@crvouga/dev-fleet 0.3.0 → 0.5.0

package/README.md

@@ -42,7 +42,9 @@ dev-fleet is opinionated. These are part of it, not options:
 - The **manager** is a macOS machine. You run `fleet-sync` on it, and it hosts
   the shared services (the CLI proxy and the monitoring hub) in Docker Desktop.
 - **Workers** are Ubuntu 26.04 machines reached over SSH. They are stateless:
-  everything on them is rebuilt from Git and your secrets.
+  everything on them is rebuilt from Git and your secrets. The
+  [support matrix](docs/support-matrix.md) lists every platform and what
+  happens to it.
 - The fleet state is kept in an **S3-compatible bucket** you own.
 - Machines reach each other over **Tailscale**.
 - Coding agents (Claude Code, Codex, Grok, OpenCode, Antigravity) run through
@@ -98,7 +100,11 @@ Ansible policy and verifies the result. It prints one table and writes a full
 JSON report. The first run on a machine installs everything, mise included, so
 Git is the only tool it needs beforehand.
 
-`--dry-run` changes no machine. On the manager it checks the release out into
+`--dry-run` changes no machine. It first brings the manager's copy of the
+fleet state up to the bucket (never uploading), then prints, and adds to
+`--json` as `plan`, what a sync would change: the revision, each tool pin that
+moves, and what restarts because of it (a T3 restart ends its running agent
+turns). On the manager it checks the release out into
 dev-fleet's cache and installs the Bun that release pins beside any others, so
 that it can run; it never installs the toolchain, publishes the global mise
 configuration, edits shell profiles or touches a worker.
@@ -316,9 +322,11 @@ fleet.json contents.
   `fleet-sync` fetches that copy again when it is deleted, but the proxy then
   needs `devfleet cliproxy install` once more.
 - The manager is a Mac host. There is no container image of the manager.
-- `fleet-sync --schedule enable` (unattended runs on a timer) is not available
-  from the published package yet, so nothing re-applies the fleet until you
-  run `fleet-sync`.
+- `fleet-sync --schedule enable --apply --yes` (unattended runs every 30
+  minutes) is installed by that command on the manager, not yet by the
+  manager's playbook, and its interval is not yet part of `fleet.json`.
+  `fleet-sync --schedule status` lists its last runs, and `fleet-status` fails
+  `manager:schedule` when it has not converged the fleet for two intervals.
 - Not everything on a machine is pinned. [What is declared, and
   where](docs/declared.md) lists what is and what is not: most of a worker's
   own packages, the manager's applications and every login are outside it.
@@ -327,18 +335,18 @@ fleet.json contents.
 
 ## Repository layout
 
-| Path         | What                                                              |
-| ------------ | ----------------------------------------------------------------- |
-| `src/`       | Inventory, orchestration, verification, the report; `src/cli` CLI |
-| `src/state/` | The fleet state database and its replication to the bucket        |
-| `ansible/`   | Machine policy: `ubuntu/`, `macos/`, `monitoring/`                |
-| `agents/`    | Agent launchers T3 runs, and their registry                       |
-| `cliproxy/`  | The CLIProxyAPI service: install, audit, backup, model health     |
-| `bootstrap/` | Toolchain bootstrap and the manager and worker entry scripts      |
-| `schema/`    | JSON schemas for `fleet.json` and the private roster              |
-| `examples/`  | A complete example configuration                                  |
-| `features/`  | What dev-fleet does, as Gherkin features: the tests               |
-| `bin/`       | The entry point of the published package                          |
+| Path         | What                                                                    |
+| ------------ | ----------------------------------------------------------------------- |
+| `src/`       | Inventory, orchestration, verification, the report; `src/cli` CLI       |
+| `src/state/` | The fleet state database and its replication to the bucket              |
+| `ansible/`   | Machine policy: `ubuntu/`, `macos/`, `monitoring/`                      |
+| `agents/`    | Agent launchers T3 runs, and their registry                             |
+| `cliproxy/`  | The CLIProxyAPI service: install, audit, backup, model health           |
+| `bootstrap/` | Toolchain bootstrap and the manager and worker entry scripts            |
+| `schema/`    | JSON schemas for `fleet.json`, the roster and command output; check IDs |
+| `examples/`  | A complete example configuration                                        |
+| `features/`  | What dev-fleet does, as Gherkin features: the tests                     |
+| `bin/`       | The entry point of the published package                                |
 
