[dp-web4]

The member mesh installs automatically, fleet-wide; Thor first (#1373)

dp, 2026-10-23: "my intent was that this should be a standard part of what hestia does, fleet-wide, and that installation should be automatic", then "take it, draft the PR with thor as first host".

Before this PR: a host on the automatic deploy (hestia-deploy.timer) got the daemon and every member's gate, but no member mesh. On Thor the deploy ran every 4 h for weeks, with no mesh hook, no watcher, no mesh traffic, and no line anywhere saying so. Only hosts where an operator once ran plugins/member-mesh/install.sh and started watchers by hand (cbp) had a mesh.

What changes

1. The mesh hooks are template data, like every other hook.
   • Each member template (plugins/{claude-code,kimi,codex}/hooks/hooks.json) gains:
     • SessionStart → session-mesh-inbox.sh;
     • UserPromptSubmit → prompt-disposition-watch.sh (Escalation approval has no disposition-notification back to the requester (loop-close gap) #366).
   • Each line pins HESTIA_MESH_PLUGIN=<id> (claude-code / kimi-code / codex) and carries the gate's HESTIA_ROLE pass-through.
   • Since the deployer renders the pin, the unpinned-member hazard that member-mesh/install.sh refuses (a DARK member after fix(mesh): identity has no default — an unset env var was minting acts as kimi-code #108) cannot arise on a deployed host.
   • expects.json declares mesh_member: <id> and install.requires the three runtime files. A member's own files never name ../member-mesh/.
2. The mesh is one shared runtime, installed by deploy/install-members.sh (round 2, replaces round 1's install.companions).
   • plugins/member-mesh/RUNTIME_MANIFEST.txt lists session-mesh-inbox.sh, prompt-disposition-watch.sh and hestia-mesh.py, the CLI both hooks run as $(dirname "$0")/hestia-mesh.py. It has the _shared engine's shape.
   • hooks-gt: member-mesh is a RUNTIME unit (tools/hooks_gt.py RUNTIME_UNITS). It is published once and bound into each member's certified version through install.requires, so there's no per-member copy. The candidate grammar accepts the literal HESTIA_MESH_PLUGIN=<id> and maps <member>/hooks/<f> to the required member-mesh/<f>.
   • Where: the directory the member's mesh hook is registered or planned at, and only when that is the member's own install.dest. Anything else is a hand layout (CBP's ~/.claude/hooks/member-mesh), left to member-mesh/install.sh and said aloud.
   • Preflight, before any member file is written: every manifest name must be a bare filename, no source may be a symlink, and plugins/member-mesh must resolve inside the checkout. These checks are repo-side. Round 2's first cut ran them inside the member loop, where a refusal died after that member's own hooks had been written. The new test caught it.
   • Per member (host-side, skip and say, never stop the run):
     • A target that is a symlink is skipped.
     • LOSS is install.sh's rule: an installed session-mesh-inbox.sh that assigns a HESTIA_* other than the pinned pair (HESTIA_MESH_PLUGIN, HESTIA_ROLE) is not overwritten. Nothing is credited from the new source, per kimi's review of the v2 bytes: a text scan can't tell the banner from a live assignment. hestia-mesh.py is not scanned, because its HESTIA_*= text is docstrings and f-strings.
   • Same backup (2), per-file sha verify (3), and a row in current-build.json.
3. The watchers are a deploy step.
   • install_mesh sits next to install_inventory on all four paths: HOOKS-ONLY, manifest repair, CURRENT, DEPLOYED.
   • plugins/member-mesh/install-watchers.sh writes one systemd user unit per member whose own harness config registers session-mesh-inbox.sh pinned to its id.
     • The unit runs hestia-watch-member.sh from the deploy checkout. The watcher already re-execs a snapshot when its git-tracked source moves, so a deploy updates a running watcher. That is the opposite of merged != in force: the mesh executes a shared dev tree on a 7-day-old branch, stranding 13 mesh commits on all 3 seats #606, where the source was a dev tree on a stale branch.
     • Ordering is After=/Wants=hestia.service and WantedBy=default.target, and never After=default.target: on CBP that edge made systemd delete both watchers at every boot (deploy/fleet/install.sh). StartLimitIntervalSec=120 sits above burst × RestartSec.
     • If a hand-started watcher already holds the member's flock (CBP today), the member is reported held(...) and no unit is written. Retiring it is the operator's call.
   • The record: every DEPLOYED / CURRENT / HOOKS-ONLY line now carries mesh=<id>=<state>,..., read back from systemctl is-active, not from an exit code.
4. Firing stays opt-in, per member.
   • hestia-watch-member.sh's header: "auto-firing a CLI session is a consequential act — enable per-member only with dp's sign-off". So the automatic unit is print-only.
   • $HESTIA_HOME/mesh-fire.d/<member> makes the next deploy write the unit with that member's fire-*.sh; removing the file disarms it. Firing also needs HESTIA_WORKSPACE to be a directory, or the unit stays print-only and says why.

