Backtalk6858/claude-projects
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Agent-Sudo P4 — server-01 LIVE (unsigned interim deploy)

Browse Source 
- P4 prompt: unsigned-interim override (SUDO_MD_VERIFY_ENFORCE=false,
  non-blocking AppRole/NTFY provisioning)
- server-01 Agent-Sudo swapped live on 8082 (full gate green, 4/4 replay
  match); primary on 8084 shadow, manual swap pending (#146)
- tier-2 root cause found: old primary bridge NTFY endpoint unreachable,
  not NTFY itself (behavior_changes id=3 corrected)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Backtalk6858
2026-07-10 03:19:50 -05:00
parent 6248875e13
commit 32131ade7e
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent-builder/agent_prompts.md
+8 -1
View File
@@ -1141,8 +1141,15 @@ Order: server-01 FIRST, primary LAST. Agent-Sudo stands up on port 8084 while th
## Use the shared block. ## Use the shared block.
## ⚠️ UNSIGNED INTERIM DEPLOY — READ FIRST (2026-07-10 override)
The SUDO.md transit signature is NOT active yet (Vault admin access is being resolved on a separate task; the signature is D9 tamper-evidence ONLY, not a functional dependency — the old sudo-bridge you are replacing has zero signing). Therefore deploy with signature verification OFF:
- Set **`SUDO_MD_VERIFY_ENFORCE=false`** in the Agent-Sudo container env on BOTH hosts (compose env or Jenkins-injected). With this set, the daemon runs unsigned SUDO.md exactly like the current bridge. Do NOT try to sign SUDO.md, enable transit, or touch Vault transit — that is out of scope for this phase.
- **Vault AppRole provisioning is NON-BLOCKING.** The daemon's scoped AppRole (creds at `AGENT_SUDO_APPROLE_DIR`) is only needed for signed-verify gate + secret reads. If the AppRole/creds aren't present or a Vault call 403s, log it under `actions_failed` as "needs manual: agent-sudo AppRole provisioning" and CONTINUE the deploy + gate. Agent-Sudo must come up and pass L1–L4 without it.
- **NTFY provisioning is NON-BLOCKING** (topic/token). If NTFY isn't wired, still deploy + gate; record the missing NTFY config under `actions_failed` and print gate results in the wrap-up instead. Do NOT block the deploy or swap on NTFY.
- Everything else (parallel-8084 deploy, 4-level gate, server-01 autonomous swap, primary manual hand-off) proceeds exactly as below.
## Contract — what must be true when you finish ## Contract — what must be true when you finish
1. **server-01:** Agent-Sudo deployed on 8084 via Jenkins/Gitea (plain compose). 4-level gate run and logged to `agent_test_results`: 1. **server-01:** Agent-Sudo deployed on 8084 via Jenkins/Gitea (plain compose) with `SUDO_MD_VERIFY_ENFORCE=false`. 4-level gate run and logged to `agent_test_results`:
- L1 Structure (compose valid, container up, /health 200) · L2 Deployment (endpoints present, auth works) · L3 Smoke (a tier-0 read, a tier-1 reversible write in sandbox) · L4 Assertion (replay a set of known-safe commands through 8082 AND 8084, assert identical exit_code/output; assert a danger command → 403 tier-4; assert removed /approve endpoint → 404). - L1 Structure (compose valid, container up, /health 200) · L2 Deployment (endpoints present, auth works) · L3 Smoke (a tier-0 read, a tier-1 reversible write in sandbox) · L4 Assertion (replay a set of known-safe commands through 8082 AND 8084, assert identical exit_code/output; assert a danger command → 403 tier-4; assert removed /approve endpoint → 404).
- If ALL green → atomic swap on server-01 (8084→8082, old bridge→8084 standby). If ANY red → do NOT swap; leave 8082 serving; report. - If ALL green → atomic swap on server-01 (8084→8082, old bridge→8084 standby). If ANY red → do NOT swap; leave 8082 serving; report.
2. **primary:** deploy Agent-Sudo on 8084 in parallel and run L1–L4 in shadow (diff against 8082) — but DO NOT swap. Produce a one-paragraph hand-off: exact manual command(s) for the user to flip primary, and the exact rollback command (flip back to old bridge on 8082). 2. **primary:** deploy Agent-Sudo on 8084 in parallel and run L1–L4 in shadow (diff against 8082) — but DO NOT swap. Produce a one-paragraph hand-off: exact manual command(s) for the user to flip primary, and the exact rollback command (flip back to old bridge on 8082).