root/Jyotisha
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Merge pull request 'Record staging env ownership drift guard' (#14)
Staging Backend Quality Gate / validate (push) Successful in 11m31s
Details
Staging Backend Quality Gate / publish (push) Successful in 15m29s
Details

Browse Source 
Record and prevent the staging env owner drift found by the encrypted backup gate.
This commit was merged in pull request #14.
This commit is contained in:
jesse
2026-08-06 14:32:20 +08:00
parent 8d636fc5ac a277efb8f4
commit eccd831ae9
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/research/pre_work_error_ledger.md
+6
View File
@@ -133,6 +133,12 @@ A direct strict SSH inspection of `118.26.111.127` stopped with `REMOTE HOST IDE
Prevention: on any staging host-key warning, stop before SSH/deploy; compare the observed key against an independently administered trusted source such as `STAGING_KNOWN_HOSTS`, and require exact key-material equality. Never trust `ssh-keyscan` alone, never use `StrictHostKeyChecking=no`, and never overwrite unrelated known-host entries. Preserve a local backup and record the trusted fingerprint. Do not `chmod` or `chown` `/opt/jyotisha-staging` to make ad-hoc inspection easier.
## ERR-093 | Staging env ownership drift blocked the reviewed backup helper | mitigated 2026-08-06
Before the personal-report staging migration, the encrypted backup helper correctly refused to write into the private `deploy`-owned backup tree when invoked as root. Read-only inspection then showed both `.env.staging` and `.env.staging.database` had drifted to `root:root 0600`, although the deployment tree, backup directory, state directory, and Docker-capable deployment account are owned by `deploy`; the operations runbooks explicitly require the env files to be owned by the deployment user. This made the correct `deploy` execution unable to read its database env while root could not pass the helper's private-directory ownership boundary.
Prevention: before staging backup/migration, verify both env files are regular, non-symlink files owned by `deploy:deploy` with mode `0600`; restore only that documented owner/mode under the shared mutation lock, without printing or copying file contents. Run `backup-staging-postgres.sh` as `deploy`, never weaken its ancestor checks, never create a parallel root backup tree, and never broaden env permissions.
## Fragment Sweep Command Set
## ERR-086 | Steve Jobs jyotishganit artifacts used non-San-Francisco coordinates | mitigated 2026-07-21