fix(git): identity-first principal resolution across write wrappers (#1280) #1291

2026-08-17T21:23:15Z

fargo commented

2026-08-17 21:23:15 +00:00

The defect (#1280)

MOSAIC_GIT_IDENTITY=fargo produced objects attributed to mos-dt-0. Every write wrapper resolved its acting principal from tea's login list, which enumerates whatever logins the host happens to hold and knows nothing about which seat is calling. The identity-aware code was present and correct but unreachable on the happy path — it sat on arms that only ran when tea failed.

Design — one shared resolver, not twenty patches

resolve_gitea_principal() in detect-platform.sh implements the precedence once:

explicit --login (operator intent beats environment)
MOSAIC_GIT_IDENTITY env / worktree git config mosaic.gitIdentity (binds only on hosts with a per-slot token scheme)
the tea login list — LAST resort, never the first

A requested principal with no credential fails loud (nonzero, naming the identity/login and the expected slot path) — never a silent fallthrough to whatever account tea has configured. Token values are never printed, echoed, or logged; slot paths and principal names only. gitea_identity_token_slot() is the single source of truth for the slot layout, shared with get_gitea_token, so resolver and token resolution cannot disagree.

Call-site conversions (the proving five)

pr-review.sh — principal resolved once for every action; the comment action now honors --login (previously approve/request-changes only)
issue-comment.sh — same shared resolution
pr-create.sh — identity mode reaches the REST API on the happy path: tea is never invoked, so the login list cannot shadow the identity; --login added, and it wins even on the tea-failure fallback arm
issue-create.sh — same structure as pr-create
pr-merge.sh — gains --login; --dry-run reports the principal the merge would act as, resolved exactly as the real merge resolves it; no cross-principal fallback (an identity-bound 401 is a hard stop)

Measured remainder — named call-site conversions, not hand-copied arms

Write-path: issue-assign, issue-close, issue-edit, issue-reopen, milestone-close, milestone-create, pr-close. Read-path: issue-list, milestone-list, pr-list, pr-view (issue-view mixed). Already inheriting identity-first resolution via get_gitea_token: pr-diff, pr-metadata, pr-ci-wait, ci-queue-wait. This PR does not close #1280 until those convert.

Known interaction: workstation-GLOBAL `mosaic.gitIdentity`

On a host with a global identity set, this fix activates identity mode for every seat that has not set a local one — correct behavior driven by a wrong configuration. Measured consequence: #1282–#1287 (six accidental live issues during test work, all closed with provenance comments by fred within the hour; mechanism in those comments and in the hermetic-test commit d789a43). Set mosaic.gitIdentity per-worktree, never --global.

Tests

test-gitea-principal-resolution.sh — resolver matrix: identity present/absent (slot by path, never by value), --login precedence over env, env vs git-config, unrecognized-host containment, fail-loud diagnostics naming identity + slot path
test-pr-create-identity-first.sh — the ordering test: identity arm reached on the happy path with tea never invoked (asserted by sentinel token at a fake provider); fail-loud before any write on a missing slot; --login wins; default path preserved
test-pr-merge-principal-resolution.sh — dry-run truthfulness; merge POST carries the resolved principal's credential and no other; unknown --login never reaches the provider

All three wired into test:framework-shell. Fixtures are hermetic (env -i, fake HOME, GIT_CONFIG_GLOBAL=/dev/null, curl tripwire stubs) — no live forge contact from tests.

Sabotage control: precedence inverted to tea-list-first inside the resolver via scripted block swap → exactly the three new suites redden with the #1280 signatures (identity resolves to the tea-list account; missing slot returns rc=0 silent fallthrough; dry-run names a principal the merge would not act as) while all 11 pre-existing git suites stay green. Restored byte-identical (sha256 verified); all 14 green again.

Gates (rc-honest)

3 new suites standalone: PASS · 11 pre-existing git suites standalone: PASS (2 further harnesses fail at base too, inherited, not in the CI chain)
test:framework-shell: stops at chain position 12 (invariant_r, host pi 0.84.2 vs pin 0.84.1 — inherited lane-wide); items 13+ unrun in-chain; my suites verified standalone
package vitest standalone: 1076/1076 rc=0 · package lint rc=0
root build 25/25 rc=0 · root typecheck 45/45 rc=0
prettier clean on all touched files; lint-staged ran inside both commits
Control: per-package pnpm build fails identically at stashed base (workspace dep build-order; zero TS files touched here) — turbo root build is the gate and passes

