shitratgit[bot] 1f7207d10c fix(secrets): make hung-daemon recovery headless ...

Intent:
- Prevent agent-secrets recovery from opening an administrator dialog when its RPC loop is unresponsive.
- Complete the service-account migration documented restricted break-glass contract.

Implementation:
- Add an exact-command sudoers grant for only the agent-secrets launchd kickstart.
- Install and validate that grant during both service-account migration and critical-daemon installation.
- Document sudo -n recovery and classify password prompts as bootstrap defects.

Outcomes:
- Agents can restart a wedged service-account daemon without a password or UI after host bootstrap.
- The grant does not expose wildcard or general launchctl root access.

Verification:
- sh -n and bash -n passed for all changed installers.
- visudo -c parsed infra/sudoers-agent-secrets successfully.
- Exact-command and no-wildcard contract assertions passed.

Follow-ups:
- Flagg still needs the repaired root-owned sudoers file installed once because the original migration omitted it.

Co-authored-by: shitratgit[bot] <286405550+shitratgit[bot]@users.noreply.github.com>

2026-09-16 02:24:25 +00:00

..

agent-contracts

feat(cli): add capability contract scaffold and phase-1 commands

2026-02-28 13:00:41 -08:00

decisions

docs: record Chorus Rhizomatic adapter canary

2026-06-14 16:13:59 +00:00

runbooks

fix: bound flowing capture and retire old memory surfaces

2026-08-25 07:22:16 +00:00

architecture.md

cutover daemon wiring (handover composition the live gateway is running — belated to main) + messaging v2 docs: AGENTS/architecture/cli/gateway/sdk updated, canonical skills/messaging added

2026-07-16 15:44:28 -07:00

book-outline.md

redesign: cool finds index — full titles, readable descriptions, compact cards

2026-02-22 08:07:35 -08:00

cli.md

fix(nas): route docs and books through current storage placement

2026-09-11 20:52:12 +00:00

context-budget-analysis-2026-03-04.md

Fix Pi startup warnings by renaming capture-progress and making memory-enforcer session-safe

2026-06-05 11:48:43 -07:00

deploy.md

fix(secrets): make hung-daemon recovery headless

2026-09-16 02:24:25 +00:00

gateway.md

fix(gateway): use launchd user domain

2026-08-11 18:59:49 +00:00

inngest-functions.md

fix(infra): native typesense snapshots, convex LAN forwarder, MTU 8192 receipts

2026-07-31 13:23:36 -07:00

k8s-aistor-migration.md

Fix the MinIO NFS manifests to mount /volume1/joelclaw via NFSv3 and use subPath s3.

2026-03-08 07:29:34 -07:00

observability.md

Teach Talon to debounce critical probes and throttle repeated SOS pages

2026-06-05 21:53:56 -07:00

prd-project-threads.md

docs: capture central terms and project thread format

2026-06-14 18:45:17 +00:00

prd-reply-grants-channel-routing.md

Record synthetic end-to-end Reply Grant canary evidence

2026-05-26 08:29:16 -07:00

prd-rhizomatic-network-canary.md

docs: record Chorus Rhizomatic adapter canary

2026-06-14 16:13:59 +00:00

prompt-architecture.md

Clarify the prompt-layer hierarchy, route system-session operator updates through gateway notify, and generate session-local handles in session-lifecycle

2026-03-09 19:19:28 -07:00

sdk.md

cutover daemon wiring (handover composition the live gateway is running — belated to main) + messaging v2 docs: AGENTS/architecture/cli/gateway/sdk updated, canonical skills/messaging added

2026-07-16 15:44:28 -07:00

skills.md

docs: capture central topology and operator skills

2026-06-26 08:05:41 -07:00

specialist-agents.md

Rewrite the default pi role as system, keep interactive as a legacy alias, and update specialist-agent docs

2026-03-09 19:01:09 -07:00

web.md

Degrade apps/web Convex static generation when env is missing, seed placeholder slug params for Cache Components, and no-op client Convex providers during prerender

2026-03-10 09:15:07 -07:00

webhooks.md

Probe /webhooks via endpoint fallback, switch Agent Secrets health to secrets status, and give joelclaw runs adaptive GraphQL timeouts

2026-04-06 08:48:00 -07:00

workloads.md

Refresh workflow-rig skill and workloads docs so they describe the proven 2026-03-17 runtime state

2026-03-17 07:48:18 -07:00