docs: gameplan to fully-deployed Agent-Sudo + secrets-proxy, plus S1/A1/A7 agent prompts
Agent-Sudo went live on both hosts tonight (005c214 in the boilerplates repo). This records what "done" actually means and what is left, since dedicated time on this ends today and the rest has to run via background agents. Corrects the goal: tier 4 is human-only BY DESIGN (D-CB7) — the daemon unit env holds SUDO_MD_VERIFY_ENFORCE, so a system that can restart its own daemon can disarm its own gate. "Handling tier 4" means refusing it, which is done and verified. Real remaining scope is tiers 1-3. Records the measured Incus asymmetry (server-01 has it, primary does not), which makes tier 2 on primary an open design question rather than a task; the tier-1 scoped-undo defect (app.py:244 hardcodes tier 3 while REQUIRES_UNDO_TIERS is (1,3)); and the per-host-values-in-a-shared-tracked-file bug class that bit twice in one directory. secrets-proxy is deliberately scoped as investigate-then-plan: it exited gracefully and nobody knows why, so S1 answers that before anyone writes S2. Refs #128, #146, #149, #150, #173, #191, projects id=187. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Backtalk6858
@@ -1303,3 +1303,163 @@ Before stopping for ANY reason — task complete, error, human gate, or approach
|
||||
--max-turns 25
|
||||
If you issue the same tool call or command twice with identical arguments, STOP immediately and output the mandatory wrap-up with status=partially_succeeded.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# S1-SECRETS-PROXY-SCOPE (2026-07-15) — task #128 · gameplan §4 · **READY TO RUN NOW**
|
||||
|
||||
> **Zero dependencies. Run this FIRST**, ahead of the Agent-Sudo work — per
|
||||
> `feedback_build_the_freeing_capability_first`, secrets-proxy being down taxes every future
|
||||
> session (every secret read needs a workaround), including business-development days.
|
||||
> **This is INVESTIGATION ONLY. It produces a written scope, not a deploy.**
|
||||
|
||||
You are scoping what remains to finish `secrets-proxy`. Nobody currently knows. Your job is to
|
||||
find out and write it down with evidence. **Do not fix. Do not deploy. Do not start the container.**
|
||||
|
||||
## Verified starting facts (do not re-derive; DO verify anything you rely on further)
|
||||
- Container `secrets-proxy-secrets-proxy-1` = `Exited (0)` ~6 days ago (~2026-07-09).
|
||||
- Logs show a GRACEFUL, DELIBERATE shutdown ("Application shutdown complete", "Stopping parent
|
||||
process [1]"). **This is NOT a crash.** Do not investigate it as one.
|
||||
- Repo: `/opt/appdata/docker/docker-compose/secrets-proxy/` — `app.py`, `docker-compose.yml`,
|
||||
`Dockerfile`, `mirror/`, `requirements.txt`. On host `primary` (192.168.1.88).
|
||||
- Task #128 = "Finish secrets-proxy (sprint-11 #1)". Task #150 (sign `proxy.md` via Vault
|
||||
transit) is explicitly blocked on secrets-proxy being deployed.
|
||||
|
||||
## Questions you must answer WITH EVIDENCE (quote the file/line/log/commit)
|
||||
1. **WHY was it stopped?** Search git log, session summaries, sprint-11 notes, task #128.
|
||||
⚠️ **It may have been stopped for a reason that still applies.** This is the most important
|
||||
question. If you cannot find the reason, say so explicitly — do not guess.
|
||||
2. What does "sprint-11 #1" actually scope? What is incomplete in `app.py` / `mirror/`?
|
||||
3. Would it start cleanly today? Determine by READING code/config, **not by starting it**.
|
||||
4. Does `docker-compose.yml` carry per-host values hardcoded in a shared tracked file?
|
||||
(See gameplan §2 — this bug class bit twice in agent-sudo on 2026-07-15: a hardcoded port
|
||||
and `SERVER_ID`/`VAULT_ADDR` in a unit file. Check ports, IPs, `SERVER_ID`-alikes.)
|
||||
5. `project_coolify_env_var_debt`: any `${VAR}` Coolify placeholders that would bite on restart?
|
||||
6. What would the proxy-only rule require to be honoured again (the `/shell` + vault-ref path)?
|
||||
|
||||
## Hard constraints
|
||||
- **READ-ONLY.** No edits, no `docker compose up`, no `docker start`, no restarts, no commits.
|
||||
- **NEVER surface a credential.** Do not `cat` the env file; do not `docker exec` to read env;
|
||||
do not echo token-shaped values. To show config, print KEYS ONLY (`sed 's/=.*/=<redacted>/'`).
|
||||
The `security-enforcement.py` PreToolUse hook will block token patterns, and anything printed
|
||||
lands permanently in the transcript. If a credential is needed for a check, STOP and report.
|
||||
- secrets-proxy is itself DOWN, so you cannot use it for credential reads. Do not work around this.
|
||||
- If a question cannot be answered from evidence, write "UNKNOWN — could not determine because X".
|
||||
**An honest UNKNOWN is worth more than a confident guess.** Do not fill gaps by inference.
|
||||
|
||||
## Deliverable
|
||||
`/opt/appdata/docker/docker-compose/secrets-proxy/SCOPE.md` — findings, each with its evidence,
|
||||
and a proposed S2 task list with effort estimates. Flag anything human-only.
|
||||
|
||||
--max-turns 20
|
||||
|
||||
## MANDATORY WRAP-UP — you cannot stop without emitting this
|
||||
```json
|
||||
{"status":"succeeded|partially_succeeded|failed",
|
||||
"actions_taken":[], "actions_failed":[],
|
||||
"questions_answered":{"why_stopped":"", "sprint11_scope":"", "starts_clean":"",
|
||||
"per_host_bug":"", "coolify_placeholders":"", "proxy_only_path":""},
|
||||
"unknowns":[], "human_action_required":[], "notes":""}
|
||||
```
|
||||
If you issue the same tool call twice with identical arguments, STOP and emit the wrap-up with
|
||||
status=partially_succeeded.
|
||||
|
||||
---
|
||||
|
||||
# A1-TIER1-UNDO (2026-07-15) — projects id=187 gap B · gameplan §3-A1 · **GATED**
|
||||
|
||||
> 🔴 **DO NOT RUN THIS UNTIL THE HUMAN HAS DECIDED (a) vs (b) BELOW.**
|
||||
> The decision is the user's, not yours. If dispatched without a recorded decision, STOP
|
||||
> immediately and emit the wrap-up with `human_action_required: ["A1 decision (a) or (b)"]`.
|
||||
|
||||
## The defect (verified 2026-07-15 19:55)
|
||||
- `security/scoped_undo.py:186` → `REQUIRES_UNDO_TIERS = (1, 3)`
|
||||
- `app.py:244` → `scoped_undo.capture_or_refuse(command, 3, server_id=SERVER_ID)` — **tier
|
||||
hardcoded to 3**. Nothing ever captures undo for tier 1.
|
||||
- Result: **tier-1 commands auto-execute with NO undo capture**, contradicting D4 ("tier 1 =
|
||||
auto-execute + capture scoped-undo").
|
||||
|
||||
## The conflict a human must resolve first
|
||||
The P3 task contract said "tier 0/1 behaviour unchanged"; D4 says tier 1 captures undo. The P3
|
||||
agent followed the contract, pinned it with a test, and flagged it — correctly.
|
||||
- **(a) Implement D4:** tier 1 captures scoped-undo. Cost: undo-capture latency on every tier-1
|
||||
command (tier 1 is the volume tier). Benefit: tier 1 becomes reversible.
|
||||
- **(b) Amend D4:** drop `1` from `REQUIRES_UNDO_TIERS`; tier 1 is fire-and-forget. Cheaper, but
|
||||
tier 1 becomes irreversible.
|
||||
|
||||
## If (a) — your task
|
||||
1. Make the tier argument at `app.py:244` reflect the ACTUAL tier, not a hardcoded 3.
|
||||
2. Ensure tier-1 flows through `capture_or_refuse` per `REQUIRES_UNDO_TIERS`.
|
||||
3. ⚠️ **The existing test pins the WRONG behaviour** (tier 1 = no undo capture). You MUST update
|
||||
it, or you will lock in the bug. Find it, understand why the P3 agent wrote it, then change it.
|
||||
4. Decide + implement what happens when tier-1 undo capture FAILS. Note the precedent in gap C:
|
||||
a failed PRE-exec snapshot refuses without calling `record_tier3_failure()`, because counting
|
||||
infrastructure faults toward the benign trip threshold would let broken infra disarm the tier.
|
||||
Apply the SAME reasoning to tier 1 and say so explicitly in your notes.
|
||||
⚠️ Refusing every tier-1 command when undo capture is broken would stall the user's whole
|
||||
workflow — that is the exact stall CA-D7 forbids. Think about this; flag it, do not guess.