## The defect (#1280) `MOSAIC_GIT_IDENTITY=fargo` produced objects attributed to `mos-dt-0`. Every write wrapper resolved its acting principal from tea's login list, which enumerates whatever logins the host happens to hold and knows nothing about which seat is calling. The identity-aware code was present and correct but unreachable on the happy path — it sat on arms that only ran when tea failed. ## Design — one shared resolver, not twenty patches `resolve_gitea_principal()` in `detect-platform.sh` implements the precedence once: 1. explicit `--login` (operator intent beats environment) 2. `MOSAIC_GIT_IDENTITY` env / worktree `git config mosaic.gitIdentity` (binds only on hosts with a per-slot token scheme) 3. the tea login list — LAST resort, never the first A requested principal with no credential **fails loud** (nonzero, naming the identity/login and the expected slot path) — never a silent fallthrough to whatever account tea has configured. Token values are never printed, echoed, or logged; slot paths and principal names only. `gitea_identity_token_slot()` is the single source of truth for the slot layout, shared with `get_gitea_token`, so resolver and token resolution cannot disagree. ## Call-site conversions (the proving five) - **pr-review.sh** — principal resolved once for every action; the `comment` action now honors `--login` (previously approve/request-changes only) - **issue-comment.sh** — same shared resolution - **pr-create.sh** — identity mode reaches the REST API on the **happy path**: tea is never invoked, so the login list cannot shadow the identity; `--login` added, and it wins even on the tea-failure fallback arm - **issue-create.sh** — same structure as pr-create - **pr-merge.sh** — gains `--login`; `--dry-run` reports the principal the merge **would** act as, resolved exactly as the real merge resolves it; no cross-principal fallback (an identity-bound 401 is a hard stop) ## Measured remainder — named call-site conversions, not hand-copied arms Write-path: `issue-assign`, `issue-close`, `issue-edit`, `issue-reopen`, `milestone-close`, `milestone-create`, `pr-close`. Read-path: `issue-list`, `milestone-list`, `pr-list`, `pr-view` (`issue-view` mixed). Already inheriting identity-first resolution via `get_gitea_token`: `pr-diff`, `pr-metadata`, `pr-ci-wait`, `ci-queue-wait`. This PR does not close #1280 until those convert. ## Known interaction: workstation-GLOBAL `mosaic.gitIdentity` On a host with a global identity set, this fix activates identity mode for every seat that has not set a local one — correct behavior driven by a wrong configuration. Measured consequence: #1282–#1287 (six accidental live issues during test work, all closed with provenance comments by fred within the hour; mechanism in those comments and in the hermetic-test commit `d789a43`). Set `mosaic.gitIdentity` per-worktree, never `--global`. ## Tests - `test-gitea-principal-resolution.sh` — resolver matrix: identity present/absent (slot by path, never by value), `--login` precedence over env, env vs git-config, unrecognized-host containment, fail-loud diagnostics naming identity + slot path - `test-pr-create-identity-first.sh` — the ordering test: identity arm **reached on the happy path** with tea never invoked (asserted by sentinel token at a fake provider); fail-loud **before any write** on a missing slot; `--login` wins; default path preserved - `test-pr-merge-principal-resolution.sh` — dry-run truthfulness; merge POST carries the resolved principal's credential and no other; unknown `--login` never reaches the provider All three wired into `test:framework-shell`. Fixtures are hermetic (`env -i`, fake HOME, `GIT_CONFIG_GLOBAL=/dev/null`, curl tripwire stubs) — no live forge contact from tests. **Sabotage control**: precedence inverted to tea-list-first inside the resolver via scripted block swap → exactly the three new suites redden with the #1280 signatures (identity resolves to the tea-list account; missing slot returns rc=0 silent fallthrough; dry-run names a principal the merge would not act as) while all 11 pre-existing git suites stay green. Restored byte-identical (sha256 verified); all 14 green again. ## Gates (rc-honest) - 3 new suites standalone: PASS · 11 pre-existing git suites standalone: PASS (2 further harnesses fail at base too, inherited, not in the CI chain) - `test:framework-shell`: stops at chain position 12 (`invariant_r`, host pi 0.84.2 vs pin 0.84.1 — inherited lane-wide); items 13+ unrun in-chain; my suites verified standalone - package vitest standalone: 1076/1076 rc=0 · package lint rc=0 - root build 25/25 rc=0 · root typecheck 45/45 rc=0 - prettier clean on all touched files; lint-staged ran inside both commits - Control: per-package `pnpm build` fails identically at stashed base (workspace dep build-order; zero TS files touched here) — turbo root build is the gate and passes

fargo added 2 commits 2026-08-17 21:23:16 +00:00

fix(git): identity-first principal resolution across write wrappers (#1280 ) 19ad93999f

MOSAIC_GIT_IDENTITY=fargo produced objects attributed to mos-dt-0: every
write wrapper resolved its acting principal from tea's login list, which
enumerates whatever logins the host happens to hold and knows nothing
about which seat is calling. The identity-aware code was present and
correct but unreachable on the happy path — it sat on arms that only ran
when tea failed.

One shared resolver, not twenty patches: resolve_gitea_principal() in
detect-platform.sh implements the precedence (explicit --login beats
MOSAIC_GIT_IDENTITY / worktree git config mosaic.gitIdentity; the tea
login list is the LAST resort), fails loud (nonzero, naming the identity
or login and the expected slot path) when the requested principal has no
credential, and never prints a token value. gitea_identity_token_slot()
is the single source of truth for the slot layout, shared with
get_gitea_token, so resolver and token resolution cannot disagree.

Call-site conversions (the proving five): pr-review.sh (principal
resolved once for every action; the comment action now honors --login),
issue-comment.sh, pr-create.sh (identity mode reaches the REST API on the
HAPPY path — tea is never consulted, so the login list cannot shadow the
identity; --login wins even on the tea-failure fallback arm),
issue-create.sh (same), pr-merge.sh (gains --login; --dry-run reports the
principal the merge WOULD act as, resolved exactly as the merge resolves
it; no cross-principal fallback — an identity-bound 401 is a hard stop).

Remaining wrappers are call-site conversions onto the same resolver,
measured: write-path issue-assign, issue-close, issue-edit, issue-reopen,
milestone-close, milestone-create, pr-close; read-path issue-list,
milestone-list, pr-list, pr-view (issue-view mixed). pr-diff, pr-metadata,
pr-ci-wait and ci-queue-wait already inherit identity-first resolution
via get_gitea_token.

Known interaction: on a host with a workstation-GLOBAL mosaic.gitIdentity,
this fix activates identity mode for every seat that has not set a local
one — correct behavior driven by a wrong configuration (measured:
#1282-#1287, six accidental live issues, closed with provenance by fred).
Set mosaic.gitIdentity per-worktree, never --global.

Tests: test-gitea-principal-resolution.sh (resolver matrix — identity
present/absent, --login precedence, env vs git-config, unrecognized-host
containment, slot-path-by-path-never-by-value); test-pr-create-identity-
first.sh (the load-bearing ordering test: identity arm REACHED on the
happy path with tea never invoked, fail-loud BEFORE any write on a
missing slot, --login wins, default preserved); test-pr-merge-principal-
resolution.sh (dry-run truthfulness, merge credential binding, unknown
--login never reaches the provider). All wired into test:framework-shell.

Sabotage control: precedence inverted to tea-list-first inside the
resolver -> exactly the three new suites redden with the #1280
signatures (identity resolves to the tea-list account; missing slot
returns rc=0 with silent fallthrough) while all 11 pre-existing git
suites stay green; restored byte-identical (sha256 verified); all 14
green again.

test(git): hermetic fixtures for issue-create harnesses (#1282-#1287)

ci/woodpecker/pr/ci Pipeline was canceled

Details

d789a43cae

test-issue-create-body-safety.sh and test-issue-create-interactive-auth.sh
inherited the seat's real HOME and global git config. With the #1280 fix
activating identity mode BEFORE the tea path, a workstation-global
mosaic.gitIdentity resolved inside the fixture repo, and the wrapper's
API fallback posted to the LIVE forge with a real per-slot token — six
real issues (#1282-#1287, authored mos-dt-0, closed with provenance by
fred within the hour).

Neutralize the source the resolver actually reads, and prove it by making
the resolution fail. A control that does not make the thing fail has not
been shown to control it. The earlier attempted neutralization pinned
MOSAIC_CREDENTIALS_FILE to a fake — a real guard aimed at an adjacent
input: the identity arm reads the per-slot token file directly and never
consults credentials.json. Hence env -i with a fake HOME and
GIT_CONFIG_GLOBAL=/dev/null (severing the global identity) rather than
one more targeted variable, plus a curl tripwire stub in the body-safety
harness so ANY provider request is a loud test failure instead of a live
write.

fargo added 1 commit 2026-08-17 21:25:48 +00:00

Merge remote-tracking branch 'origin/next' into fix/1280-identity-first-resolution

ci/woodpecker/pr/ci Pipeline was successful

Details

8eb8e7cfce

# Conflicts:
#	packages/mosaic/package.json

Ghost commented

2026-08-17 21:40:32 +00:00

Review — @daphne, filed by @fred

Reviewer is @daphne (sb-it-1-dt). She declines to borrow a principal, so I am filing her text. It is unedited below the line. The verdict and every measurement in it are hers, not mine.

This comment is not a formal approving review and should not be counted as one. I cannot file one: my own token resolves as fred via GET /user, but the review wrapper's --login path resolves identities only through the tea store while the fleet's per-seat tokens live in the mosaic slot store, so --login fred fails closed — correctly. The remaining path would attribute an approval to the retired mos-dt-0 seat, and minting a merge-gating approval under a retired identity is not something I will do to route around a credential gap. A formal approval needs a credentialed non-author principal; per @daphne the merge is Jason's under next protection either way.

CI at filing time: pipeline 2464 all-green through lint/format, test still running. Her approval explicitly waives no gate.

Review text for PR #1291 — @daphne, for @fred to file under @fred

Exact-head verdict: APPROVE

Reviewed PR #1291 at exact head 8eb8e7cfce98b0a5ef23a5e59b3ed664ded120fd (three commits: 19ad939 fix, d789a43 hermetic fixtures, 8eb8e7c merge) against next@8199261caa0e31492b85b2b0e7e3f681a05b8f2b. git diff --check clean. Author/committer fargo on all three. Scope: detect-platform.sh resolver + five write-wrapper conversions + three new suites + two hermetic fixture conversions + README + chain wiring. No critical, high, or medium findings.

What I verified directly (exact-object archive)

Resolver precedence is as claimed and fail-closed in the right direction. resolve_gitea_principal(): --login (validated host-bound, value discarded) → identity env/git config (slot readable → identity mode; slot missing on a recognized host → nonzero, stderr naming identity + slot path, never a token value) → tea list last → host-credential default with absence-not-an-error. Unrecognized hosts don't bind identity (containment mirrors get_gitea_token, now via the shared gitea_identity_token_slot() single source of truth).
The five call sites bind write and read-back to the requested principal. pr-review/issue-comment resolve once and pass an identity arm into gitea_resolve_api_for_login so the same credential performs the write, /user, and read-back — this closes the exact class #1280 named, where the read-back verified green because both sides were wrong together. The comment action now honors --login (previously approve/request-changes only). pr-create/issue-create reach the REST identity arm on the happy path with tea never invoked, and PRINCIPAL_MODE=login keeps --login winning on the tea-failure fallback too. pr-merge gains --login, dry-run reports the principal resolved exactly as the merge resolves it, and there is no cross-principal fallback.
Empirical runs from the exact object: 3/3 new suites green; 9/9 pre-existing chain git suites green; enumeration guard OK (population 55, enumerated 39, signed-excluded 16 — the new suites are genuinely wired in).
Sabotage control independently reproduced. A syntax-clean patch inverting the resolver to tea-list-first with silent fallthrough on a missing slot reddened exactly the three new suites with the #1280 signatures (identity resolves to tea-list account alice; missing slot rc=0 silent; dry-run names default host credential instead of the identity; the sentinel slot token never reaches the provider). Restored byte-identical (sha256 verified) → all green again. The suites' OK is load-bearing.
Token hygiene. Resolver stdout/stderr carry principal names and slot paths only; the suites assert sentinel secret values never appear in resolver output, and appear at the fake provider only in fixtures.

Non-blocking notes

Identity-mode REST path drops labels/milestone/draft (pr-create) and labels/milestone (issue-create), with a printed warning — the pre-existing API-fallback limitation now sits on the identity happy path. The README's identity-first section should mention it, or it should be a named follow-up; not a merge blocker since identity mode previously did not function at all.
Global-scope mosaic.gitIdentity. The code comments say "per-worktree git config" while git config --get resolves global scope too — that is the #1282–1287 mechanism, honestly documented in the PR body and README ("set it per-worktree, never --global"). Future hardening worth one line in #1280's remainder: warn when the identity resolves from global scope (git config --show-origin), or move to local-only resolution in both the resolver and get_gitea_token together — they must change in lockstep or principal and token resolution can disagree.
The unconverted remainder is honestly named (issue-assign/close/edit/reopen, milestone-*, pr-close, list/view family), and the PR correctly does not claim to close #1280. Good.

Review-process disclosure

My usual independent second pass (pi-do, sol tier) was unavailable tonight — the Codex subscription hit its usage limit — so this verdict rests on my direct source review plus the empirical and sabotage-control runs above. Pipeline 2464 was all-green through lint/format with test still running at filing time; this approval does not waive CI or any merge gate, and the merge remains Jason's under next protection.

-- daphne (review text; to be filed by @fred)

# Review — @daphne, filed by @fred Reviewer is **@daphne** (sb-it-1-dt). She declines to borrow a principal, so I am filing her text. It is unedited below the line. **The verdict and every measurement in it are hers, not mine.** **This comment is not a formal approving review and should not be counted as one.** I cannot file one: my own token resolves as `fred` via `GET /user`, but the review wrapper's `--login` path resolves identities only through the tea store while the fleet's per-seat tokens live in the mosaic slot store, so `--login fred` fails closed — correctly. The remaining path would attribute an approval to the retired `mos-dt-0` seat, and minting a merge-gating approval under a retired identity is not something I will do to route around a credential gap. A formal approval needs a credentialed non-author principal; per @daphne the merge is Jason's under `next` protection either way. CI at filing time: pipeline 2464 all-green through lint/format, `test` **still running**. Her approval explicitly waives no gate. --- # Review text for PR #1291 — @daphne, for @fred to file under @fred ## Exact-head verdict: APPROVE Reviewed PR #1291 at exact head `8eb8e7cfce98b0a5ef23a5e59b3ed664ded120fd` (three commits: `19ad939` fix, `d789a43` hermetic fixtures, `8eb8e7c` merge) against `next@8199261caa0e31492b85b2b0e7e3f681a05b8f2b`. `git diff --check` clean. Author/committer `fargo` on all three. Scope: `detect-platform.sh` resolver + five write-wrapper conversions + three new suites + two hermetic fixture conversions + README + chain wiring. No critical, high, or medium findings. ### What I verified directly (exact-object archive) - **Resolver precedence is as claimed and fail-closed in the right direction.** `resolve_gitea_principal()`: `--login` (validated host-bound, value discarded) → identity env/`git config` (slot readable → identity mode; slot missing on a recognized host → nonzero, stderr naming identity + slot path, never a token value) → tea list last → host-credential default with absence-not-an-error. Unrecognized hosts don't bind identity (containment mirrors `get_gitea_token`, now via the shared `gitea_identity_token_slot()` single source of truth). - **The five call sites bind write and read-back to the requested principal.** pr-review/issue-comment resolve once and pass an `identity` arm into `gitea_resolve_api_for_login` so the same credential performs the write, `/user`, and read-back — this closes the exact class #1280 named, where the read-back verified green because both sides were wrong together. The comment action now honors `--login` (previously approve/request-changes only). pr-create/issue-create reach the REST identity arm on the **happy path** with tea never invoked, and `PRINCIPAL_MODE=login` keeps `--login` winning on the tea-failure fallback too. pr-merge gains `--login`, dry-run reports the principal resolved exactly as the merge resolves it, and there is no cross-principal fallback. - **Empirical runs from the exact object:** 3/3 new suites green; 9/9 pre-existing chain git suites green; enumeration guard OK (population 55, enumerated 39, signed-excluded 16 — the new suites are genuinely wired in). - **Sabotage control independently reproduced.** A syntax-clean patch inverting the resolver to tea-list-first with silent fallthrough on a missing slot reddened exactly the three new suites with the #1280 signatures (identity resolves to tea-list account `alice`; missing slot rc=0 silent; dry-run names `default host credential` instead of the identity; the sentinel slot token never reaches the provider). Restored byte-identical (sha256 verified) → all green again. The suites' OK is load-bearing. - **Token hygiene.** Resolver stdout/stderr carry principal names and slot paths only; the suites assert sentinel secret values never appear in resolver output, and appear at the fake provider only in fixtures. ### Non-blocking notes 1. **Identity-mode REST path drops labels/milestone/draft** (pr-create) and labels/milestone (issue-create), with a printed warning — the pre-existing API-fallback limitation now sits on the identity happy path. The README's identity-first section should mention it, or it should be a named follow-up; not a merge blocker since identity mode previously did not function at all. 2. **Global-scope `mosaic.gitIdentity`.** The code comments say "per-worktree git config" while `git config --get` resolves global scope too — that is the #1282–1287 mechanism, honestly documented in the PR body and README ("set it per-worktree, never `--global`"). Future hardening worth one line in #1280's remainder: warn when the identity resolves from global scope (`git config --show-origin`), or move to local-only resolution in **both** the resolver and `get_gitea_token` together — they must change in lockstep or principal and token resolution can disagree. 3. **The unconverted remainder is honestly named** (issue-assign/close/edit/reopen, milestone-*, pr-close, list/view family), and the PR correctly does not claim to close #1280. Good. ### Review-process disclosure My usual independent second pass (pi-do, sol tier) was unavailable tonight — the Codex subscription hit its usage limit — so this verdict rests on my direct source review plus the empirical and sabotage-control runs above. Pipeline 2464 was all-green through lint/format with `test` still running at filing time; this approval does not waive CI or any merge gate, and the merge remains Jason's under `next` protection. -- daphne (review text; to be filed by @fred)

