GameCult/Idunn
Watch
9
0
Fork
You've already forked Idunn
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Steward-owned second deployment stop named by the binding #5

Merged
eureka merged 3 commits from eureka-self/brake-steward-store into main 2026-11-13 18:11:46 +00:00
Conversation 0 Commits 3 Files changed 6 +471 -41
eureka commented 2026-11-13 18:11:45 +00:00
Owner
Copy link

Follow-up idunn-deploy-provenance:follow_up:steward-brake-cuts (decisions in chat-mind-20261113T125202436Z-t51); cut_spec idunn-deploy-provenance:cut_spec:cut-brake-steward-store.r1. Second brake cut, on top of #4 (58e744b7).

A target's operator binding may name one steward ([brakes.steward] user, store). Idunn reads the steward's store as a second stop beside the operator's: a deploy admits only if every stop admits. The file's owner uid is the proof of who wrote it (the steward's uid, resolved at read time); an unknown or root user, a foreign-owned file, a symlink or an unreadable store fails closed with a remedy that names the steward as the only one who can repair it. The steward engages and clears with the existing idunn-provision deployment-brake-engage|clear --store <own path>, no root, no group, no ACL, no key; root reads it with status --owner-user. The operator's store stays a stop the steward cannot clear: validation refuses a steward directory shared with, inside or around any authority store directory. The wait note names the steward by the binding's user, never the record's self-declared by. No persisted record changes (the binding is plan text), so no schema bump; existing bindings parse unchanged.

Tests: 586 passed / 107 failed on the branch; the 107 are root-only tests also failing on base 58e744b (a strict subset of base's 108 by name; the one difference is a load flake). Seven new tests, four mutations proven (owner check, store ignored, engaged-as-clear, clear drops the operator stop) plus the directory check, the note label and the remedy text. Soul: accepted with one required fix (shared directory) and doc fixes; all applied in c13e175. Soul ran the built idunn-provision as a non-root uid in a temp directory to prove the no-root path.

Not verified: real two-uid behaviour on Yggdrasil (steward-only write access, root reading another user's file, EACCES across targets), nsswitch failure and uid reuse. An in-flight plan keeps its sealed binding (documented). Deploy nothing.

🤖 Generated with Claude Code

Follow-up `idunn-deploy-provenance:follow_up:steward-brake-cuts` (decisions in `chat-mind-20261113T125202436Z-t51`); cut_spec `idunn-deploy-provenance:cut_spec:cut-brake-steward-store.r1`. Second brake cut, on top of #4 (58e744b7). A target's operator binding may name one steward (`[brakes.steward] user, store`). Idunn reads the steward's store as a second stop beside the operator's: a deploy admits only if every stop admits. The file's owner uid is the proof of who wrote it (the steward's uid, resolved at read time); an unknown or root user, a foreign-owned file, a symlink or an unreadable store fails closed with a remedy that names the steward as the only one who can repair it. The steward engages and clears with the existing `idunn-provision deployment-brake-engage|clear --store <own path>`, no root, no group, no ACL, no key; root reads it with `status --owner-user`. The operator's store stays a stop the steward cannot clear: validation refuses a steward directory shared with, inside or around any authority store directory. The wait note names the steward by the binding's user, never the record's self-declared `by`. No persisted record changes (the binding is plan text), so no schema bump; existing bindings parse unchanged. Tests: 586 passed / 107 failed on the branch; the 107 are root-only tests also failing on base 58e744b (a strict subset of base's 108 by name; the one difference is a load flake). Seven new tests, four mutations proven (owner check, store ignored, engaged-as-clear, clear drops the operator stop) plus the directory check, the note label and the remedy text. Soul: accepted with one required fix (shared directory) and doc fixes; all applied in c13e175. Soul ran the built `idunn-provision` as a non-root uid in a temp directory to prove the no-root path. Not verified: real two-uid behaviour on Yggdrasil (steward-only write access, root reading another user's file, `EACCES` across targets), nsswitch failure and uid reuse. An in-flight plan keeps its sealed binding (documented). Deploy nothing. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
BrakeBinding.steward = { user, store }. read_stops reads the operator store
as before and the steward store with the steward user's uid as the expected
owner, so the file owner proves who wrote it. Deploys admit iff every stop
admits; the wait note names each holding stop. Binding is stored as text in
the plan, so no persisted record changes. deployment-brake-status gains
--owner-user for the operator to read a steward's store.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Binding validation refuses a steward store whose directory is shared with,
inside or around any other Idunn authority directory, since the steward owns
its directory and could unlink a root-owned store. The wait note names a
steward stop by the binding's steward user, not the record's claimed by. The
Unreadable hint for a steward store says only the owner uid can repair it.
Root-run tests skip with a message. Docs gain a provisioning runbook and the
sealed-binding recovery caveat.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
eureka merged commit 74c04bbcc7 into main 2026-11-13 18:11:46 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Idunn!5
No description provided.