feat(claude): stamp a wildcard permission allow on every host #1165

Merged

coilysiren merged 2 commits from chore/fleet-allow-wildcard into main

2026-08-20 10:21:14 +00:00

coilyco-ops commented

2026-08-20 09:58:16 +00:00

Owner

Fleet-wide half of the change infrastructure took repo-locally in coilyco-flight-deck/infrastructure#897.

scripts/apply-base-claude-settings.py gains BASE_ALLOWED_PERMISSIONS = ["'*'"], appended to permissions.allow on every host by the claude-hooks ansible role.

Deny outranks allow, so this widens nothing the deny list closes. The live-infrastructure CLIs (gcloud, kubectl, helm, terraform, gsutil, mongosh, mongo) and the memory directory stay shut. What it drops is the prompt on everything else.

Append-only, matching the deny merge. A host's accumulated allow entries are inert once * is present, but they are operator-local state and no fleet writer deletes those, so they are left in place.

.pre-commit-config.yaml pins check-illegal-windows-names to the pre-commit stage. Unpinned, it also ran at commit-msg and was handed $GIT_DIR/COMMIT_EDITMSG, which a linked worktree resolves absolute, so the drive colon read as an illegal name and every worktree commit failed. Same prerequisite fix that landed in infrastructure#897.

Docs and tests updated in place. The docs page sits at 120 lines against its 120-line cap, so the allow is folded into the existing permission section rather than given its own: splitting the page cleared the size cap but tripped the 40-doc cap, which the hook calls out as trading one violation for another.

Not done here: agentic-os-kai/scripts/up-to-date.py asserts the deny rules are present on a host and does not yet assert the allow. A missing allow costs prompts rather than safety, so it is a detector gap, not a guardrail gap. Follow-up filed.

🤖 Generated with Claude Code

Fleet-wide half of the change infrastructure took repo-locally in coilyco-flight-deck/infrastructure#897. **`scripts/apply-base-claude-settings.py`** gains `BASE_ALLOWED_PERMISSIONS = ["'*'"]`, appended to `permissions.allow` on every host by the `claude-hooks` ansible role. Deny outranks allow, so this widens nothing the deny list closes. The live-infrastructure CLIs (`gcloud`, `kubectl`, `helm`, `terraform`, `gsutil`, `mongosh`, `mongo`) and the memory directory stay shut. What it drops is the prompt on everything else. Append-only, matching the deny merge. A host's accumulated `allow` entries are inert once `*` is present, but they are operator-local state and no fleet writer deletes those, so they are left in place. **`.pre-commit-config.yaml`** pins `check-illegal-windows-names` to the `pre-commit` stage. Unpinned, it also ran at `commit-msg` and was handed `$GIT_DIR/COMMIT_EDITMSG`, which a linked worktree resolves absolute, so the drive colon read as an illegal name and every worktree commit failed. Same prerequisite fix that landed in infrastructure#897. Docs and tests updated in place. The docs page sits at 120 lines against its 120-line cap, so the allow is folded into the existing permission section rather than given its own: splitting the page cleared the size cap but tripped the 40-doc cap, which the hook calls out as trading one violation for another. Not done here: `agentic-os-kai/scripts/up-to-date.py` asserts the deny rules are present on a host and does not yet assert the allow. A missing allow costs prompts rather than safety, so it is a detector gap, not a guardrail gap. Follow-up filed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 2 commits

2026-08-20 09:58:16 +00:00

ci(pre-commit): keep the windows-name check off the commit-msg stage 33151cfca1

The hook carries no stage pin, so it also ran at commit-msg and was handed
$GIT_DIR/COMMIT_EDITMSG. In the canonical checkout that path is relative and
passes; from a linked worktree git resolves it absolute, and the drive colon
reads as an illegal Windows name, so every commit from a worktree failed.

Agents are required to take a linked worktree before touching a checkout that
holds another task's work, which made this a hard block rather than a nuisance.
Landed in infrastructure first, as the same prerequisite.

feat(claude): stamp a wildcard permission allow on every host

ci / aos-cli-tests (pull_request) Successful in 17s

Details

ci / aos-eval-tests (pull_request) Successful in 6s

Details

ci / ward-doctor (pull_request) Successful in 12s

Details

ci / gate (pull_request) Successful in 1m0s

Details

e5b00e1909

The fleet base already carried the deny half. It now carries the allow half
too: a single `*` appended to `permissions.allow`, matching what infrastructure
just took repo-locally.

Deny outranks allow, so this widens nothing the deny list closes. The
live-infrastructure CLIs and the memory directory stay shut. What it drops is
the prompt on everything else, and the enumerated allowlists it replaces were
never a boundary, since an agent denied one spelling of a read just reached for
a permitted one.

Append-only like the deny, so a host's accumulated allow entries are left in
place rather than evicted. They are inert once `*` is present, and they are
operator-local state no fleet writer should delete.

coilysiren merged commit a8978b8417 into main

2026-08-20 10:21:14 +00:00

coilysiren deleted branch chore/fleet-allow-wildcard

2026-08-20 10:21:14 +00:00

coilysiren referenced this pull request from a commit

2026-08-20 10:21:15 +00:00

feat(claude): stamp a wildcard permission allow on every host (#1165)