From 4e778aeddcefc4efb40e23629179151f3eace5e6 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sat, 19 Sep 2026 07:05:27 -0700 Subject: [PATCH] fix(ops-log): say 'unattributed' when there is no handle, not a unix login The fallback recorded `lkraven@nh3-dev` when ALTHING_HANDLE was unset, which reads like an answer while being the absence of one. It now records `unattributed(lkraven@nh3-dev)` -- handles never contain @ or parentheses, so the fallback cannot be mistaken for an identity. Found by the commit hook's first independent test, which was not one I ran: infra-hermes committed 0fe4da6 and the hook caught it unprompted -- but logged him as lkraven@nh3-dev, not infra-hermes. His seat exports ALTHING_HANDLE from althing-infra-hermes-seat-run.sh, while neither hermes-gateway.service nor his pump unit carries it, so anything he does outside that one script logs with no handle. So the hook is real but partially blind: it distinguishes not-infra-ops from infra-ops, which is enough to have told me e43e262 was not mine, and not enough to name who made it. The env-var gap is his to close. Making the blind spot announce itself in the record is mine -- an instrument that cannot answer should say so rather than return something answer-shaped. --- scripts/ops-log | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/scripts/ops-log b/scripts/ops-log index e4292fd..fbbf8c7 100755 --- a/scripts/ops-log +++ b/scripts/ops-log @@ -83,14 +83,23 @@ OUTCOMES = ("ok", "changed", "failed", "refused", "skipped") # ─── identity ────────────────────────────────────────────────────────────── def agent_id() -> str: - """Who is acting. ALTHING_HANDLE is the fleet's agent identity and is set - per pane by dev-launch; fall back to user@box so a human shell is still - distinguishable rather than anonymous.""" + """Who is acting. ALTHING_HANDLE is the fleet's agent identity. + + When it is unset the record says so IN THE NAME — `unattributed(user@box)` + — rather than quietly recording a unix login as though it were an agent + handle. Handles never contain `@` or parentheses, so the fallback can never + be misread as one. + + This is not hypothetical: infra-hermes's seat exports ALTHING_HANDLE from + `althing-infra-hermes-seat-run.sh`, but neither `hermes-gateway.service` + nor his pump unit carries it, so work he does outside that one script logs + with no handle. An entry that merely said `lkraven@nh3-dev` would look like + an answer while being the absence of one.""" handle = os.environ.get("ALTHING_HANDLE", "").strip() if handle: return handle user = os.environ.get("USER") or os.environ.get("LOGNAME") or "unknown" - return f"{user}@{os.uname().nodename}" + return f"unattributed({user}@{os.uname().nodename})" def now_iso() -> str: