mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
aef525f913
The persona contract expects every role to exercise the administrator and biber personas, and requires a persona-block-rationale where one cannot reach the application at all. 68 roles already carry it; these three did not. Each rationale names the mechanism, and each was checked against the declaration rather than taken at face value: - hermes admits only the administrator and mcp RBAC groups to its oauth2 proxy, so biber is refused at the proxy. allowed_groups lists exactly those two. - homeassistant runs its own auth provider with sso.enabled false, and its hub account comes from secrets.credentials.administrator_password rather than the platform user password. - the litellm admin UI has no platform-user concept, authenticating with the UI_USERNAME/UI_PASSWORD pair the service provisions, with sso.enabled false. Both sso pins verified as false in meta/services.yml. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
13 lines
904 B
Bash
13 lines
904 B
Bash
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
HOMEASSISTANT_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
MCP_SERVICE_ENABLED={{ lookup('config', application_id, 'mcp.enabled') | string | lower }}
|
|
|
|
# nocheck: persona-block-rationale: Home Assistant runs its own auth provider. The hub account is provisioned from secrets.credentials.administrator_password rather than the platform user password, and meta/services.yml pins sso.enabled false, so the administrator persona holds no credential the hub accepts.
|
|
PERSONA_ADMINISTRATOR_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale: the deploy provisions only the hub administrator and the MCP service account in Home Assistant's own auth provider, and meta/services.yml pins sso.enabled false, so no auth path exists that would admit biber.
|
|
PERSONA_BIBER_BLOCKED=true
|