fix(shell): stop a native session freezing its own path into gpg.program #1306

Merged

coilysiren merged 1 commit from aos/claude/pp94 into main

2026-08-27 03:58:46 +00:00

coilyco-ops commented

2026-08-27 03:55:26 +00:00

Owner

Closes #1137.

What was broken

gpg.program on Kai's Mac named a native-session home from 2026-08-06 whose temp root has since been purged, so gpg-ssm could not sign anything. Confirmed and now fixed on the host: the value is /Users/kai/.local/bin/gpg-ssm, and a probe commit returns %G? = G.

The mechanism, not just the value

A native session home symlinks .gitconfig to the durable one while $HOME itself is session-scoped. So the documented wire-up, git config --global gpg.program "$HOME/.local/bin/gpg-ssm", writes an ephemeral path into durable config. The same trap sits one layer down: apply-shell-links derives its link sources from its own checkout, so running it from a shadow worktree would point ~/.local/bin/gpg-ssm at a path that dies with the session.

scripts/apply-shell-links.py now:

owns gpg.program alongside the symlink it names, so one command wires both and there is no hand-run git config to get wrong
resolves the durable host home rather than $HOME, so wiring up from inside a session still records a path that outlives it
refuses to run from a native-session checkout
reports both as drift under -- --check, which is the detector the issue asked for

docs/install.md, the tooling-gpg-ssm skill, its debugging notes, and the justfile comment all move to just apply-shell-links as the wire-up.

Left for Kai

Two of the issue's three settling conditions are decisions, not work, and are asked on the issue rather than assumed here: whether commit.gpgsign should default to true on this fleet, and whether ssm-get is deliberately interactive-only (Finding 2). Fleet convergence of the corrected value stays with infrastructure/ansible per the authoring-versus-rollout contract.

Verification

uv run pytest tests/ - 730 passed
uv run pre-commit run --all-files - clean
just apply-shell-links -- --check from the canonical checkout flagged the purged path before the fix and is quiet on gpg.program after

Closes #1137. ## What was broken `gpg.program` on Kai's Mac named a native-session home from 2026-08-06 whose temp root has since been purged, so `gpg-ssm` could not sign anything. Confirmed and now fixed on the host: the value is `/Users/kai/.local/bin/gpg-ssm`, and a probe commit returns `%G?` = `G`. ## The mechanism, not just the value A native session home symlinks `.gitconfig` to the durable one while `$HOME` itself is session-scoped. So the documented wire-up, `git config --global gpg.program "$HOME/.local/bin/gpg-ssm"`, writes an ephemeral path into durable config. The same trap sits one layer down: `apply-shell-links` derives its link sources from its own checkout, so running it from a shadow worktree would point `~/.local/bin/gpg-ssm` at a path that dies with the session. `scripts/apply-shell-links.py` now: * owns `gpg.program` alongside the symlink it names, so one command wires both and there is no hand-run `git config` to get wrong * resolves the durable host home rather than `$HOME`, so wiring up from inside a session still records a path that outlives it * refuses to run from a native-session checkout * reports both as drift under `-- --check`, which is the detector the issue asked for `docs/install.md`, the `tooling-gpg-ssm` skill, its debugging notes, and the justfile comment all move to `just apply-shell-links` as the wire-up. ## Left for Kai Two of the issue's three settling conditions are decisions, not work, and are asked on the issue rather than assumed here: whether `commit.gpgsign` should default to `true` on this fleet, and whether `ssm-get` is deliberately interactive-only (Finding 2). Fleet convergence of the corrected value stays with infrastructure/ansible per the authoring-versus-rollout contract. ## Verification * `uv run pytest tests/` - 730 passed * `uv run pre-commit run --all-files` - clean * `just apply-shell-links -- --check` from the canonical checkout flagged the purged path before the fix and is quiet on `gpg.program` after

coilyco-ops added 1 commit

2026-08-27 03:55:26 +00:00

fix(shell): stop a native session freezing its own path into gpg.program

ci / aos-eval-tests (pull_request) Successful in 8s

Details

ci / ward-doctor (pull_request) Successful in 7s

Details

ci / aos-cli-tests (pull_request) Successful in 26s

Details

ci / gate (pull_request) Successful in 1m14s

Details

0084df5afc

`gpg.program` on this host named a native-session home from 2026-08-06 that
the temp root has since purged, so gpg-ssm could not sign anything and the
signature half of the pull-verification policy was verifying nothing.

The value rotted because a session home symlinks `.gitconfig` to the durable
one while `$HOME` itself is session-scoped, so the documented wire-up records
an ephemeral path into durable config. `apply-shell-links` now owns that
setting alongside the symlink it names, resolves the durable home rather than
`$HOME`, and refuses to run from a session checkout, where every link it
wrote would carry the same defect. `--check` reports the drift.

Closes #1137

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform