mosaicstack/stack
16
0
Fork 1
Code Issues 330 Pull Requests 12 Actions Packages Projects Releases 15 Wiki Activity

framework: fail-closed credential helper is host-local and clobbered by upgrades — adopt git-credential-mosaic into the tree #1220

New Issue
Open
opened 2026-08-13 19:16:01 +00:00 by Ghost · 1 comment
Ghost commented 2026-08-13 19:16:01 +00:00
Copy Link
Copy Source

Defect

The fail-closed git credential helper (git-credential-mosaic) — the component that enforces per-seat identity, refuses shared/privileged fallback, and escalates on missing identity — is not in the framework tree. It exists only as host-local copies, and its own header says so: "HOST-LOCAL: clobbered by mosaic upgrades."

Measured (2026-08-13)

Two divergent copies on one workstation:

  • ~/.local/bin/git-credential-mosaic — sha256 540f9960…, Jul 28, the active fail-closed copy
  • ~/.config/mosaic/tools/git/git-credential-mosaic — sha256 026aad82…, Jul 26, older

An upgrade that reseeds ~/.config/mosaic overwrites the second and never touches the first; nothing reconciles them; which one a host runs depends on PATH order plus installation history. The estate's core identity-enforcement control has no canonical source, no version, and no delivery path.

Relation to existing issues

  • #1071 measures host/framework skew for files that ARE in the tree. This helper is worse-positioned: it cannot even skew against main, because main has no copy to skew from.
  • #1072 (no framework deploy pipeline) means that even after adoption, delivery needs an answer — but adoption into the tree is a prerequisite and is independently valuable (review, versioning, a canonical sha to compare hosts against).
  • #1043 (closed) specified the helper's resolution chain as the contract seats rely on; the component implementing that contract should live where the contract does.

Remedy

  1. Adopt the helper into the framework tree (with its escalation spooling and fail-closed semantics) as the canonical source.
  2. Install path managed by install.sh like every other tool; the host-local copy becomes a deployment artifact, not an original.
  3. A doctor check comparing the installed helper's hash against the tree's, so divergence is a detectable condition instead of an archaeology exercise.
## Defect The fail-closed git credential helper (`git-credential-mosaic`) — the component that enforces per-seat identity, refuses shared/privileged fallback, and escalates on missing identity — is not in the framework tree. It exists only as host-local copies, and its own header says so: "HOST-LOCAL: clobbered by `mosaic` upgrades." ## Measured (2026-08-13) Two divergent copies on one workstation: - `~/.local/bin/git-credential-mosaic` — sha256 540f9960…, Jul 28, the active fail-closed copy - `~/.config/mosaic/tools/git/git-credential-mosaic` — sha256 026aad82…, Jul 26, older An upgrade that reseeds `~/.config/mosaic` overwrites the second and never touches the first; nothing reconciles them; which one a host runs depends on PATH order plus installation history. The estate's core identity-enforcement control has no canonical source, no version, and no delivery path. ## Relation to existing issues - #1071 measures host/framework skew for files that ARE in the tree. This helper is worse-positioned: it cannot even skew against main, because main has no copy to skew from. - #1072 (no framework deploy pipeline) means that even after adoption, delivery needs an answer — but adoption into the tree is a prerequisite and is independently valuable (review, versioning, a canonical sha to compare hosts against). - #1043 (closed) specified the helper's resolution chain as the contract seats rely on; the component implementing that contract should live where the contract does. ## Remedy 1. Adopt the helper into the framework tree (with its escalation spooling and fail-closed semantics) as the canonical source. 2. Install path managed by `install.sh` like every other tool; the host-local copy becomes a deployment artifact, not an original. 3. A doctor check comparing the installed helper's hash against the tree's, so divergence is a detectable condition instead of an archaeology exercise.
Ghost commented 2026-08-13 19:16:22 +00:00
Copy Link
Copy Source

ATTRIBUTION CORRECTION: filed by mos-claude (Mos). Author shows coder-mos1 via the wrapper fallback defect documented in the correction comment on #1218 — itself an instance of the wrong-identity class these issues describe.

ATTRIBUTION CORRECTION: filed by mos-claude (Mos). Author shows coder-mos1 via the wrapper fallback defect documented in the correction comment on #1218 — itself an instance of the wrong-identity class these issues describe.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1220