@crvouga/dev-fleet 0.8.0 → 0.9.1

package/README.md

@@ -41,8 +41,10 @@ dev-fleet is opinionated. These are part of it, not options:
 
 - The **manager** is a macOS machine. You run `fleet-sync` on it, and it hosts
   the shared services (the CLI proxy and the monitoring hub) in Docker Desktop.
-- **Workers** are Ubuntu 26.04 machines reached over SSH. They are stateless:
-  everything on them is rebuilt from Git and your secrets. The
+- **Workers** are Ubuntu 26.04 or 24.04 machines reached over SSH. They are stateless:
+  everything on them is rebuilt from Git and your secrets.
+  [What a worker must offer](docs/worker-requirements.md) is one page: image,
+  architecture, size, access, first-boot data and network. The
   [support matrix](docs/support-matrix.md) lists every platform and what
   happens to it.
 - The fleet state is kept in an **S3-compatible bucket** you own.
@@ -128,10 +130,26 @@ npm install --save-dev --save-exact @crvouga/dev-fleet@latest
 npx devfleet fleet-sync              # the fleet moves to that release
 ```
 
-Install an older version and run `fleet-sync` to go back. One worker, the
-canary, proves a new revision before the others receive it: the first
-reachable worker, or the one `canary` in `fleet.json` (or `--canary`) names
-when it is reachable. An offline worker never holds the others back.
+One worker, the canary, proves a new revision before the others receive it:
+the first reachable worker, or the one `canary` in `fleet.json` (or
+`--canary`) names when it is reachable. An offline worker never holds the
+others back.
+
+A sync never ends a running agent turn. A worker's T3 that must restart for
+a new release or provider policy restarts only once it runs no agent turn;
+until then the restart is pending and the worker's recovery timer applies it
+at the first idle check. `fleet-sync --restart-busy` restarts it at once and
+ends those turns, and `fleet-sync --dry-run` (with or without the flag) says
+which of the two a sync would do.
+
+To go back, run `npx devfleet fleet-sync --rollback` on the manager: it
+converges every machine to the revision applied before the approved one, which
+the fleet state records: after an upgrade whose canary failed, that is the
+revision the fleet still runs. A rollback covers what a revision declares: the
+checkout, the pinned tools and T3 Code. System packages roll forward only
+(apt never downgrades them), so a release that moved one keeps it. Installing
+an older version and running `fleet-sync` does the same for any earlier
+release.
 
 ## Your project's own tools
 
@@ -139,8 +157,10 @@ On a fleet machine the global mise configuration (`~/.config/mise/config.toml`
 and its `mise.lock`) belongs to dev-fleet: `fleet-sync` publishes it with the
 fleet's pinned tools and the agent worktree roots mise must trust. A project
 pins its own tools in its own `mise.toml` and installs them with
-`mise install --locked` in its checkout. It never publishes a global
-configuration. If anything replaces dev-fleet's, `fleet-status` fails the check
+`mise install --locked` in its checkout. On a fleet machine mise installs a
+project's tools only from the project's `mise.lock` (run `mise lock` after
+changing a pin); a tool the lock does not name is refused. A project never
+publishes a global configuration. If anything replaces dev-fleet's, `fleet-status` fails the check
 `tool:global-mise-config` until the next `fleet-sync`.
 
 ## Using it from code
@@ -219,6 +239,12 @@ propagates them without a full sync.
    }
    ```
 
+   A worker may add `"features": { "preset": "editing" }` for a rented
+   machine that only edits code: no Docker, and T3 as a headless server with
+   no desktop. `containers` and `session` set each one; fleet-wide defaults go
