vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops(albok): vh joins every albok read group; macOS withdrawal-test run staged

Browse Source 
Prime, 2026-10-09: "vh gets albok-everything". playbooks/nh3-albok-vh-viewer.yaml
joins vh to albok-read, albok-personal and albok-feedback on nh3-albok and
authorizes his four Macs' public keys for vh; verified at a fresh login that
every wing's .browse/ lists and reads.

The withdrawal harness gains a macOS driver (run-mac.sh: every mountable FUSE
backend, a read-only smoke of the real wings, results copied back), env
overrides for a non-container client, and summarize.py. Sanity-checked as vh
from the Linux container before staging.
This commit is contained in:
vh
2026-10-09 22:45:52 -07:00
parent 172d893cdf
commit 70b7281182
9 changed files with 202 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/albok-service/README.md
+6 -5
View File
@@ -26,9 +26,10 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`,
**[2026-10-09] PASSED on sshfs `ro,follow_symlinks` with a Linux client** (SSHFS 3.7.3 / libfuse 3.14): fresh open
ENOENT 5/5 with sshfs defaults and 5/5 with hour-long client caches, while the cached listing and stat still showed
the child; null and positive controls behaved (`scripts/oneoff/albok-browse-withdrawal/`). Reported to albok-dev.
Still before any share: the workstation's own client must re-run that harness if it is macOS (different FUSE
backend), and no user is in `albok-read`/`albok-personal` yet, so the operator's user needs those groups (the
operator's call; `albok-feedback` stays default-deny). Rollback: `compose.yaml.pre-0.1.14` (0.1.13) is free, because no
**[2026-10-09 2244] vh holds every albok read group** (Prime: "vh gets albok-everything"; his four Macs' keys are
authorized for vh; verified at a fresh login, every wing's view lists and reads). Still before he browses from a Mac:
the macOS re-run of that harness (staged in `~vh/albok-browse-test/`, `run-mac.sh`), because the FUSE backend differs.
Rollback: `compose.yaml.pre-0.1.14` (0.1.13) is free, because no
sidecar shape changed.
Prior: 0.1.13 @ `sha256:bea95617…` (2026-10-07 1135 – 1804) (healthy 1136:17,
between walks). infra-ops deployed it at albok-dev's ask (althing 8413), from a clean archive of vh/albok `70b55ad7`
@@ -107,8 +108,8 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`,
**Identities (fixed numeric ids, created by `playbooks/albok-service-host.yaml`):** user and group
`albok` 1500:1500 (the image's user), read groups `albok-read` **1510** (building `fleet`) and
`albok-personal` **1511** (building `personal`). **`albok-feedback` 1512** = restricted wing `personal/agent-feedback` (2026-10-03, default-deny: no viewer is
in it). Reserve 1513+ for the vault wing and any later restricted wing; add each to the host, `conf/group` and `group_add`.
`albok-personal` **1511** (building `personal`). **`albok-feedback` 1512** = restricted wing `personal/agent-feedback` (2026-10-03, default-deny: no viewer was
in it until Prime's 2026-10-09 ruling "vh gets albok-everything": vh now holds 1510, 1511 and 1512, `playbooks/nh3-albok-vh-viewer.yaml`). Reserve 1513+ for the vault wing and any later restricted wing; add each to the host, `conf/group` and `group_add`.
**Why the group file and `group_add`:** the service resolves group NAMES with `grp.getgrnam()`
inside the container and `chgrp`s wing dirs as uid 1500. Without the names in the container's