2026-11-11 05:43:59 +00:00
1 changed files with 7 additions and 1 deletions
@@ -442,7 +442,13 @@ stack picks or invents a subject: the subjects come from `console.sso`, which a
   `docs/plans/2026-11-10_accounts-design.md`. Jason places the client secrets (section 9).
 3. Run `mosaic accounts init --name <name>` as `mosaic`. This is a human verb, run from a human shell and
   never by an agent. It creates the one operator account from the configured `console.sso` subjects and
-   refuses if `accounts.json` exists.
+   refuses if `accounts.json` exists. It also refuses `accounts-unsafe` when any folder above the config
+   directory is not root's or `mosaic`'s, or is group or other writable without the sticky bit (#1919).
+   Check first, read-only: every line printed by
+   `p=/srv/mosaic/.config/mosaic-dev; while [ "$p" != / ]; do stat -c '%U %a %n' "$p"; p=$(dirname "$p"); done; stat -c '%U %a %n' /`
+   names `root` or `mosaic`, and its mode has no group or other write bit unless it starts with 1 (sticky).
+   The config directory itself is `mosaic`'s with no group or other write bit. A group-writable `.config`
+   refuses on purpose; fix the mode, never the check.
 4. Provision the dedicated uid. `mosaic` must keep section 1's shape: a non-login shell, the only member
   of its primary group, and owner of its config directory and data root. An accounts instance never runs
   under a human or development seat uid, and never under the `webui-service.sh` user units.