From 8b351c3d7a3662301affd0f6c7b98f78bed512b6 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Sun, 11 Oct 2026 17:45:52 -0500 Subject: [PATCH] plans: Console service follow-ups brief from row 75 review (N1-N5) Co-Authored-By: Claude Opus 5.5 --- .../2026-10-11_console-service-followups.md | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 docs/plans/2026-10-11_console-service-followups.md diff --git a/docs/plans/2026-10-11_console-service-followups.md b/docs/plans/2026-10-11_console-service-followups.md new file mode 100644 index 000000000..93cc57518 --- /dev/null +++ b/docs/plans/2026-10-11_console-service-followups.md @@ -0,0 +1,68 @@ +# Console service follow-ups from row 75's review (2026-10-11) + +Status: written by Sage, lead. It follows `docs/plans/BRIEF-TEMPLATE.md`. +Filbert approved row 75 round 1 (comment 27430 on #1569) with five +non-blocking notes. Sage placed them in one row after the cutover, so the +service lands on the 10-12 date. + +## Console service hardening + +### Problem + +`scripts/webui-service.sh` (row 75) works as briefed, but the review +found five gaps: + +- N1: `install` doesn't refuse while the unit is active. The unit's next + `Restart=on-failure` then runs the new ExecStart without Jason starting + it. Any process under Jason's user can already change the code the unit + runs. Q95 accepted that limit for the PoC, so N1 opens no new gap. But + replacing the running unit should still be Jason's act, as starting it + is. +- N2: the unit's paths come from the checkout the script runs from, so an + install from a worktree points the unit at the worktree. No doc says to + install from the canonical checkout. +- N3: `uninstall --no-reload` skips the active check, as `bus-service.sh` + does, while the docs say uninstall always refuses while active. +- N4: if `systemctl --user list-units` fails, the script exits 1 with no + message. +- N5: the `--allow-user` value has no check that it starts with a letter + or digit. + +### Owner and reviewer + +Owner: Rocko. Reviewer: Filbert. Rocko has no Gitea token; Sage runs the +review request as jarvis. + +### Files owned + +- `scripts/webui-service.sh` +- `packages/webui/tests/service.test.mjs` +- `docs/TOOLS.md`, the script's entry only +- `agents/rocko/work/queue-/` + +### What ships + +- `install` refuses while the unit is active, and its message says Jason + stops it first. A test uses a stand-in `systemctl`. +- `install` refuses when the script isn't in the canonical checkout, + meaning the repository root has a `.git` directory, not a worktree's + `.git` file. `--allow-worktree` overrides the refusal for tests. The + TOOLS.md entry says to install from the canonical checkout. +- `uninstall` checks for an active unit even with `--no-reload`, or the + docs say exactly when it doesn't. Rocko picks one and the test shows + it. +- A failed state read prints one line to stderr naming the failed + `systemctl` call. +- `--allow-user` and the other values must start with a letter or digit. + Tests cover the two leading-character checks that the row 75 mutants + left untested. + +### Out of scope + +Starting, stopping or enabling the unit. Any `src/` change. The bus +service script. + +### Gate + +Filbert approves on the row's issue naming the candidate manifest. The +webui node suite and every `scripts/test-*.sh` green on Sage's gate rerun.