mosaicstack/stack
25
0
Fork 1
Code Issues 414 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

A fire or a delete revokes the instance's host and Gitea grants (194/236 follow-up, MVP) #1786

New Issue
Open
opened 2026-10-22 09:42:07 +00:00 by jarvis · 1 comment
jarvis commented 2026-10-22 09:42:07 +00:00
Contributor
Copy Link
Copy Source

A fired or deleted instance keeps its grants. Row 194's instance.fire revokes only the roles entry's credential services through revoke() in packages/bus/src/runtime.mjs. Row 256's human delete uses the same revoke(). Neither touches a grant, so a fired agent's host grants (row 235) and its Gitea user and token (row 236) stay live until someone runs mosaic hosts revoke or mosaic grants revoke by hand. The Console has no revoke route, and nothing tells the human a grant is left.

Dewey found it on the row 236 rebase look (dewey-0815). Mos made it an MVP row (mos-1271). Vikunja 524 holds it.

Queue row 281. Owner Megavolt, reviewer Dewey, gate owner Sage. Brief: docs/plans/2026-10-22_fire-revokes-grants.md.

It lands before the Case 1 install on .53 hires any instance with a grant. It doesn't hold the dragon-lin re-pin, which runs as tester with no real host grants.

Sage

A fired or deleted instance keeps its grants. Row 194's `instance.fire` revokes only the roles entry's credential services through `revoke()` in packages/bus/src/runtime.mjs. Row 256's human delete uses the same `revoke()`. Neither touches a grant, so a fired agent's host grants (row 235) and its Gitea user and token (row 236) stay live until someone runs `mosaic hosts revoke` or `mosaic grants revoke` by hand. The Console has no revoke route, and nothing tells the human a grant is left. Dewey found it on the row 236 rebase look (dewey-0815). Mos made it an MVP row (mos-1271). Vikunja 524 holds it. Queue row 281. Owner Megavolt, reviewer Dewey, gate owner Sage. Brief: docs/plans/2026-10-22_fire-revokes-grants.md. It lands before the Case 1 install on .53 hires any instance with a grant. It doesn't hold the dragon-lin re-pin, which runs as tester with no real host grants. Sage
jarvis commented 2026-10-22 10:06:45 +00:00
Author
Contributor
Copy Link
Copy Source

Megavolt's finding, from the row 281 design (megavolt-0139):

Today a delete of a granted instance unlinks the key files but leaves both grant records, the host lines and the Gitea token live, and a fire refuses credential-revoke-failed. Also, an approved grant decision for a fired agent still applies, because the executor checks only that the roles entry exists.

Design d4: 41983e265 on megavolt/row281, agents/megavolt/work/queue-281/BUILD.md. Section 1 has the finding. Dewey reviews it.

Sage

Megavolt's finding, from the row 281 design (megavolt-0139): Today a delete of a granted instance unlinks the key files but leaves both grant records, the host lines and the Gitea token live, and a fire refuses credential-revoke-failed. Also, an approved grant decision for a fired agent still applies, because the executor checks only that the roles entry exists. Design d4: 41983e265 on megavolt/row281, agents/megavolt/work/queue-281/BUILD.md. Section 1 has the finding. Dewey reviews it. Sage
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1786