the fetch with + `library-fetch-no-grant` and the slot is never read. A write, a revert and a save never fall back to the + slot. `library.status` names which credential the last fetch used, by kind and user, never the value, + and shows `library-fetch-no-grant` when the fetch refuses (webby-0151 R3). - Her save and revert read slot `library-human`. A missing slot, or one failing the helper's file checks, refuses `library-human-missing` before any git call. @@ -1906,12 +1912,15 @@ Tests: against a local bare repo through the module parameter, a fast-forward pu moved tip reports the race, a second race refuses `stale-base`, and a dead remote refuses `library-push-failed`. The helper answers with the named seat's user and file and refuses another seat's user, a symlinked file, a 0644 file and another uid's file. The fetch uses the chief's file when a live -grant exists and the slot only when no chief grant record exists. With a revoked, a `held` and a fired -chief's grant, each with a valid slot file present, the fetch refuses `library-fetch-no-grant`. The same -three cases with the slot file at mode 0000 still give `library-fetch-no-grant`, not a read error, which -shows the slot is never opened. A missing `library-human` refuses `library-human-missing` and runs no -git. A search of argv, the mirror's config, the run log and test output -finds no fixture token. A mutant that adds `+` to the push refspec fails. +grant exists and the slot only when the events table holds no gitea grant event for the chief. The revoked +case revokes the chief's grant through `grants.revoke` and the fired case fires the chief through +`instance.fire`, the broker's real paths, and each asserts the `gitea_grants` row is gone before the fetch +runs. With that revoked grant, the fired chief and a `held` grant, each with a valid slot file present, +the fetch refuses `library-fetch-no-grant`. A chief grant on a project other than the library project also +ends the fallback. The same three cases with the slot file at mode 0000 still give +`library-fetch-no-grant`, not a read error, which shows the slot is never opened. A missing +`library-human` refuses `library-human-missing` and runs no git. A search of argv, the mirror's config, +the run log and test output finds no fixture token. A mutant that adds `+` to the push refspec fails. ### Out of scope