From ca4585d7925e8f8f7ecb58a54f67059f75fb42af Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Mon, 12 Oct 2026 14:54:14 -0500 Subject: [PATCH] plans: decision 118 (Q125 rows), row 92 adds the session credential line (#1586) Co-Authored-By: Claude Opus 5.5 --- docs/plans/2026-09-26_lead-decisions.md | 28 ++++++++++++++++++++ docs/plans/2026-10-12_session-confinement.md | 20 +++++++++++++- 2 files changed, 47 insertions(+), 1 deletion(-) diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md index 07d8da67a..6f9fcabbe 100644 --- a/docs/plans/2026-09-26_lead-decisions.md +++ b/docs/plans/2026-09-26_lead-decisions.md @@ -2653,3 +2653,31 @@ which stay with him. Each item names who decided it and what happened. launchable ones. Mos agreed. - Q123 doesn't settle who edits the business file. Decision 104 stands, and Mos asks Jason that as its own question. +118. **Jason's PM test is fixed through rows 89 to 95; row 92 lands only + with a session credential Jason chooses (Q125, 2026-10-12).** Jason, + through Mos (sage-0104), verbatim: "We need to fix the identified + issues outside of the operating "pm", redeploy, and verify." He + answered "Q125: yes" to Mos's reading: the faults from his test + (#228, #232, the PM's findings file, faults 1 to 10, and his talk and + Console reports) are fixed through Sage's rows, #232 first, then + redeploy and re-run his test. The coder and reviewer stay stopped + until row 92 lands; Jason stopped them at 19:50Z. + - Rows: 92 (#1586, confinement, Darkwing), 89 (#1583, Dewey, also + fault 9), 90 (#1584, Dewey, also faults 2, 7 and 10), 91 (#1585, + Darkwing, after 92), 93 (#1587, review loop, Filbert, after 91 and + 95), 94 (#1588, messages live, Rocko, after 77), 95 (#1589, + Console Board and sign-out, Filbert). Row 85 waits for 94. + - Fault 10's fix keeps the broker's rule that a blocking decision + needs a task. A non-blocking `role.revoke` already routes to the + human with no task; row 90 makes the tool and session text say + so, and how a run is stopped. + - Row 92 grows by one `EnvironmentFile=` line in + `packages/cli/systemd/mosaic-bus.service.in`. A confined session + can't use Jason's `~/.claude` login (Darkwing, 19:52Z), and + binding the credentials file would hand the session a refresh + token. Sage recommends Darkwing's option 1: Jason runs `claude + setup-token` and puts the token in a 0600 file under + `~/.config/mosaic-dev/secrets/`. Option 2 is an API key, billed + separately. The choice and the file are Jason's; row 92 can pass + review and the gate first but doesn't land until the file is in + place. diff --git a/docs/plans/2026-10-12_session-confinement.md b/docs/plans/2026-10-12_session-confinement.md index 1af5d26c0..21ee44585 100644 --- a/docs/plans/2026-10-12_session-confinement.md +++ b/docs/plans/2026-10-12_session-confinement.md @@ -38,6 +38,9 @@ boundary. session needs - `packages/harness/src/gate.mjs`, the header comment only - `packages/harness/README.md` "Limits", `packages/seat/README.md` +- `packages/cli/systemd/mosaic-bus.service.in`, one `EnvironmentFile=` + line for the session credential, and its paragraph in + `packages/cli/README.md` (lead decision 118) - tests under `packages/seat/tests/`, `packages/cli/tests/` and `packages/harness/tests/` - `agents/darkwing/work/queue-/` @@ -60,6 +63,19 @@ boundary. - A missing or failing `bwrap` refuses the launch with `sandbox-unavailable`, through the broker's `refuse()`. There is no unconfined fallback. +- A confined Claude Code session can't reach Jason's + `~/.claude/.credentials.json`, which is how every role session logs + in today (Darkwing, 2026-10-12T19:52Z: the bus host has no + `ANTHROPIC_*` or `CLAUDE_CODE_OAUTH_TOKEN` variable). Binding that + file in is ruled out: Claude Code replaces it by rename on refresh, + and the session would hold a refresh token that can log out Jason and + every seat. The credential comes from a 0600 file under + `~/.config/mosaic-dev/secrets/`, which the bus unit loads with + `EnvironmentFile=`, as `CLAUDE_CODE_OAUTH_TOKEN` (or + `ANTHROPIC_API_KEY`), and `ENV_ALLOW` passes it on + (`packages/seat/src/session.mjs:61-66`). Which one is Jason's + choice. Sessions get nothing from `~/.claude`. With no credential a + Claude Code launch refuses before it starts, naming the missing file. - The network stays as it is. The harness needs its model endpoint, and the README keeps saying the network isn't confined. - Tests run a real confined session's shell and prove these refuse: @@ -90,4 +106,6 @@ Filbert and Dewey approve on the row's issue, naming the candidate manifest. The suites above pass on Sage's gate rerun. The launcher runs in the bus host, so the change is live at the next bus restart, which ends every running session (decision 109 notices to Mos). Until it is -live, whether bash-capable sessions run is Jason's call. +live, whether bash-capable sessions run is Jason's call. The row lands +only after Jason has chosen the credential and its file is in place; +without it the PM would not log in after the restart.