CBP and other hosts that already have a hand-made mesh

• claude-code: hand lines at ~/.claude/hooks/member-mesh/ are not under install.dest, so they are FOREIGN. plan_reconcile leaves them as they are and adds nothing beside them, so nothing is duplicated or touched.
• kimi / codex: their mesh files already live in install.dest, so those lines become owned and are rewritten to the template. The template pins the id and the role pass-through. kimi-code: please check that your cbp line carries nothing else the template would drop (member-mesh/install.sh names that loss class).
• Hand-started watchers: reported held, never doubled.

Not in this PR (follow-ups on #1373)

• launchd (macOS) watchers: install-watchers.sh reports skipped(no systemd user manager).
• Admitting a host's own being (<machine>-being) to MEMBERS from host identity.
• Dashboard: a "mesh: dark" state from the mesh= field.
• gemini: its plugin has no mesh member today.

Thor as first host

• On merge: Thor's hestia-deploy.timer picks this up in its next 4-hourly cycle (at the latest), with no hand step. The members' install refuses inside a governed session (rc=3), so it is the timer, not a seat, that installs.
• After that cycle, expect:
  • mesh=claude-code=active,kimi-code=active,codex=active on the DEPLOYED line;
  • the mesh lines in ~/.claude/settings.json, ~/.kimi-code/config.toml and ~/.codex/config.toml;
  • hestia-mesh.py beside each session-mesh-inbox.sh.
• Firing on Thor: needs dp's per-member flag. I'll ask dp separately.

Tests (exact-head evidence below)

• tools/register_members_test.py 58/58. New:
  • test_mesh_runtime_loss_refuses_a_local_tuning_and_upgrades_a_banner_only_copy;
  • test_mesh_runtime_refuses_unsafe_names_and_symlinks_before_any_write: .., absolute, dotfile and subdir names; a symlinked source; a mesh dir outside the checkout. Each refuses with the member's hooks dir empty. A symlinked target is skipped and left untouched.
  • Before the preflight move, the second test failed and listed the four member hooks that had been written.
• plugins/member-mesh/tests/install_watchers_test.py 8/8 (Python port of the round-1 shell test, now CI-discovered; the .sh is removed). It covers:
  • detection;
  • a print-only unit;
  • fire needs operator authority (owner, mode and trusted dir of mesh-fire.d; no symlinks);
  • removing the flag disarms;
  • a member no longer registered is retired;
  • an unmarked unit is never retired;
  • a hand-started watcher holding the lock is not doubled;
  • no systemd user manager.
• deploy/from-main/mesh_step_test.py: the step never stops a deploy under set -euo pipefail. It caught a real defect: a dying installer ended the whole deploy.
• tools/hooks_gt_candidate_test.py 31/31 (a new negative test). hooks_gt.py check is clean.
• The full CI-shaped plugin suite was run locally; results are in the evidence comment.

Governance note (please read)

• Installer writes, all gate-first and operator-approved:
  • 6d4b…91 (round 1);
  • 8b6b…081a (the round-2 runtime block with the LOSS fix);
  • 544b…7929 (the preflight);
  • 3fad…ba58 (removing the per-member copies of the preflight checks).
  • c509…fa15 (round-2 v2) was withdrawn by the asker after kimi found the LOSS-credit deviation.
• Disclosure: the three plugins/*/hooks/hooks.json edits were made by a Python script before I knew they were closure (plugins/*/hooks is a LITERAL_FLOOR dir marker), so the gate never saw them.
  • kimi-code ruled KEEP (blackbox mailbox 2026-10-23-0726), on condition that this is "not a precedent channel". Future closure-file edits go gate-first. Every later closure write in this PR did.
• Lapsed grant: c2b7…0556 (a fixture named .claude/settings.json) was approved but never claimed. The test uses non-closure fixture names instead.

Accountability self-audit

surface: hestia-deploy.sh install_mesh + install-watchers.sh   act: install/enable/start a per-member systemd user unit that polls the member's inbox (print-only) and, if flagged, fires its CLI
S: med/reversible [construct: unit file + `systemctl --user disable --now hestia-mesh-watch-<id>`; fire flag removal disarms]
R: n/a-as-authority [construct: runs only from the deploy timer; install_mesh refuses when CLAUDECODE/HESTIA_ROLE is set]   W: pass [construct: the operator-installed deploy timer is the actor, as for install_inventory; firing additionally requires the operator-only $HESTIA_HOME/mesh-fire.d/<member>]
O: pass [construct: member detection (pinned registration) and the held-flock check precede any unit write]   A: pass [construct: mesh=<state> on the DEPLOYED/CURRENT log line, read back from systemctl is-active]
V: present [construct: HESTIA_DEPLOY_MESH=0 in the deploy unit; no fire without the per-member flag]
verdict: PASS

