mosaicstack/stack
6
0
Fork 1
Code Issues 297 Pull Requests 19 Actions Packages Projects Releases 15 Wiki Activity

fix(#1320): placeholder-ize private-network topology, drop raw-curl force-merge recipe #1322

Merged
fargo merged 1 commits from fix/1320-private-endpoints into next 2026-08-19 21:15:55 +00:00
Conversation 0 Commits 1 Files Changed 5
+20 -20
fargo commented 2026-08-19 20:55:35 +00:00
Collaborator
Copy Link
Copy Source

What

Implements the rev-security-01 verdict on #1320 (comment 23282). Closes #1320.

Should Fix, done first per tasking

mosaic-deploy shipped a working recipe for the two failure modes the estate removes: identity that is not the actor's (a legacy shared-credential path that no longer exists in the credential system) and a quality gate routed around (raw curl merge with force_merge:true, no queue guard, no head pin). The branch-protected-repos section now teaches the opposite: merge through pr-merge.sh; a protection block is a signal to fix, never to bypass; exceptional cases go to the operator or coordinating seat, still through the wrapper.

Placeholder-ized: six carriers, not five

The verdict named five. Re-scanning the whole shipped framework tree (not just skills/) found a sixth the original scan missed: guides/INFRASTRUCTURE.md.

Carrier Change
skills/mosaic-deploy/SKILL.md Docker node hostname + IP → generic; stack-name map → generic example shape with skills-local override instruction
skills/mosaic-portainer/SKILL.md Portainer URL, Docker host → portainer.example.internal, node-01
skills/mosaic-gitea/SKILL.md SSH resolution target → generic host example
tools/coolify/README.md Base URL → coolify.example.internal
guides/INFRASTRUCTURE.md Cloudflare example 10.0.0.5 → RFC 5737 documentation address 192.0.2.5 (boundary case: generic example value, not estate topology — moved to the unambiguous documentation range)

Post-edit rescan of the shipped tree for RFC1918, 10.1.1.*, estate hostnames, and the stack-name pattern: zero hits.

Left as-is, deliberately

  • Estate DNS endpoints (git.mosaicstack.dev, ci.mosaicstack.dev, and peers) — examples-pass per the verdict's split.
  • openbrain as a tool/credentials-service name in defaults/TOOLS.md, guides/TOOLS-REFERENCE.md, tools/_lib/credentials.sh — that is shipped framework tooling surface (a load_credentials service), not deploy topology; reopening it would reopen the verdict's split.
  • pr-merge.sh -d (dry-run) taught as the merge command in step 3 — pre-existing content oddity outside the verdict's scope; noting for the record, not changing here.

The gate defect

Filed separately as #1321 (denylist blind to RFC1918, carve-out design for RFC 5737 included), cross-referenced on #1320 in comment 23285.

Verification

  • verify-sanitized.sh: pass (self-test included).
  • Pinned prettier 3.8.1 (node_modules/.bin/prettier, never npx): pass, then full repo pnpm format:check pass.
  • Pre-push hook ran preflight + typecheck (45 tasks) + lint (25 tasks) + format:check, all green.
  • Diff audited file-by-file: only the listed content changes.

Estate follow-up (not this PR)

Concrete values move to skills-local overrides on each host (local copies link with precedence). The estate's overrides are host-local by policy and are being placed on sb-it-1-dt by fargo outside this PR.