 ## Develop
 

package/ansible/github/git.yml

@@ -0,0 +1,66 @@
+---
+# The Git identity and GitHub credentials every node commits and pushes with,
+# the manager included, as the developer: no become. Written in Git's own
+# per-user file (~/.config/git/config), inside a marked block, so a person's
+# ~/.gitconfig is never touched. Variables arrive through a private 0600
+# variables file, never argv.
+- name: Converge the Git identity and GitHub credential helper
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: false
+  vars:
+    git_config: '{{ git_home }}/.config/git/config'
+    # gh answers for GitHub through the pinned toolchain's shim, so any
+    # session's PATH works.
+    git_credential_helper: "!'{{ git_home }}/.local/share/mise/shims/gh' auth git-credential"
+  tasks:
+    - name: Require a declared identity
+      ansible.builtin.assert:
+        that:
+          - git_name | length > 0
+          - git_email is match('^[^@ ]+@[^@ ]+$')
+          - git_home is match('^/')
+        fail_msg: GIT_IDENTITY_UNDECLARED; declare git.name and git.email in fleet.json.
+    - name: Create the per-user Git configuration directory
+      ansible.builtin.file:
+        path: '{{ git_home }}/.config/git'
+        state: directory
+        mode: '0700'
+    - name: Declare the identity and the GitHub credential helper
+      ansible.builtin.blockinfile:
+        path: '{{ git_config }}'
+        create: true
+        mode: '0600'
+        marker: '# {mark} dev-fleet: Git identity and GitHub credentials'
+        block: |
+          [user]
+          	name = "{{ git_name }}"
+          	email = {{ git_email }}
+          [credential "https://github.com"]
+          	helper =
+          	helper = {{ git_credential_helper }}
+          [credential "https://gist.github.com"]
+          	helper =
+          	helper = {{ git_credential_helper }}
+    - name: Read the effective identity and GitHub credential helper
+      ansible.builtin.command:
+        argv: [git, config, --global, --get-all, '{{ item }}']
+      environment:
+        HOME: '{{ git_home }}'
+      loop:
+        - user.name
+        - user.email
+        - credential.https://github.com.helper
+      register: git_effective
+      check_mode: false
+      changed_when: false
+      failed_when: false
+    - name: Require the declared identity and helper to be the effective ones (worker:git-identity)
+      ansible.builtin.assert:
+        that:
+          - git_effective.results[0].stdout_lines | default([]) | last | default('') == git_name
+          - git_effective.results[1].stdout_lines | default([]) | last | default('') == git_email
+          - git_effective.results[2].stdout_lines | default([]) | last | default('') == git_credential_helper
+        fail_msg: GIT_IDENTITY_OVERRIDDEN; another Git configuration (often ~/.gitconfig) sets user.name, user.email or the GitHub credential helper after dev-fleet's. Remove those lines.
+      when: not ansible_check_mode

package/ansible/macos/policy.json

@@ -1,9 +1,20 @@
 {
   "version": 1,
   "minimumMajorVersion": 14,
+  "architectures": ["arm64", "x86_64"],
   "pmset": {
     "sleep": "0",
     "womp": "1"
   },
-  "beszelDaemon": "dev.devfleet.beszel-agent"
+  "beszelDaemon": "dev.devfleet.beszel-agent",
+  "disk": {
+    "warnFreeMiB": 20480,
+    "failFreeMiB": 5120,
+    "dockerWarnGiB": 64
+  },
+  "containerWatchdog": {
+    "unhealthyChecks": 3,
+    "maxRestartsPerHour": 3,
+    "intervalSeconds": 60
+  }
 }

