omp-conductor 0.4.4 → 0.5.0

package/src/verbs/server.ts

@@ -57,15 +57,6 @@ import {
   type SocketOwnership,
 } from "./socket.ts";
 
-/**
- * The OS principal a run was allocated (#125).
- *
- * Imported as a type from the credential boundary rather than redeclared, so
- * there is one definition of "which uid is this run": a second copy is a second
- * place identity is decided, which is the bug both issues exist to remove.
- */
-import type { SlotPrincipal } from "../credentials.ts";
-
 /**
  * How long a merge lock may be held before another daemon may break it.
  *
@@ -101,17 +92,15 @@ export type VerbChannel =
       issue: number;
       /** The routed checkout, for the privileged push/PR half. */
       repo: RepoTarget;
-      /** The run's own repository on disk (#125's per-run clone). */
+      /** The run's own repository on disk. */
       runRepoPath: string;
       branch: string;
-      principal?: SlotPrincipal;
     }
   | {
       kind: "orchestrator";
       path: string;
       project: string;
       role: "orchestrator";
-      principal?: SlotPrincipal;
     };
 
 export type ActionOutcome = { ok: true; sha?: string; detail?: string } | { ok: false; stderr: string };
@@ -978,20 +967,6 @@ export async function listenVerbChannel(
         "owned by the daemon (or root), free of symlinks, and unwritable by anyone else.",
     );
   }
-  // Traversal, proven rather than assumed, and only when it can actually fail:
-  // a run with its own principal reaches this socket by searching every
-  // component, and the daemon's state directory is 0700. Refusing here names
-  // the directory and the fix; letting it bind would produce an EACCES inside
-  // a worker turn, about a path nobody was thinking about.
-  if (channel.principal !== undefined) {
-    const blocked = (opts.traversal ?? traversalProblem)(channel.path);
-    if (blocked !== undefined) {
-      throw new VerbSocketRefusal(
-        `dispatch refused: ${blocked.message}. This run has its own OS principal, so it must be able to ` +
-          "traverse to its socket; binding one it cannot reach would take its verbs away silently.",
-      );
-    }
-  }
   // Only the daemon ever unlinks these, and it has just proven the parent is
   // not writable by anyone else — which is what makes unlink-then-bind safe
   // here and a race in a world-writable directory.
@@ -1013,7 +988,7 @@ export async function listenVerbChannel(
   });
 
   const secure = opts.secure ?? secureBoundSocket;
-  const ownership = secure(channel.path, channel.principal);
+  const ownership = secure(channel.path);
 
   return {
     path: channel.path,
@@ -1037,7 +1012,7 @@ function handleConnection(
 ): void {
   const fd = socketFd(socket);
   const peer = fd === undefined || peerReader === undefined ? undefined : peerReader(fd);
-  const verdict = peerVerdict(channel.principal, peer);
+  const verdict = peerVerdict({ uid: process.getuid?.() ?? 0 }, peer);
   if (!verdict.ok) {
     // Not a client error, and deliberately not answered: a caller who is not
     // who the socket was allocated to gets no reply to calibrate against.

package/src/verbs/socket.ts

@@ -256,26 +256,22 @@ export function unlinkStaleSocket(path: string): void {
 }
 
 /**
- * Hand a bound socket to its run's principal.
+ * Restrict a bound socket to the daemon's own uid.
  *
- * Returns which guarantee is actually in force, because #126 asks the daemon to
- * *state* its mechanism at startup rather than guess: with a principal the
- * socket is one-uid; without one it is one-user, and the parent's `0711` plus
- * the unguessable suffix are the whole story. Saying which is the difference
- * between an audited boundary and a hopeful one.
+ * Returns the guarantee in force, because #126 asks the daemon to *state* its
+ * mechanism at startup rather than guess: the socket is `0600` under a `0711`
+ * daemon-owned parent, so it is one-user, and the unguessable suffix plus that
+ * parent are the whole story. Saying so is the difference between an audited
+ * boundary and a hopeful one.
  */
-export type SocketOwnership = "run-principal" | "daemon-user";
+export type SocketOwnership = "daemon-user";
 