+   under `worker.features`. The [worker contract](docs/worker-contract.md)
+   says what each feature installs and the minimum size of a worker.
+
 3. Run `fleet-sync`. A machine that has only an SSH server and an account
    with sudo is enough: every pull request proves that against a bare
    Ubuntu machine, over SSH
@@ -243,7 +269,10 @@ Remove a machine with `npx devfleet fleet-node-retire --id ID --apply --yes`
 and leaves a tombstone in the fleet state), then delete its entry and run
 `fleet-sync`. To put a fresh machine in place of a worker under the same id,
 run `npx devfleet fleet-node-replace --id ID --host-key "TYPE BASE64" --apply
---yes` and then `fleet-sync --node ID`.
+--yes` and then `fleet-sync --node ID`; the manager's T3 pairs with the new
+machine's T3 by itself, with no code to copy. A run scoped with `--node` records only the
+revision of the workers it covered; the fleet's applied revision moves with a
+full `fleet-sync`.
 
 ## Configuration
 
@@ -399,6 +428,32 @@ Every pull request runs these checks ([`ci.yml`](.github/workflows/ci.yml)):
 | Fleet state           | The pinned Litestream replicates the fleet state to a directory and to an S3 API, and a second manager restores it                |
 | Fresh worker over SSH | A new Ubuntu machine with only an SSH server and sudo is bootstrapped by the production code over real SSH, on amd64 and on arm64 |
 | Workflows             | The workflow files pass `actionlint`                                                                                              |
+| Playbooks             | Every playbook passes `ansible-lint` (production profile) and `--syntax-check`                                                    |
+| Manager on macOS      | Every feature on macOS, launchd jobs linted by macOS, and the manager playbook converged, then re-run and checked with no change  |
+
+The ruleset of `main` requires one check, **Required checks**, which passes
+only when every job above passed: a job that is added, renamed or split is
+required from the pull request that does it. The two fresh worker features
+run side by side, each in a job of its own for every release and
+architecture.
+
+A pull request needs nobody attending
+([`pull-requests.feature`](features/rules/pull-requests.feature)):
+
+- A pull request from a branch of this repository is squash-merged as soon as
+  **Required checks** passes ([`auto-merge.yml`](.github/workflows/auto-merge.yml)).
+  A draft is left alone until it is marked ready; a fork's is left to a person.
+- The merge is checked again on `main` and then released. A merge made with
+  the workflow's own token starts no workflow, so `auto-merge.yml` starts CI
+  on `main` itself when the newest commit there has no run.
+- A workflow that fails on `main` (CI, the release, the weekly VM and tailnet
+  tests, the pins) has one open issue labelled
+  [`ci-failure`](https://github.com/crvouga/dev-fleet/issues?q=is%3Aissue+is%3Aopen+label%3Aci-failure)
+  for as long as it fails ([`failures.yml`](.github/workflows/failures.yml)):
+  the run, the commit, the jobs and steps that failed. Each failing run
+  rewrites it and the first passing run closes it, so those issues are what is
+  broken on `main` now. Start there; fix with a pull request that says
+  `Fixes #<issue>`.
 
 Some scenarios need something a laptop may not have, and are skipped there:
 
@@ -406,6 +461,7 @@ Some scenarios need something a laptop may not have, and are skipped there:
 DEVFLEET_TEST_FRESH_BOX=1 bun test features/fresh-box     # Docker; tests the HEAD commit
 mise install litestream
 DEVFLEET_TEST_S3=http://127.0.0.1:5000 bun test features/state
+bun ansible/ubuntu/tests/run-vm.ts baseline   # Linux amd64 with KVM; the Ubuntu VM workflow
 ```
 
