@crvouga/dev-fleet 0.5.0 → 0.7.0

package/docs/runbooks.md

@@ -8,7 +8,7 @@ person (a login, an approval, a choice) is marked **needs a person**.
 `features/rules/runbooks.feature` fails when a code in the source has no
 entry here, or a `devfleet` command quoted in the documents does not exist.
 
-There are 238 codes; 29 need a person.
+There are 244 codes; 31 need a person.
 
 ## Bootstrap of a new or returning worker
 
@@ -147,6 +147,20 @@ There are 238 codes; 29 need a person.
 - `GIT_REMOTE_REFUSED`: git remote refused. **Needs a person.**
 - `GIT_REMOTE_UNREACHABLE`: git remote unreachable.
 
+## GitHub sign-in
+
+- **Meaning:** A node is not signed in to GitHub from the stored `github-token`, or the token belongs to another login. See [GitHub on every node](github.md).
+- **Confirm:** The `worker:github-sync` and `github:*` checks of `devfleet fleet-status --workers`; on the node, `gh auth status`.
+- **Fix:** Put a valid token for `worker.githubLogin` in the store as `github-token`, then run `devfleet fleet-sync` (a worker also retries every ten minutes).
+- **Escalate:** A missing login or a token issued for another account needs a person to declare the login or issue a new token.
+
+- `GITHUB_LOGIN_MISMATCH`: github login mismatch. **Needs a person.**
+- `GITHUB_LOGIN_UNDECLARED`: github login undeclared. **Needs a person.**
+- `GITHUB_SIGN_IN_FAILED`: github sign in failed.
+- `GITHUB_TOKEN_MISSING`: github token missing.
+- `GITHUB_TOKEN_REJECTED`: github token rejected.
+- `GITHUB_UNREACHABLE`: github unreachable.
+
 ## Tailscale
 
 - **Meaning:** A machine is not on the tailnet as the fleet declares it.

package/docs/state.md

@@ -64,9 +64,9 @@ arguments and never written to a report or a log.
 
 **A new fleet.** Nothing more: the first `fleet-sync` seeds the bucket.
 
-**A replacement manager, or a second machine.** Clone your project, `npm ci`,
-and run `fleet-sync` with the credentials. The bucket already holds the fleet,
-so its state is downloaded before anything is changed.
+**A replacement manager.** The bucket already holds the fleet, so its state is
+downloaded before anything is changed. Follow
+[replacing the manager](manager-recovery.md).
 
 **Runs the manager starts by itself.** A worker that hands `fleet-sync` to the
 manager starts a command there that gets no environment and no project. Save
@@ -172,6 +172,7 @@ it records what it applied. Its report carries the result as the
 | `local-ahead`  | This machine has changes the bucket has not received   | The next change, or `--push`, uploads them                 |
 | `bucket-ahead` | Another manager changed the bucket; this copy is stale | The next change or `fleet-sync` takes the bucket's version |
 | `unreachable`  | The bucket did not answer, or did not take an upload   | Changes still apply locally and are uploaded later         |
+| `corrupt`      | The bucket answered with a version that cannot be read | Changes apply locally; `--restore --timestamp` repairs it  |
 | `diverged`     | Both sides changed                                     | Refused. `--restore --yes` takes the bucket's version      |
 
 A stale copy never overwrites the bucket. A machine that was offline while
@@ -210,6 +211,7 @@ once `fleet-sync` has fetched it back.
 | `DEVFLEET_CONFIG`                                                    | A configuration file, instead of the project's `fleet.json`  |
 | `DEVFLEET_STATE`                                                     | Another state directory. Earlier files are not read for it   |
 | `DEVFLEET_BUCKET`                                                    | Another `bucket.json`                                        |
+| `DEVFLEET_MANAGER_HOLDER`                                            | How the manager lease names this machine                     |
 
 How a command reaches the bucket:
 
@@ -254,7 +256,37 @@ mise exec litestream -- litestream restore -no-expand-env \
   ~/.local/share/dev-fleet/state/fleet.db
 ```
 
+`devfleet fleet-state --restore --timestamp 2026-11-01T00:00:00Z --yes` does
+the same and then uploads that version as the bucket's current one. It is the
+remedy for a `corrupt` replica: the bucket answers, but its latest version
+cannot be read.
+
 Litestream is pinned in `mise.toml` and installed the first time it is used.
-The manager is the only machine that runs it. There is one manager, so there is
-one writer; two machines changing the state at the same moment are not
-supported, only detected afterwards.
+The manager is the only machine that runs it.
+
+## One manager at a time
+
+The fleet state carries a **manager lease**: which machine is the manager,
+and until when. Every change takes or renews it, and it reaches the bucket
+with the change. A second machine (a replacement while the old manager still
+runs, or an old manager that wakes up) reads it from the bucket before it
+writes anything and stops with `FLEET_MANAGER_LEASE_HELD`. `fleet-state
+--init` still restores the state on such a machine; it only writes nothing.
+
+The lease runs for seven days after the last change. After that, any machine
+may take it. Before that, `--take-over` (on `fleet-sync`, `fleet-state --init`
+or `fleet-state --import`) makes this machine the manager; use it only once
+the other one is gone ([replacing the manager](manager-recovery.md)).
+
+A machine is named in the lease by a digest of its machine ID
+(`/etc/machine-id` on Linux, the hardware UUID on macOS), never by its host
+name, which a replacement shares. `DEVFLEET_MANAGER_HOLDER` names it instead.
+
+## Schema version
+
+The database records its schema version in `PRAGMA user_version`. The schema
+is a series of numbered migrations (`src/state/migrations/0001-….sql`, …),
+and a command brings an older database forward before it writes. A database a
+newer dev-fleet wrote is refused with `FLEET_STATE_NEWER_THAN_CLI`, read or
+written, and nothing in it changes: install the dev-fleet version the fleet
+runs.

package/docs/topology.md

@@ -41,7 +41,8 @@ your project's `fleet.json` (version 3, checked by [the schema](../schema/fleet.
   manager is asleep, closed or offline, workers have no CLI proxy and no
   dashboard; nothing fails over, because a singleton never runs twice.
 - Its state (proxy OAuth/runtime state, the hub database) is backed up off the
-  machine as each service documents, so a replacement manager restores it.
+  machine as each service documents, so a replacement manager restores it
+  ([replacing the manager](manager-recovery.md)).
 
 ## Workers
 
@@ -63,7 +64,5 @@ your project's `fleet.json` (version 3, checked by [the schema](../schema/fleet.
 
 - **Add or replace a worker:** add it to `workers`, enroll it with
   `fleet-sync`, done. Remove it by deleting the entry.
-- **Replace the manager:** edit `manager`, then move each singleton service with
-  its documented fence-and-restore runbook (never two copies at once):
-  [CLI proxy](../cliproxy/docs/migration.md),
-  [Beszel hub](../ansible/monitoring/README.md).
+- **Replace the manager:** follow
+  [replacing the manager](manager-recovery.md).

package/docs/ubuntu-sync.md

@@ -187,7 +187,7 @@ verification and the CLIProxy singleton.
 | Disk safety                 | `personal-fleet-disk-guard` kills only the top user-cgroup writer below 3 GiB free, never deletes files; hourly `personal-fleet-disk-gc.timer` deletes git-ignored build output (`node_modules`, `.cache`, `dist`, ...) in checkouts idle 7d (12h under 15 GiB free) with no process inside, plus unused Docker images and build cache, never source, worktrees or volumes; journal 1G; `/tmp` 25% of RAM, aged 2d hourly, a measured write probe (`TMP_QUOTA_EXHAUSTED`), and T3 agents use disk-backed `/var/tmp` (`TMPDIR`, aged 14d); Docker log rotation                                                                                                                                                                       | not managed                                                                                                                                                                                                                                                                                                                                                                                               |