 export function secureBoundSocket(
   path: string,
-  principal: { uid: number; gid: number } | undefined,
   chmod: (p: string, mode: number) => void = chmodSync,
-  chown: (p: string, uid: number, gid: number) => void = chownSync,
 ): SocketOwnership {
   chmod(path, VERB_SOCKET_MODE);
-  if (principal === undefined) return "daemon-user";
-  chown(path, principal.uid, principal.gid);
-  return "run-principal";
+  return "daemon-user";
 }
 
 export interface PeerCredentials {
@@ -406,14 +402,14 @@ export function peerVerdict(
     return {
       ok: true,
       basis: "socket-ownership",
-      why: "this run has no distinct OS principal, so peer uid cannot tell two runs apart; the 0600 socket under the daemon-owned 0711 parent is the whole boundary",
+      why: "no uid was named for this socket, so the 0600 mode under the daemon-owned 0711 parent is the whole boundary",
     };
   }
   if (peer === undefined) {
     return {
       ok: true,
       basis: "socket-ownership",
-      why: "this host exposes no peer credentials, so the 0600 socket owned by the run principal is the whole boundary",
+      why: "this host exposes no peer credentials, so the 0600 socket under the daemon-owned 0711 parent is the whole boundary",
     };
   }
   if (peer.uid !== expected.uid) {
@@ -428,19 +424,15 @@ export function peerVerdict(
 }
 
 /** One line naming what the transport can actually enforce on this host. */
-export function transportBanner(
-  dir: string,
-  peerReader: PeerReader | undefined,
-  principals: boolean,
-): string {
+export function transportBanner(dir: string, peerReader: PeerReader | undefined): string {
   const peers =
     peerReader === undefined
       ? `no peer-credential call on ${process.platform}`
       : process.platform === "darwin"
         ? "peer uid asserted with getpeereid"
         : "peer uid asserted with SO_PEERCRED";
-  const owners = principals
-    ? "each socket 0600 and chowned to its run principal"
-    : "each socket 0600 under the daemon's own uid (no per-run principals on this host)";
-  return `verb sockets in ${dir} (mode ${VERB_DIR_MODE.toString(8)}); ${owners}; ${peers}`;
+  return (
+    `verb sockets in ${dir} (mode ${VERB_DIR_MODE.toString(8)}); ` +
+    `each socket 0600 under the daemon's own uid; ${peers}`
+  );
 }

package/src/worker.ts

@@ -10,7 +10,6 @@
  * sliding into a merge queue.
  */
 
-import type { SessionBoundary } from "./credentials.ts";
 import { createSession, disposeSession } from "./omp.ts";
 import type { Caps, ReleaseShape, ResolvedGrants, RunState } from "./types.ts";
 
@@ -54,17 +53,7 @@ export interface WorkerOpts {
   releaseGrants?: ResolvedGrants;
   /** Durable audit sink for rejected release/deploy calls. */
   onReleaseBlocked?: (shape: ReleaseShape) => void;
-  /**
-   * The OS principal this run's session executes as (#125). The worker does not
-   * interpret it — it hands it to {@link createSession}, which is where the
-   * launcher lives. Omitted, the session is still a child process but runs as
-   * the daemon's own user: that is A1's shape and carries no security claim.
-   */
-  boundary?: SessionBoundary;
-  /**
-   * Control socket for that child. The daemon puts it inside the run's own
-   * boundary root, because a slot principal has to be able to reach it.
-   */
+  /** Control socket for that child, beside the run's own session directory. */
   socketPath?: string;
   /**
    * The run's conductor verb socket (#126) — its only route to a push, a PR or
@@ -206,7 +195,6 @@ export async function runWorker(
     role: "worker",
     ...(o.releaseGrants === undefined ? {} : { releaseGrants: o.releaseGrants }),
     ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
-    ...(o.boundary === undefined ? {} : { boundary: o.boundary }),
     ...(o.socketPath === undefined ? {} : { socketPath: o.socketPath }),
     ...(o.verbSocketPath === undefined ? {} : { verbSocketPath: o.verbSocketPath }),
     ...(o.onChildLog === undefined ? {} : { onChildLog: o.onChildLog }),

package/src/worktree.ts

@@ -17,7 +17,7 @@
  * the price of not cloning the repo per run.
  *
  * Publishing is therefore the daemon's job, never the worker's — see
- * `pushRunBranch` in `credentials.ts`. The run repo's `origin` deliberately
+ * `pushRunBranch` in `gitops.ts`. The run repo's `origin` deliberately
  * names the real clone URL rather than the mirror, so a worker's
  * `git push origin HEAD` attempts the network and fails on credentials instead
  * of quietly succeeding into the shared object store.
@@ -26,7 +26,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
-import { credentialedEnv, scrubUserinfo } from "./credentials.ts";
+import { credentialedEnv, scrubUserinfo } from "./gitops.ts";
 import type { RepoTarget } from "./types.ts";
 
