rosotacom-dev 2.5.dev1__tar.gz → 2.5.dev3__tar.gz

{rosotacom_dev-2.5.dev1 → rosotacom_dev-2.5.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev1
+Version: 2.5.dev3
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause

rosotacom_dev-2.5.dev3/docs/github-repository-settings.md

@@ -0,0 +1,155 @@
+# GitHub Repository Settings
+
+These settings live outside git and must be verified separately in every
+repository using this shared codebase. The GitHub UI, CLI, and API remain the
+live source of truth.
+
+## Branch Protection
+
+Expected shared state:
+
+- `main` is the protected release line.
+- The repository's active development/default branch is protected.
+- Pull requests are required.
+- The required status check is `ci-success` — the aggregate gate job in
+  `pr-merge-gate.yml`, not the individual lanes. It `needs` all of them and runs
+  under `if: always()`, so it turns red rather than vanishing when one fails.
+  Requiring the lanes individually would mean editing this ruleset every time
+  CI gains or renames a job; requiring the aggregate means CI can change shape
+  without the ruleset drifting.
+- "Require branches to be up to date before merging" (`strict`) is **off**. With
+  auto-merge enabled it would make every merge invalidate all other open PRs,
+  each then waiting for a rebase.
+- The bypass list contains the Repository role `admin` and nothing else, so the
+  owner is not locked out by a stuck check while the agent account still cannot
+  merge around one. See "Identities" below.
+- Squash merges are allowed.
+- CodeQL default setup is enabled for Actions and Python.
+- The `release` environment and `PYPI_PUBLISH_URL` variable point at this
+  repository's intended package index.
+
+Verify:
+
+```bash
+REPO="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"
+DEFAULT_BRANCH="$(gh repo view --repo "$REPO" --json defaultBranchRef --jq .defaultBranchRef.name)"
+gh ruleset list --repo "$REPO" --parents
+gh ruleset check "$DEFAULT_BRANCH" --repo "$REPO"
+gh ruleset check main --repo "$REPO"
+gh api "repos/$REPO/code-scanning/default-setup"
+gh variable get PYPI_PUBLISH_URL --repo "$REPO"
+
+# the two rules most likely to drift back, read straight from the ruleset
+gh api "repos/$REPO/rulesets/$(gh api "repos/$REPO/rulesets" --jq '.[0].id')" \
+  --jq '{bypass: [.bypass_actors[].actor_type],
+         checks: [.rules[] | select(.type=="required_status_checks")
+                  | .parameters.required_status_checks[].context],
+         strict: [.rules[] | select(.type=="required_status_checks")
+                  | .parameters.strict_required_status_checks_policy]}'
+
+# who acts on the repository, and with what
+gh api "repos/$REPO/collaborators" --jq '.[] | "\(.login) \(.role_name)"'
+```
+
+`gh ruleset check` reports which rules apply, not which status checks they
+require. A ruleset can be named for CI and still carry no
+`required_status_checks` rule, in which case auto-merge will merge a pull
+request whose checks are red. Read the rule types out directly:
+
+```bash
+gh api "repos/$REPO/rulesets" --jq '.[].id' \
+  | xargs -I{} gh api "repos/$REPO/rulesets/{}" \
+      --jq '{name, rules: [.rules[] | select(.type=="required_status_checks")
+             | .parameters.required_status_checks[].context]}'
+```
+
+Expected output names `ci-success`. An empty list is the drift this section
+exists to catch.
+
+## Trusted Publishers
+
+PyPI authorizes an upload by matching the OIDC claims of the *workflow file*
+that requests it, so a publisher registration is per filename, not per
+repository. This codebase publishes from two:
+
+| Workflow | Publishes | Registration |
+|---|---|---|
+| `release.yml` | stable `vX.Y.Z` tags | required |
+| `dev-release.yml` | `X.Y.devN` from the development branch | required for the development channel |
+
+A missing registration fails at upload with `invalid-publisher: valid token, but
+no corresponding publisher`, after a completely successful build. The message
+prints the claims it presented; `workflow_ref` is the filename to register.
+
+Register on PyPI under the project's *Publishing* settings: owner, repository,
+the workflow filename, and an empty environment (this codebase deliberately uses
+no GitHub environment, so that no repository sharing it needs environment-admin
+rights).
+
+## Identities
+
+Two accounts act on this repository, and the difference between them is the
+point: work done by an agent must be attributable and must not be able to
+change the rules it runs under.
+
+| | `develNor` | `develNor-agent` |
+|---|---|---|
+| Relation | owner | collaborator |
+| Repository permission | admin | write |
+| Ruleset bypass | yes (Repository role `admin`) | no |
+| Credential | interactive login | classic PAT in `.agents/github.env` |
+
+**A personal repository has no role picker.** Adding a collaborator to a
+repository owned by a user — as opposed to an organization — grants write, with
+no read/triage/maintain/admin choice offered. So the owner/agent boundary is not
+drawn by the collaborator entry; it is drawn by two things that *are*
+configurable: the agent is not admin, and the ruleset's bypass list names the
+`admin` role only. An agent therefore cannot merge without `ci-success`, cannot
+force-push, and cannot edit the ruleset that says so.
+
+**Pushing must use HTTPS.** `origin` is an SSH URL, and SSH authenticates by
+key, not by token: with an SSH remote every push lands under whoever owns the
+key, no matter which `GH_TOKEN` is set. An agent push must therefore name an
+HTTPS URL carrying its own PAT. Getting this wrong is silent — the push
+succeeds, under the wrong name.
+
+```bash
+set -a; . .agents/github.env; set +a
+git push "https://${GITHUB_USER}:${GITHUB_PAT_CLASSIC}@github.com/develNor/ros_communication_devcontainer.git" HEAD
+```
+
+**What the agent can verify for itself.** A write collaborator reads more repo
+settings than expected, which is what makes autonomous advice about them
+possible. Measured against this repository:
+
+| Endpoint | agent | owner |
+|---|---|---|
+| `rulesets` | yes | yes |
+| `actions/variables`, `actions/secrets` (names) | yes | yes |
+| `environments` | yes | yes |
+| merge settings (`allow_auto_merge`, …) | yes | yes |
+| `actions/permissions/workflow` | **403** | yes |
+| `vulnerability-alerts` | **404** | yes |
+| `hooks` | **404** | yes |
+| `security_and_analysis` on the repo object | **null** | yes |
+
+Scope is not the limit here — the PAT already carries `read:repo_hook` and still
+gets 404 on `hooks`, because repository role decides, not token scope. The four
+denied items are all owner-only checks; an agent asked to audit them should say
+so rather than report an absent value as a finding.
+
+## Repository Metadata
+
+Expected topics include `ros2`, `docker`, `robotics`, `teleoperation`, and
+`communication`.
+
+Verify:
+
+```bash
+gh repo view --json description,homepageUrl,repositoryTopics
+```
+
+## Drift Handling
+
+If GitHub state differs from this document, either update the live setting to
+match the documented contract or update this document in a PR if policy changed.