 ## License

package/agents/audit.md

@@ -7,24 +7,24 @@ nodes were inspected or authenticated. The execution host exposes Codex, Claude
 and T3 on PATH; the mise catalog additionally includes Gemini, Copilot and OpenCode.
 Cursor and Antigravity are desktop prerequisites, not mise-managed binaries.
 
-| Source/owner                                                           | Installed destination                                                   | Scope                                                                                            |
-| ---------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
-| `mise.toml`, `mise.lock`, `.mise/locks/`; bootstrap                    | Global mise config, shims and installed tools                           | Versions; no authentication                                                                      |
-| `agents/registry.json`; dev-fleet                                      | Dedicated profile outputs described below                               | Endpoint, models, secret references, node model overrides                                        |
-| `cli/lib/agents/render.ts`; dev-fleet                                  | `ROOT/NODE/codex/{direct,proxy}/config.toml`                            | Separate CODEX_HOME, Responses HTTP/SSE provider declaration                                     |
-| same                                                                   | `ROOT/NODE/claude/{direct,proxy}/settings.json`                         | Passed using native --settings; process environment routes proxy                                 |
-| same                                                                   | `ROOT/NODE/opencode/{direct,proxy}/opencode.json`                       | OPENCODE_CONFIG, environment key placeholder                                                     |
-| same                                                                   | `ROOT/NODE/gemini/direct/.gemini/settings.json`                         | GEMINI_CLI_HOME is the profile root; independent native login                                    |
-| `cli/lib/agents/converge.ts`; dev-fleet                                | Each profile's receipt.json; ROOT/backups                               | Nonsecret fingerprints/revision; private migration backups                                       |
-| Existing `opencode/provider-secrets.ts`, OpenRouter package; dev-fleet | Platform OpenCode directory/opencode.json                               | Vault provider catalog, OpenRouter auto policy; existing sync embeds private keys with mode 0600 |
-| Existing OpenCode plugins/bin and cli/lib/links.ts; dev-fleet          | Platform OpenCode plugins/bin, tui.json, notifier files                 | Notification plugins, sounds, platform-derived app paths                                         |
-| `agents/codex-proxy.ts`; dev-fleet                                     | T3 binaryPath points directly into reviewed Git checkout                | Runtime Vault injection; WS_AGENT_NODE is a declared machine value                               |
-| `agents/t3.json`; personal T3 reconciler                               | T3CODE_HOME/userdata/settings.json                                      | Owned provider instances only; plan/apply/import/cleanup and private ownership state             |
-| `../fleet/definition.json`, cli/lib/net; dev-fleet                     | Managed SSH block and VS Code Remote-SSH settings                       | Existing machine aliases, OS/user/identity public paths and T3 ports; no private keys            |
-| `.agents/commands/*.md`; agents:sync                                   | Harness command symlinks                                                | Canonical agent commands; do not edit copies                                                     |
-| Root AGENTS.md, CLAUDE.md, GEMINI.md, .github/copilot-instructions.md  | Repository instruction discovery                                        | Same canonical repository rules                                                                  |
-| Existing cliproxy clients/bootstrap.py and launcher.py                 | ~/.config/cliproxy-fleet; ~/.local/bin/*-fleet                          | Legacy opt-in migration boundary; native settings preserved                                      |
-| Fleet configure                                                        | checkout/node_modules/.fleet-revisions/SHA; .fleet-configuration/*.json | Pinned Git deployment worktrees and per-selection rollout receipts                               |
+| Source/owner                                                                                   | Installed destination                                                   | Scope                                                                                            |
+| ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| `mise.toml`, `mise.lock`, `.mise/locks/`; bootstrap                                            | Global mise config, shims and installed tools                           | Versions; no authentication                                                                      |
+| `agents/registry.json`; dev-fleet                                                              | Dedicated profile outputs described below                               | Endpoint, models, secret references, node model overrides                                        |
+| `ansible/agents/templates/` (specified by `src/agents/render.ts`); `ansible/agents/agents.yml` | `ROOT/NODE/codex/{direct,proxy}/config.toml`                            | Separate CODEX_HOME, Responses HTTP/SSE provider declaration                                     |
+| same                                                                                           | `ROOT/NODE/claude/{direct,proxy}/settings.json`                         | Passed using native --settings; process environment routes proxy                                 |
+| same                                                                                           | `ROOT/NODE/opencode/{direct,proxy}/opencode.json`                       | OPENCODE_CONFIG, environment key placeholder                                                     |
+| same                                                                                           | `ROOT/NODE/gemini/direct/.gemini/settings.json`                         | GEMINI_CLI_HOME is the profile root; independent native login                                    |
+| `src/agents/converge.ts` decides, `ansible/agents/agents.yml` writes                           | Each profile's receipt.json; ROOT/backups                               | Nonsecret fingerprints/revision; private migration backups                                       |
+| Existing `opencode/provider-secrets.ts`, OpenRouter package; dev-fleet                         | Platform OpenCode directory/opencode.json                               | Vault provider catalog, OpenRouter auto policy; existing sync embeds private keys with mode 0600 |
+| Existing OpenCode plugins/bin and cli/lib/links.ts; dev-fleet                                  | Platform OpenCode plugins/bin, tui.json, notifier files                 | Notification plugins, sounds, platform-derived app paths                                         |
+| `agents/codex-proxy.ts`; dev-fleet                                                             | T3 binaryPath points directly into reviewed Git checkout                | Runtime Vault injection; WS_AGENT_NODE is a declared machine value                               |
+| `agents/t3.json`; personal T3 reconciler                                                       | T3CODE_HOME/userdata/settings.json                                      | Owned provider instances only; plan/apply/import/cleanup and private ownership state             |
+| `../fleet/definition.json`, cli/lib/net; dev-fleet                                             | Managed SSH block and VS Code Remote-SSH settings                       | Existing machine aliases, OS/user/identity public paths and T3 ports; no private keys            |
+| `.agents/commands/*.md`; agents:sync                                                           | Harness command symlinks                                                | Canonical agent commands; do not edit copies                                                     |
+| Root AGENTS.md, CLAUDE.md, GEMINI.md, .github/copilot-instructions.md                          | Repository instruction discovery                                        | Same canonical repository rules                                                                  |
+| Existing cliproxy clients/bootstrap.py and launcher.py                                         | ~/.config/cliproxy-fleet; ~/.local/bin/*-fleet                          | Legacy opt-in migration boundary; native settings preserved                                      |
+| Fleet configure                                                                                | checkout/node_modules/.fleet-revisions/SHA; .fleet-configuration/*.json | Pinned Git deployment worktrees and per-selection rollout receipts                               |
 
