saf: name the borrowed hand and lock owner
Make the laptop and phone obey the same principal map: Souvie, Annie/Aster, and Vanguard are dedicated residents; Kitty, Gem, and Hal knowingly borrow Casey's UID. Their live posture is regenerated from actual credentials for every model request, outside memory, replay, and compaction.\n\nTake the lock boundary out of all of them. Casey authenticates, agents may request, and the dedicated souveraine-session principal holds the hostile pre-unlock edge with only Ambient and Revealable reach.
This commit is contained in:
Fimeg
parent
af60d9e401
commit
ee496a7c6e
4 changed files with 172 additions and 6 deletions
|
|
@ -33,12 +33,17 @@ agents. The name is reserved.
|
|||
|
||||
Casey's devices retain Casey's human account. Agents do not borrow it.
|
||||
|
||||
| Agent | Role | Suggested local account |
|
||||
| Agent | Role | Required local account on Casey's admitted nodes |
|
||||
|---|---|---|
|
||||
| Souvie / Souveraine | default Souveraine agent on a fresh system | `souvie` |
|
||||
| Annie | Casey's primary personal agent | `annie` |
|
||||
| Annie, in both Ani and Aster cadence | Casey's primary personal agent | `annie` |
|
||||
| Vanguard | named additional agent | `vanguard` |
|
||||
|
||||
"Each node" includes this laptop. The laptop is not a development exception,
|
||||
and the phone is not a special appliance case. When these three resident
|
||||
agents run on either body, their turn, subconscious pass, memory access, and
|
||||
tools must cross the worker boundary under the mapped account.
|
||||
|
||||
The display name is editable. The agent ID, SeedID, and admitted account
|
||||
mapping are not derived again when the display name changes. Account names are
|
||||
chosen once, checked against the local account database and reserved names,
|
||||
|
|
@ -58,6 +63,73 @@ Unix user. Aster shares Annie's principal unless Casey and the system later
|
|||
admit her as an independently authorized agent. The account boundary follows
|
||||
authority, not the number of internal thought streams.
|
||||
|
||||
## Resident agents and borrowed-user modes
|
||||
|
||||
Not every named mode needs a Unix account. Kitty, Gem, and Hal are intended to
|
||||
run as hosted or borrowed-user modes under Casey's account rather than claim a
|
||||
fully admitted resident identity. That is a deliberate posture, not the same
|
||||
failure as Annie accidentally running as Casey.
|
||||
|
||||
The durable agent record therefore carries a principal intent, not one vague
|
||||
boolean:
|
||||
|
||||
| Intent | Expected runtime | Meaning |
|
||||
|---|---|---|
|
||||
| `dedicated` | the named agent account | full node admission and kernel-backed identity |
|
||||
| `borrowed-user` | the invoking human account | a hosted mode using authority the human process can already reach |
|
||||
|
||||
On Casey's current fleet Souvie, Annie/Aster, and Vanguard are `dedicated`.
|
||||
Kitty, Gem, and Hal are `borrowed-user`. Promoting a borrowed mode to a resident
|
||||
agent is an admission ceremony; changing a UI label or model does not do it.
|
||||
|
||||
A borrowed-user mode must know, in every model request, that readable does not
|
||||
mean owned or shareable. Its operating posture is stricter:
|
||||
|
||||
- Casey's files, groups, sockets, credentials, and decrypted home are borrowed
|
||||
reach, not the mode's personal territory;
|
||||
- do not widen mode bits, ACLs, group membership, links, remotes, publication,
|
||||
or sharing outside the explicit task without Casey's confirmation;
|
||||
- prefer the named workspace or a narrow temporary copy over exploring the
|
||||
rest of the human home;
|
||||
- never read or disclose a resident agent's private memory merely because the
|
||||
shared human UID permits it;
|
||||
- attribute actions to a borrowed mode acting through Casey's principal, not
|
||||
to an independently admitted agent.
|
||||
|
||||
This caution is context and policy, not a substitute for containment. A
|
||||
borrowed process still has Casey's kernel permissions; sensitive verbs must
|
||||
remain behind the same capability and consent gates.
|
||||
|
||||
## The live principal fact
|
||||
|
||||
The intent in `agent.json` is durable. The live posture is observed afresh from
|
||||
the selected agent or mode, node mapping, process credentials, and worker unit.
|
||||
The trigger may expose a convenient `operating_as_user` boolean, but that
|
||||
boolean is only a projection of the facts and is never an authorization input.
