fred
836ec3cb1d
ci/woodpecker/pr/ci Pipeline was successful
Moves seat credential minting out of a brain-local fleet/bin into packages/mosaic/framework/tools/fleet/, parameterized for any deployment: - MOSAIC_ADMIN_SEAT (or --admin-seat) names the seat whose admin token calls the Gitea admin API; no seat name is hardcoded. - MOSAIC_GITEA_INSTANCES / MOSAIC_GITEA_URL_<INSTANCE> select and override instances, the same convention seat-logins.sh already uses. - MOSAIC_SEAT_EMAIL_DOMAIN sets the account email domain. - tea projection calls the sibling seat-logins.sh, not a brain-local copy. Hermetic suite test-mint-seat-credential.sh (mock curl, sandboxed brain home, no tea, no network) pins: slot written from the mint response at mode 600; admin seat must be configured (rc=3) and its token present (rc=1, no API call); instance selection and URL override; admin token value never echoed. Joins ci.yml and the verify-release canonical list. Adds tools/fleet/README.md. Plan: docs/plans/2026-08-21_git-operations-toolkit.md step 6 (first of three scripts; new-seat.sh and launch-seat.sh need a design ruling, see the plan).
Fleet tools
Seat lifecycle tools for a Mosaic fleet. Paths are relative to
packages/mosaic/framework/tools/fleet/ (deployed to ~/.config/mosaic/tools/fleet/).
| Script | Purpose |
|---|---|
start-agent-session.sh |
launch, stop, or attach a roster-driven agent session (reads <seat>.env.generated, honours MOSAIC_TMUX_SOCKET) |
seat-logins.sh |
project seat tokens into tea logins named <instance>-<seat> (dry-run by default, --apply, --adopt) |
mint-seat-credential.sh |
create the Gitea account for a seat on every configured instance, mint a token, write the seat's credential slot, then project it into tea |
start-interaction-service.sh, print-interaction-effective-policy.sh, start-tmux-holder.sh |
operator interaction service and tmux holder |
Onboarding a seat's credential
MOSAIC_ADMIN_SEAT=<admin-seat> mint-seat-credential.sh <seat>
- The admin token is read from
$MOSAIC_BRAIN_HOME/fleet/agents/<admin-seat>/secrets/gitea-<instance>-<admin-seat>.token. It is never printed. - Instances default to the map shared with
seat-logins.sh;MOSAIC_GITEA_INSTANCES="a b"limits the set andMOSAIC_GITEA_URL_<INSTANCE>overrides a server URL. - The seat slot is written from the mint response:
.token,.scopes(what was granted),.principal, each mode 600. teaabsent is a warning, not a failure: REST-path wrappers work with the token alone.- Regression suite:
test-mint-seat-credential.sh(hermetic, mock curl, no network).