docs(records): lead decision 37, raw per-seat token files in the Gitea helper (row 12)

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-09-26 20:25:02 -05:00
parent 8ffbd73b76
commit d2813a4b6b
1 changed files with 23 additions and 0 deletions
@@ -473,3 +473,26 @@ which stay with him. Each item names who decided it and what happened.
      (24 pass, 2 fail). The canonical checkout passes 26/26. This goes
      to DEFERRED for Darkwing. Until it is fixed, read the queue suite's
      result in the canonical checkout.
 37. **Gitea helper reads the per-seat raw token files (row 12).**
    Darkwing found that `scripts/gitea-api.sh` accepts only the JSON
    credential file, while the per-seat files Jason ruled on hold a raw
    token (checked with `stat` only: 41 bytes for four seats, 40 for
    jarvis, all 0600). Without a change every live Piece D attempt fails
    at the pre-send `GET user`. Sage says yes to a separate helper patch
    with the D candidate, on these terms:
    - The JSON path is unchanged. The raw path applies only when the file
      isn't JSON.
    - The raw path accepts exactly one line of token characters, with an
      optional trailing newline, and refuses anything else before any
      request.
    - On the raw path the base URL is fixed at https://git.mosaicstack.dev,
      with no override.
    - The file checks stay (regular file, no symlink, no group or other
      bits). The token goes only through the curl config stream. Tests
      use stubs and read no real token.
    - A seat uses only its own file.
    - Rocko reviews the patch as well as Filbert.
    This doesn't widen access: each seat already has the token by Jason's
    ruling, and the change only lets the helper read the file's actual
    format. JSON wrapper files would need writes under `~/.mosaic`, which
    are forbidden.