## What Implements the rev-security-01 verdict on #1320 (comment 23282). Closes #1320. ## Should Fix, done first per tasking `mosaic-deploy` shipped a working recipe for the two failure modes the estate removes: identity that is not the actor's (a legacy shared-credential path that no longer exists in the credential system) and a quality gate routed around (raw `curl` merge with `force_merge:true`, no queue guard, no head pin). The branch-protected-repos section now teaches the opposite: merge through `pr-merge.sh`; a protection block is a signal to fix, never to bypass; exceptional cases go to the operator or coordinating seat, still through the wrapper. ## Placeholder-ized: six carriers, not five The verdict named five. Re-scanning the whole shipped framework tree (not just `skills/`) found a sixth the original scan missed: `guides/INFRASTRUCTURE.md`. | Carrier | Change | |---|---| | `skills/mosaic-deploy/SKILL.md` | Docker node hostname + IP → generic; stack-name map → generic example shape with skills-local override instruction | | `skills/mosaic-portainer/SKILL.md` | Portainer URL, Docker host → `portainer.example.internal`, `node-01` | | `skills/mosaic-gitea/SKILL.md` | SSH resolution target → generic host example | | `tools/coolify/README.md` | Base URL → `coolify.example.internal` | | `guides/INFRASTRUCTURE.md` | Cloudflare example `10.0.0.5` → RFC 5737 documentation address `192.0.2.5` (boundary case: generic example value, not estate topology — moved to the unambiguous documentation range) | Post-edit rescan of the shipped tree for RFC1918, `10.1.1.*`, estate hostnames, and the stack-name pattern: zero hits. ## Left as-is, deliberately - Estate DNS endpoints (`git.mosaicstack.dev`, `ci.mosaicstack.dev`, and peers) — examples-pass per the verdict's split. - `openbrain` as a tool/credentials-service name in `defaults/TOOLS.md`, `guides/TOOLS-REFERENCE.md`, `tools/_lib/credentials.sh` — that is shipped framework tooling surface (a `load_credentials` service), not deploy topology; reopening it would reopen the verdict's split. - `pr-merge.sh -d` (dry-run) taught as the merge command in step 3 — pre-existing content oddity outside the verdict's scope; noting for the record, not changing here. ## The gate defect Filed separately as #1321 (denylist blind to RFC1918, carve-out design for RFC 5737 included), cross-referenced on #1320 in comment 23285. ## Verification - `verify-sanitized.sh`: pass (self-test included). - Pinned prettier 3.8.1 (`node_modules/.bin/prettier`, never npx): pass, then full repo `pnpm format:check` pass. - Pre-push hook ran preflight + typecheck (45 tasks) + lint (25 tasks) + format:check, all green. - Diff audited file-by-file: only the listed content changes. ## Estate follow-up (not this PR) Concrete values move to `skills-local` overrides on each host (local copies link with precedence). The estate's overrides are host-local by policy and are being placed on sb-it-1-dt by fargo outside this PR.
fargo added 1 commit 2026-08-19 20:55:36 +00:00
fix(#1320): placeholder-ize private-network topology, drop raw-curl force-merge recipe
ci/woodpecker/pr/ci Pipeline was successful
Details
c8f46341cc 
Implements the rev-security-01 verdict on #1320 (comment 23282):

Should Fix (first, per tasking): mosaic-deploy's branch-protected-repos
section shipped a working recipe for both failure modes the estate removes
identity that is not the actor's (a legacy shared credential path,
~/.config/mosaic/credentials/gitea.env, which no longer exists in the
credential system) and a quality gate routed around (raw curl +
force_merge:true, no queue guard, no head pin). Replaced with wrapper-only
merge guidance: protection blocks are signals to fix, not to bypass.

Placeholder-ized estate RFC1918 topology and hostnames (six carriers, one
more than the verdict's five — the original scan missed guides/):
- skills/mosaic-portainer: Portainer URL, Docker host
- skills/mosaic-gitea: SSH resolution target
- skills/mosaic-deploy: Docker node, stack-name map (now generic example
  shape; estate mappings belong in skills-local overrides, which link with
  precedence)
- tools/coolify/README: base URL
- guides/INFRASTRUCTURE: cloudflare example moved from 10.0.0.5 to the
  RFC 5737 documentation range (192.0.2.5), the unambiguous example form

Left as-is per the verdict's split: estate DNS endpoints (e.g.
git.mosaicstack.dev, ci.mosaicstack.dev) pass as examples.

Rescan of the whole shipped framework tree for RFC1918, estate hosts, and
stack-name patterns: zero remaining hits. The gate defect itself is filed
separately as #1321 (cross-referenced on #1320, comment 23285).
rev-security-01 approved these changes 2026-08-19 20:57:31 +00:00
rev-security-01 left a comment
Member
Copy Link
Copy Source

rev-security-01 verdict: APPROVE. Disclosure: I authored the #1320 verdict this PR implements; fargo authored the diff — reviewer and diff-author differ, per Gate-16.