|
||||
5. All 85 existing tests must still pass. Add tests for the new behaviour.
|
||||
|
||||
## If (b) — your task
|
||||
Drop `1` from `REQUIRES_UNDO_TIERS`, update D4 in `agent_sudo_design_decisions.md` to say tier 1
|
||||
is deliberately irreversible AND why, keep the existing test, add a comment at `app.py:244`
|
||||
explaining the hardcoded 3 is now correct-by-decision.
|
||||
|
||||
## Hard constraints
|
||||
- **Permitted files ONLY:** `app.py`, `security/scoped_undo.py`, `test_app.py`,
|
||||
`agent_sudo_design_decisions.md` (path b only). Anything else → **flag, do not touch**.
|
||||
(On 2026-07-15 the P3 agent's two most valuable findings were blockers OUTSIDE its permitted
|
||||
set, which it flagged rather than fixed. That is the system working. Do the same.)
|
||||
- **NEVER** restart/stop `agent-sudo-daemon`, edit its unit, edit `SUDO.md`, or write
|
||||
`/var/lib/agent-sudo/breaker.log` — all tier-4 human-only by design (D-CB7).
|
||||
- **NEVER** fire a danger-veto or `host_override_setb` command on a live host — it latches a
|
||||
production breaker. Both hosts are LIVE as of 2026-07-15 (server-01 `:8082`, primary `:8084`).
|
||||
- Run tests with `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest test_app test_sudo_rules
|
||||
test_circuit_breaker` (baseline: `Ran 85 tests ... OK`).
|
||||
- **A green suite proves less than you think.** On 2026-07-15, 85/85 passed while the image
|
||||
crashed on boot and the breaker was resettable by `docker restart`. If you change behaviour,
|
||||
prove it with a test that FAILS before your change and passes after. Say which test that is.
|
||||
|
||||
--max-turns 25
|
||||
|
||||
## MANDATORY WRAP-UP — you cannot stop without emitting this
|
||||
```json
|
||||
{"status":"succeeded|partially_succeeded|failed|blocked_on_decision",
|
||||
"decision_taken":"a|b|none",
|
||||
"actions_taken":[], "actions_failed":[],
|
||||
"tests":{"baseline_85_pass":true, "new_tests_added":[], "test_that_fails_before_change":""},
|
||||
"undo_capture_failure_behaviour":"", "files_touched":[], "files_flagged_not_touched":[],
|
||||
"human_action_required":[], "notes":""}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# A7-SPEC-GAPS-AC (2026-07-15) — projects id=187 gaps A + C · gameplan §3-A7 · small
|
||||
|
||||
Confirm-and-close two flagged spec gaps. **Analysis + recommendation; change only gap A, and
|
||||
only if the human has said which way.**
|
||||
|
||||
**Gap A:** `ATTACK_TIER4_SOURCES = ('danger_veto', 'host_override_setb')`. But `classify()` also
|
||||
reaches tier 4 via `rule_match` (explicit SUDO.md tier-4 rule) and `miss_verb_heuristic`
|
||||
(server-01). Both are currently audit-only (no latch). **Question for the human: should an
|
||||
explicit tier-4 SUDO.md rule be an attack signal?** One-line change to `ATTACK_TIER4_SOURCES`.
|
||||
⚠️ **D-CB8 deliberately EXCLUDES `miss_primary_refuse` — it is the DEFAULT for unlisted
|
||||
commands, so latching on it would take a host read-only on the first typo. Do NOT "fix" that.
|
||||
If you propose adding it, you have misunderstood the design.**
|
||||
|
||||
**Gap C:** A failed PRE-exec snapshot refuses 503 without calling `record_tier3_failure()` — the
|
||||
command never ran, and counting infrastructure faults toward the benign trip threshold would let
|
||||
a broken timeshift disarm tier 3. **Verify this reasoning against the code and confirm or refute.**
|
||||
|
||||
Permitted files: `app.py` (gap A one-liner only, only once decided). Everything else: report only.
|
||||
Do not fire tier-4 commands on live hosts. All 85 tests must pass.
|
||||
|
||||
--max-turns 12
|
||||
|
||||
## MANDATORY WRAP-UP
|
||||
```json
|
||||
{"status":"succeeded|partially_succeeded|failed",
|
||||
"gap_a":{"recommendation":"", "changed":false, "reasoning":""},
|
||||
"gap_c":{"confirmed":true, "reasoning":""},
|
||||
"actions_taken":[], "actions_failed":[], "human_action_required":[], "notes":""}
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user