package/ansible/monitoring/compose.yml

@@ -5,6 +5,16 @@ services:
   hub:
     image: henrygd/beszel:0.21.1@sha256:8514a69d9bbbcb74f371a3205561ee231fc0289739cea64e8131f341d695b770
     restart: unless-stopped
+    # Docker restarts a hub that exits; the container watchdog on the manager
+    # restarts one that stays unhealthy (container-watchdog.py).
+    labels:
+      dev.devfleet.watchdog: restart
+    healthcheck:
+      test: ['CMD', '/beszel', 'health', '--url', 'http://localhost:8090']
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
     ports:
       - '127.0.0.1:8090:8090'
     environment:

package/ansible/monitoring/container-watchdog.py

@@ -0,0 +1,118 @@
+#!/usr/bin/python3
+"""Restart a fleet container that stays unhealthy, a bounded number of times.
+
+Managed by fleet-sync (ansible/monitoring/hub-darwin.yml) as the per-user
+launchd agent dev.devfleet.container-watchdog on the manager. Docker restarts
+a container that exits, never one that hangs while it still holds its port.
+Every run reads the health of each container labelled
+dev.devfleet.watchdog=restart. One that was unhealthy for --unhealthy-checks
+runs in a row is restarted, at most --max-restarts-per-hour times an hour.
+Past that cap it is left alone and recorded as capped: a restart storm is a
+failing check (manager:container-watchdog), not a loop.
+
+Every decision is one JSON line on stdout; nothing a container printed is
+repeated. The state file holds counters only and is safe to delete.
+
+Usage: container-watchdog.py --state FILE [--unhealthy-checks N]
+                             [--max-restarts-per-hour N] [--dry-run]
+"""
+import argparse
+import json
+import os
+import subprocess
+import sys
+import time
+
+HOUR = 3600
+LABEL = 'dev.devfleet.watchdog=restart'
+
+
+def log(**event):
+    print(json.dumps(event, sort_keys=True), flush=True)
+
+
+def decide(memory, health, now, limit, cap):
+    """The next memory, and the containers to restart now with the reason.
+
+    memory: {name: {"unhealthy": n, "restarts": [t, ...], "capped": t|None}}
+    health: {name: "healthy" | "unhealthy" | "starting" | "none"}
+    """
+    after, restart = {}, []
+    for name, status in sorted(health.items()):
+        before = memory.get(name, {})
+        restarts = [t for t in before.get('restarts', []) if now - t < HOUR]
+        unhealthy = before.get('unhealthy', 0) + 1 if status == 'unhealthy' else 0
+        capped = before.get('capped')
+        if capped is not None and now - capped >= HOUR:
+            capped = None
+        if unhealthy >= limit:
+            if len(restarts) < cap:
+                restarts.append(now)
+                restart.append((name, f'unhealthy for {unhealthy} checks'))
+                unhealthy = 0
+            else:
+                capped = now
+        after[name] = {'unhealthy': unhealthy, 'restarts': restarts,
+                       'capped': capped}
+    return after, restart
+
+
+def docker(*args):
+    return subprocess.run(['docker', *args], capture_output=True, text=True,
+                          timeout=60)
+
+
+def observe():
+    listed = docker('ps', '--filter', f'label={LABEL}', '--format', '{{.Names}}')
+    if listed.returncode:
+        return None
+    health = {}
+    for name in listed.stdout.split():
+        state = docker('inspect', '--format',
+                       '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}',
+                       name)
+        health[name] = state.stdout.strip() if state.returncode == 0 else 'none'
+    return health
+
+
+def main(argv):
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--state', required=True)
+    parser.add_argument('--unhealthy-checks', type=int, default=3)
+    parser.add_argument('--max-restarts-per-hour', type=int, default=3)
+    parser.add_argument('--dry-run', action='store_true')
+    args = parser.parse_args(argv)
+    try:
+        with open(args.state) as file:
+            memory = json.load(file)
+        if not isinstance(memory, dict):
+            memory = {}
+    except (OSError, ValueError):
+        memory = {}
+    health = observe()
+    if health is None:
+        log(event='docker_unavailable')
+        return 0
+    now = time.time()
+    memory, restart = decide(memory, health, now, args.unhealthy_checks,
+                             args.max_restarts_per_hour)
+    for name, reason in restart:
+        ok = True
+        if not args.dry_run:
+            ok = docker('restart', name).returncode == 0
+        log(event='restarted', container=name, reason=reason, ok=ok,
+            dry_run=args.dry_run)
+    for name, entry in memory.items():
+        if entry['capped'] == now:
+            log(event='capped', container=name,
+                restarts=len(entry['restarts']))
+    os.makedirs(os.path.dirname(os.path.abspath(args.state)), exist_ok=True)
+    temporary = args.state + '.tmp'
+    with open(temporary, 'w') as file:
+        json.dump(memory, file, sort_keys=True)
+    os.replace(temporary, args.state)
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))

