vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(albok-service): library building (fiction, nonfiction) for unit 4.5; widened Nemi and albok-dev tokens minted

Browse Source
This commit is contained in:
vh
2026-10-09 14:57:38 -07:00
parent 65fffe21aa
commit fa934cc574
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/albok-service/README.md
+6
View File
@@ -113,6 +113,12 @@ Verified: wings came up `drwxr-s--- albok:albok-read` / `albok:albok-personal`,
**Secrets (vault):** `albok/litellm-key`, a LiteLLM key scoped to `qwen3-embedding` only (alias
`albok-service`; verified 200 on embeddings, 403 on any other model; widened 2026-10-05 to also cover `qwen3-embedding-bulk`, the write-path alias, c0d3384); `albok/bootstrap-admin-token`,
the first-start admin token (also at `/srv/albok/private/bootstrap-admin-token`, 0600).
**Building `library` (2026-10-09, albok-dev ask, unit 4.5 Nemi books):** wings `library/fiction` and `library/nonfiction`,
`default_group: albok-read` (1510), neither restricted, no encrypted mount; live config `albok.yaml.pre-library` kept.
Token grants are immutable, so the widening was done by minting NEW tokens: nemi `01M4HAP9G90J79HBRJB6VW6PQA` (previous six
grants plus read+write on both library wings) and albok-dev `01M4HAP9HFYZCFV76WX2HPVWT2` (`write:fleet/memory`, `read:fleet/*`,
`read:library/*`), vaulted over `albok/token-nemi` / `albok/token-albok-dev`. albok-dev swaps them into nemi.yaml and
albok-check, then revokes the previous nemi `01M40JWJ3NZ6VJ77KS8B06BCYZ` and albok-dev `01M3ZMCXE8P66MRX16MZN1D44D`.
**Nemi (albok's tagger, runs on nh3-dev):** `albok/token-nemi`, a service token minted 0255 with read+write on
`fleet/memory`, `fleet/stash` and `personal/agent-feedback`; it sees exactly those three wings (`personal/notes` hidden).
The previous token (`01M40979…`, without agent-feedback) is still live until albok-dev revokes it.