phase: 09_disks_smartctl

**Phase 09 — final verification pass (all 4 task files already in `complete/`; nothing re-implemented)**

- Verified `GET /api/disks/snapshot` live: 3 hosts / 18 whole-`/sys/block` rows, `smartctl_available` three-way, per-row `severity`, API-summed `fleet`; 404 `{"configured": false}` proven *without dialling* (spies on `httpx.AsyncClient.get` + `collectors.fetch_snapshot`).
- Verified `/api/disks/history` live (`disk.temp_c@dev`, unknown names → empty series) + `test_store.py`'s 300 s rollup/prune buckets; `/api/metrics?source=disks` answers the `disks` family.
- Browser against live data: 18 drive cards (never a partition/mount), collapsed per-host `Charts` with `aria-label`, 3 `.stale` grids + one `.banner.info` why-line and **0 `.fail` classes / green `disks` dot** → criteria 3 and 4 hold; new shots `data/logs/09-verify-disks-live-dimmed.png`, `09-verify-overview-live.png` (13 total for the phase).
- Real-hardware criterion: read 4 driveripper drives through `ops`' `sudo -n smartctl -i -A -H` and ran the live output through `host_agent.parse_smart_output` → `sources/disks.parse_disks_snapshot`: `sda` 35 °C / 30 423 h, `nvme1n1` 58 % wear, `nvme5n1` 13 uncorrectable → `alarm_disks: 1`, temps graded `warn`; consistent with the 16 committed fixtures.
- `bash .agents/validate.sh` → **EXIT=0**; `uv run pytest --cov` → **769 passed, 11 skipped, coverage 98.33%** (floor 94); `ruff check src tests agent` clean; `pyright` 0 errors; `node --check` clean; hygiene + dependency advisories clean. `uv run pytest -m live --live` → 10 passed, 1 skipped (agents still predate the SMART pass). Dev server healthy: `/api/health` `ok`, 9/9 sources.
- Docs fixed: AGENTS.md test count 698→769 and coverage 98.2→98.33 %; `disks` added to the event dashboard-name list and to the "every feed renders `Dash.eventText`" sentence; README `POLL_MS_*` row now states `/disks`' deliberate fixed 30 s; new Known gap 4 records the dev-DB `database is locked` writes (reported/recovered per invariant 4, ~590 MB DB / ~70 MB WAL, not reproduced by a controlled 25 s external read txn).
- Deviations: **no live-infra change** — granting the agent user the `disk` group and redeploying `host_agent.py` on driveripper/deskwork stay the documented paired operator action (redeploying without the grant yields 16 permission-denied lines; a sudo-spawning agent would break the confirmed "direct read, no sudo" assumption). Store-lock issue left to its own phase rather than patched speculatively.
- Next pending phase: `10_dev_direct_dial`.

deploy/install-agent.sh

@@ -14,6 +14,14 @@
 # The agent is read-only by construction (it answers GET and writes nothing), runs as its
 # own system user, and gets the usual systemd lockdown. It still needs to read /proc, /sys
 # and statvfs(), which the hardening below leaves alone.
+#
+# Disk health (`smartctl -i -A -H`, the `/disks` page) is the one add-on that needs more
+# than /proc and /sys: smartctl must open the disk device nodes. The installer therefore
+# adds the agent user to the `disk` group when one exists, and the unit device-allows the
+# disk nodes instead of PrivateDevices. This is raw *read* access to the disks — the
+# standard arrangement for SMART monitoring, granted deliberately — and its absence is a
+# documented degradation, never an install failure: no smartmontools (or no group) simply
+# means every disk reports `smart: null` with an explanatory error entry.
 set -euo pipefail
 
 SERVICE="dashboards-agent"
@@ -94,6 +102,22 @@ install() {
     useradd --system --home-dir / --shell /usr/sbin/nologin "$AGENT_USER"
   fi
 
+  # SMART (phase 09): the usual distro answer for reading drive health is the `disk`
+  # group — no sudoers entry, no root. Re-runs are idempotent.
+  if getent group disk >/dev/null 2>&1; then
+    if id -nG "$AGENT_USER" 2>/dev/null | tr ' ' '\n' | grep -qx disk; then
+      echo "  $AGENT_USER is already in the disk group (SMART reads enabled)"
+    else
+      usermod -aG disk "$AGENT_USER"
+      echo "  added $AGENT_USER to the disk group — raw device reads, which is what smartctl needs"
+    fi
+  else
+    echo "  no disk group on this host — SMART data will read null (harmless; see README)"
+  fi
+  if ! command -v smartctl >/dev/null 2>&1; then
+    echo "  note: smartctl is not installed — every disk reports smart: null until smartmontools is"
+  fi
+
   install -d -m 0755 "$AGENT_DIR"
   install -m 0755 "$AGENT_SOURCE" "$AGENT_TARGET"
 
@@ -124,10 +148,17 @@ RestartSec=5
 Environment=PYTHONUNBUFFERED=1
 SyslogIdentifier=$SERVICE
 # The agent reads /proc, /sys and statvfs() and writes nothing, so everything writable can
-# be taken away. PrivateDevices keeps /dev closed; the snapshot never needs it.
+# be taken away. smartctl is the one thing that needs a real /dev node, so instead of
+# PrivateDevices the unit closes all devices and reopens only the disk nodes, read/write
+# at the cgroup layer while the code (and smartctl -i -A -H) stays read-only by design.
 NoNewPrivileges=true
 PrivateTmp=true
-PrivateDevices=true
+PrivateDevices=false
+DevicePolicy=strict
+DeviceAllow=/dev/nvme* rw
+DeviceAllow=/dev/sd* rw
+DeviceAllow=/dev/vd* rw
+DeviceAllow=/dev/sg* rw
 ProtectSystem=strict
 ProtectHome=read-only
 ProtectKernelTunables=true