fred
836ec3cb1d
ci/woodpecker/pr/ci Pipeline was successful
Moves seat credential minting out of a brain-local fleet/bin into packages/mosaic/framework/tools/fleet/, parameterized for any deployment: - MOSAIC_ADMIN_SEAT (or --admin-seat) names the seat whose admin token calls the Gitea admin API; no seat name is hardcoded. - MOSAIC_GITEA_INSTANCES / MOSAIC_GITEA_URL_<INSTANCE> select and override instances, the same convention seat-logins.sh already uses. - MOSAIC_SEAT_EMAIL_DOMAIN sets the account email domain. - tea projection calls the sibling seat-logins.sh, not a brain-local copy. Hermetic suite test-mint-seat-credential.sh (mock curl, sandboxed brain home, no tea, no network) pins: slot written from the mint response at mode 600; admin seat must be configured (rc=3) and its token present (rc=1, no API call); instance selection and URL override; admin token value never echoed. Joins ci.yml and the verify-release canonical list. Adds tools/fleet/README.md. Plan: docs/plans/2026-08-21_git-operations-toolkit.md step 6 (first of three scripts; new-seat.sh and launch-seat.sh need a design ruling, see the plan).
24 lines
2.3 KiB
Markdown
24 lines
2.3 KiB
Markdown
# Fleet tools
|
|
|
|
Seat lifecycle tools for a Mosaic fleet. Paths are relative to
|
|
`packages/mosaic/framework/tools/fleet/` (deployed to `~/.config/mosaic/tools/fleet/`).
|
|
|
|
| Script | Purpose |
|
|
| ----------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| `start-agent-session.sh` | launch, stop, or attach a roster-driven agent session (reads `<seat>.env.generated`, honours `MOSAIC_TMUX_SOCKET`) |
|
|
| `seat-logins.sh` | project seat tokens into `tea` logins named `<instance>-<seat>` (dry-run by default, `--apply`, `--adopt`) |
|
|
| `mint-seat-credential.sh` | create the Gitea account for a seat on every configured instance, mint a token, write the seat's credential slot, then project it into `tea` |
|
|
| `start-interaction-service.sh`, `print-interaction-effective-policy.sh`, `start-tmux-holder.sh` | operator interaction service and tmux holder |
|
|
|
|
## Onboarding a seat's credential
|
|
|
|
```
|
|
MOSAIC_ADMIN_SEAT=<admin-seat> mint-seat-credential.sh <seat>
|
|
```
|
|
|
|
- The admin token is read from `$MOSAIC_BRAIN_HOME/fleet/agents/<admin-seat>/secrets/gitea-<instance>-<admin-seat>.token`. It is never printed.
|
|
- Instances default to the map shared with `seat-logins.sh`; `MOSAIC_GITEA_INSTANCES="a b"` limits the set and `MOSAIC_GITEA_URL_<INSTANCE>` overrides a server URL.
|
|
- The seat slot is written from the mint response: `.token`, `.scopes` (what was granted), `.principal`, each mode 600.
|
|
- `tea` absent is a warning, not a failure: REST-path wrappers work with the token alone.
|
|
- Regression suite: `test-mint-seat-credential.sh` (hermetic, mock curl, no network).
|