From 32131ade7ecd9fcf81b9e9f80d6addb0de6831fa Mon Sep 17 00:00:00 2001 From: Backtalk6858 Date: Fri, 10 Jul 2026 03:19:50 -0500 Subject: [PATCH] =?UTF-8?q?feat:=20Agent-Sudo=20P4=20=E2=80=94=20server-01?= =?UTF-8?q?=20LIVE=20(unsigned=20interim=20deploy)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - P4 prompt: unsigned-interim override (SUDO_MD_VERIFY_ENFORCE=false, non-blocking AppRole/NTFY provisioning) - server-01 Agent-Sudo swapped live on 8082 (full gate green, 4/4 replay match); primary on 8084 shadow, manual swap pending (#146) - tier-2 root cause found: old primary bridge NTFY endpoint unreachable, not NTFY itself (behavior_changes id=3 corrected) Co-Authored-By: Claude Opus 4.8 --- agent-builder/agent_prompts.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/agent-builder/agent_prompts.md b/agent-builder/agent_prompts.md index a5ae5cd..27e0f71 100644 --- a/agent-builder/agent_prompts.md +++ b/agent-builder/agent_prompts.md @@ -1141,8 +1141,15 @@ Order: server-01 FIRST, primary LAST. Agent-Sudo stands up on port 8084 while th ## Use the shared block. +## ⚠️ UNSIGNED INTERIM DEPLOY — READ FIRST (2026-07-10 override) +The SUDO.md transit signature is NOT active yet (Vault admin access is being resolved on a separate task; the signature is D9 tamper-evidence ONLY, not a functional dependency — the old sudo-bridge you are replacing has zero signing). Therefore deploy with signature verification OFF: +- Set **`SUDO_MD_VERIFY_ENFORCE=false`** in the Agent-Sudo container env on BOTH hosts (compose env or Jenkins-injected). With this set, the daemon runs unsigned SUDO.md exactly like the current bridge. Do NOT try to sign SUDO.md, enable transit, or touch Vault transit — that is out of scope for this phase. +- **Vault AppRole provisioning is NON-BLOCKING.** The daemon's scoped AppRole (creds at `AGENT_SUDO_APPROLE_DIR`) is only needed for signed-verify gate + secret reads. If the AppRole/creds aren't present or a Vault call 403s, log it under `actions_failed` as "needs manual: agent-sudo AppRole provisioning" and CONTINUE the deploy + gate. Agent-Sudo must come up and pass L1–L4 without it. +- **NTFY provisioning is NON-BLOCKING** (topic/token). If NTFY isn't wired, still deploy + gate; record the missing NTFY config under `actions_failed` and print gate results in the wrap-up instead. Do NOT block the deploy or swap on NTFY. +- Everything else (parallel-8084 deploy, 4-level gate, server-01 autonomous swap, primary manual hand-off) proceeds exactly as below. + ## Contract — what must be true when you finish -1. **server-01:** Agent-Sudo deployed on 8084 via Jenkins/Gitea (plain compose). 4-level gate run and logged to `agent_test_results`: +1. **server-01:** Agent-Sudo deployed on 8084 via Jenkins/Gitea (plain compose) with `SUDO_MD_VERIFY_ENFORCE=false`. 4-level gate run and logged to `agent_test_results`: - L1 Structure (compose valid, container up, /health 200) · L2 Deployment (endpoints present, auth works) · L3 Smoke (a tier-0 read, a tier-1 reversible write in sandbox) · L4 Assertion (replay a set of known-safe commands through 8082 AND 8084, assert identical exit_code/output; assert a danger command → 403 tier-4; assert removed /approve endpoint → 404). - If ALL green → atomic swap on server-01 (8084→8082, old bridge→8084 standby). If ANY red → do NOT swap; leave 8082 serving; report. 2. **primary:** deploy Agent-Sudo on 8084 in parallel and run L1–L4 in shadow (diff against 8082) — but DO NOT swap. Produce a one-paragraph hand-off: exact manual command(s) for the user to flip primary, and the exact rollback command (flip back to old bridge on 8082).