|
||||
|
||||
The runtime projection contains at least:
|
||||
|
||||
```text
|
||||
agent_id, display_name, principal_intent
|
||||
expected_account, effective_account, effective_uid
|
||||
node_id, worker_pid, trigger, observed_at
|
||||
posture = isolated | borrowed-user | acting-as-human | drift
|
||||
```
|
||||
|
||||
It is injected as a fresh system block into **every model request**, including
|
||||
Ani and Aster passes, subagents, resumed conversations, and later tool rounds
|
||||
after a mode switch. It is not ordinary conversation history and cannot be
|
||||
microcompacted, replayed from an old session, or taught back as assistant
|
||||
speech.
|
||||
|
||||
A machine-generated cache may be exposed as
|
||||
`/run/souveraine/agent-principals/{agent_id}.json` and a Markdown rendering for
|
||||
inspection. It does not belong in the agent-writable, Git-backed
|
||||
`system/dynamic/` memory tree: an awareness file the agent can edit cannot be
|
||||
the source of who the kernel says she is. The prompt projection rechecks the
|
||||
effective credentials when it reads the cache. Authorization always checks
|
||||
the actual peer and process credentials again at the verb boundary.
|
||||
|
||||
## Creation is logical creation followed by admission
|
||||
|
||||
The current creation path makes a UUID, an agent seed, memory directories, an
|
||||
|
|
@ -82,7 +154,7 @@ Agent creation should ask for the authority shape, not merely a name and
|
|||
model:
|
||||
|
||||
- create a new identity or admit an existing one;
|
||||
- local principal name, with the suggested name visible;
|
||||
- principal intent and, for a resident, the required local account name;
|
||||
- which node and role are being admitted;
|
||||
- whether the privileged admission completed;
|
||||
- which operating skill was projected from the admitted capabilities.
|
||||
|
|
@ -171,8 +243,9 @@ The top-level states are deliberately blunt:
|
|||
| State | Meaning |
|
||||
|---|---|
|
||||
| `isolated` | account, ownership, worker, commission, and peer identity agree |
|
||||
| `borrowed-user` | hosted mode intentionally uses the invoking human's account and receives the cautious borrowed-permission posture |
|
||||
| `unadmitted` | logical agent exists; this node has no completed admission |
|
||||
| `acting-as-human` | a turn or tool is executing as Casey or another human UID |
|
||||
| `acting-as-human` | a `dedicated` agent's turn or tool is unexpectedly executing as Casey or another human UID |
|
||||
| `principal-drift` | mapping exists but NSS, ownership, unit, or peer facts disagree |
|
||||
| `identity-drift` | account is healthy but agent key or node commission does not match |
|
||||
| `stopped` | admission is sound and no worker is currently expected/running |
|
||||
|
|
@ -180,7 +253,9 @@ The top-level states are deliberately blunt:
|
|||
`acting-as-human`, `principal-drift`, and `identity-drift` are not yellow
|
||||
decorations. They refuse personal and step-up authority. Ambient conversation
|
||||
may remain available in a visibly degraded compatibility mode while migration
|
||||
is unfinished.
|
||||
is unfinished. `borrowed-user` is intentional and may use only the human-granted
|
||||
capability surface; it never becomes `isolated` merely because Casey's UID can
|
||||
read something.
|
||||
|
||||
The audit trail records both logical and kernel-backed subjects: agent ID,
|
||||
node ID, account name, UID, PID, operation, human requestor or consent grant,
|
||||
|
|
@ -217,11 +292,14 @@ gives the newly admitted agent an accurate way to use and explain it.
|
|||
- The setup wizard defaults inconsistently between `Souveraine` state and an
|
||||
`Ani` form field; neither creates a Unix account.
|
||||
- the packaged `souveraine` account exists only for the machine tier;
|
||||
- on the laptop, NSS currently has no `souvie`, `annie`, or `vanguard`
|
||||
accounts, and all seven agent records live below Casey's home;
|
||||
- the Agent settings diagnostics check IDs and paths, not principal or process
|
||||
identity;
|
||||
- the server hosts multiple agents inside the human's process and home;
|
||||
- no admission executor, per-agent worker boundary, account mapping, account
|
||||
health result, or generated operating skill exists yet.
|
||||
health result, fresh runtime-principal projection, or generated operating
|
||||
skill exists yet.
|
||||
|
||||
Until those pieces land, the system must say **logical identity present,
|
||||
kernel principal absent**. That is the live gap this chapter owns.
|
||||
|
|
|
|||
Loading…
Reference in a new issue