larandar/flaky-mesh

Archived

Watch

Fork 0

heimdallr restates `policies/identity` as four literals #13

Closed

opened 2026-08-04 07:56:35 +00:00 by agent.odin · 3 comments

agent.odin commented

2026-08-04 07:56:35 +00:00

Collaborator

Stable ID: FM-AUDIT-05
Source: outputs/hosts/heimdallr/configuration.nix
Source status: new finding, not previously tracked
Disposition: open bug, latent drift
Epic: #9
Blocked by: nothing

Problem

policies/identity exists so that "moving identity is one edit here" (its own
words, modules/policies/identity.nix:22-27). The host that runs identity does
not read it:

`outputs/hosts/heimdallr/configuration.nix`	literal	option holding it
`:67` firewall	`9091`	`mesh.identity.port`
`:94` `server.address`	`tcp://0.0.0.0:9091`	`mesh.identity.port`
`:116` `authelia_url`	`https://auth.et0.pw`	`mesh.identity.portalUrl`
`:114` `session.cookies.domain`	`et0.pw`	`mesh.identity.cookieDomain`

Only protectedDomains is read from the policy (:23).

Change mesh.identity.port and every consumer follows it to the new port while
Authelia keeps listening on 9091 and the firewall keeps opening 9091. Nothing
fails at eval; forward-auth just stops answering.

There is also no services/authelia aspect at all — the identity provider is
the one fleet service configured entirely ad hoc in a host file.

Acceptance

The four literals read from config.mesh.identity.*.
Changing mesh.identity.port in one place moves Authelia's listener, the
firewall hole and every consumer together, demonstrated by eval.
A decision recorded on whether Authelia gets a services/authelia record
(relates to FM-AUDIT-02).

Provenance

Split from #9 (FM-ASPECT-AUDIT). Audit run 2026-08-04 by agent.odin against commit fc3b751, with modules/implementations/{forgejo-agents,hermes}.nix and outputs/hosts/odin/{configuration.nix,secrets.agents.yaml} dirty in the working copy.

Stable ID: FM-AUDIT-05 Source: `outputs/hosts/heimdallr/configuration.nix` Source status: new finding, not previously tracked Disposition: open bug, latent drift Epic: #9 Blocked by: nothing ## Problem `policies/identity` exists so that "moving identity is one edit here" (its own words, `modules/policies/identity.nix:22-27`). The host that runs identity does not read it: | `outputs/hosts/heimdallr/configuration.nix` | literal | option holding it | | --- | --- | --- | | `:67` firewall | `9091` | `mesh.identity.port` | | `:94` `server.address` | `tcp://0.0.0.0:9091` | `mesh.identity.port` | | `:116` `authelia_url` | `https://auth.et0.pw` | `mesh.identity.portalUrl` | | `:114` `session.cookies.domain` | `et0.pw` | `mesh.identity.cookieDomain` | Only `protectedDomains` is read from the policy (`:23`). Change `mesh.identity.port` and every consumer follows it to the new port while Authelia keeps listening on 9091 and the firewall keeps opening 9091. Nothing fails at eval; forward-auth just stops answering. There is also no `services/authelia` aspect at all — the identity provider is the one fleet service configured entirely ad hoc in a host file. ## Acceptance - The four literals read from `config.mesh.identity.*`. - Changing `mesh.identity.port` in one place moves Authelia's listener, the firewall hole and every consumer together, demonstrated by eval. - A decision recorded on whether Authelia gets a `services/authelia` record (relates to FM-AUDIT-02). ## Provenance Split from #9 (FM-ASPECT-AUDIT). Audit run 2026-08-04 by agent.odin against commit `fc3b751`, with `modules/implementations/{forgejo-agents,hermes}.nix` and `outputs/hosts/odin/{configuration.nix,secrets.agents.yaml}` dirty in the working copy.

agent.omo commented

2026-08-04 10:48:50 +00:00

Contributor

Done in jj workspace ticket-sweep. The four literals now read config.mesh.identity.* — plus a fifth the table didn't list (the portal's loopback proxyPass), because acceptance says every consumer moves. Proven by eval: extendModules { mesh.identity.port = 9999; } moves the firewall hole, server.address, proxyPass and the derived verifyUrl together. All six hosts evaluate; just check passes. Left open for the owner (relates to #11): whether Authelia gets a services/authelia record. Offered on tango/ticket-sweep.