package/ansible/monitoring/hub-darwin.yml

@@ -14,6 +14,12 @@
       - compose
       - '-f'
       - '{{ playbook_dir }}/compose.yml'
+    watchdog_policy: "{{ (lookup('ansible.builtin.file', playbook_dir ~ '/../macos/policy.json') | from_json).containerWatchdog }}"
+    watchdog_label: dev.devfleet.container-watchdog
+    watchdog_root: '{{ ansible_facts.env.HOME }}/Library/Application Support/dev-fleet/container-watchdog'
+    watchdog_state: '{{ ansible_facts.env.HOME }}/Library/Caches/dev-fleet/container-watchdog.json'
+    watchdog_plist: '{{ ansible_facts.env.HOME }}/Library/LaunchAgents/{{ watchdog_label }}.plist'
+    watchdog_domain: 'gui/{{ ansible_facts.user_uid }}'
     beszel_environment:
       BESZEL_HUB_URL: '{{ beszel_hub_url }}'
       BESZEL_APP_URL: '{{ beszel_public_url | default(beszel_hub_url) }}'
@@ -100,3 +106,143 @@
       delay: 2
       register: hub_health
       until: hub_health.status == 200
+    # Scheduled off-machine backups, as the fleet configuration declares them
+    # (services.monitoring.backups), through the hub's own superuser API. Only
+    # what differs is changed; the storage keys never leave the variables file.
+    - name: Converge the hub's scheduled off-machine backups
+      when:
+        - beszel_backup_schedule is defined
+        - beszel_fleet_password | default('') | length > 0
+      block:
+        - name: Sign in to the hub as its superuser
+          ansible.builtin.uri:
+            url: http://127.0.0.1:8090/api/collections/_superusers/auth-with-password
+            method: POST
+            body_format: json
+            body:
+              identity: '{{ beszel_fleet_identity }}'
+              password: '{{ beszel_fleet_password }}'
+            return_content: true
+          check_mode: false
+          no_log: true
+          register: hub_superuser
+        - name: Read the hub's backup settings
+          ansible.builtin.uri:
+            url: http://127.0.0.1:8090/api/settings
+            headers:
+              Authorization: '{{ hub_superuser.json.token }}'
+            return_content: true
+          check_mode: false
+          no_log: true
+          register: hub_settings
+        - name: Schedule backups to the declared off-machine storage (BESZEL_BACKUP_CONVERGENCE_FAILED)
+          ansible.builtin.uri:
+            url: http://127.0.0.1:8090/api/settings
+            method: PATCH
+            headers:
+              Authorization: '{{ hub_superuser.json.token }}'
+            body_format: json
+            body:
+              backups:
+                cron: '{{ beszel_backup_schedule }}'
+                cronMaxKeep: '{{ beszel_backup_keep | int }}'
+                s3:
+                  enabled: true
+                  bucket: '{{ beszel_backup_bucket }}'
+                  region: '{{ beszel_backup_region }}'
+                  endpoint: '{{ beszel_backup_endpoint }}'
+                  accessKey: '{{ beszel_backup_access_key }}'
+                  secret: '{{ beszel_backup_secret_key }}'
+                  forcePathStyle: '{{ beszel_backup_force_path_style | default(false) | bool }}'
+          no_log: true
+          changed_when: true
+          when: >-
+            (hub_settings.json.backups | default({})).cron | default('') != beszel_backup_schedule
+            or (hub_settings.json.backups | default({})).cronMaxKeep | default(0) | int != beszel_backup_keep | int
+            or not ((hub_settings.json.backups | default({})).s3 | default({})).enabled | default(false)
+            or ((hub_settings.json.backups | default({})).s3 | default({})).bucket | default('') != beszel_backup_bucket
+            or ((hub_settings.json.backups | default({})).s3 | default({})).region | default('') != beszel_backup_region
+            or ((hub_settings.json.backups | default({})).s3 | default({})).endpoint | default('') != beszel_backup_endpoint