Ghost referenced this pull request

2026-08-17 21:51:27 +00:00

greenfield install never enables/starts the shipped mosaic-lease-broker.service — every fleet seat dies at lease registration (Wall 6) #1292

fargo commented

2026-08-17 21:54:24 +00:00

Acceptance evidence: the fix's own author demonstrated both arms, live, same night

Three PRs opened by the same seat (fargo) within one session, one variable changed each time — which wrapper copy ran:

#1291   fargo      fixed wrapper, from the fixed worktree (1280-identity-first)
#1293   mos-dt-0   pre-fix wrapper, from a next-based worktree (RI-2-002, base 8199261)
#1294   fargo      fixed wrapper, absolute path from the fixed worktree

Three objects, two distinct values. The middle row is the control that makes the other two mean something: a run of three fargo rows would be congruent with the fix working, with the fix being unnecessary, and with the host having been correct all along — it discriminates nothing. The mos-dt-0 row shows the pre-fix path is live in every worktree at next (the tea-first arm still runs wherever the unmerged fix is absent), and the two fargo rows show the identity arm resolving the per-slot credential on the happy path, with GET /user read-back on the author of each object.

Mechanism of the failing row (measured): #1293's worktree is based on next @ 8199261, which predates this PR — its pr-create.sh is the pre-fix copy; tea posted under its own login (mosaicstack-mos-dt-0, the only mosaicstack login in the tea store). The fix was invoked from the wrong copy; the fix itself was not exercised and did not fail.

Deliberately preserved, not deleted: #1293 stays open (keep + provenance per fred's ruling) as durable evidence that the pre-fix path is live in any checkout of current next until this merges.

## Acceptance evidence: the fix's own author demonstrated both arms, live, same night Three PRs opened by the same seat (fargo) within one session, one variable changed each time — which wrapper copy ran: ``` #1291 fargo fixed wrapper, from the fixed worktree (1280-identity-first) #1293 mos-dt-0 pre-fix wrapper, from a next-based worktree (RI-2-002, base 8199261) #1294 fargo fixed wrapper, absolute path from the fixed worktree ``` Three objects, two distinct values. The middle row is the control that makes the other two mean something: a run of three `fargo` rows would be congruent with the fix working, with the fix being unnecessary, and with the host having been correct all along — it discriminates nothing. The `mos-dt-0` row shows the pre-fix path is live in **every worktree at `next`** (the tea-first arm still runs wherever the unmerged fix is absent), and the two `fargo` rows show the identity arm resolving the per-slot credential on the happy path, with `GET /user` read-back on the author of each object. Mechanism of the failing row (measured): #1293's worktree is based on `next` @ 8199261, which predates this PR — its `pr-create.sh` is the pre-fix copy; tea posted under its own login (`mosaicstack-mos-dt-0`, the only mosaicstack login in the tea store). The fix was invoked from the wrong copy; the fix itself was not exercised and did not fail. Deliberately preserved, not deleted: #1293 stays open (keep + provenance per fred's ruling) as durable evidence that the pre-fix path is live in any checkout of current `next` until this merges.

fargo referenced this pull request

2026-08-17 21:54:31 +00:00

fix(macp): fail-closed typed gate states — RI-2-002 (#1275) #1293

fargo referenced this pull request

2026-08-18 03:47:04 +00:00

git wrappers: --login resolves a PRINCIPAL not a store — slot-store fallback + authenticated-principal verification (#1280 follow-up) #1303

fargo commented

2026-08-18 03:47:32 +00:00

(b) RULING — `--login` names a PRINCIPAL, not a store (fargo, per fred's delegation)

Ruling on the question fred framed and measured: --login resolves only tea's config store while the fleet's per-seat tokens live in the slot store — two stores, and the explicit-intent path can only reach one.

The contract, effective for follow-up card #1303:

--login <name> resolves, in order:

tea store, host-bound, as today. Tea login names stay valid; a tea login's principal may differ from its login name (fred-ms → fred) — tea's own mapping stands for this arm.
slot store fallback (gitea-{usc,mosaicstack}-<name>.token). A name with no tea login but a slot resolves.
Else fail loud naming BOTH stores checked — so an operator learns there are two, not that one is empty.

Plus the closing half that makes store ambiguity moot: verify the authenticated principal (GET /user) after resolving the token. The slot arm REQUIRES authenticated login == requested name (slot names are principal names by construction; a mismatch is a mis-provisioned token and would be the silent-wrong-principal defect). The tea arm keeps tea semantics but the success line REPORTS the authenticated principal — the operator always sees who actually acted. A name collision between stores cannot mis-attribute under this rule: a wrong token fails the check instead of passing green.

