From 7ca2f76d218a09da67510c3d5cf001732adfcf25 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Tue, 13 Oct 2026 17:31:49 -0700 Subject: [PATCH] feat(albok): personal/inbox wing on nh3-albok + /srv/nemi/inbox capture root on nh3-dev (unit 4.4 slice C, gate 2) Prime ruled albok subsumes note intake (1530). The wing is like personal/notes (albok-personal 1511, not service-restricted); health reads 7 wings ready. Nemi's token was re-minted with read+write on the new wing and vaulted over albok/token-nemi. /srv/nemi/inbox is lkraven:nemi-drop 2770 with a default ACL, plus u:lkraven:rx on /srv/nemi, so Nemi reaches it from lkraven's user manager, whose groups predate nemi-drop. Both paths are verified by the playbook. --- persistent-memory.md | 1 + playbooks/albok-personal-inbox.yaml | 41 +++++++++++++++++++ playbooks/nh3-dev-nemi-inbox.yaml | 38 +++++++++++++++++ servers/nh3-dev/README.md | 10 +++++ stacks/albok-service/README.md | 9 ++++ stacks/albok-service/conf/albok.yaml.template | 1 + 6 files changed, 100 insertions(+) create mode 100644 playbooks/albok-personal-inbox.yaml create mode 100644 playbooks/nh3-dev-nemi-inbox.yaml diff --git a/persistent-memory.md b/persistent-memory.md index fa7f2e3..f8f9825 100644 --- a/persistent-memory.md +++ b/persistent-memory.md @@ -180,6 +180,7 @@ Every vLLM seat on a shared card (GPU 0, GPU 1) has byte-pinned KV (`--kv-cache- ## Recent decisions +- `[2026-10-13]` **Albok note intake (Prime 1530: albok subsumes library/note intake; Muninn's watcher, muninn-gate and mimir-inbox retired). Gate 2 DONE 1735:** wing `personal/inbox` on nh3-albok, Nemi token re-minted `01M4VX207PJ09ZSECASCSZPCFE` (vaulted `albok/token-nemi`; the old `01M4HAP9…` stays live until albok-dev swaps and asks for revocation), and `/srv/nemi/inbox` on nh3-dev (`playbooks/nh3-dev-nemi-inbox.yaml`). **Gate 1 (ruling 6, Prime's Obsidian vault synced read-only onto nh3-dev) WAITS ON PRIME:** the vault's location, plus approval for Syncthing receive-only (recommended). Thread `01M4VWV5FEF64EP71W60N6Q1N0`. - `[2026-10-13]` **A171: Miranda's bus sends no longer card (Prime 1400, "give miranda more autonomy", via svos-dev).** On nh3-svos the `miranda → app:app-postoffice write` grant got `autonomous = true` (`playbooks/nh3-svos-a171-miranda-postoffice-autonomous.yaml`; backup `instance.toml.pre-a171`), and config_gen went `acae45206bbc9fcb → 9139783f413b45fa`. Revert = restore the backup and `systemctl reload svos-kernel`. - `[2026-10-13]` **app-terminal was degraded from the U13 cutover until 0856 on 10-13: its user unit's PATH lacked `~/.cargo/bin`, so every `zellij` call failed to launch** (rc 127). That broke /health AND every dump/inject. Fixed with `Environment=PATH=` in `configs/svos-apps/nh3-dev/svos-terminal.service` (3c92a12). The kernel logged app-terminal up at 15:56:40Z, the manifest was unchanged, and no card was raised; kernel health reads up 7 / degraded 0. The restart moved its process from release dc241f8 to adc862e (same svos_terminal 0.0.3). ⚠ Any new user unit that shells out to a cargo/uv/bun tool needs PATH set explicitly. - `[2026-10-12]` **Prime's rulings ~1715:** CI fix A (fast runner on nh3-docker); push eshpfi main (done, `3aa715c..6a01da7`); deny old card `05cf119e` (moot: the kernel DB shows Prime approved it 10-11 1354:25, so there is nothing to deny); **no rotation of `albok/judge-token`** (it was printed only into a local transcript). The ana-docker vCPU-type change is dropped. diff --git a/playbooks/albok-personal-inbox.yaml b/playbooks/albok-personal-inbox.yaml new file mode 100644 index 0000000..d226986 --- /dev/null +++ b/playbooks/albok-personal-inbox.yaml @@ -0,0 +1,41 @@ +# nh3-albok: the personal/inbox wing (unit 4.4 slice C's capture target; albok-dev 2026-10-13, after Prime's 1530 ruling +# that albok subsumes library/note intake). Like personal/notes: building personal, default_group albok-personal (1511), +# not