Files

T

gates / consistency-and-conventions (push) Successful in 26s

Details

fix: stabilization pass — fail-closed auth, ai flag validation, lint/config/security hardening, regression tests

17-point code-level audit executed via Explorer->Architect->Builder->Tester->Reviewer;
Reviewer accepted (APPROVE_WITH_NOTES; 3 block-list items resolved):

- security: telegram sender-owner AND-gate + TELEGRAM_OWNER_ID, matrix
  MATRIX_ROOM_ID fail-closed, gpg --passphrase-fd 3 (no argv secret),
  /dev/tcp positional-arg form (checkport/smb-client/share-lib/NET_PROBE),
  eval deny-by-default + --no-command-execution carried by both chat bridges,
  tty-gated --trust; config/{telegram,matrix}.env reference templates
- ai: all ExecStart flags validated against installed llama.cpp
  (requested->error, default->omit+warn, CONFIG_REQUESTED_FLAGS); single-file
  hf download failure rc=1 + no .hf-meta; LLAMACPP_HOST coherent;
  POS_SUBCMDS + metadata gaps closed
- tooling: lint-conventions Bash-native rewrite (~24-30x faster, rules and
  output byte-identical, :num restored); pos system uninstall covers all 12
  libs + scale-tail + flags dir + systemd user units (|| true) + plugin
  markers; anchored .bash_completion/.bashrc removal replaces sed -i '/pos/d'
- config: canonical load_env_file in lib/config-ui.sh (CRLF strip, env-wins,
  XDG, LOADED_ENV_KEYS); 9 tools migrated; entertainment-lib collapsed to
  wrappers; docker-compose deliberately unmigrated (source semantics)
- tests: first committed regression suite — tests/run-tests.sh zero-dep
  runner + make test; 12 files / 179 checks / 0 skip / ~52s; hard skip
  contract; systemd-analyze verify on generated unit PASS

Verified: make gen idempotent; make check green; make lint 0 FAIL, 0 WARN;
make test green; bash -n clean; git diff --check clean. Audit deliverables +
agent reports + AGENT_TODO Done entry included.

2026-09-06 07:25:44 -04:00

6.4 KiB

Raw Blame History

D-A Fail-Mode Decision — Ratify Soft-Fail (2026-09-06)

TL;DR

Decision 1: D-A is formally AMENDED to the soft-fail model (option 2): unset TELEGRAM_OWNER_ID / MATRIX_ROOM_ID → daemon starts, logs a startup warning naming the missing var, and ignores every incoming command (no execution, no hint reply).
Decision 2: No doc/template/test changes required — they already describe soft-fail (DOC/POS.md:372,402, DOC/howto/communication.md, config/telegram.env:10, config/matrix.env:10-11, tests/t-telegram-auth.sh:76, tests/t-matrix-auth.sh:78).
Residual caveat (explicit): soft-fail misconfiguration is SILENT to senders — an admin who forgets TELEGRAM_OWNER_ID gets a daemon that looks alive (systemd healthy, long-polling) but ignores everyone; the only signal is the warning in the local log. Strict mode would have been LOUD at startup but would crash-loop a systemd Restart=always daemon for a non-fatal config gap.
Files changed: AgentsReport/architect/2026-09-06_stabilization-design.md (D-A section amendment, [DECIDED]).

Decision 1: Ratify soft-fail as shipped (amend D-A)

Problem: D-A as written required err+exit (fail-stop) when TELEGRAM_OWNER_ID/MATRIX_ROOM_ID are unset. The security-track Builder implemented soft-fail: daemon starts, warns, ignores commands. Reviewer finding F2 (BLOCKING) confirmed fail-closed security is preserved but the approved contract was substituted silently — violating my own decision criteria 1/5.

Decision: Formally amend D-A to the soft-fail model as shipped. The strict wording in AgentsReport/architect/2026-09-06_stabilization-design.md D-A (Telegram bullet, Matrix guard, acceptance criteria 1/5, Files-affected rows, risk note, TL;DR) is replaced and marked "AMENDED at review (2026-09-06): soft-fail ratified as shipped".

Rationale:

The entire shipped surface already encodes soft-fail: code (bin/pos-communication-telegram-listener:758-762,789-791, bin/pos-communication-matrix-listener:510-512), docs (DOC/POS.md:372,402), templates (config/telegram.env:10, config/matrix.env:10-11), and tests (t-telegram-auth.sh:76, t-matrix-auth.sh:78). Ratifying creates zero doc/template/test churn; choosing strict would require rewriting 5+ artifacts against an internally consistent implementation.
The security property is identical in both models: fail-closed — an unauthorized/unauthored command never executes. The difference is purely operational (startup refusal vs degraded liveness), so there is no security case forcing strict.
Strict fail-stop on a systemd-managed daemon with Restart=always produces a crash-loop for a non-fatal config gap; soft-fail keeps the daemon alive, diagnosable via its log, and recoverable via pos config.
Both directions are cheaply reversible (a 2-line guard flip) if future evidence favors strict.

Security implications of soft-fail (explicit): misconfiguration is silent to senders — no reply, no error, no hint that commands exist; the only signal is the local-log warning. Weighing that against strict's startup crash-loop, soft-fail is the better operation for a personal toolkit where a missing optional auth key should not take down a supervised unit.

[DECIDED]

Decision 2: No docs/templates/tests changes

DOC/POS.md (lines 372, 402), DOC/howto/communication.md, config/telegram.env (line 10), config/matrix.env (lines 10-11), tests/t-telegram-auth.sh (line 76), and tests/t-matrix-auth.sh (line 78) all describe exactly the ratified behavior. They stay as-is.