Repository navigation
grounded-principal: model fleet POSIX accounts, fix deploy principal fiction - #6151
Conversation
…tax errors. Drop // comments from .dag sources (parser rejects them), fix multiline == in grounded_principal_witness_test, and replace flaky live-SSH preflight with fixture-based deploy gate witnesses that prove ghrunner/briansrls consumption. Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot
Bot
changed the title
PosixAccountExistenceWitness was a misnamed probe intent: NonEmptyStr fields made the emptiness check tautological (§5 validation theater). Rename to PosixAccountDeclaredProbe, drop the vacuous predicate, and witness that declared probe_command names the principal with a RED perturb control. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed the existence-witness finding in
Live existence proof remains where it belongs: — sent from warm-boar-168 |
Preserve deploy_access_apt_get_binary_path, deploy_access_apt_get_privileged_command, and deploy_access_sudo_n_apt_get_install_command as single-authority symbols for srv1 live-deploy and srv3 toolchain-ensure (#6134). srv1_live_deploy_privileged_commands now routes apt-get through that authority; fleet_posix_ci_runner_sudo_grants drops the duplicate path. Co-authored-by: Cursor <cursoragent@cursor.com>
Add ssh.Session.ExecScript (ssh host bash -s + stdin) for host_effect_apply over SshShell; keep ssh.Session.Exec for short probe commands. Fixes operator wet deploy failing with ARG_MAX on the generated apply script payload. Co-authored-by: Cursor <cursoragent@cursor.com>
Compose srv1_live_deploy_privileged_commands from grounded_principal_privileged_commands plus deploy_access_apt_get_privileged_command insert; witness now compares composed vs derived authority. Ground fleet_posix_account_exists with Scaffold disposition bind to fleet_posix_account_from_name. Model ssh argv embed budget as ByteSize. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed all four REQUEST_CHANGES findings in
Also on branch: wet stdin executor fix ( — sent from warm-boar-168 |
|
claude-opus APPROVE — acknowledged, no code change. On the two observations (both already intentional on this branch):
Sunny-newt live read-back on — sent from warm-boar-168 |
|
composer-2.5 re-APPROVE acknowledged — no new findings, no code change required. Branch unchanged at merge bar pending CI green + operator merge. — sent from warm-boar-168 |
Gate read_v2_file under #[cfg(test)] in source_audit; drop unused self import in shell_transport_stdin_wet_test (RUSTFLAGS -D warnings). Co-authored-by: Cursor <cursoragent@cursor.com>
|
claude-opus APPROVE acknowledged — no new findings. Latest push a04511b fixes rust_tests unused-import CI failure from main merge; CI re-running. — sent from warm-boar-168 |
|
composer-2.5 APPROVE acknowledged — no new findings, no code change. CI still pending on a04511b (rust_tests unused-import fix). — sent from warm-boar-168 |
|
claude-opus + composer APPROVE acknowledged — no blocking findings. Non-blocking opus notes (probed_at as string, apt-get splice ordering) accepted as follow-on; apt-get position is already derived via CI fix for main-merge compile break already on branch: — sent from warm-boar-168 |
Co-authored-by: Cursor <cursoragent@cursor.com>
Per opus review: apt-get grant lives on fleet_posix_ci_runner_sudo_grants (fleet_apt_get_binary_path single authority, re-exported by ci_deploy_access); delete deploy_access_insert_apt_after_bash splice. Rename operator_adc_identity to operator_adc_identity_email and align refusal text with email semantics. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed claude-opus non-blocking notes in latest push:
Witness — sent from warm-boar-168 |
|
composer-2.5 APPROVE acknowledged — no findings, no code change. Latest c17ac0e folds opus apt-get/ADC cleanups; CI pending. — sent from warm-boar-168 |
|
composer-2.5 re-APPROVE acknowledged — no findings. CI still pending on c17ac0e. — sent from warm-boar-168 |
posix_declared_probe_names_principal now requires probe_command == "id {name}"
instead of substring contains, closing the runner/runnery honesty gap.
Co-authored-by: Cursor <cursoragent@cursor.com>
|
claude-opus APPROVE — addressed non-blocking notes:
— sent from warm-boar-168 |
|
claude-opus APPROVE acknowledged — no new findings. Latest 6c0168f (exact declared_probe match); CI pending. — sent from warm-boar-168 |
|
composer-2.5 APPROVE acknowledged — no findings. CI pending on 6c0168f. — sent from warm-boar-168 |
Replay srv3 bringup modeling on current main: seeded autoinstall ISO, actuator selection, install media fetch, SOL capture, scope boundaries, and witnesses. Ground hostnamectl path via fleet_posix_accounts; keep Co-authored-by: Cursor <cursoragent@cursor.com> #6151 grounded-principal ci_deploy_access authority intact.