+            or ((hub_settings.json.backups | default({})).s3 | default({})).accessKey | default('') != beszel_backup_access_key
+            or ((hub_settings.json.backups | default({})).s3 | default({})).forcePathStyle | default(false) != beszel_backup_force_path_style | default(false) | bool
+    # Docker restarts a container that exits, never one that hangs while it
+    # holds its port. The watchdog restarts a labelled container (the hub, the
+    # CLI proxy) that stays unhealthy, a bounded number of times an hour; the
+    # bounds are containerWatchdog in ansible/macos/policy.json, and
+    # manager:container-watchdog reports a container past them.
+    - name: Create the container watchdog's directories
+      ansible.builtin.file:
+        path: '{{ item }}'
+        state: directory
+        mode: '0700'
+      loop:
+        - '{{ watchdog_root }}'
+        - '{{ watchdog_state | dirname }}'
+        - '{{ ansible_facts.env.HOME }}/Library/LaunchAgents'
+    - name: Install the container watchdog
+      ansible.builtin.copy:
+        src: '{{ playbook_dir }}/container-watchdog.py'
+        dest: '{{ watchdog_root }}/container-watchdog.py'
+        mode: '0700'
+    - name: Install the container watchdog's launch agent
+      ansible.builtin.copy:
+        dest: '{{ watchdog_plist }}'
+        mode: '0644'
+        content: |
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <!-- Managed by personal Fleet: container watchdog -->
+          <plist version="1.0"><dict>
+            <key>Label</key><string>{{ watchdog_label }}</string>
+            <key>ProgramArguments</key><array>
+              <string>/usr/bin/python3</string>
+              <string>-I</string>
+              <string>-B</string>
+              <string>{{ watchdog_root }}/container-watchdog.py</string>
+              <string>--state</string>
+              <string>{{ watchdog_state }}</string>
+              <string>--unhealthy-checks</string>
+              <string>{{ watchdog_policy.unhealthyChecks }}</string>
+              <string>--max-restarts-per-hour</string>
+              <string>{{ watchdog_policy.maxRestartsPerHour }}</string>
+            </array>
+            <key>EnvironmentVariables</key><dict>
+              <key>PATH</key><string>/usr/local/bin:/usr/bin:/bin:/Applications/Docker.app/Contents/Resources/bin</string>
+            </dict>
+            <key>StartInterval</key><integer>{{ watchdog_policy.intervalSeconds }}</integer>
+            <key>ProcessType</key><string>Background</string>
+            <key>Umask</key><integer>63</integer>
+            <key>StandardOutPath</key><string>{{ watchdog_root }}/watchdog.log</string>
+            <key>StandardErrorPath</key><string>{{ watchdog_root }}/watchdog.log</string>
+          </dict></plist>
+      register: watchdog_agent
+    - name: Inspect whether the container watchdog is loaded
+      ansible.builtin.command:
+        argv:
+          [/bin/launchctl, print, '{{ watchdog_domain }}/{{ watchdog_label }}']
+      changed_when: false
+      failed_when: false
+      register: watchdog_loaded
+    # launchd caches a loaded definition: a changed plist needs a reload.
+    - name: Unload a stale container watchdog definition
+      ansible.builtin.command:
+        argv:
+          [
+            /bin/launchctl,
+            bootout,
+            '{{ watchdog_domain }}/{{ watchdog_label }}',
+          ]
+      when: watchdog_agent.changed and watchdog_loaded.rc == 0
+      failed_when: false
+      changed_when: true
+    - name: Load the container watchdog
+      ansible.builtin.command:
+        argv:
+          [
+            /bin/launchctl,
+            bootstrap,
+            '{{ watchdog_domain }}',
+            '{{ watchdog_plist }}',
+          ]
+      when: watchdog_agent.changed or watchdog_loaded.rc != 0
+      changed_when: true