{rosotacom_dev-2.5.dev1 → rosotacom_dev-2.5.dev3}/src/rosotacom/cli.py

@@ -98,7 +98,19 @@ SESSION_CONFIG_CONTAINER_DIR = "/session/configs"
 SESSION_DEFINITION_CONTAINER_DIR = "/session/definitions"
 SESSION_INSTANCE_CONTAINER_DIR = "/session/instances"
 EXTERNAL_SESSION_CONTAINER_DIR = "/session/current"
-RUN_SESSION_CONTAINER_PATH = "/ws/session/creation/run_session.py"
+# Run through the interpreter, never as a bare path. `docker exec` on a bare
+# path relies on the file's executable bit, and a wheel does not carry
+# executable bits for package data: the bit is present in a checkout and gone
+# after an install. Every packaged machine therefore failed with
+# `exec: "/ws/session/creation/run_session.py": permission denied` and exit 126,
+# while the development laptop — an editable install over the checkout — worked.
+# That is the one shape no test exercised, and the only shape a control centre,
+# a vehicle or a bench machine ever runs.
+#
+# Not relying on the bit beats making the bit survive packaging: one is a
+# property of this command, the other a property of every tool in the chain.
+# `anonymize_bag.py` two thousand lines below already does it this way.
+RUN_SESSION_CONTAINER_ARGV = ("python3", "/ws/session/creation/run_session.py")
 DEFAULT_SMOKE_SESSION = "1_heartbeat"
 OTA_SUDO_MODES = ("passwordless", "askpass")
 
@@ -4299,7 +4311,7 @@ def _session_command(
     link_trace_modem_command: str | None = None,
 ) -> list[str]:
     parts = [
-        RUN_SESSION_CONTAINER_PATH,
+        *RUN_SESSION_CONTAINER_ARGV,
         "--session-dir",
         session.container_dir,
         "--output-dir",

{rosotacom_dev-2.5.dev1 → rosotacom_dev-2.5.dev3}/src/rosotacom_dev.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev1
+Version: 2.5.dev3
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause

rosotacom_dev-2.5.dev3/src/rosotacom_dev.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.4",
+  "distance": 3,
+  "node": "g07f0fe6e171dd825cb669cb2bb14ca0ee6fb0b98",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-08-09"
+}

{rosotacom_dev-2.5.dev1 → rosotacom_dev-2.5.dev3}/tests/unit/test_cli.py

@@ -1759,6 +1759,7 @@ def test_peer_binding_identity_and_command_helpers(tmp_path: Path, monkeypatch:
         peer_address_overrides={"a": "10.0.0.1", "b": "10.0.0.2"},
         attach_mode="attach",
     ) == [
+        "python3",
         "/ws/session/creation/run_session.py",
         "--session-dir",
         "/session/current",
@@ -1801,6 +1802,41 @@ def test_peer_binding_identity_and_command_helpers(tmp_path: Path, monkeypatch:
         rosotacom._parse_peer_address_overrides(["a=1.1.1.1", "a=2.2.2.2"])
 