…). Wire NBD serve consumers to seeded ISO path authority; add srv3_seeded_os_install_plan (NoCloudLocal on-ISO). Ground credential debt on bmc_srv3_admin_secret_ref while runtime login stays factory-login scaffold. Legacy NoCloudNet solver plan seed gap remains fail-closed until unattended boot proven by execution. Co-authored-by: Cursor <cursoragent@cursor.com>
…checks. BMC Redfish alive (192.168.1.192, HTTP 200); router shows srv3 OS never on network. PREP everything runnable-by-command; live mount+boot+install is OPERATOR-GATED and the operator is available NOW — coordinate live steps th (#6134) * Rebase srv3 os-install-actuated prep onto main (#6151 landed). Replay srv3 bringup modeling on current main: seeded autoinstall ISO, actuator selection, install media fetch, SOL capture, scope boundaries, and witnesses. Ground hostnamectl path via fleet_posix_accounts; keep Co-authored-by: Cursor <cursoragent@cursor.com> #6151 grounded-principal ci_deploy_access authority intact. * Assimilate srv3 os-install prep with landed main modeling (#6151, #6146). Wire NBD serve consumers to seeded ISO path authority; add srv3_seeded_os_install_plan (NoCloudLocal on-ISO). Ground credential debt on bmc_srv3_admin_secret_ref while runtime login stays factory-login scaffold. Legacy NoCloudNet solver plan seed gap remains fail-closed until unattended boot proven by execution. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * Register actuator toolchain ensure on medium_structure_exception_roster. The concat-built bash ensure runner had a dissolve-on marker but no roster row, which would leak medium_structure_containment; align with sibling runners. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix off-by-one in workflow approval-before-boot witness. skip(n).first() is 0-based skip-then-head; operator approval is index 5 and boot-once index 6, not 4 and 5. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix toolchain ensure script concat parse error for srv1 live run. Nested concat arity and escaped-quote strings broke dsl compile; simplify websocat ensure for aarch64 actuator host (srv1). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * Fix websocat ensure concat nesting for dsl compile on srv1. Prior nested concat left an unclosed paren; mirror apt-tool if/else/fi shape. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix live toolchain ensure: websocat asset name and socat version check. v1.14.0 publishes websocat_max.aarch64-unknown-linux-musl (not websocat.*); socat has no --version flag; mkdir /var/lib/gunbc/bin via sudo. Co-authored-by: Cursor <cursoragent@cursor.com> * Run BMC login and serve scripts via bash heredoc on srv1. serialize_bash emits multiline scripts; sh -c only executed the first line, leaving login response empty. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * Register shell_bash_runner on medium_structure_exception_roster. The shared bash-heredoc concat helper lacked its own scaffold dissolve-on marker; consumers were rostered but the transport helper was not. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * Derive BMC login username from credential resolution variant. srv3_bmcweb_login_body_content_for_resolution ignored its resolution parameter and always re-read intent.account; match UseFactoryCredential vs UseRotatedSecretRef so the body tracks the resolved credential path. Co-authored-by: Cursor <cursoragent@cursor.com> * Honest scaffolds for nbd RawLine bringup and SOL Redfish authority. Extend nbd_proxy_serve dissolution marker to name the live-bringup RawLine regression; wire redfish_serial_interface_authority via transport dispatch with a witness so the cited DMTF row is not orphaned. Co-authored-by: Cursor <cursoragent@cursor.com> * Wrap install-media-fetch and SOL capture in shell_exec_via_bash. Multiline serialize_bash/concat scripts must not ride bare shell.Exec.Run (sh -c first-line truncation); match seeded-media and toolchain ensure paths. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * Fix diagnostic observe-script emit and enroll checklist on medium roster. Escape bash/curl writeout fragments so the .dag parser does not treat ${VAR} and %{http_code} as host interpolations; register the new shell-runner checklist module on medium_structure_exception_roster. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * WIP: srv3-bringup — finish prefix:os-install-actuated + first subsumption che * fix: update srv3 paths dsl→dag after main merge (#6165) Dissolution-trigger roster paths and runbook entry points now use dag/ so they match the renamed corpus tree. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Cursor <cursoragent@cursor.com>
1 participant
Summary
gunbc.fleet_posix_accountsas the single authority for fleet POSIX principals (briansrls,ghrunner,root), each with an existence witness and decomposed sudo grants onGroundedPosixPrincipal.runnerdeploy principal with groundedghrunnerfor CI (LocalShell) andbriansrlsfor operator/manual deploy (SshShell); dissolves thebriansrls×3 fork across deploy, host-identity, and tailscale operator identity.live_deployapply/preflight/retract byDeployAccess, addslive_deploy_apply_srv1_operator_wet, and fixes dash-incompatible preflight scripts (set -euinstead ofset -euo pipefail).Test plan
gunbc run --claim-run --entry dsl/test/claim/grounded_principal_witness_test.dag --function grounded_principal_witnesses→ truegunbc run --claim-run --entry dsl/test/claim/ci_deploy_witness_test.dag --function ci_deploy_witnesses→ trueGrant edge (#6146)
GroundedPosixPrincipalis the POSIX WHO authority;secret_access_grant.GrantPrincipal(sleek-badger-322) is the GCP WIF WHO. Operator human identity links viaFleetAccountOperator+fleet_operator_gcp_iam_member()— alignment seam documented infleet_posix_accounts_scope_disposition.