package/ansible/net/remote-probe.sh

@@ -8,6 +8,11 @@ if [ "$(uname)" = Darwin ]; then
 else
   echo "ncpu=$(nproc)"
   echo "load=$(cut -d' ' -f1 /proc/loadavg)"
+  # Free inodes as a percentage: bytes can be free while every write fails.
+  df -Pi "$HOME" | awk 'NR==2 && $2>0{print "inodefree=" int($4*100/$2)}'
+  # Clock synchronisation, as systemd sees it: 1 or 0.
+  timedatectl show -p NTPSynchronized -p NTP 2>/dev/null | awk -F= '{v=($2=="yes")?1:0} $1=="NTP"{print "ntp=" v} $1=="NTPSynchronized"{print "ntpsync=" v}'
   awk '/MemTotal/{t=$2} /MemAvailable/{a=$2} /SwapTotal/{st=$2} /SwapFree/{sf=$2} END{print "memfree=" int(a*100/t); if (st>0) print "swap=" int((st-sf)*100/st); else print "swap=0"}' /proc/meminfo
 fi
 echo "diskmb=$(df -Pk "$HOME" | awk 'NR==2{print int($4/1024)}')"
+echo "epoch=$(date +%s)"

package/ansible/platforms.json

@@ -0,0 +1,111 @@
+{
+  "version": 1,
+  "rows": [
+    {
+      "role": "manager",
+      "platform": "any other",
+      "versions": "any",
+      "architectures": "any",
+      "status": "refused",
+      "note": "The fleet configuration accepts only a macOS manager."
+    },
+    {
+      "role": "worker",
+      "platform": "Ubuntu",
+      "versions": "any other release",
+      "architectures": "any",
+      "status": "refused",
+      "note": "UBUNTU_BASELINE_MISMATCH"
+    },
+    {
+      "role": "worker",
+      "platform": "Ubuntu",
+      "versions": "an accepted release",
+      "architectures": "any other",
+      "status": "refused",
+      "note": "UBUNTU_BASELINE_MISMATCH"
+    },
+    {
+      "role": "worker",
+      "platform": "Debian",
+      "versions": "any",
+      "architectures": "any",
+      "status": "refused",
+      "note": "UBUNTU_BASELINE_MISMATCH"
+    },
+    {
+      "role": "worker",
+      "platform": "macOS",
+      "versions": "any",
+      "architectures": "any",
+      "status": "refused",
+      "note": "The fleet configuration accepts only Linux workers."
+    },
+    {
+      "role": "worker",
+      "platform": "Windows",
+      "versions": "any",
+      "architectures": "any",
+      "status": "refused",
+      "note": "The fleet configuration accepts only Linux workers."
+    },
+    {
+      "role": "worker",
+      "platform": "WSL2",
+      "environment": "wsl",
+      "versions": "any",
+      "architectures": "any",
+      "status": "refused",
+      "note": "WORKER_ENVIRONMENT_UNSUPPORTED"
+    },
+    {
+      "role": "worker",
+      "platform": "container",
+      "environment": "container",
+      "versions": "any",
+      "architectures": "any",
+      "status": "refused",
+      "note": "WORKER_ENVIRONMENT_UNSUPPORTED"
+    },
+    {
+      "role": "toolchain only",
