Execute confirmed timezone provisioning safely #6

Merged

ochenstarik-ui merged 34 commits from hermes/system-base-install-execution into main

2026-07-30 14:40:30 +00:00

ochenstarik-ui commented

2026-07-30 06:49:18 +00:00

(Migrated from github.com)

Summary

Stacked on draft PR #5 (agent/standalone-linux-bootstrap). Implements the first real system.base-install mutation slice: confirmed timezone-only execution through Agent -> Control execution grant -> restricted root provisioning helper.

Safety invariants

execution is bound to the saved confirmed plan and a short-lived ECDSA grant
grant validates local node, job, action, schema, plan SHA-256 and expiry
grant expiry is capped by job expiry and each nonce is atomically consumed before any helper process call, including verified no-op
fixed allowlist: /usr/bin/timedatectl with argument arrays; no shell, command text or arbitrary executable/path
locale, APT, packages, swap, non-default vm swappiness, unattended upgrades and reboot changes fail before mutation
root-owned 0700 rollback directory; atomic CreateNew records created directly as 0600; symlinked managed paths rejected
factual verification is required; mutation/verification failure triggers rollback and factual rollback verification
inconsistent helper responses and uncertain post-dispatch failures become NeedsReconciliation, never Completed
malformed/disconnected local clients cannot terminate the helper listener

Deployment

helper loads the local SMM_NodeId from agent.env
ProtectSystem=strict remains enabled
write access is limited to /var/lib/ochenstarik-server-monitor-manager/provisioning/rollback

Evidence

dotnet test ServerMonitorManager.slnx --configuration Release --no-restore: 51 passed, 0 failed, 0 skipped
clean detached checkout restore/build/test: 51 passed, 0 failed, 0 skipped
dotnet format ServerMonitorManager.slnx --verify-no-changes --no-restore: PASS
git diff --check: PASS
bash tests/bootstrap/test-bootstrap-contract.sh: BOOTSTRAP_CONTRACT=PASS
trimmed self-contained single-file publish: Agent/helper linux-x64 and linux-arm64: PASS
independent security review repair cycle: all original security findings verified fixed; no new BLOCKING/HIGH boundary defects

Scope

This intentionally marks only the timezone-only increment complete. Full base-install execution, broader desired/factual drift and remaining mutations stay unchecked in the roadmap.

## Summary Stacked on draft PR #5 (`agent/standalone-linux-bootstrap`). Implements the first real `system.base-install` mutation slice: confirmed timezone-only execution through Agent -> Control execution grant -> restricted root provisioning helper. ## Safety invariants - execution is bound to the saved confirmed plan and a short-lived ECDSA grant - grant validates local node, job, action, schema, plan SHA-256 and expiry - grant expiry is capped by job expiry and each nonce is atomically consumed before any helper process call, including verified no-op - fixed allowlist: `/usr/bin/timedatectl` with argument arrays; no shell, command text or arbitrary executable/path - locale, APT, packages, swap, non-default vm swappiness, unattended upgrades and reboot changes fail before mutation - root-owned `0700` rollback directory; atomic `CreateNew` records created directly as `0600`; symlinked managed paths rejected - factual verification is required; mutation/verification failure triggers rollback and factual rollback verification - inconsistent helper responses and uncertain post-dispatch failures become `NeedsReconciliation`, never `Completed` - malformed/disconnected local clients cannot terminate the helper listener ## Deployment - helper loads the local `SMM_NodeId` from `agent.env` - `ProtectSystem=strict` remains enabled - write access is limited to `/var/lib/ochenstarik-server-monitor-manager/provisioning/rollback` ## Evidence - `dotnet test ServerMonitorManager.slnx --configuration Release --no-restore`: **51 passed, 0 failed, 0 skipped** - clean detached checkout restore/build/test: **51 passed, 0 failed, 0 skipped** - `dotnet format ServerMonitorManager.slnx --verify-no-changes --no-restore`: PASS - `git diff --check`: PASS - `bash tests/bootstrap/test-bootstrap-contract.sh`: `BOOTSTRAP_CONTRACT=PASS` - trimmed self-contained single-file publish: Agent/helper `linux-x64` and `linux-arm64`: PASS - independent security review repair cycle: all original security findings verified fixed; no new BLOCKING/HIGH boundary defects ## Scope This intentionally marks only the timezone-only increment complete. Full base-install execution, broader desired/factual drift and remaining mutations stay unchecked in the roadmap.