 ROOT is `~/.config/personal/agents` on macOS/Linux and
 `%USERPROFILE%\AppData\Local\personal\agents` on native Windows. Home and platform

package/ansible/agents/agents.yml

@@ -0,0 +1,134 @@
+---
+# One agent CLI's dedicated profile (src/agents/converge.ts): its
+# configuration files, rendered from templates/, and the receipt that records
+# them. Written as the developer: no become. These files already exist on
+# running machines and every byte of them is an interface; the templates
+# render exactly what src/agents/render.ts specifies
+# (features/agents/agent-configuration-templates.feature proves it).
+#
+# TypeScript decides beforehand: it refuses a file someone edited unless the
+# person adopts it, names the files to back up first, and passes the SHA-256
+# of each file as it must be written. A rendered file without that digest
+# never replaces the one in place, the play measures every file again before
+# it writes the receipt, so a receipt never vouches for a file it does not
+# describe, and TypeScript measures the profile once more afterwards. A
+# profile with nothing to change is not played at all. Variables arrive
+# through a private 0600
+# variables file, never argv; none of them is a secret (a profile names the
+# variable that holds the proxy key, never the key).
+- name: Render an agent CLI's dedicated profile
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: false
+  vars:
+    # Where each CLI reads its configuration, relative to its profile.
+    agent_templates:
+      codex:
+        directories: []
+        files:
+          - { dest: config.toml, src: codex.config.toml.j2 }
+      claude:
+        directories: []
+        files:
+          - { dest: settings.json, src: claude.settings.json.j2 }
+      grok:
+        directories: []
+        files:
+          - { dest: config.toml, src: grok.config.toml.j2 }
+      antigravity:
+        directories: [.gemini, .gemini/antigravity-cli]
+        files:
+          - {
+              dest: .gemini/antigravity-cli/settings.json,
+              src: antigravity.settings.json.j2,
+            }
+      gemini:
+        directories: [.gemini]
+        files:
+          - { dest: .gemini/settings.json, src: gemini.settings.json.j2 }
+      opencode:
+        directories: []
+        files:
+          - { dest: opencode.json, src: opencode.json.j2 }
+    agent_profile_directory: '{{ agent_root }}/{{ agent_node }}/{{ agent_tool }}/{{ agent_profile }}'
+    agent_spec: '{{ agent_templates[agent_tool] }}'
+  tasks:
+    - name: Require one known profile of one plain machine name
+      ansible.builtin.assert:
+        that:
+          - agent_root is match('^/')
+          - agent_node is match('^[a-z0-9][a-z0-9-]{0,62}$')
+          - agent_tool in agent_templates
+          - agent_profile in ['direct', 'proxy']
+          - agent_model is match('^[a-zA-Z0-9_./:+-]+$')
+          - agent_revision is match('^[a-f0-9]{40}$')
+          - agent_fingerprint is match('^[a-f0-9]{64}$')
+          - agent_profile == 'direct' or agent_proxy_endpoint is match('^https?://')
+          - agent_files.keys() | sort == agent_spec.files | map(attribute='dest') | sort
+        fail_msg: AGENT_PROFILE_REQUEST_INVALID; dev-fleet passes a validated selection and the digest of every file it renders.
+    - name: Create the profile directories
+      ansible.builtin.file:
+        path: '{{ item }}'
+        state: directory
+        mode: '0700'
