Skip to content

extdeps.os.id #10285

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
briansrls wants to merge 3 commits into from
Closed

extdeps.os.id #10285

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c00256c
Mark the §5.A extdeps.os.id row landed, and file the id_lookup_argv z…
Sep 3, 2026
c65f7bb
Retire id_lookup_argv on structural ruling, and correct the overstate…
Sep 3, 2026
cf445a8
Fix ruling record: point future consumers at the real canonical symbol
Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions dag/extdeps/tools/id.dag
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,6 @@ fn id_gid_argv() -> List<String> {
["id", "-g"]
}

fn id_lookup_argv(user: NonEmptyStr) -> List<String> {
["id", user as String]
}

service os.Id {
operation Uid {
input {}
Expand Down
4 changes: 3 additions & 1 deletion docs/plans/shell-to-dag-residual-census-and-arc-completion.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -782,10 +782,12 @@ What the trigger does **not** discharge is the **existing** rows: the wall stops
| --- | --- | --- | --- |
| `extdeps.os.hostname` · ~~`Read`~~ **LANDED** + `Set` | `dag/extdeps/os/hostname.dag` (created) | ~~`hostname -s`~~ **done**; `hostnamectl set-hostname` remains | **Read done** — `os.Hostname.ReadShort` realized via typed cell `HostnameReadOnHost` + `gunbc.hostname_read` (LocalShell → op, SshShell → typed argv); both read consumers dissolved: `host_identity_observation` (`HostIdentityShortHostnameRead`, the `host_identity_short_hostname_script` concat DELETED) and `ci_deploy_target_host` (runtime-present read; the GHA preflight *block* stays E-emit). **Set** (`host_effect_hostname` `SetHostnameCas`, its own `host_effect_set_hostname_cas_script` concat) still pending — reuses this op file with a `SetHostname` op. |
| `systemd.Systemctl.ListUnits` | **add to** `dag/extdeps/os/systemctl.dag` | `systemctl list-units --state=active` | `host_converge_slice1` (was `_enumerate_units_script`; now calls `systemctl_list_units_active_services` at `:287`). *The `fleet_show_effective_read` consumer named here — `fleet_runner_width_count_read_script` — was never migrated: it was superseded and left dead, and is deleted by the 2026-07-26 true-up.* |
| `extdeps.os.id` · `Read` (uid/gid/user) | **new** `dag/extdeps/os/id.dag` | `id -u`, `id -g`, `id <user>` | `host_effect_realize` (ssh probes), `fleet_posix_accounts` (`probe_command`) |
| `extdeps.os.id` · `Read` (uid/gid/user) — **ops landed; row NOT done** | `dag/extdeps/tools/id.dag` (created; landed #7194; post-#7231 home) | `id -u`, `id -g`, `id <user>` — service `os.Id` ops `Uid`/`Gid`/`Lookup` | **Operation model + hermetic operation witnesses have landed** (`test.claim.shell_dag_census_5a_typed_ops_witness`, `witness_os_id_uid_realizes_hermetically`, `witness_os_id_gid_realizes_hermetically`, `witness_os_id_lookup_realizes_hermetically`; declared scope is model-before-implement, call-site migration §5.B a later lane). **NOT "Done"** — that word requires the production consumers to have moved AND the superseded string/argv path to be deleted. Remaining argv/SSH callers are dispositioned independently, not by this row: `host_effect_realize` srv3 probes (raw argv rows `extdeps.tools.id.id_uid_argv`/`id_gid_argv`, absolute-path variants), `fleet_posix_accounts` `probe_command` (NOT-a-shell-site, §4), `spark/managed_access_apply` (deferred, dissolve-on). `id_lookup_argv` RETIRED by ruling (below). |
| `ssh.Session.ExecArgv` | **add to** `dag/extdeps/diagnostic/ssh.dag` | typed argv over ssh (`ssh host -- argv`) | `host_effect_realize` ssh probes — **IN FLIGHT, C5 #6946** |
| `systemd.Systemctl.Status` | **add to** `dag/extdeps/os/systemctl.dag` | `systemctl status --no-pager --full <unit>` (models exit-3-for-dead-unit — retires the `\| tail`+`exit 0` absorbing fallback) | `live_deploy/readiness.dag` unit diagnosis |

**RULING — `extdeps.tools.id.id_lookup_argv` RETIRED and deleted (ruled 2026-09-03).** The retirement is on the ruling, not on the zero-reference count: `os.Id.Lookup` (the semantic operation) already names the intended request; a future consumer should consume `os.Id.Lookup` and choose a typed SSH realization (`ssh.Session.ExecArgv` on the `id` binary with a `{user}` argument, or an `IdLookup` invocation modeled on the `os.Hostname.Set`/`HostnameSetInvocation` pattern) — not resurrect a raw `List<String>` argv helper because it sat in inventory. Keeping it "reserved" would preserve exactly the lower-level interface the migration exists to make unavailable. The measured denominator (filed 2026-09-03) found no production reference — the §5.A witness calls `os.Id.Lookup`, NOT this helper — but a future need is the trigger to add a typed remote realization, not evidence that the helper should survive.

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Do not prescribe the legacy ExecArgv path

When a future lookup receives a username containing whitespace or shell metacharacters, the suggested direct ssh.Session.ExecArgv realization does not preserve that value as one remote argument: dag/extdeps/ssh/session.dag:36-40 explicitly marks this operation for dissolution because SSH carries a single command string, and lines 49-63 explain that OpenSSH joins and remotely shell-parses the words. Since os.Id.Lookup.user is only a NonEmptyStr, following this new ruling can turn the username into shell syntax unless the caller separately uses the portable-word refusal wall. Point the ruling to ExecPortableWords/the guarded fleet SSH seam or only to the proposed typed IdLookup realization instead.

Useful? React with 👍 / 👎.


That is the entire new-modeling surface. (A sixth, optional: a typed stdout/receipt emit for the two `echo <receipt>` sites, or reuse `Filesystem.Write`.) The healthz probe needs **no** new op — `http.Client.Get` already exists.

### 5.B — CALL AN EXISTING OP (receipt: the op is already modeled on main)
Expand Down
Loading