 
+def test_container_scripts_run_through_the_interpreter() -> None:
+    """No `docker exec` may depend on a file's executable bit.
+
+    A wheel does not carry executable bits for package data, so a bare script
+    path works from a checkout and fails from an install with
+
+        exec: "/ws/session/creation/run_session.py": permission denied
+
+    and exit 126. That broke `rosotacom start` on every packaged machine —
+    bench, control centre, vehicle — while the development laptop's editable
+    install kept working, which is why it survived to a two-host bring-up on
+    2026-08-09 before anyone saw it.
+
+    Asserted as a property rather than as one literal command, so a second
+    script added later fails here instead of on a machine.
+    """
+    assert rosotacom.RUN_SESSION_CONTAINER_ARGV[0] == "python3"
+    assert rosotacom.RUN_SESSION_CONTAINER_ARGV[1].endswith("/run_session.py")
+
+    # And the same for any container script added later. Comment lines are
+    # dropped first: the explanation above quotes the failing path, and a test
+    # that reads prose as code would fail on the wrong thing.
+    code = "\n".join(
+        line
+        for line in Path(rosotacom.__file__).read_text(encoding="utf-8").splitlines()
+        if not line.lstrip().startswith("#")
+    )
+    for match in re.finditer(r'"(/ws/[^"]*\.py)"', code):
+        preceding = code[max(0, match.start() - 200) : match.start()]
+        assert '"python3"' in preceding, (
+            f"{match.group(1)} is handed to the container without an interpreter; "
+            "a wheel install has no executable bit and this fails with exit 126"
+        )
+
+
 def test_resolve_session_and_base_extra_run_args(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     session = tmp_path / "sessions" / "1_heartbeat"
     session.mkdir(parents=True)

rosotacom_dev-2.5.dev1/docs/github-repository-settings.md

@@ -1,81 +0,0 @@
-# GitHub Repository Settings
-
-These settings live outside git and must be verified separately in every
-repository using this shared codebase. The GitHub UI, CLI, and API remain the
-live source of truth.
-
-## Branch Protection
-
-Expected shared state:
-
-- `main` is the protected release line.
-- The repository's active development/default branch is protected.
-- Pull requests are required.
-- The required status check is `ci-success`.
-- Squash merges are allowed.
-- CodeQL default setup is enabled for Actions and Python.
-- The `release` environment and `PYPI_PUBLISH_URL` variable point at this
-  repository's intended package index.
-
-Verify:
-
-```bash
-REPO="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"
-DEFAULT_BRANCH="$(gh repo view --repo "$REPO" --json defaultBranchRef --jq .defaultBranchRef.name)"
-gh ruleset list --repo "$REPO" --parents
-gh ruleset check "$DEFAULT_BRANCH" --repo "$REPO"
-gh ruleset check main --repo "$REPO"
-gh api "repos/$REPO/code-scanning/default-setup"
-gh variable get PYPI_PUBLISH_URL --repo "$REPO"
-```
-
-`gh ruleset check` reports which rules apply, not which status checks they
-require. A ruleset can be named for CI and still carry no
-`required_status_checks` rule, in which case auto-merge will merge a pull
-request whose checks are red. Read the rule types out directly:
-
-```bash
-gh api "repos/$REPO/rulesets" --jq '.[].id' \
-  | xargs -I{} gh api "repos/$REPO/rulesets/{}" \
-      --jq '{name, rules: [.rules[] | select(.type=="required_status_checks")
-             | .parameters.required_status_checks[].context]}'
-```
-
-Expected output names `ci-success`. An empty list is the drift this section
-exists to catch.
-
-## Trusted Publishers
-
-PyPI authorizes an upload by matching the OIDC claims of the *workflow file*
-that requests it, so a publisher registration is per filename, not per
-repository. This codebase publishes from two:
-
-| Workflow | Publishes | Registration |
-|---|---|---|
-| `release.yml` | stable `vX.Y.Z` tags | required |
-| `dev-release.yml` | `X.Y.devN` from the development branch | required for the development channel |
-
-A missing registration fails at upload with `invalid-publisher: valid token, but
-no corresponding publisher`, after a completely successful build. The message
-prints the claims it presented; `workflow_ref` is the filename to register.
-
-Register on PyPI under the project's *Publishing* settings: owner, repository,
-the workflow filename, and an empty environment (this codebase deliberately uses
-no GitHub environment, so that no repository sharing it needs environment-admin
-rights).
-
-## Repository Metadata
-
-Expected topics include `ros2`, `docker`, `robotics`, `teleoperation`, and
-`communication`.
-
-Verify:
-
-```bash
-gh repo view --json description,homepageUrl,repositoryTopics
-```
-
-## Drift Handling
-
-If GitHub state differs from this document, either update the live setting to
-match the documented contract or update this document in a PR if policy changed.

rosotacom_dev-2.5.dev1/src/rosotacom_dev.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "2.4",
-  "distance": 1,
-  "node": "ga1220fae8fd4fb89add803f4548e99a2c8dce0fd",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-08-07"
-}