+      loop: "{{ [agent_root ~ '/' ~ agent_node, agent_root ~ '/' ~ agent_node ~ '/' ~ agent_tool, agent_profile_directory] + (agent_spec.directories | map('regex_replace', '^', agent_profile_directory ~ '/') | list) }}"
+    # Only what TypeScript names: a file someone edited and the person
+    # adopted, or a managed file that changes.
+    - name: Create the backup directory
+      ansible.builtin.file:
+        path: '{{ agent_root }}/backups'
+        state: directory
+        mode: '0700'
+      when: agent_backups | length > 0
+    - name: Back up a file before it is replaced
+      ansible.builtin.copy:
+        src: '{{ item.source }}'
+        dest: '{{ item.dest }}'
+        remote_src: true
+        force: false
+        mode: '0600'
+      loop: '{{ agent_backups }}'
+      loop_control:
+        label: '{{ item.dest | basename }}'
+    # A rendered file replaces the one in place only when it has the digest
+    # dev-fleet specified: a template that drifted never reaches a machine.
+    - name: Render the configuration files
+      ansible.builtin.template:
+        src: '{{ item.src }}'
+        dest: '{{ agent_profile_directory }}/{{ item.dest }}'
+        mode: '0600'
+        validate: >-
+          {{ ansible_playbook_python | quote }} -c 'import hashlib, sys;
+          sys.exit(None if hashlib.sha256(open(sys.argv[1], "rb").read()).hexdigest() == sys.argv[2]
+          else "AGENT_PROFILE_RENDER_MISMATCH; the template and src/agents/render.ts disagree.")'
+          %s {{ agent_files[item.dest] | quote }}
+      loop: '{{ agent_spec.files }}'
+      loop_control:
+        label: '{{ item.dest }}'
+    - name: Measure what was written
+      ansible.builtin.stat:
+        path: '{{ agent_profile_directory }}/{{ item.dest }}'
+        checksum_algorithm: sha256
+      loop: '{{ agent_spec.files }}'
+      loop_control:
+        label: '{{ item.dest }}'
+      register: agent_written
+      when: not ansible_check_mode
+    - name: Require every file to be byte for byte what dev-fleet specifies
+      ansible.builtin.assert:
+        that:
+          - item.stat.checksum == agent_files[item.item.dest]
+        fail_msg: AGENT_PROFILE_RENDER_MISMATCH; the template and src/agents/render.ts disagree. No receipt was written.
+        quiet: true
+      loop: '{{ agent_written.results }}'
+      loop_control:
+        label: '{{ item.item.dest }}'
+      when: not ansible_check_mode
+    # A template, not copy's content: before 2.19, Ansible turns a task
+    # argument that reads as JSON into data and writes it back reformatted.
+    - name: Record the receipt of the profile
+      ansible.builtin.template:
+        src: receipt.json.j2
+        dest: '{{ agent_profile_directory }}/receipt.json'
+        mode: '0600'

package/ansible/agents/templates/antigravity.settings.json.j2

@@ -0,0 +1,3 @@
+{
+  "modelProvider": "gemini"
+}

package/ansible/agents/templates/claude.settings.json.j2

@@ -0,0 +1,3 @@
+{
+  "model": {{ agent_model | to_json }}
+}

package/ansible/agents/templates/codex.config.toml.j2

@@ -0,0 +1,11 @@
+model = {{ agent_model | to_json }}
+{% if agent_profile == 'proxy' %}
+model_provider = "personal_proxy"
+[model_providers.personal_proxy]
+name = "Personal CLI Proxy"
+base_url = {{ (agent_proxy_endpoint ~ '/v1') | to_json }}
+env_key = "CLIPROXY_API_KEY"
+wire_api = "responses"
+requires_openai_auth = false
+supports_websockets = false
+{% endif %}

package/ansible/agents/templates/gemini.settings.json.j2

@@ -0,0 +1,14 @@
+{
+  "model": {
+    "name": {{ agent_model | to_json }}
+{% if agent_profile == 'proxy' %}
+  },
+  "security": {
+    "auth": {
+      "selectedType": "gateway"
+    }
+  }
+{% else %}
+  }
+{% endif %}
+}

package/ansible/agents/templates/grok.config.toml.j2

@@ -0,0 +1,19 @@
+[cli]
+auto_update = false
+
+[marketplace]
+default_skills_installs_purged = true
+
+[models]
+{% if agent_profile == 'proxy' %}
+default = "personal-proxy"
+
+[model.personal-proxy]
+model = {{ agent_model | to_json }}
+name = {{ (agent_model ~ ' (Personal CLI Proxy)') | to_json }}
+base_url = {{ (agent_proxy_endpoint ~ '/v1') | to_json }}
+env_key = "CLIPROXY_API_KEY"
+api_backend = "chat_completions"
+{% else %}
+default = {{ agent_model | to_json }}
+{% endif %}

package/ansible/agents/templates/opencode.json.j2

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+{% if agent_profile == 'proxy' %}
+  "model": {{ ('personal_proxy/' ~ agent_model) | to_json }},
+  "provider": {
+    "personal_proxy": {
+      "npm": "@ai-sdk/openai",
+      "options": {
+        "baseURL": {{ (agent_proxy_endpoint ~ '/v1') | to_json }},
+        "apiKey": "{env:CLIPROXY_API_KEY}"
+      },
+      "models": {
+{% for id in (agent_proxy_models + [agent_model]) | unique %}
+        {{ id | to_json }}: {
+          "name": {{ id | to_json }}
+        }{{ '' if loop.last else ',' }}
+{% endfor %}
+      }
+    }
+  }
+{% else %}
+  "model": {{ agent_model | to_json }}
+{% endif %}
+}

package/ansible/agents/templates/receipt.json.j2

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "revision": {{ agent_revision | to_json }},
+  "fingerprint": {{ agent_fingerprint | to_json }},
+  "files": {
+{% for name, sha256 in agent_files.items() %}
+    {{ name | to_json }}: {{ sha256 | to_json }}{{ '' if loop.last else ',' }}
+{% endfor %}
+  }
+}

package/ansible/ansible.cfg

@@ -0,0 +1,14 @@
+# How Ansible reaches a machine over SSH. dev-fleet points ANSIBLE_CONFIG at
+# this file for every run (src/platform/ansible.ts), so no ansible.cfg of the
+# operator's or of the working directory changes it. The SSH options
+# themselves (strict host-key checking, keepalives, connection attempts, the
+# fleet-owned known_hosts, user and port) come from src/ssh-connection.ts
+# through the inventory, the same list every direct session takes, so the two
+# cannot drift. Playbooks that run on the machine itself use no SSH at all.
+[defaults]
+timeout = 10
+
+[ssh_connection]
+retries = 3
+pipelining = True
+ssh_args = -o ControlMaster=auto -o ControlPersist=60s

package/ansible/github/git.yml

@@ -14,6 +14,11 @@
     # gh answers for GitHub through the pinned toolchain's shim, so any
     # session's PATH works.
     git_credential_helper: "!'{{ git_home }}/.local/share/mise/shims/gh' auth git-credential"
+    # Optional commit signing (git.signing in fleet.json): each node signs
+    # with an SSH key of its own, made on the node. The private key never
+    # leaves it and is never in fleet.json, a variable or argv.
+    git_signs: "{{ git_signing | default('') == 'ssh' }}"
+    git_signing_key: '{{ git_home }}/.ssh/dev-fleet-git-signing'
   tasks:
     - name: Require a declared identity
       ansible.builtin.assert:
@@ -64,3 +69,80 @@
           - git_effective.results[2].stdout_lines | default([]) | last | default('') == git_credential_helper
         fail_msg: GIT_IDENTITY_OVERRIDDEN; another Git configuration (often ~/.gitconfig) sets user.name, user.email or the GitHub credential helper after dev-fleet's. Remove those lines.
       when: not ansible_check_mode
+    - name: Create the per-user SSH directory for the signing key
+      ansible.builtin.file:
+        path: '{{ git_home }}/.ssh'
+        state: directory
+        mode: '0700'
+      when: git_signs | bool
+    - name: Make this node's own commit signing key, once
+      ansible.builtin.command:
+        argv:
+          - ssh-keygen
+          - -q
+          - -t
+          - ed25519
+          - -N
+          - ''
+          - -C
+          - dev-fleet git signing
+          - -f
+          - '{{ git_signing_key }}'
+        creates: '{{ git_signing_key }}'
+      when: git_signs | bool
+    - name: Inspect the public half of the signing key
+      ansible.builtin.stat:
+        path: '{{ git_signing_key }}.pub'
+      register: git_signing_public_file
+      when: git_signs | bool
+    - name: Read the public half of the signing key
+      ansible.builtin.slurp:
+        src: '{{ git_signing_key }}.pub'
+      register: git_signing_public
+      when: git_signs | bool and git_signing_public_file.stat.exists
+    - name: Name the node's own key as the signer of the declared identity
+      ansible.builtin.copy:
+        dest: '{{ git_home }}/.config/git/allowed_signers'
+        content: "{{ git_email }} namespaces=\"git\" {{ git_signing_public.content | b64decode | trim }}\n"
+        mode: '0600'
+      when: git_signing_public is not skipped
+    - name: Sign every commit and tag with the node's own key, or stop signing
+      ansible.builtin.blockinfile:
+        path: '{{ git_config }}'
+        create: true
+        mode: '0600'
+        marker: '# {mark} dev-fleet: commit signing'
+        state: "{{ 'present' if git_signs | bool else 'absent' }}"
+        block: |
+          [gpg]
+          	format = ssh
+          [gpg "ssh"]
+          	allowedSignersFile = {{ git_home }}/.config/git/allowed_signers
+          [user]
+          	signingkey = {{ git_signing_key }}.pub
+          [commit]
+          	gpgsign = true
+          [tag]
+          	gpgsign = true
+    - name: Read the effective signing configuration
+      ansible.builtin.command:
+        argv: [git, config, --global, --get-all, '{{ item }}']
+      environment:
+        HOME: '{{ git_home }}'
+      loop:
+        - gpg.format
+        - user.signingkey
+        - commit.gpgsign
+      register: git_signing_effective
+      check_mode: false
+      changed_when: false
+      failed_when: false
+      when: git_signs | bool
+    - name: Require the node's own key to sign every commit (worker:git-signing)
+      ansible.builtin.assert:
+        that:
+          - git_signing_effective.results[0].stdout_lines | default([]) | last | default('') == 'ssh'
+          - git_signing_effective.results[1].stdout_lines | default([]) | last | default('') == git_signing_key + '.pub'
+          - git_signing_effective.results[2].stdout_lines | default([]) | last | default('') == 'true'
+        fail_msg: GIT_SIGNING_OVERRIDDEN; another Git configuration (often ~/.gitconfig) sets gpg.format, user.signingkey or commit.gpgsign after dev-fleet's. Remove those lines.
+      when: git_signs | bool and not ansible_check_mode