 | Tailscale                   | pinned APT package, `tailscaled` enabled, native login required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Tailscale app, human login                                                                                                                                                                                                                                                                                                                                                                                |
 | Dashboard agent             | pinned native binary, hardened `beszel-agent` systemd unit as user `beszel`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | not installed                                                                                                                                                                                                                                                                                                                                                                                             |
-| Credential renewal          | user timer `personal-worker-auth` renews the node's own Vault token and GitHub login every 10min                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | the human's own Vault and GitHub sessions                                                                                                                                                                                                                                                                                                                                                                 |
+| Credential renewal          | user timer `personal-worker-auth` renews the node's own Vault token every 10min; `personal-worker-github` signs it in to GitHub from the stored token ([GitHub](github.md))                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | the human's own Vault and GitHub sessions                                                                                                                                                                                                                                                                                                                                                                 |
 | Noninteractive sudo         | validated `/etc/sudoers.d/personal-fleet-USER`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | never; the human runs `manager.yml` once with `-K`                                                                                                                                                                                                                                                                                                                                                        |
 | T3 worker app               | pinned desktop `.deb` is the only T3 process (UI plus embedded server); GDM auto-login, user unit `t3code-desktop.service` bound to the graphical session with `Restart=always`; `personal-worker-recovery` runs a copy of `t3-health.sh` installed in `/usr/local/lib/personal-fleet` every minute: it stops and disables a still-running headless `t3code.service`, reports `T3_NO_GRAPHICAL_SESSION` and restarts the display manager (three times at most) when there is no session, starts a stopped app after `reset-failed`, restarts one whose local API missed three checks, and restarts one on another release than the installed one or with a deferred policy restart once it runs no agent turn; administrator policy | not a worker                                                                                                                                                                                                                                                                                                                                                                                              |
 | T3 providers                | the same managed instances (`fleet/agents/t3.json`) through locked T3 administrator policy                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | reconciled into the human's T3 settings by `fleet-sync` (`t3:providers`) with the ownership-safe `t3-apply` engine, so every T3 offers the identical set; unrelated and unmanaged instances are preserved. `fleet-sync` also applies the same proxy agent profiles (`configuration:apply`) and verifies the shared Vault gateway credential end to end with `provider:*:inference`, exactly as on workers |
@@ -209,10 +209,10 @@ vault kv get -field=FLEET_WORKER_TOKEN_WORKER_ONE secret/personal/prd \
   | ssh worker-one 'vault login -address=https://vault.example.com -no-print -'
 ```
 