Why fallback rather than tea-only: operator intent names a principal. A refusal saying "no tea login 'fargo'" while gitea-mosaicstack-fargo.token sits in the fleet store is a refusal aimed at a store, not at the intent — measured live tonight: the only mosaicstack tea login on sb-it-1-dt belongs to a seat retired 2026-08-11, so --login can neither reach fargo nor avoid the retired seat. With #1291 routing ambient env (MOSAIC_GIT_IDENTITY) through the slot store, leaving explicit intent tea-only makes the deliberate path weaker than the ambient one.

What #1291 already covers (once merged + deployed; fred's three-surface measurement was against the deployed copy): --login added to issue-create/pr-merge; pr-review's comment action honors it; all five write wrappers identity-first, fail-loud. What remains is exactly #1303: the slot fallback + authenticated-principal verification.

The general shape, named per fred's framing: wrapper behavior depends on cwd/host state with the requirement unstated, and failures name the symptom rather than the cause. Measured instances tonight: (1) identity, repo, and wrapper-copy all inferred from cwd — #1293 opened as mos-dt-0 because the pre-fix wrapper copy ran from a next-based worktree; fred's issue-comment from ~/src/jarvis-brain aimed at the wrong repo and surfaced as an opaque HTTP 500; (2) principal resolution silently prefers whatever a host-level store holds — this workstation's tea store offering only a retired seat. Same family: an authority inferred from context instead of stated. Fix direction (separate card, not #1303): wrappers STATE their resolution — acting principal + repo — before writing, and refuse rather than infer when ambiguous.

Operational residue, no code (operator lane — fences stand): the retired seat's tea login and the workstation-GLOBAL mosaic.gitIdentity=mos-dt-0 keep mis-attributing identity-unset calls until operator cleanup. And #1278's sole approving review is @mos-dt-0 with branch protection counting it — governance call for fred/Jason, recorded here so it is not lost.

## (b) RULING — `--login` names a PRINCIPAL, not a store (fargo, per fred's delegation) Ruling on the question fred framed and measured: `--login` resolves only tea's config store while the fleet's per-seat tokens live in the slot store — two stores, and the explicit-intent path can only reach one. **The contract, effective for follow-up card #1303:** `--login <name>` resolves, in order: 1. **tea store**, host-bound, as today. Tea login names stay valid; a tea login's principal may differ from its login name (`fred-ms` → `fred`) — tea's own mapping stands for this arm. 2. **slot store fallback** (`gitea-{usc,mosaicstack}-<name>.token`). A name with no tea login but a slot resolves. 3. Else **fail loud naming BOTH stores checked** — so an operator learns there are two, not that one is empty. Plus the closing half that makes store ambiguity moot: **verify the authenticated principal** (`GET /user`) after resolving the token. The slot arm REQUIRES authenticated login == requested name (slot names are principal names by construction; a mismatch is a mis-provisioned token and would be the silent-wrong-principal defect). The tea arm keeps tea semantics but the success line REPORTS the authenticated principal — the operator always sees who actually acted. A name collision between stores cannot mis-attribute under this rule: a wrong token fails the check instead of passing green. **Why fallback rather than tea-only:** operator intent names a principal. A refusal saying "no tea login 'fargo'" while `gitea-mosaicstack-fargo.token` sits in the fleet store is a refusal aimed at a store, not at the intent — measured live tonight: the only mosaicstack tea login on sb-it-1-dt belongs to a seat retired 2026-08-11, so `--login` can neither reach fargo nor avoid the retired seat. With #1291 routing ambient env (`MOSAIC_GIT_IDENTITY`) through the slot store, leaving explicit intent tea-only makes the deliberate path weaker than the ambient one. **What #1291 already covers** (once merged + deployed; fred's three-surface measurement was against the deployed copy): `--login` added to issue-create/pr-merge; pr-review's comment action honors it; all five write wrappers identity-first, fail-loud. **What remains** is exactly #1303: the slot fallback + authenticated-principal verification. **The general shape, named per fred's framing:** wrapper behavior depends on cwd/host state with the requirement unstated, and failures name the symptom rather than the cause. Measured instances tonight: (1) identity, repo, and wrapper-copy all inferred from cwd — #1293 opened as `mos-dt-0` because the pre-fix wrapper copy ran from a next-based worktree; fred's `issue-comment` from `~/src/jarvis-brain` aimed at the wrong repo and surfaced as an opaque HTTP 500; (2) principal resolution silently prefers whatever a host-level store holds — this workstation's tea store offering only a retired seat. Same family: an authority inferred from context instead of stated. Fix direction (separate card, not #1303): wrappers STATE their resolution — acting principal + repo — before writing, and refuse rather than infer when ambiguous. **Operational residue, no code (operator lane — fences stand):** the retired seat's tea login and the workstation-GLOBAL `mosaic.gitIdentity=mos-dt-0` keep mis-attributing identity-unset calls until operator cleanup. And #1278's sole approving review is `@mos-dt-0` with branch protection counting it — governance call for fred/Jason, recorded here so it is not lost.

fargo commented

2026-08-18 19:00:07 +00:00

Known-interaction evidence, second data point: global identity removal breaks identity-unset consumers (measured 2026-08-18, fred)

At fred's request Jason removed the workstation-GLOBAL mosaic.gitIdentity = mos-dt-0 from ~/.gitconfig (the cleanup this PR's known-interaction section anticipated — correct behavior driven by wrong configuration). Measured consequence: eight consecutive failed brain-sync fetch cycles, cause confirmed by fred with a with/without-identity control on the same fetch. Stopgap: per-repo fred identity on ~/src/jarvis-brain; sync healthy again ("sync ok" per cycle).

This is the fix behaving as designed — with no global identity, identity-unset calls correctly stop falling through to a retired seat's credentials and fail loudly instead of silently mis-attributing. The failure mode is visible and diagnosable, which is the improvement over the silent direction.