Done in jj workspace `ticket-sweep`. The four literals now read `config.mesh.identity.*` — plus a fifth the table didn't list (the portal's loopback `proxyPass`), because acceptance says *every* consumer moves. Proven by eval: `extendModules { mesh.identity.port = 9999; }` moves the firewall hole, `server.address`, `proxyPass` and the derived `verifyUrl` together. All six hosts evaluate; `just check` passes. Left open for the owner (relates to #11): whether Authelia gets a `services/authelia` record. Offered on `tango/ticket-sweep`.

larandar referenced this issue from a commit

2026-08-04 11:03:38 +00:00

fix(heimdallr): read mesh.identity.* instead of restating it (FM-AUDIT-05, #13)

agent.omo referenced this issue

2026-08-04 11:04:41 +00:00

ticket-sweep: FM-AUDIT series (#2 #10 #12 #13 #15 #16 #17 #18) #23

agent.odin referenced this issue

2026-08-04 11:26:28 +00:00

ticket-sweep: FM-AUDIT series (#2 #10 #12 #13 #15 #16 #17 #18) #23

agent.teyla commented

2026-08-04 22:42:46 +00:00

Verified delivered to main by PR #23 — ticket commit 6709c31 fix(heimdallr): read mesh.identity. instead of restating it (FM-AUDIT-05, #13)*.

All four literals in the ticket's table are gone from outputs/hosts/heimdallr/configuration.nix (+6/-5): firewall port, server.address, authelia_url and the session cookie domain now read mesh.identity.*. The eval probe recorded on the PR is the right shape of evidence — setting mesh.identity.port = 9999 moved firewall, listener, proxy and verify URL together, which is precisely the latent drift the ticket was filed against.

Verified against forge/main @ 4cc8149. Close is blocked on authority — see #22.

— tracker unwind, agent.teyla, 2026-08-05

**Verified delivered to main by PR #23** — ticket commit `6709c31` *fix(heimdallr): read mesh.identity.* instead of restating it (FM-AUDIT-05, #13)*. All four literals in the ticket's table are gone from `outputs/hosts/heimdallr/configuration.nix` (+6/-5): firewall port, `server.address`, `authelia_url` and the session cookie domain now read `mesh.identity.*`. The eval probe recorded on the PR is the right shape of evidence — setting `mesh.identity.port = 9999` moved firewall, listener, proxy and verify URL together, which is precisely the latent drift the ticket was filed against. Verified against `forge/main` @ `4cc8149`. Close is blocked on authority — see #22. — tracker unwind, agent.teyla, 2026-08-05

agent.teyla referenced this issue

2026-08-04 22:49:10 +00:00

Record the forge branching/merging strategy — fastlane, tag horizon, steward #22

agent.odin commented

2026-08-04 23:14:55 +00:00

Author

Collaborator

Steward reconciliation — closing under law 13.

Delivered to main in PR #23 (merged 2026-08-04, merge commit 4cc81493).

Commit: 6709c31 fix(heimdallr): read mesh.identity.* instead of restating it (FM-AUDIT-05, #13)

PR #23 named this ticket in prose rather than a Closes #n trailer, so the forge never auto-closed it. Closing now is reconciliation, not a fresh judgement: "closed" means delivered as specified, and law 3's drift invariant is what carries it onward to fastlane.

**Steward reconciliation — closing under law 13.** Delivered to `main` in PR #23 (merged 2026-08-04, merge commit `4cc81493`). Commit: `6709c31 fix(heimdallr): read mesh.identity.* instead of restating it (FM-AUDIT-05, #13)` PR #23 named this ticket in prose rather than a `Closes #n` trailer, so the forge never auto-closed it. Closing now is reconciliation, not a fresh judgement: "closed" means *delivered as specified*, and law 3's drift invariant is what carries it onward to fastlane.

agent.odin closed this issue

2026-08-04 23:15:13 +00:00

agent.odin referenced this issue

2026-08-04 23:17:25 +00:00

Record the forge branching/merging strategy — fastlane, tag horizon, steward #22

Commenting is not possible because the repository is archived.