-From then on the node's `personal-worker-auth` timer renews that token and
-restores its GitHub login from it (`bootstrap/worker-auth.ts`). It renders no
-provider configuration: agent profiles are applied by `fleet-sync`. See
-[Authentication and accounts](authentication.md).
+From then on the node's `personal-worker-auth` timer renews that token and its
+`personal-worker-github` timer keeps its GitHub sign-in current
+([GitHub](github.md)). It renders no provider configuration: agent profiles
+are applied by `fleet-sync`. See [Authentication and accounts](authentication.md).
 
 ## Ubuntu and remote-work safety
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/dev-fleet",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Keeps a set of development machines in sync: one manager and many workers",
   "license": "MIT",
   "repository": "github:crvouga/dev-fleet",
@@ -72,5 +72,5 @@
   "engines": {
     "node": ">=22"
   },
-  "gitHead": "620b8de05d662b4dc9072457580ca4b4eab54242"
+  "gitHead": "77efce7ad99a3d521169a5e773ad6b97ca21bc75"
 }

package/schema/check-ids.json

@@ -50,6 +50,14 @@
       "id": "auth:*",
       "meaning": "A required login or capability works in this process context."
     },
+    {
+      "id": "auth:copilot",
+      "meaning": "Copilot CLI uses the node's GitHub sign-in with a token it accepts."
+    },
+    {
+      "id": "auth:github",
+      "meaning": "gh answers auth status in this context."
+    },
     {
       "id": "auth:toolchain",
       "meaning": "The pinned toolchain, dependencies and Docker could be checked."
@@ -168,12 +176,52 @@
     },
     {
       "id": "git:configuration",
-      "meaning": "The fleet's Git identity and credential helper were written on this node."
+      "meaning": "The declared Git identity and the GitHub credential helper are written in the node's global Git configuration."
+    },
+    {
+      "id": "github:expiry",
+      "meaning": "The GitHub token does not expire within the warning window."
+    },
+    {
+      "id": "github:git-credential",
+      "meaning": "git asks gh for its GitHub credential."
+    },
+    {
+      "id": "github:org-access",
+      "meaning": "Single sign-on has authorised the GitHub token for each declared organisation."
+    },
+    {
+      "id": "github:permissions",
+      "meaning": "The GitHub token has every declared scope and can push to every declared repository."
+    },
+    {
+      "id": "github:principal",
+      "meaning": "The node is signed in to GitHub as its declared login."
+    },
+    {
+      "id": "github:rate-limit",
+      "meaning": "The GitHub rate limit left is above the warning floor."
+    },
+    {
+      "id": "github:sync",
+      "meaning": "fleet-sync signed this node in to GitHub from the stored credential."
+    },
+    {
+      "id": "github:token-current",
+      "meaning": "The node uses the GitHub token the store holds now."
+    },
+    {
+      "id": "github:workflow",
+      "meaning": "fleet-github-verify completed clone, branch, commit, push, pull request, checks and comment on the sandbox repository."
     },
     {
       "id": "login:*",
       "meaning": "A native per-machine login is in place."
     },
+    {
+      "id": "manager:boot-recovery",
+      "meaning": "The manager comes back by itself after a power cut or reboot."
+    },
     {
       "id": "manager:docker",
       "meaning": "The manager runs the pinned Docker Desktop."
@@ -483,8 +531,8 @@
       "meaning": "The worker runs the declared revision."
     },
     {
-      "id": "worker:github-principal",
-      "meaning": "The worker's GitHub login is the declared account."
+      "id": "worker:github-sync",
+      "meaning": "The worker is signed in to GitHub from the stored credential as the declared login."
     },
     {
       "id": "worker:package:*",

package/schema/fleet.schema.json

@@ -611,8 +611,24 @@
                     }
                   },
                   "description": "Only with the ntfy notify target: the ntfy topic URL fleet-watch publishes to."
+                },
+                "github-token": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["path", "field"],
+                  "properties": {
+                    "path": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9._/-]+$"
+                    },
+                    "field": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9_]+$"
+                    }
+                  }
                 }
-              }
+              },
+              "description": "Required for every secret except github-token, which defaults to the field GITHUB_TOKEN beside proxy-client-key."
             }
           }
         }
@@ -662,6 +678,68 @@
           "maximum": 720
         }
       }
+    },
+    "github": {
+      "description": "How every node signs in to GitHub. The fleet login is worker.githubLogin.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "manager": {
+          "description": "fleet: the manager signs in as the fleet login. {login}: a person's own login, checked and never replaced.",
+          "oneOf": [
+            {
+              "const": "fleet"
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["login"],
+              "properties": {
+                "login": {
+                  "type": "string",
+                  "pattern": "^[a-zA-Z0-9-]{1,39}$"
+                }
+              }
+            }
+          ]
+        },
+        "credential": {
+          "description": "shared: one github-token for every node. per-node: github-token-<node> for each node.",
+          "enum": ["shared", "per-node"]
+        },
+        "scopes": {
+          "description": "Token scopes every node must have, such as repo and workflow.",
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[a-z:_]{1,40}$"
+          }
+        },
+        "repositories": {
+          "description": "owner/name of repositories every node must be able to push to.",
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[a-zA-Z0-9-]{1,39}/[A-Za-z0-9._-]{1,100}$"
+          }
+        },
+        "organizations": {
+          "description": "Organisations whose single sign-on must have authorised the token.",
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[a-zA-Z0-9-]{1,39}$"
+          }
+        },
+        "sandbox": {
+          "type": "string",
+          "pattern": "^[a-zA-Z0-9-]{1,39}/[A-Za-z0-9._-]{1,100}$",
+          "description": "owner/name of a repository fleet-github-verify branches, pushes to and opens pull requests on, then cleans up."
+        }
+      }
     }
   }
 }

package/src/auth-checks.ts

@@ -6,6 +6,8 @@ import { codingAuth, serviceAuth } from './service-auth';
 import { workstationChecks } from './workstation-checks';
 import { toolchainChecks } from './toolchain-checks';
 import { workerSelection } from '../bootstrap/worker-tools';
+import { githubChecks } from './github/checks';
+import { secretsProvider } from './secrets';
 import type { Capability, Check, Runner, CommandResult } from './types';
 
