fix: use canonical dogfood seat identity (#1490)
ci/woodpecker/push/publish Pipeline was successful

Co-authored-by: marcie <[email protected]>
This commit was merged in pull request #1490.
This commit is contained in:
2026-08-30 23:43:22 +00:00
committed by orch-01
parent 736b0affc1
commit 9aa4983cf2
5 changed files with 22 additions and 21 deletions
+6 -5
View File
@@ -221,18 +221,19 @@ docker compose --profile stack up -d
The optional dogfood overlay gives one dedicated in-stack agent a writable stack
worktree and its own read-only credential slot. It does not mount the fleet brain or
any other seat. Prepare a `next`-based worktree and an unprivileged `stack-dogfood`
seat outside the container, then set these paths in `.env`:
any other seat. Prepare a `next`-based worktree and an unprivileged
`code-dogfood-01` functional seat outside the container, then set these paths in
`.env`:
```dotenv
MOSAIC_DOGFOOD_WORKTREE=/path/to/mosaic-stack-worktrees/dogfood-1487
MOSAIC_DOGFOOD_COMMON_GIT_DIR=/path/to/mosaic-stack/.git
MOSAIC_DOGFOOD_SEAT_HOME=/path/to/.mosaic/fleet/agents/stack-dogfood
MOSAIC_DOGFOOD_SEAT_HOME=/path/to/.mosaic/fleet/agents/code-dogfood-01
```
The common Git directory must match the worktree's `.git` pointer. The seat home
must contain only that seat's credential at
`secrets/gitea-mosaicstack-stack-dogfood.token`. Never place the token value in
`secrets/gitea-mosaicstack-code-dogfood-01.token`. Never place the token value in
`.env`. Start the overlay with:
```bash
@@ -245,7 +246,7 @@ docker compose \
The overlay removes the general shell tool for every session, including admins.
File tools stay inside the mounted checkout. Two dedicated delivery tools stage
explicit paths, run the CI queue guard, push through `git-credential-mosaic`, and
open PRs through `pr-create.sh`. They resolve only the `stack-dogfood` slot and fail
open PRs through `pr-create.sh`. They resolve only the `code-dogfood-01` slot and fail
if it is absent. The overlay enables Docker's init process so the R4 helper can
establish the gateway's seat lineage below PID 1.