From a3c50d91ca06d9b7b13ea03bf2a2d6896130d787 Mon Sep 17 00:00:00 2001 From: fred Date: Tue, 18 Aug 2026 18:28:37 -0500 Subject: [PATCH] guides: genericize the operator name in SEAT-IDENTITY provisioning Pipeline 2514 failed the sanitization gate on 'Jason mints the token into the seat slot'. The denylist is jarvis|jason|woltje|... and a shipped framework file must not carry operator identity. My mistake: I generalized the estate paths and seat names when promoting this guide and did not check the operator name. Now reads 'the estate operator', with the accompanying rule that an agent does not ask another agent to mint one either. Verified by running tools/quality/scripts/verify-sanitized.sh locally rather than guessing at the pattern: gate passes. --- packages/mosaic/framework/guides/SEAT-IDENTITY.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/mosaic/framework/guides/SEAT-IDENTITY.md b/packages/mosaic/framework/guides/SEAT-IDENTITY.md index 5890089e..e14da52d 100644 --- a/packages/mosaic/framework/guides/SEAT-IDENTITY.md +++ b/packages/mosaic/framework/guides/SEAT-IDENTITY.md @@ -95,7 +95,8 @@ is not how a system finds a credential; the helper resolving the right store is. 1. Create `~/.mosaic/fleet/agents//secrets/` mode 700. 2. Write `.principal` (the Gitea login) and `.scopes` (the granted scopes), mode 600. -3. Jason mints the token into the seat slot, mode 600. Agents do not mint their own. +3. The estate operator mints the token into the seat slot, mode 600. Agents do not mint their + own, and do not ask another agent to mint one for them. 4. Symlink the framework store entry to the seat slot. 5. Verify with an authenticated `GET /user` and confirm the returned login is the seat, **not the minting account**. Record the date in `ENTITY.md`. Never record the value.