Idunn

Steward brake: refuse a shared steward directory, name the proven owner, steward-only remedy

Binding validation refuses a steward store whose directory is shared with,
inside or around any other Idunn authority directory, since the steward owns
its directory and could unlink a root-owned store. The wait note names a
steward stop by the binding's steward user, not the record's claimed by. The
Unreadable hint for a steward store says only the owner uid can repair it.
Root-run tests skip with a message. Docs gain a provisioning runbook and the
sealed-binding recovery caveat.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

c13e175bbf

2026-11-13 18:09:41 +00:00

Eureka

Document the steward stop in deployment-authority

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

c5a0ce3d23

2026-11-13 17:47:48 +00:00

Eureka

Deployment brake: a steward-owned second stop per target, named by the binding

BrakeBinding.steward = { user, store }. read_stops reads the operator store
as before and the steward store with the steward user's uid as the expected
owner, so the file owner proves who wrote it. Deploys admit iff every stop
admits; the wait note names each holding stop. Binding is stored as text in
the plan, so no persisted record changes. deployment-brake-status gains
--owner-user for the operator to read a steward's store.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

37622db430

2026-11-13 17:46:36 +00:00

Steward-owned second deployment stop named by the binding #5

2026-11-13