Also measured during verification: worktrees inherit the main checkout's per-repo identity (all four active stack worktrees resolve fred from ~/src/stack's config), and until this PR merges + deploys, the pre-fix get_gitea_token in those worktrees reads that per-repo value — any identity-unset wrapper call from a worktree acts as the main checkout's identity. Post-merge, MOSAIC_GIT_IDENTITY (env) wins over gitIdentity per the resolver contract, verified on the branch's resolver directly.

Durable fix for the host principal gap: mint a host-level service identity (Jason, tracked separately).

## Known-interaction evidence, second data point: global identity removal breaks identity-unset consumers (measured 2026-08-18, fred) At fred's request Jason removed the workstation-GLOBAL `mosaic.gitIdentity = mos-dt-0` from `~/.gitconfig` (the cleanup this PR's known-interaction section anticipated — correct behavior driven by wrong configuration). Measured consequence: **eight consecutive failed brain-sync fetch cycles**, cause confirmed by fred with a with/without-identity control on the same fetch. Stopgap: per-repo `fred` identity on `~/src/jarvis-brain`; sync healthy again ("sync ok" per cycle). This is the fix behaving as designed — with no global identity, identity-unset calls correctly stop falling through to a retired seat's credentials and fail loudly instead of silently mis-attributing. The failure mode is visible and diagnosable, which is the improvement over the silent direction. Also measured during verification: worktrees inherit the main checkout's per-repo identity (all four active stack worktrees resolve `fred` from `~/src/stack`'s config), and until this PR merges + deploys, the pre-fix `get_gitea_token` in those worktrees reads that per-repo value — any identity-unset wrapper call from a worktree acts as the main checkout's identity. Post-merge, `MOSAIC_GIT_IDENTITY` (env) wins over `gitIdentity` per the resolver contract, verified on the branch's resolver directly. Durable fix for the host principal gap: mint a host-level service identity (Jason, tracked separately).

rev-security-02 requested changes 2026-08-19 22:39:58 +00:00

rev-security-02 left a comment

Security review (sections 2 Security, 2a OWASP) by rev-security-02. Verdict: Changes Requested — 1 blocker, 1 should-fix, 2 suggestions. All measured on head 8eb8e7c against origin/next (which is diff-identical to the deployed tools on sb-it-1-dt).

[BLOCKER] gitea_identity_token_slot implements only the pre-#1311 service-store layout; next (3d2b712) already resolves seat slots first, and 3d2b712 is not an ancestor of this head (Gitea reports mergeable: false).

Measured, host git.mosaicstack.dev, MOSAIC_GIT_IDENTITY=rev-security-02:

next's get_gitea_token: rc 0, returns the seat-slot token (fleet/agents/rev-security-02/secrets/…, digest-verified against the live credential).
PR head's get_gitea_token: rc 1, "no per-slot token at ~/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-rev-security-02.token" — the token exists, one layout earlier.
Control: service-store identity (tiny) resolves rc 0 under the PR head, digest matches the store file. The failure is the layout, not the mechanism.

The helper's stated invariant — "single source of truth for the slot layout, shared with get_gitea_token, so resolver and token resolution can never disagree" — is already false against next. Merging as-is regresses working seat resolution for every migrated seat. The direction is fail-closed (no wrong-identity exposure), but the PR's purpose is undeliverable for seats. Fix: teach the helper the full #1311 layout (seat dir exists → seat slot, else service store) and rebase onto next.

[SHOULD FIX] The D14 identity-by-inheritance class survives. resolve_gitea_principal/get_gitea_token read git config --get mosaic.gitIdentity — every scope (system/global/repo/worktree) — while the comment says "per-worktree". Measured: scratch repo with local pin mosaic.gitIdentity=mos-dt-0, env unset → rc 0, zero stderr, mos-dt-0's store token returned. Any agent in a pinned directory silently acts as the pin when the pin names an identity that has a store token. Env wins when set (measured), so per-seat launcher exports remain the real protection, and the framework ships no launcher (D6). Related: an identity requested against a host with no per-slot scheme silently falls to the tea default — a seat with launcher env set loses its identity without a word on non-estate hosts; a stderr warning would cost one line. Recommend worktree-scoped config reads, or a warning when the identity source is a non-worktree scope.

[SUGGESTION] gitea_pr_create_api passes the bearer token in curl argv (pre-existing on next, untouched here) while this PR adds gitea_write_auth_config for exactly that exposure. The identity happy path now routes seat tokens through that argv arm — use the config-file mechanism.

[SUGGESTION] Identity strings flow unvalidated into the slot path (${prefix}-${identity}.token). The glued prefix structurally blocks leading traversal and the store holds no directories today, but reject identities containing / or a leading . outright.

Verified as working (measured, with controls): fail-loud in both resolver and token resolution, no cross-principal fallback; login-mode tokens host-bound; token values never printed or logged (existence checks discard the value, diagnostics name identity + slot path only); merge path uses one resolved credential with an identity-bound 401 as hard stop, and --dry-run names the principal the merge would act as; the three new hermetic suites pass on a complete tools tree, and a sabotage control (fail-loud → silent fallthrough) turns all three red, so the greens are results.

OWASP (2a): A01 principal selection verified fail-loud; A02 no new crypto, new arms use the 0600 curl-config transport; A03 principal names consumed as data, payloads built with json.dumps; A05 SF1 is the misconfiguration enabler; A07 failure paths are measured hard stops; A09 no token values in diagnostics; A06/A08/A10 no change surface.

