889e23629c
The operator ruled "delete the Bifrost lane". This route was that lane's live trigger: /srv/odin/deploy-manifests/bifrost-persona-feedback runs `docker compose up persona-feedback`, and the provider actually running on Yggdrasil is the native bifrost-persona-feedback.service. Firing the route would start a container next to it. Following deploy/legacy's own order, the grant goes first, then the dispatch: - sudoers: drop `deploy bifrost-persona-feedback *`. - idunn-yggdrasil: drop the target's policy case and its dispatch token, plus the Bifrost release-authority check that only it used (requires_bifrost_authority and the `idunn validate-release-authority` call). A deploy request that claims a Bifrost authority is still refused. The manifest environment keeps IDUNN_REQUIRES_BIFROST_AUTHORITY=false, because the installed Epiphany manifest checks for it. - README: record the retirement and the counts. Also record that on 2026-09-30 the installed actuator matched this file, but the sudoers grant was not installed: the idunn user cannot sudo. Rebinding persona-feedback to a current Idunn binding is a separate follow-up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
1.3 KiB
Text
23 lines
1.3 KiB
Text
# Narrow root actuator grant for the Idunn Yggdrasil deployment/continuity path.
|
|
# One line per live target. codex-connector and gjallar were retired 2026-09-06,
|
|
# and bifrost-persona-feedback on 2026-09-30; their grants are removed here first,
|
|
# because the privileged half of a retired target must not outlive its consumer.
|
|
Cmnd_Alias IDUNN_YGGDRASIL_DEPLOY = \
|
|
/usr/local/libexec/idunn-yggdrasil deploy odin *, \
|
|
/usr/local/libexec/idunn-yggdrasil deploy ghostlight *, \
|
|
/usr/local/libexec/idunn-yggdrasil deploy voidbot *, \
|
|
/usr/local/libexec/idunn-yggdrasil deploy heimdall *, \
|
|
/usr/local/libexec/idunn-yggdrasil deploy epiphany-capstone-17 *, \
|
|
/usr/local/libexec/idunn-yggdrasil deploy epiphany *, \
|
|
/usr/local/libexec/idunn-yggdrasil deploy repixelizer *, \
|
|
/usr/local/libexec/idunn-yggdrasil deploy streampixels *
|
|
Cmnd_Alias IDUNN_YGGDRASIL_RESTART = \
|
|
/usr/local/libexec/idunn-yggdrasil restart odin, \
|
|
/usr/local/libexec/idunn-yggdrasil restart ghostlight, \
|
|
/usr/local/libexec/idunn-yggdrasil restart voidbot, \
|
|
/usr/local/libexec/idunn-yggdrasil restart heimdall, \
|
|
/usr/local/libexec/idunn-yggdrasil restart epiphany, \
|
|
/usr/local/libexec/idunn-yggdrasil restart repixelizer, \
|
|
/usr/local/libexec/idunn-yggdrasil restart streampixels
|
|
|
|
idunn ALL=(root) NOPASSWD: IDUNN_YGGDRASIL_DEPLOY, IDUNN_YGGDRASIL_RESTART
|