+      "platform": "macOS",
+      "versions": "any",
+      "architectures": "arm64, x86_64",
+      "status": "best effort",
+      "note": "No fleet role: devfleet bootstrap installs the pinned tools (docs/machine-setup.md)."
+    },
+    {
+      "role": "toolchain only",
+      "platform": "Linux",
+      "versions": "any",
+      "architectures": "x86_64, aarch64",
+      "status": "best effort",
+      "note": "No fleet role: devfleet bootstrap installs the pinned tools (docs/machine-setup.md)."
+    },
+    {
+      "role": "toolchain only",
+      "platform": "WSL2",
+      "versions": "any",
+      "architectures": "x86_64",
+      "status": "best effort",
+      "note": "Treated as Linux: devfleet bootstrap installs the pinned tools (docs/machine-setup.md)."
+    },
+    {
+      "role": "toolchain only",
+      "platform": "Windows",
+      "versions": "any",
+      "architectures": "x64",
+      "status": "best effort",
+      "note": "No fleet role: bootstrap/bootstrap.ps1 installs the pinned tools (docs/machine-setup.md)."
+    },
+    {
+      "role": "toolchain only",
+      "platform": "Alpine",
+      "versions": "any",
+      "architectures": "any",
+      "status": "refused",
+      "note": "musl: the pinned mise build needs glibc."
+    }
+  ]
+}

package/ansible/ubuntu/authorize-sudo.sh

@@ -3,14 +3,11 @@
 # SSH terminal so sudo reads the operator's password itself; never capture it.
 set -eu
 umask 077
-case "$(uname -s)" in
-  Linux)
-    . /etc/os-release
-    [ "$ID" = ubuntu ] && [ "$VERSION_ID" = 26.04 ] || exit 1 ;;
-  Darwin)
-    [ "$(sw_vers -productVersion | cut -d. -f1)" -ge 14 ] || exit 1 ;;
-  *) exit 1 ;;
-esac
+# Workers are Ubuntu. Which releases is checked by the bootstrap that
+# follows, against ansible/ubuntu/policy.json; this only grants sudo.
+[ "$(uname -s)" = Linux ] || exit 1
+. /etc/os-release
+[ "$ID" = ubuntu ] || exit 1
 user=$(id -un)
 case "$user" in root|''|*[!a-z0-9_-]*) exit 1;; esac
 command -v sudo >/dev/null 2>&1 || exit 1
@@ -23,11 +20,7 @@ mkdir -p "$root"
 chmod 700 "$root"
 [ ! -L "$root/remote-operation.lock" ] || exit 1
 exec 9>"$root/remote-operation.lock"
-if command -v flock >/dev/null 2>&1; then
-  flock -n 9 || exit 1
-else
-  python3 -c 'import fcntl; fcntl.flock(9, fcntl.LOCK_EX | fcntl.LOCK_NB)' 9>&9 || exit 1
-fi
+flock -n 9 || exit 1
 sudo -v
 file=$(mktemp)
 trap 'rm -f "$file"' EXIT
@@ -45,7 +38,5 @@ if sudo -n test -e "$target"; then
   }
   sudo -n cp -p -- "$target" "$target.before-fleet-enrollment"
 fi
-group=root
-[ "$(uname -s)" != Darwin ] || group=wheel
-sudo -n install -o root -g "$group" -m 0440 -- "$file" "$target"
+sudo -n install -o root -g root -m 0440 -- "$file" "$target"
 sudo -n true