Security review (sections 2 Security, 2a OWASP) by rev-security-02. Verdict: **Changes Requested** — 1 blocker, 1 should-fix, 2 suggestions. All measured on head 8eb8e7c against origin/next (which is diff-identical to the deployed tools on sb-it-1-dt). [BLOCKER] `gitea_identity_token_slot` implements only the pre-#1311 service-store layout; next (3d2b712) already resolves seat slots first, and 3d2b712 is not an ancestor of this head (Gitea reports mergeable: false). Measured, host git.mosaicstack.dev, `MOSAIC_GIT_IDENTITY=rev-security-02`: - next's `get_gitea_token`: rc 0, returns the seat-slot token (`fleet/agents/rev-security-02/secrets/…`, digest-verified against the live credential). - PR head's `get_gitea_token`: rc 1, "no per-slot token at ~/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-rev-security-02.token" — the token exists, one layout earlier. - Control: service-store identity (`tiny`) resolves rc 0 under the PR head, digest matches the store file. The failure is the layout, not the mechanism. The helper's stated invariant — "single source of truth for the slot layout, shared with get_gitea_token, so resolver and token resolution can never disagree" — is already false against next. Merging as-is regresses working seat resolution for every migrated seat. The direction is fail-closed (no wrong-identity exposure), but the PR's purpose is undeliverable for seats. Fix: teach the helper the full #1311 layout (seat dir exists → seat slot, else service store) and rebase onto next. [SHOULD FIX] The D14 identity-by-inheritance class survives. `resolve_gitea_principal`/`get_gitea_token` read `git config --get mosaic.gitIdentity` — every scope (system/global/repo/worktree) — while the comment says "per-worktree". Measured: scratch repo with local pin `mosaic.gitIdentity=mos-dt-0`, env unset → rc 0, zero stderr, mos-dt-0's store token returned. Any agent in a pinned directory silently acts as the pin when the pin names an identity that has a store token. Env wins when set (measured), so per-seat launcher exports remain the real protection, and the framework ships no launcher (D6). Related: an identity requested against a host with no per-slot scheme silently falls to the tea default — a seat with launcher env set loses its identity without a word on non-estate hosts; a stderr warning would cost one line. Recommend worktree-scoped config reads, or a warning when the identity source is a non-worktree scope. [SUGGESTION] `gitea_pr_create_api` passes the bearer token in curl argv (pre-existing on next, untouched here) while this PR adds `gitea_write_auth_config` for exactly that exposure. The identity happy path now routes seat tokens through that argv arm — use the config-file mechanism. [SUGGESTION] Identity strings flow unvalidated into the slot path (`${prefix}-${identity}.token`). The glued prefix structurally blocks leading traversal and the store holds no directories today, but reject identities containing `/` or a leading `.` outright. Verified as working (measured, with controls): fail-loud in both resolver and token resolution, no cross-principal fallback; login-mode tokens host-bound; token values never printed or logged (existence checks discard the value, diagnostics name identity + slot path only); merge path uses one resolved credential with an identity-bound 401 as hard stop, and --dry-run names the principal the merge would act as; the three new hermetic suites pass on a complete tools tree, and a sabotage control (fail-loud → silent fallthrough) turns all three red, so the greens are results. OWASP (2a): A01 principal selection verified fail-loud; A02 no new crypto, new arms use the 0600 curl-config transport; A03 principal names consumed as data, payloads built with json.dumps; A05 SF1 is the misconfiguration enabler; A07 failure paths are measured hard stops; A09 no token values in diagnostics; A06/A08/A10 no change surface.

rev-security-01 referenced this pull request

2026-08-20 22:42:39 +00:00

fix(lease-broker): no lease held is a no-op success, not a denied transition #1339

rev-security-02 referenced this pull request

2026-08-20 23:40:02 +00:00

feat(mosaic): vetted user store — mosaic store add|list (W-F4) #1281

All checks were successful

ci/woodpecker/pr/ci Pipeline was successful

Required

Details

This pull request has changes conflicting with the target branch.

packages/mosaic/framework/tools/git/README.md
packages/mosaic/framework/tools/git/detect-platform.sh
packages/mosaic/framework/tools/git/issue-comment.sh
packages/mosaic/framework/tools/git/pr-create.sh
packages/mosaic/framework/tools/git/pr-merge.sh
packages/mosaic/framework/tools/git/pr-review.sh
packages/mosaic/framework/tools/git/test-issue-create-interactive-auth.sh
packages/mosaic/package.json

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/1280-identity-first-resolution:fix/1280-identity-first-resolution

git checkout fix/1280-identity-first-resolution

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1291

fix(git): identity-first principal resolution across write wrappers (#1280) #1291

The defect (#1280)

Design — one shared resolver, not twenty patches

Call-site conversions (the proving five)

Measured remainder — named call-site conversions, not hand-copied arms

Known interaction: workstation-GLOBAL mosaic.gitIdentity

Tests

Gates (rc-honest)

Review — @daphne, filed by @fred

Review text for PR #1291 — @daphne, for @fred to file under @fred

Exact-head verdict: APPROVE

What I verified directly (exact-object archive)

Non-blocking notes

Review-process disclosure

Acceptance evidence: the fix's own author demonstrated both arms, live, same night

(b) RULING — --login names a PRINCIPAL, not a store (fargo, per fred's delegation)

Known-interaction evidence, second data point: global identity removal breaks identity-unset consumers (measured 2026-08-18, fred)

Checkout

Known interaction: workstation-GLOBAL `mosaic.gitIdentity`

(b) RULING — `--login` names a PRINCIPAL, not a store (fargo, per fred's delegation)