coilyco-flight-deck/agentic-os

Watch

Make gpg-ssm tolerate long native-session home paths #954

New issue

Closed

opened 2026-08-06 11:45:05 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-08-06 11:45:05 +00:00

Owner

Observed failure

A native AOS session uses a long temporary HOME and symlinks .gnupg to the canonical host keyring. With GnuPG 2.5.21, gpg-ssm reaches SSM and reads the secret key, but key import fails because keyboxd cannot create or reach its socket through the long logical home path.

The decisive diagnostic was:

gpg: can't connect to the keyboxd: File name too long
gpg: error opening key DB: No Keybox daemon running

Setting GNUPGHOME to the short physical target of the existing .gnupg symlink removes the socket-path failure and allows the key import to complete. This was observed while landing coilyco-flight-deck/infrastructure#763.

Ownership and boundary

Agentic OS owns the native-session home projection and the canonical gpg-ssm wrapper. Infrastructure should not embed a host-specific GPG workaround. The fix must preserve SSM-backed signing and must not cache passphrases or private material outside the existing contract.

Acceptance

gpg-ssm resolves a safe short physical GPG home when the session home projects .gnupg through a symlink.
A focused fixture reproduces a long logical home path without reading live SSM or real signing material.
Verification and signing invocations preserve their current behavior.
The wrapper fails closed when no safe physical keyring exists.
Repository validation passes.

## Observed failure A native AOS session uses a long temporary `HOME` and symlinks `.gnupg` to the canonical host keyring. With GnuPG 2.5.21, `gpg-ssm` reaches SSM and reads the secret key, but key import fails because `keyboxd` cannot create or reach its socket through the long logical home path. The decisive diagnostic was: ```text gpg: can't connect to the keyboxd: File name too long gpg: error opening key DB: No Keybox daemon running ``` Setting `GNUPGHOME` to the short physical target of the existing `.gnupg` symlink removes the socket-path failure and allows the key import to complete. This was observed while landing `coilyco-flight-deck/infrastructure#763`. ## Ownership and boundary Agentic OS owns the native-session home projection and the canonical `gpg-ssm` wrapper. Infrastructure should not embed a host-specific GPG workaround. The fix must preserve SSM-backed signing and must not cache passphrases or private material outside the existing contract. ## Acceptance * `gpg-ssm` resolves a safe short physical GPG home when the session home projects `.gnupg` through a symlink. * A focused fixture reproduces a long logical home path without reading live SSM or real signing material. * Verification and signing invocations preserve their current behavior. * The wrapper fails closed when no safe physical keyring exists. * Repository validation passes.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-08-06 11:45:06 +00:00

Install and live-verify Qwen Image Edit 2511 for AOSX #763

coilyco-ops commented

2026-08-06 15:57:45 +00:00

Author

Owner

Additional diagnosis:

The configured signing key is the same key that produced valid signatures on recent infrastructure commits.
The flat SSM key and passphrase parameters remain version 1 and were last written minutes apart on 2026-07-08. No recent parameter mutation explains the failure.
GnuPG 2.5.21 successfully unlocks and signs with a disposable key through the exact --pinentry-mode loopback --passphrase-fd 3 mechanism, so the wrapper transport remains functional.
The canonical key imports successfully after using the short physical GPG home, but the flat SSM passphrase does not unlock it.
The host config uses a long-lived GPG agent cache. Recent successful commits therefore prove the key and cached unlock state, but do not prove the current SSM key/passphrase pair. Restarting the agent during diagnosis cleared that cache and exposed the latent mismatch.

The long-home fix in this issue remains valid. Separate attended recovery must reconcile or rotate the SSM signing pair. A durable provisioning check should verify that a freshly imported key can sign with the stored passphrase before declaring bootstrap complete.

Additional diagnosis: * The configured signing key is the same key that produced valid signatures on recent infrastructure commits. * The flat SSM key and passphrase parameters remain version 1 and were last written minutes apart on 2026-07-08. No recent parameter mutation explains the failure. * GnuPG 2.5.21 successfully unlocks and signs with a disposable key through the exact `--pinentry-mode loopback --passphrase-fd 3` mechanism, so the wrapper transport remains functional. * The canonical key imports successfully after using the short physical GPG home, but the flat SSM passphrase does not unlock it. * The host config uses a long-lived GPG agent cache. Recent successful commits therefore prove the key and cached unlock state, but do not prove the current SSM key/passphrase pair. Restarting the agent during diagnosis cleared that cache and exposed the latent mismatch. The long-home fix in this issue remains valid. Separate attended recovery must reconcile or rotate the SSM signing pair. A durable provisioning check should verify that a freshly imported key can sign with the stored passphrase before declaring bootstrap complete.

coilysiren commented

2026-08-06 15:58:09 +00:00

Owner

fix: make the auto-generated suffix shorter. they can be a lot shorter. I'm thinking about using the o2r phonetic suffix style

fix: make the auto-generated suffix shorter. they can be *a lot* shorter. I'm thinking about using the o2r phonetic suffix style

coilyco-ops referenced this issue from a commit

2026-08-06 16:10:01 +00:00

fix(aos): shorten native session IDs (closes #954)

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-06 16:10:18 +00:00

fix(aos): shorten native session IDs #955

coilyco-ops commented

2026-08-06 16:10:39 +00:00

Author

Owner

Implemented the requested shorter suffix in PR #955 at commit 596c9ef2.

Native sessions now use the canonical o2r-derived four-character dictatable ID shape, such as ab85.
Allocation retries collisions against session directories, leases, and local or remote branches.
The AOS test suite, build, vet, and exact repository gate pass. The gate reports 523 tests passed and every pre-commit hook passed.

workflow: pull-request-and-merge

The separately diagnosed SSM key/passphrase recovery remains attended work and is unchanged by this PR.

Implemented the requested shorter suffix in PR #955 at commit 596c9ef2. * Native sessions now use the canonical o2r-derived four-character dictatable ID shape, such as `ab85`. * Allocation retries collisions against session directories, leases, and local or remote branches. * The AOS test suite, build, vet, and exact repository gate pass. The gate reports 523 tests passed and every pre-commit hook passed. workflow: pull-request-and-merge The separately diagnosed SSM key/passphrase recovery remains attended work and is unchanged by this PR.

coilysiren closed this issue

2026-08-06 16:29:31 +00:00

coilysiren referenced this issue from a commit

2026-08-06 16:29:33 +00:00

fix(aos): shorten native session IDs (#955)

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#954

No description provided.

Rows
Columns