service-restricted. Run between two Nemi walks (albok-nemi.timer on nh3-dev fires hourly at ~:01). +# scripts/elway infra-ops@10.100.50.44 --playbook playbooks/albok-personal-inbox.yaml +steps: + - name: Back up the live config + sudo: true + shell: cp -p /srv/albok/etc/albok.yaml /srv/albok/etc/albok.yaml.pre-inbox + creates: /srv/albok/etc/albok.yaml.pre-inbox + - name: Add wing personal/inbox after personal/notes + sudo: true + shell: | + python3 - <<'PY' + import os, grp + p = "/srv/albok/etc/albok.yaml"; s = open(p).read() + if " - id: inbox" in s: + print("already present"); raise SystemExit(0) + old = " wings:\n - id: notes\n" + assert s.count(old) == 1, s.count(old) + s = s.replace(old, old + " - id: inbox # unit 4.4 capture wing (Nemi's drop-box /srv/nemi/inbox on nh3-dev); like notes (2026-10-13)\n") + t = p + ".tmp" + fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o640) + with os.fdopen(fd, "w") as f: f.write(s) + os.chown(t, 0, grp.getgrnam("albok").gr_gid); os.replace(t, p); print("edited") + PY + - name: Restart the service (config is read at start) and wait for health + sudo: true + shell: | + docker restart albok-service >/dev/null + for i in $(seq 1 60); do + h=$(curl -s -m 3 http://127.0.0.1:8392/health) && echo "$h" | grep -q '"status":"ok"' && break; sleep 2 + done + echo "$h" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status'), d.get('wings'), d.get('leaks'))" +verify: + - name: Seven wings ready, none degraded + shell: curl -s -m 5 http://127.0.0.1:8392/health | python3 -c "import json,sys; w=json.load(sys.stdin)['wings']; print(w); assert w['ready']==7 and w['degraded']==0 and w['locked']==0" + changed_when: "false" + - name: The wing's store dir carries the personal group + sudo: true + shell: stat -c '%A %U:%G %n' /srv/albok/store/personal/inbox* | head -3 + changed_when: "false" diff --git a/playbooks/nh3-dev-nemi-inbox.yaml b/playbooks/nh3-dev-nemi-inbox.yaml new file mode 100644 index 0000000..a2cf4c7 --- /dev/null +++ b/playbooks/nh3-dev-nemi-inbox.yaml @@ -0,0 +1,38 @@ +# nh3-dev: /srv/nemi/inbox, the capture root Nemi walks into albok's personal/inbox wing (unit 4.4 slice C; albok-dev +# 2026-10-13 after Prime's 1530 intake ruling). People and agents drop markdown here; Nemi ingests each file once +# (capture mode never tombstones on absence, so a walked file may be moved away). +# scripts/elway infra-ops@10.100.10.50 --playbook playbooks/nh3-dev-nemi-inbox.yaml +# Writers: group nemi-drop (lkraven, infra-ops). Nemi runs as lkraven from the user manager, whose groups were fixed +# at its start, so lkraven's access does not depend on the new group: the dir is lkraven-owned and a DEFAULT ACL gives +# lkraven and nemi-drop rw on everything created inside, whoever drops it and whatever their umask. +steps: + - name: Group nemi-drop with lkraven and infra-ops + sudo: true + shell: | + getent group nemi-drop >/dev/null || groupadd nemi-drop + usermod -aG nemi-drop lkraven; usermod -aG nemi-drop infra-ops + getent group nemi-drop + - name: /srv/nemi (root:nemi-drop 0750) and /srv/nemi/inbox (lkraven:nemi-drop 2770, default ACL) + sudo: true + shell: | + install -d -o root -g nemi-drop -m 0750 /srv/nemi + setfacl -m u:lkraven:rx /srv/nemi # traversal for lkraven's user manager, whose groups predate nemi-drop + install -d -o lkraven -g nemi-drop -m 2770 /srv/nemi/inbox + setfacl -m u:lkraven:rwx,g:nemi-drop:rwx /srv/nemi/inbox + setfacl -d -m u::rwX,u:lkraven:rwX,g::rwX,g:nemi-drop:rwX,o::--- /srv/nemi/inbox + getfacl -p /srv/nemi/inbox +verify: + - name: Nemi's own context (lkraven's systemd user manager, groups fixed at boot) can list the inbox + shell: runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 systemd-run --user --wait --pipe -q ls -ld /srv/nemi/inbox + sudo: true + changed_when: "false" + - name: A file dropped by infra-ops is readable and removable by lkraven + sudo: true + shell: | + set -e + f=/srv/nemi/inbox/.acl-probe-$$ + runuser -u infra-ops -g nemi-drop -- sh -c "umask 077; echo probe > $f" + runuser -u lkraven -- cat "$f" >/dev/null + runuser -u lkraven -- rm -f "$f" + test ! -e "$f" && echo "infra-ops drop -> lkraven read+remove: ok" + changed_when: "false" diff --git a/servers/nh3-dev/README.md b/servers/nh3-dev/README.md index 8d5a54e..054f720 100644 --- a/servers/nh3-dev/README.md +++ b/servers/nh3-dev/README.md @@ -229,3 +229,13 @@ Available to **every user/project** on this box — no per-home `playwright inst / `heid run` pollers) into Claude Code session orchestrators (heid commit `12aa5a9`); the `~/development/volva` dir + venvs are gone. `volva.service` had been crash-looping `203/EXEC`. Cleanup done by infra-ops at heid's request. + +## `/srv/nemi/inbox`: albok's drop-box (2026-10-13) + +Nemi (lkraven's `albok-nemi.timer`) ingests markdown dropped here into albok's `personal/inbox` wing, once per file; +capture mode never tombstones, so a walked file may be moved away. Writers are group `nemi-drop` (lkraven, +infra-ops). The dir is `lkraven:nemi-drop 2770` with a default ACL (u:lkraven, g:nemi-drop rwX), and `/srv/nemi` +carries `u:lkraven:rx`. +⚠ lkraven's systemd user manager started before `nemi-drop` existed, so Nemi gets in through those ACL entries +for lkraven, NOT through the group. Do not "simplify" them away until lkraven's user manager has restarted. +`playbooks/nh3-dev-nemi-inbox.yaml` verifies both paths. diff --git a/stacks/albok-service/README.md b/stacks/albok-service/README.md index 7520cf1..dc33e2c 100644 --- a/stacks/albok-service/README.md +++ b/stacks/albok-service/README.md @@ -126,6 +126,15 @@ grants plus read+write on both library wings) and albok-dev `01M4HAP9HFYZCFV76WX `read:library/*`), vaulted over `albok/token-nemi` / `albok/token-albok-dev`. albok-dev swaps them into nemi.yaml and albok-check (swapped 1459, proven by the 1503 walk) and revoked the previous nemi `01M40JWJ3NZ6VJ77KS8B06BCYZ` and albok-dev `01M3ZMCXE8P66MRX16MZN1D44D` at 1555 10-09. Live set: bootstrap-admin, svos-knowledge-nh3-svos, the new nemi, the new albok-dev. +**Wing `personal/inbox` (2026-10-13, unit 4.4 slice C's capture target, albok-dev's ask after Prime's 1530 intake ruling):** +like `personal/notes`, so `default_group: albok-personal` (1511) and not service-restricted. The hiding is the sensitivity +classes plus Nemi's `restricted_wings`. vh reads it through 1511, and no API token besides Nemi's holds it. The live +config backup is `albok.yaml.pre-inbox`; added by `playbooks/albok-personal-inbox.yaml`, with health reading 7 wings +ready. Nemi's token was re-minted for it: `01M4VX207PJ09ZSECASCSZPCFE`, its previous ten grants plus read+write on +`personal/inbox`, vaulted over `albok/token-nemi`. The previous nemi token `01M4HAP9G90J79HBRJB6VW6PQA` stays live +until albok-dev has swapped and asks for its revocation. The capture ROOT is on nh3-dev: `/srv/nemi/inbox` +(`playbooks/nh3-dev-nemi-inbox.yaml`). + **Nemi (albok's tagger, runs on nh3-dev):** `albok/token-nemi`, a service token minted 0255 with read+write on `fleet/memory`, `fleet/stash` and `personal/agent-feedback`; it sees exactly those three wings (`personal/notes` hidden). The previous token (`01M40979…`, without agent-feedback) is still live until albok-dev revokes it. diff --git a/stacks/albok-service/conf/albok.yaml.template b/stacks/albok-service/conf/albok.yaml.template index 9553c4f..c1acdcd 100644 --- a/stacks/albok-service/conf/albok.yaml.template +++ b/stacks/albok-service/conf/albok.yaml.template @@ -49,6 +49,7 @@ buildings: default_group: albok-personal # host gid 1511 wings: - id: notes + - id: inbox # unit 4.4 capture wing (Nemi's drop-box /srv/nemi/inbox on nh3-dev); like notes (2026-10-13) - id: agent-feedback # auto-memory (Nemi's third source); restricted, default-deny (2026-10-03) restricted: true group: albok-feedback # host gid 1512