 /**
@@ -312,7 +312,7 @@ export async function addRunRepo(
   branch: string,
 ): Promise<{ path: string; reattached: boolean }> {
   const mirrorPath = await ensureMirror(repo, mirrorRoot);
-  // 0711: searchable, so a slot principal can reach its own checkout; not
+  // 0711: searchable, so a session reaches its own checkout by name; not
   // listable, so it cannot enumerate its siblings; not writable, so it cannot
   // create or unlink one. Same reasoning as the socket parent directory.
   mkdirSync(workspaceRoot, { recursive: true, mode: 0o711 });
@@ -418,7 +418,7 @@ export async function addRunRepo(
  *
  * Declared here as a function type rather than imported as a concrete
  * implementation so this module stays free of the credential path: provisioning
- * and salvage decide *what* to publish, `credentials.ts` is the only place that
+ * and salvage decide *what* to publish, `gitops.ts` is the only place that
  * decides *how*, and the daemon is the only thing that holds both.
  */
 export type RunPublisher = (

package/systemd/omp-conductor.service.example

@@ -1,13 +1,12 @@
 # Example unit for a supervised omp-conductor daemon.
 #
 # Why MemoryMax exists: worker and orchestrator sessions are child processes of
-# this service (#125 moved them out of the daemon's own process so they can run
-# as a different OS principal). They stay in this unit's cgroup, so MemoryMax
-# still governs the fleet's total footprint — it is just no longer a ceiling on
-# one process. With the default two workers plus the orchestrator session,
-# journald on a reference 7.6 GB host recorded Memory peaks of ~3.2–4.2 GB for
-# this unit (issue #51). That is expected load, not a leak — and on a shared VPS
-# it is enough to thrash swap or OOM the daemon mid-flight (orphan path).
+# this service and stay inside its cgroup, so MemoryMax governs the whole
+# fleet's footprint rather than one process. With the default two workers plus
+# the orchestrator session, journald on a reference 7.6 GB host recorded Memory
+# peaks of ~3.2–4.2 GB for this unit (issue #51). That is expected load, not a
+# leak — and on a shared VPS it is enough to thrash swap or OOM the daemon
+# mid-flight (orphan path).
 #
 # Before enabling:
 #   1. Set User=/Group=/HOME=/PATH for the account that owns ~/.omp/conductor.
@@ -16,66 +15,6 @@
 #      consider MemoryMax=3G.
 #   4. Do not co-locate ClickHouse + other multi-GB services beside a 2-worker
 #      fleet on a ≤8 GB box.
-#   5. For credentials.isolation=per-run, do the one-time provisioning below.
-#      Without it the daemon runs unprotected (isolation=none) and says so in
-#      `omp-conductor status`.
-#
-# One-time provisioning for credentials.isolation=per-run (#125)
-# --------------------------------------------------------------
-# Model-executed code must not run as the account that holds the GitHub
-# credential. Accounts, groups, a shared root and the daemon's own home mode
-# are what make that true; environment scrubbing is only accident-prevention
-# and does not survive a determined session running as the same uid.
-#
-# Do NOT hand-copy the steps. `omp-conductor boundary-setup` prints the exact
-# idempotent commands, generated from the same constants the startup probe then
-# checks — a hand-maintained copy here would drift from what the daemon demands
-# and fail at first dispatch instead of at provisioning time. It needs no config
-# and must be run BEFORE `setup`, because setup writes worktree and mirror paths
-# into the shared root it creates:
-#
-#   omp-conductor boundary-setup --slots 2       # read what it will do
-#   omp-conductor boundary-setup --slots 2 | sudo bash
-#   sudo systemctl restart omp-conductor.service
-#
-# What it establishes, and why each part is load-bearing:
-#
-#   * conductor-agent-<n> per concurrent slot, plus conductor-agent-orch. The
-#     orchestrator's is distinct so it cannot reach a run checkout, and it is
-#     launched with no supplementary group at all.
-#   * conductor-daemon — the daemon account ONLY. Lets it fetch a run branch,
-#     salvage a killed run and reclaim the tree. A slot principal must NEVER be
