mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
4164f37981
An MCP client spec signs in through the client's own OIDC button, which redirects to Keycloak. Every provider put its MCP pairing in the lean variant, and that variant pinned sso off - so the round that exists to prove the pairing was the one round without an identity provider. Run 33574056480 shows what that costs: openwebui's MCP specs reached _shared.js:131 and died on "openwebui OIDC sign-in button must be visible on the auth page". The rule now demands two things of the variant that carries the consumers: the provider pins sso on, and each admitted consumer, in the variant that round actually pulls in, does not pin it off. The second half matters because a round deploys every dependency at its own index and falls back to variant 0 only when the dependency has fewer, so the client shipping alongside is that one and not the client's variant 0. A role that declares no sso, or pins it to a literal false because upstream speaks no OIDC, is exempt from a flag it cannot have. Twenty roles moved to satisfy it. Ten already had a second sso: false pin and only needed the flip. Six could host the pairing in variant 0, which already has sso on, and dropped back to two variants. Six kept a third lean variant to carry the false polarity variants-coverage wants. moodle and mattermost took swaps instead: moodle's variant 1 is the mandated LDAP-only branch, and mattermost was already at the three-variant cap with sso on in its variant 2. nextcloud also turns context_agent on in that round, the ExApp that serves the endpoint - with it off the round proved nothing it was built to prove. The rule moves to tests/lint/ansible/services/ because it reads meta YAML and executes nothing, which is where integration.md says such a check belongs, and its suppression key joins the catalog it was never listed in. nextcloud_exapp_reregister becomes nextcloud_exapp_renew: mcp-secret-masking matches `register:` unanchored, so the substring in the old name read as a task that prints a secret. register.yml already masks the two tasks that carry one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
60 lines
1.1 KiB
YAML
60 lines
1.1 KiB
YAML
---
|
|
# Matrix-deploy variant overrides for web-svc-libretranslate.
|
|
# See docs/contributing/artefact/files/role/variants.md for the file format.
|
|
|
|
# variant pinning every dynamic services.yml flag to true so the
|
|
# matrix exercises the in-group_names branch of web-svc-libretranslate.
|
|
|
|
- services:
|
|
matomo:
|
|
enabled: true
|
|
shared: true
|
|
sso:
|
|
enabled: true
|
|
shared: true
|
|
redis:
|
|
shared: true
|
|
prometheus:
|
|
enabled: true
|
|
shared: true
|
|
css:
|
|
enabled: true
|
|
shared: true
|
|
tor:
|
|
enabled: true
|
|
openwebui:
|
|
enabled: true
|
|
shared: true
|
|
hermes:
|
|
enabled: true
|
|
shared: true
|
|
openclaw:
|
|
enabled: true
|
|
shared: true
|
|
- services:
|
|
matomo:
|
|
enabled: false
|
|
shared: false
|
|
sso:
|
|
enabled: false
|
|
shared: false
|
|
redis:
|
|
shared: false
|
|
prometheus:
|
|
enabled: false
|
|
shared: false
|
|
css:
|
|
enabled: false
|
|
shared: false
|
|
tor:
|
|
enabled: true
|
|
openwebui:
|
|
enabled: false
|
|
shared: false
|
|
hermes:
|
|
enabled: false
|
|
shared: false
|
|
openclaw:
|
|
enabled: false
|
|
shared: false
|