 export async function authCheck(
@@ -20,6 +22,17 @@ export async function authCheck(
     return codingAuth(capability, run);
   if (capability === 'services') return serviceAuth(run);
   if (capability === 'workstation') return workstationChecks(root, run);
+  if (capability === 'github')
+    return githubChecks(run, {
+      definition,
+      ...(nodeId === undefined ? {} : { node: nodeId }),
+      secret: secretsProvider(definition.secrets, {
+        run: async (argv) => {
+          const result = await run(argv, { timeoutMs: 20_000 });
+          return result.ok ? result.stdout : null;
+        },
+      }),
+    });
   if (capability === 'toolchain')
     return toolchainChecks(
       root,
@@ -32,16 +45,11 @@ export async function authCheck(
 }
 
 async function basicAuth(
-  capability: 'github' | 'vault' | 'vscode',
+  capability: 'vault' | 'vscode',
   run: Runner,
   root: string
 ): Promise<Check[]> {
   const spec = {
-    github: {
-      command: ['gh', 'auth', 'status', '--active'],
-      action:
-        'Authenticate on this node with gh auth login, then gh auth setup-git.',
-    },
     vault: {
       command: [
         'vault',

package/src/check-owners.ts

@@ -0,0 +1,163 @@
+/** Who repairs a check: a repair recipe (`repair`), or the reason only a
+ * person can (`manual`). Every check ID dev-fleet reports matches one entry,
+ * by its exact ID or by a prefix ending in `*` (`beszel:*`). The most
+ * specific match wins. `login:*` is the sign-in recipe named after the rest
+ * of an `auth:` check's ID.
+ */
+export interface CheckOwner {
+  pattern: string;
+  repair?: string;
+  manual?: string;
+}
+
+const IDENTITY =
+  'It needs a person: a sign-in, an approval or a choice only the operator can make.';
+const EVIDENCE =
+  'It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed.';
+const DECLARATION =
+  'The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them.';
+const HARDWARE =
+  'It is a property of the hardware, the firmware or the operating system release, which no command changes.';
+
+export const CHECK_OWNERS: CheckOwner[] = [
+  // Toolchain and workstation: automatic.
+  { pattern: 'tool:*', repair: 'workspace' },
+  { pattern: 'tool:docker-*', repair: 'docker' },
+  { pattern: 'tool:github-auth*', repair: 'login:github' },
+  { pattern: 'dependencies', repair: 'workspace' },
+  { pattern: 'auth:toolchain', repair: 'workspace' },
+  { pattern: 'workstation:*', repair: 'workstation' },
+  { pattern: 'auth:*', repair: 'login:*' },
+  { pattern: 'auth:vscode', manual: IDENTITY },
+  { pattern: 'auth:workstation', manual: IDENTITY },
+  { pattern: 't3:settings', repair: 't3' },
+  { pattern: 't3:api', repair: 't3' },
+  // The checks that fail when a machine breaks.
+  { pattern: 'worker:service-recovery', repair: 'recovery' },
+  { pattern: 'worker:capacity', repair: 'disk' },
+  { pattern: 'worker:capacity:*', repair: 'disk' },
+  { pattern: 'beszel:agent', repair: 'monitoring' },
+  { pattern: 'beszel:service', repair: 'monitoring' },
+  { pattern: 'beszel:installation', repair: 'monitoring' },
+  { pattern: 'beszel:protocol', repair: 'monitoring' },
+  { pattern: 'tailscale:configuration', repair: 'network' },
+  { pattern: 'tailscale:online', repair: 'network' },
+  { pattern: 'tailscale:reachability', repair: 'network' },
+  { pattern: 'state:replica', repair: 'state' },
+  { pattern: 'state:*', repair: 'state' },
+  // What only a person can do.
+  {
+    pattern: 'beszel:*',
+    manual:
+      'The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync.',
+  },
+  {
+    pattern: 'tailscale:*',
+    manual:
+      'Signing a machine in to the tailnet and approving it is a person’s; the daemon itself is repaired by the network recipe.',
+  },
+  {
+    pattern: 'state:bucket',
+    manual:
