ducoterra
86c8bf4992
Phase 33 completion pass is done. Final report:
## Phase 33 — completion report
**All 8 task files complete** (`.agents/phases/complete/33_gateway_route_switching/`), full gate green, docs verified.
### Work in this pass
1. **`tests/test_routectl.py` added** (17 tests, all green) — exercises the *real* helper binary unprivileged against a fake tree (`--root`), the real agent parser, the captured gateway fixtures, and stubbed `nginx`/`haproxy`/`systemctl` on `PATH`. Pins the full protocol (locate → state → dry-run → temp-file/fsync/`os.replace` write → checker → restore on checker failure → reload-never-restart → re-read proof → sidecar record), all three route shapes (haproxy `server`, nginx `proxy_pass`, nginx stream `map` via its sink-value id), `drift` / unknown-id / `map-default` refusals, `list`/`verify`, and the `--serve` peer gate (`SO_PEERCRED` uid check, one JSON line per request, exact body shape).
2. **Real helper defect fixed** — `deploy/dashboards-routectl.py`: `main()`'s early-return paths returned `({"ok": False, …}, EXIT_*)` tuples, so `sys.exit()` printed a Python repr instead of a JSON line (usage errors, agent-import refusal). Now prints `json.dumps(…)` and returns only the code, keeping the one-JSON-line contract.
3. **Documentation consistency fixes** (task 08 criterion 6):
- `README.md`: garbled verdict-colour sentence on the switch ("green and to the position") → "in the **on** position and tinted `--gate-on`" (the existence-pair contract).
- `README.md`: audit sentence now names all three event kinds — `route-disabled` / `route-enabled` / **`route-denied`** (the code stores one per refused call; dry runs store none).
- `page-gateway.js`: replaced the stale pre-33 module docstring ("the switch is not wired") with the two-arm `GATEWAY_ALLOW_WRITES` contract.
- `AGENTS.md`: every phase-33 claim re-verified against code (the ten gates, the 35 s/30 s budget pair, `gateway.writes_enabled`, `/api/summary`'s `disabled`, the 1.4.0 agent bullet, the gap list) — no changes needed.
### Verification
- `uv run pytest --cov`: **1970 passed**, 18 skipped — coverage **98.74%** (floor 94%)
- `ruff` clean · `pyright` 0 errors · `bash .agents/validate.sh` **exit 0** (incl. `node --check` on every page script)
- Dev server running; all 10 sources `ok`; bundles exported
### Live infrastructure
**No live changes made.** The live drill remains unexecuted per `data/logs/NOTES-33-switching.md` (no operator approval; checker binaries unavailable in the podman proxy units). All routes stay enabled, config hashes unchanged, and the sandbox rehearsal + backup tree are in place for the operator's own `DANGER` call. All changes are in the working tree only.
43 lines
1.9 KiB
Desktop File
43 lines
1.9 KiB
Desktop File
# dashboards-routectl@.service
|
|
#
|
|
# The route-switch helper, root, socket-activated, one request per instance.
|
|
#
|
|
# The privilege model, in one line: the grant is a file mode systemd enforces
|
|
# (the socket is 0600 and owned by the agent user), not a sudoers line. This
|
|
# unit is how the agent's one narrow write reaches root without the agent's
|
|
# own unit being given anything — NoNewPrivileges=true is kept *here* as well,
|
|
# because the privilege comes from being started by systemd as root, not from
|
|
# escalation.
|
|
#
|
|
# Write scope, stated out loud: the helper replaces exactly two kinds of
|
|
# config files, and os.replace needs write on the *directory*, so
|
|
# ReadWritePaths lists every directory whose file it replaces — and nothing
|
|
# else:
|
|
# /etc/haproxy the haproxy.cfg `server` line (the haproxy arm)
|
|
# /etc/nginx/conf.d the vhost `proxy_pass` line (the vhost arm)
|
|
# /etc/nginx/stream.d the `map` entry (the stream arm) and the helper's
|
|
# own sink file, 00-dashboards-sink.conf, which it
|
|
# creates and removes there
|
|
# /etc/nginx (the main config) is deliberately not listed: the helper never
|
|
# writes it.
|
|
#
|
|
# One connection, one instance: the socket's `Accept=yes` hands this template a
|
|
# fresh connected socket on stdin per connection (StandardInput=socket /
|
|
# StandardOutput=socket); the helper answers exactly one newline-delimited JSON
|
|
# request and exits, so there is never a long-lived privileged process sitting
|
|
# on a socket.
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/local/sbin/dashboards-routectl.py --serve \
|
|
--allow-uid dashboards-agent --state /var/lib/dashboards-routectl/state.json
|
|
User=root
|
|
StandardInput=socket
|
|
StandardOutput=socket
|
|
StateDirectory=dashboards-routectl
|
|
ProtectSystem=read-only
|
|
ReadWritePaths=/etc/haproxy /etc/nginx/conf.d /etc/nginx/stream.d
|
|
ProtectHome=read-only
|
|
PrivateTmp=yes
|
|
NoNewPrivileges=true
|
|
SystemCallFilter=@system-service
|