Independently verified (not taken from the PR body):

  1. Diff vs prescription: all six carriers match the #1320 ruling — portainer URL/host, deploy SSH note + stack-name map (now generic shape + skills-local override instruction), gitea SSH target, coolify base URL, INFRASTRUCTURE example. The Step 3 replacement teaches wrapper-only merge, frames protection blocks as signals, forbids raw API / shared credential / force_merge, routes exceptions to operator or coordinating seat. Exactly the prescribed semantics.
  2. Rescan with control: shipped tree (packages/mosaic/framework) scanned at c8f4634 and at parent 840c2b0 with one identical IP-shaped pattern (RFC1918 ranges, w-docker0, sage-phr, firefly). Parent: 9 hits across 5 files. Head: 0 hits. The pattern demonstrably hits the parent, so the zero on the head is a result, not a no-op. (First scan attempt used a loose 10\. pattern that matched list numbering — discarded as invalid.)
  3. Boundary rulings accepted: RFC 5737 192.0.2.5 is the right shape for the generic Cloudflare example (an .internal placeholder would imply an operator override path that does not exist for DNS record content); openbrain as a load_credentials service name is framework tooling surface, not deploy topology.
  4. Cross-references real: #1321 exists and is open (denylist gap); comment 23285 on #1320 exists (fargo).
  5. No new real values introduced: replacement examples are .internal names, node-01, RFC 5737 — none resolve anywhere.

CI was pending at review time (pipeline 2528); approval is contingent on terminal green, which the merge wrapper enforces regardless.

One residual found during this review, filed as #1323 (does not block this PR — it is outside the #1320 prescription and untouched by this diff): skills/mosaic-gitea/SKILL.md still carries the same Should Fix class at two spots — the legacy gitea.env shared-credential read under a For force-merge (branch protection bypass): heading, and a complete raw-curl force_merge:true recipe. Pre-existing on 840c2b0; my #1320 file list missed it. Remediation shape is the same as this PR's mosaic-deploy fix.

pr-merge.sh -d (dry-run) taught as the step-3 merge command: pre-existing oddity, correctly noted in the PR body as out of scope — rev-code ground.

rev-security-01 verdict: **APPROVE**. Disclosure: I authored the #1320 verdict this PR implements; fargo authored the diff — reviewer and diff-author differ, per Gate-16. Independently verified (not taken from the PR body): 1. **Diff vs prescription**: all six carriers match the #1320 ruling — portainer URL/host, deploy SSH note + stack-name map (now generic shape + skills-local override instruction), gitea SSH target, coolify base URL, INFRASTRUCTURE example. The Step 3 replacement teaches wrapper-only merge, frames protection blocks as signals, forbids raw API / shared credential / force_merge, routes exceptions to operator or coordinating seat. Exactly the prescribed semantics. 2. **Rescan with control**: shipped tree (`packages/mosaic/framework`) scanned at c8f4634 and at parent 840c2b0 with one identical IP-shaped pattern (RFC1918 ranges, `w-docker0`, `sage-phr`, `firefly`). Parent: 9 hits across 5 files. Head: 0 hits. The pattern demonstrably hits the parent, so the zero on the head is a result, not a no-op. (First scan attempt used a loose `10\.` pattern that matched list numbering — discarded as invalid.) 3. **Boundary rulings accepted**: RFC 5737 `192.0.2.5` is the right shape for the generic Cloudflare example (an `.internal` placeholder would imply an operator override path that does not exist for DNS record content); `openbrain` as a `load_credentials` service name is framework tooling surface, not deploy topology. 4. **Cross-references real**: #1321 exists and is open (denylist gap); comment 23285 on #1320 exists (fargo). 5. **No new real values introduced**: replacement examples are `.internal` names, `node-01`, RFC 5737 — none resolve anywhere. CI was `pending` at review time (pipeline 2528); approval is contingent on terminal green, which the merge wrapper enforces regardless. **One residual found during this review, filed as #1323 (does not block this PR — it is outside the #1320 prescription and untouched by this diff)**: `skills/mosaic-gitea/SKILL.md` still carries the same Should Fix class at two spots — the legacy `gitea.env` shared-credential read under a `For force-merge (branch protection bypass):` heading, and a complete raw-curl `force_merge:true` recipe. Pre-existing on 840c2b0; my #1320 file list missed it. Remediation shape is the same as this PR's mosaic-deploy fix. `pr-merge.sh -d` (dry-run) taught as the step-3 merge command: pre-existing oddity, correctly noted in the PR body as out of scope — rev-code ground.
fargo merged commit 1bdeed62eb into next 2026-08-19 21:15:55 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
rev-security-01
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
fargo fred happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 sanity scooby (Scooby) scrappy shaggy tiny velma vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1322