-#     in it; that absence is what keeps sibling runs apart, and the probe suite
-#     asserts it from a live session.
-#   * conductor-runs — every slot. Read-only access to the shared mirror that
-#     run repos borrow objects from. A run being able to READ another run's
-#     objects there is the documented residual of sharing one object store.
-#   * /var/lib/omp-conductor, mode 0711 — worktrees, mirrors, per-run session
-#     transcripts and per-run boundary homes. OUTSIDE the state directory,
-#     because that stays 0700 (it holds conductor.db and the WAL SQLite keeps
-#     recreating, so a searchable parent would publish fleet history to every
-#     local account), and outside $HOME for the reason below.
-#   * $HOME at 0711 with credential leaves closed (.ssh, .config/gh 0700;
-#     .npmrc, .git-credentials 0600). Searchable because the runtime and the
-#     installed package live in it — a 0700 home kills every worker before it
-#     connects, and no shell-based probe notices — and closed at the leaves
-#     because that is where the boundary actually rests. The daemon re-checks
-#     this empirically at dispatch and refuses if a slot can read any
-#     credential path.
-#
-# The restart is REQUIRED, not tidiness: supplementary group membership is fixed
-# when a process starts, so without it the daemon's live credentials lack
-# conductor-daemon even though `getent` shows it, and it would chown every run
-# repo to a group it cannot itself use.
-#
-#   # util-linux, for the privilege-dropping launcher. Without it the probe
-#   # reports mechanism `none` — there is deliberately no hand-rolled
-#   # spawn({uid,gid}) fallback, because a child launched that way can hold
-#   # CAP_SETUID and setuid() straight back to a sibling run or to the daemon.
-#   sudo apt-get install -y util-linux
-#
-# Verify with `omp-conductor status`: the `boundary` row names the mechanism
-# that is actually live and lists what it does not close.
 #
 # Install:
 #   sudo install -m 0644 omp-conductor.service.example /etc/systemd/system/omp-conductor.service
@@ -95,35 +34,10 @@ Type=simple
 User=fleet
 Group=fleet
 Environment=HOME=/home/fleet
-# systemd's default PATH has no user installs; include wherever `omp` /
-# `omp-conductor`, `gh` and `setpriv` live on this host.
+# systemd's default PATH has no user installs; include wherever `omp`,
+# `omp-conductor` and `gh` live on this host.
 Environment=PATH=/home/fleet/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin
 
-# These capabilities exist to be DROPPED INTO run children, never inherited by
-# them (#125). The daemon stays the unprivileged `fleet` account — a capability
-# grant on an existing account is a narrower blast radius than running as root
-# or shipping a setuid binary, both of which widen exactly what this exists to
-# narrow.
-#
-# Every run child is launched through `setpriv`, which sets the group list, then
-# the gid, then the uid, empties the permitted/effective/inheritable/ambient
-# capability sets, drops the bounding set, sets PR_SET_NO_NEW_PRIVS, and only
-# then execs. DO NOT "simplify" this into a raw spawn({uid,gid}): ambient
-# capabilities survive execve for ordinary binaries, so a child launched that
-# way holds CAP_SETUID itself and can setuid() back to another principal —
-# including a sibling run's. That voids the entire boundary while appearing to
-# work, which is the worst possible outcome for a security change.
-#
-# CAP_SETPCAP is present solely so the launcher can empty the child's capability
-# BOUNDING set (PR_CAPBSET_DROP requires it in the caller's own permitted set).
-# It is dropped along with everything else before the session child execs. A
-# host that refuses to grant it takes the documented fallback instead: the
-# launcher omits --bounding-set=-all, the child still ends with every other set
-# empty behind NoNewPrivs, and `status` reports the non-empty CapBnd as a named
-# residual rather than ignoring it.
-AmbientCapabilities=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP
-
 WorkingDirectory=/home/fleet
 
 # Foreground daemon so systemd tracks MainPID. `omp-conductor start` backgrounds;