package/ansible/macos/manager-privilege.yml

@@ -1,17 +1,30 @@
 ---
-# The one privilege grant a manager needs, given once by its administrator:
+# What a manager needs from root, given once by its administrator:
 #   ansible-playbook -K manager-privilege.yml -e user=$(id -un)
-# It lets that user run exactly `pmset -c` (the AC power settings
-# manager.yml declares) without a password, so every fleet-sync holds the
-# manager's power policy with no prompt. Run again with -e grant=absent to
-# remove it; nothing else on the manager needs root.
-- name: Grant the fleet manager its power settings without a prompt
+# - a sudoers rule that lets that user run exactly `pmset -c` (the AC power
+#   settings manager.yml declares) and read whether network time is on
+#   (`systemsetup -getusingnetworktime`, manager:clock), without a password,
+#   so every fleet-sync holds and measures them with no prompt;
+# - a newsyslog drop-in that keeps the logs of the manager's scheduled jobs
+#   (fleet-sync --schedule and fleet-watch) under the size jobLogs in
+#   policy.json names. newsyslog runs as root, so it is installed here and
+#   measured by manager:job-logs;
+# - the fleet's T3 administrator policy (t3-policy.yml), measured by
+#   t3:updates.
+# Run it again after an upgrade when manager:clock or manager:job-logs says
+# so, or with -e grant=absent to remove both; nothing else on the manager
+# needs root.
+- name: Grant the fleet manager its power settings and job log rotation
   hosts: localhost
   connection: local
   become: true
   gather_facts: false
+  vars_files:
+    - policy.json
   vars:
     grant: present
+    manager_home: "{{ ('~' ~ user) | expanduser }}"
+    job_log_directory: '{{ manager_home }}/{{ jobLogs.directory }}'
   tasks:
     - name: Check the request
       ansible.builtin.assert:
@@ -19,19 +32,52 @@
           - "user is match('^[a-z_][a-z0-9_.-]{0,31}$')"
           - "user != 'root'"
           - "grant in ['present', 'absent']"
-    - name: Allow exactly the AC power settings
+          - "manager_home is match('^/')"
+    - name: Allow exactly the AC power settings and the network time reading
       ansible.builtin.copy:
         dest: '/etc/sudoers.d/dev-fleet-manager-{{ user }}'
         content: |
           # Managed by dev-fleet: manager power policy
           {{ user }} ALL=(root) NOPASSWD: /usr/bin/pmset -c *
+          {{ user }} ALL=(root) NOPASSWD: /usr/sbin/systemsetup -getusingnetworktime
         owner: root
         group: wheel
         mode: '0440'
         validate: /usr/sbin/visudo -cf %s
       when: grant == 'present'
-    - name: Remove the grant
+    - name: Read the manager user's group
+      ansible.builtin.command:
+        argv: [/usr/bin/id, -gn, '{{ user }}']
+      changed_when: false
+      check_mode: false
+      register: manager_group
+      when: grant == 'present'
+    # newsyslog rotates a log once it is larger than the size given (in KiB),
+    # keeps that many compressed archives, and signals nothing (N): launchd
+    # opens the log again for every run of the job.
+    - name: Rotate the logs of the manager's scheduled jobs
+      ansible.builtin.copy:
+        dest: '/etc/newsyslog.d/dev-fleet-{{ user }}.conf'
+        content: |
+          # Managed by dev-fleet: manager job logs
+          # logfilename  [owner:group]  mode  count  size(KiB)  when  flags
+          {{ job_log_directory }}/{{ fleetSync.label }}.out.log {{ user }}:{{ manager_group.stdout }} 600 {{ jobLogs.keep }} {{ jobLogs.maxKiB }} * NZ
+          {{ job_log_directory }}/{{ fleetSync.label }}.err.log {{ user }}:{{ manager_group.stdout }} 600 {{ jobLogs.keep }} {{ jobLogs.maxKiB }} * NZ
+          {{ job_log_directory }}/{{ fleetWatch.label }}.out.log {{ user }}:{{ manager_group.stdout }} 600 {{ jobLogs.keep }} {{ jobLogs.maxKiB }} * NZ
+          {{ job_log_directory }}/{{ fleetWatch.label }}.err.log {{ user }}:{{ manager_group.stdout }} 600 {{ jobLogs.keep }} {{ jobLogs.maxKiB }} * NZ
+        owner: root
+        group: wheel
+        mode: '0644'
+        validate: /usr/sbin/newsyslog -n -f %s
+      when: grant == 'present'
+    - name: Remove the grant and the log rotation
       ansible.builtin.file:
-        path: '/etc/sudoers.d/dev-fleet-manager-{{ user }}'
+        path: '{{ item }}'
         state: absent
+      loop:
+        - '/etc/sudoers.d/dev-fleet-manager-{{ user }}'
+        - '/etc/newsyslog.d/dev-fleet-{{ user }}.conf'
       when: grant == 'absent'
+
+- name: Stage the fleet's T3 policy
+  ansible.builtin.import_playbook: t3-policy.yml