+      'The bucket and its credentials are the operator’s: name them in fleet.json and pass the credentials.',
+  },
+  { pattern: 'state:definition', manual: DECLARATION },
+  {
+    pattern: 'worker:*',
+    manual:
+      'Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision.',
+  },
+  { pattern: 'worker:power-loss-recovery', manual: HARDWARE },
+  { pattern: 'worker:github-principal', manual: IDENTITY },
+  { pattern: 'worker:vault-renewal', manual: IDENTITY },
+  {
+    pattern: 'manager:*',
+    manual:
+      'The manager converges itself in fleet-sync; a setting that needs an administrator is applied with ansible-playbook -K ansible/macos/manager.yml.',
+  },
+  { pattern: 'manager:identity', manual: DECLARATION },
+  {
+    pattern: 'manager:docker',
+    manual:
+      'Docker Desktop is installed and updated by a person; no playbook installs it.',
+  },
+  { pattern: 'macos:*', manual: HARDWARE },
+  { pattern: 'ubuntu:release', manual: HARDWARE },
+  {
+    pattern: 'ubuntu:*',
+    manual:
+      'Re-converge the worker with fleet-sync: it applies the Ubuntu baseline.',
+  },
+  { pattern: 'platform:*', manual: HARDWARE },
+  {
+    pattern: 'ssh:*',
+    manual:
+      'SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you.',
+  },
+  { pattern: 'login:*', manual: IDENTITY },
+  { pattern: 'provider:*', manual: IDENTITY },
+  {
+    pattern: 'agent:*',
+    manual:
+      'Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s.',
+  },
+  {
+    pattern: 't3:*',
+    manual:
+      'T3 pairing and its private route are approved by a person; fleet-sync applies the rest.',
+  },
+  { pattern: 'vscode:*', manual: IDENTITY },
+  {
+    pattern: 'git:*',
+    manual:
+      'Uncommitted or unpushed work belongs to a person; dev-fleet never resets a checkout.',
+  },
+  {
+    pattern: 'git:configuration',
+    manual:
+      'fleet-sync writes the Git identity and credential helper with ansible/github/git.yml; run it from the manager.',
+  },
+  {
+    pattern: 'github:*',
+    manual:
+      'fleet-sync signs every node in to GitHub from the stored github-token (a worker retries every ten minutes); a token that is missing, expired or short of a scope or organisation needs a person to issue a new one.',
+  },
+  {
+    pattern: 'github:git-credential',
+    manual:
+      'fleet-sync writes the GitHub credential helper with ansible/github/git.yml when the git block is declared; run it from the manager.',
+  },
+  { pattern: 'github:rate-limit', manual: EVIDENCE },
+  { pattern: 'github:workflow', manual: EVIDENCE },
+  { pattern: 'fleet:*', manual: DECLARATION },
+  { pattern: 'enrollment:*', manual: DECLARATION },
+  { pattern: 'notify:*', manual: DECLARATION },
+  {
+    pattern: 'proxy:*',
+    manual:
+      'The CLI proxy is installed with devfleet cliproxy install and its accounts are signed in by a person.',
+  },
+  {
+    pattern: 'accounts:roster-current',
+    manual:
+      'The roster reaches every node with devfleet fleet-sync --only accounts, run from the manager.',
+  },
+  { pattern: 'accounts:native-login', manual: IDENTITY },
+  { pattern: 'configuration:*', manual: EVIDENCE },
+  { pattern: 'source:*', manual: EVIDENCE },
+  { pattern: 'bootstrap:*', manual: EVIDENCE },
+  { pattern: 'rollout:*', manual: EVIDENCE },
+  { pattern: 'repair:*', manual: EVIDENCE },
+];
+
+const matches = (pattern: string, id: string): boolean =>
+  pattern.endsWith('*') ? id.startsWith(pattern.slice(0, -1)) : id === pattern;
+
+/** The entry that owns a check, or null for an ID nobody registered. */
+export function checkOwner(id: string): CheckOwner | null {
+  return (
+    CHECK_OWNERS.filter((owner) => matches(owner.pattern, id)).sort(
+      (a, b) => b.pattern.length - a.pattern.length
+    )[0] ?? null
+  );
+}