I3996 — A node's provisioning secret is read on mc's standard input, never from a command line

✕BLOKOVÁNO vlna 2 · p1 · profil implementation · bezpečné paralelně

Part of builds-reuse-the-mesh-cache — Builds reuse the mesh cache: compiled Rust, the cargo build directory, mix deps and npm packages, keyed by platform, toolchain and inputs.

Cíl

mesh build-cache provision creates a node's MinIO identity with `mc admin user add <alias> <access key>` and passes the secret on the command's standard input. That is mc's own documented form (minio/mc cmd/admin-user-add.go, fetchUserKeys), so the secret is in no process's argv.

Proč

Found in review of I2674 (#2402) on 2026-10-23, and on master since train 6 (b62848cb6f5): apps/majordomus-cli/src/mesh/cache_provision.rs appended each node's generated secret to the argv of `mc admin user add`. Every user of the provider host can read an argv in ps and /proc/<pid>/cmdline for as long as the call runs. The intent this milestone serves says no credential appears in a process's environment, a log or an answer, and an argument is all three at once. Only `mesh build-cache provision --apply` on a provider host runs the call, and none has been run (lundra, the intended host, has not been provisioned), so no secret has been exposed and none needs rotating.

Aktuální stav

Measured at master b62848cb6f5 on 2026-10-25: run_steps builds `mc --quiet admin user add <alias> mesh-cache-<node>`, pushes the secret onto that argv (cache_provision.rs:908-909), and the runner gives the child no standard input.

Cílový stav

The identity step's argv ends at the access key. The runner writes the secret, followed by a newline, to the child's standard input and closes it. Every other command gets a null standard input. The step's printed line names where the secret goes, never the secret itself.

Rozsah

• apps/majordomus-cli/src/mesh/cache_provision.rs
• .ai/repo/project/issues/I3996.yaml

Mimo rozsah

• A gate and rule that refuse a secret on any command line the repository runs (I4224, train 8)
• Rotating identities: none was ever created through the argv form

Závislosti

• I2674✕BLOKOVÁNO Uzel se idempotentně zřídí jako poskytovatel cache S3, bez jakéhokoli tajemství v repozitáři

Kritéria přijetí

• With a recording runner, no argv of any command the apply runs contains any node's secret, and each node's secret, followed by a newline, is the standard input of exactly its own admin user add
• The real runner gives a stand-in mc the input on its standard input and nothing on its command line; a command given no input reads an empty, closed standard input

Validace

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib mesh::cache_provision
• bin/majordomus plan validate

Požadované důkazy

• sada testů

Důkazy

Nic nezaznamenáno. Za každým tokenem výše musí stát příkaz nebo artefakt, než lze tento úkol dokončit; vyprávění se odmítá.

Časová osa

zahájeno

—

ověřeno

—

dokončeno

—

Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.

Canonical record: .ai/repo/project/issues/I3996.yaml. Read it back with majordomus plan show I3996.