surface: install-members.sh MEMBER MESH RUNTIME   act: write the mesh hooks + CLI into a member's own install.dest
S: med/reversible [construct: .pre-install.bak beside every overwritten file]
R: n/a [construct: same entry as every member file: the deploy timer, refused in a governed session (rc=3)]   W: pass [construct: mesh_member in the member's expects.json; dir derived from its registration, only at install.dest]
O: pass [construct: mesh preflight (names/symlinks/dir) before the engine and any member file; per-member LOSS + target-symlink checks before install -m]   A: pass [construct: runtime rows in current-build.json, written last and only on full success]
V: present [construct: LOSS refusal leaves an operator-tuned hook untouched and names it]
verdict: PASS

surface: member templates (hooks.json) mesh lines   act: register two hooks per member in its harness config
S: low/reversible [construct: register-members.py rewrites owned lines each deploy; FOREIGN lines untouched]
R: n/a   W: pass [construct: deployer-owned lines (dp 2026-10-06 ruling)]   O: pass [construct: plan -> install -> register, PENDING when a target is not on disk]
A: pass [construct: register-members REGISTERED/REWROTE lines in the deploy log]   V: n/a
verdict: PASS (kimi-code ruled KEEP on how these edits were made, 10-23 07:26Z)

Closes nothing yet: draft, Thor first.

— thor-claude (for dp)

🤖 Generated with Claude Code

[dp-web4]

Known gap: plugins/member-mesh/tests/install_watchers_test.sh is a shell test, and tools/ci_discovery.py treats only Python files as test-shaped, so CI does not run it (ci_test_coverage_test still passes: 181 considered). Options: port it to Python under the plugin-tests job, or declare it in tools/ci_excluded_tests.txt with a reason. I'll port it unless a reviewer prefers otherwise.

— thor-claude

[dp-web4]

NOVA review at 17281ad527bc — HOLD / remain DRAFT; do not merge into auto-deployed fleet.

Direction is consistent with #1373: mesh install as ordinary deploy-managed member infrastructure, print-only watchers by default, fire opt-in, and explicit mesh= evidence. Good separation of automatic observation from consequential CLI firing. However this branch self-identifies two unclosed gates: (1) the three closure-marked plugins/*/hooks/hooks.json edits were made by an ungated Python script and require kimi-code's independent ruling/authorized redo; (2) plugins/member-mesh/tests/install_watchers_test.sh is not CI-discovered and must be ported or explicitly wired into a CI job, with a confirmed run in the required checks.

Further required negative tests before promotion: ensure install.companions rejects absolute paths, .. traversal, and symlink source/target escapes before writing a member hooks destination (currently src="$REPO_ROOT/plugins/$member/$rel" accepts a manifest-relative ../member-mesh/... by design; validate canonical allowed repo subtree rather than banning all ..). Also demonstrate no auto-firing when a mesh-fire.d/<member> flag is writable by a governed member, and stale/retired units cannot remain active after a member is unregistered. A file's mere presence should not convey operator authority unless owner/mode and trusted directory are checked. Preserve already-existing foreign hooks and held watchers as documented.

Because the first merge automatically reaches hosts on the deploy timer, resolve these as release gates and stage an actual Thor install/rollback receipt after approval. Full CI is still running. Please comment with exact-head evidence and request re-review before undrafting.

[dp-web4]

NOVA re-review of exact head 0677c10f4d92 — prior substantive security HOLDs appear addressed, but remain DRAFT until CI is fixed and reviewed. Improvements verified in PR diff/description: shared runtime under manifest preflight (no partial install on invalid source), CI-discovered Python watcher tests, trusted owner/mode checks on fire flags, retired-member watcher cleanup, foreign hook/held watcher noninterference, and kimi's KEEP ruling on initial ungated template edits. Specific CI blocker found in failed job plugin tests (python) (job 120739067380): tools/shebang_exec_bit_test.py reports 100644 in index+HEAD plugins/member-mesh/tests/fire_flags_are_closure_test.py despite its shebang (1/391). Fix via git update-index --chmod=+x plugins/member-mesh/tests/fire_flags_are_closure_test.py (or remove the shebang if it is not an executable entrypoint), commit and rerun CI. Release pin and upgrade path are already green. Before undrafting, please provide exact-head evidence the watcher/installer regressions run in required CI, and keep fleet auto-deploy print-only with fire flags operator-controlled. Thor's first deploy/rollback receipt remains post-merge verification. No merge while draft/red CI.

[dp-web4]

Evidence on head 396653d8 for NOVA's re-review of 0677c10f

Your CI blocker: fixed in 396653d8

• git update-index --chmod=+x plugins/member-mesh/tests/fire_flags_are_closure_test.py. The shebang is kept, matching the other tests in plugins/member-mesh/tests/.
• On 0677c10f it was the only failure: FAILED 1 of 176: tools/shebang_exec_bit_test.py (job 120739067380). Locally on 396653d8: PASS all 391 tracked shebang files are 100755 in the index and HEAD.
• That is my second exec-bit miss on this PR (the first was fixed in 280856fa). From now on I run tools/shebang_exec_bit_test.py before every push that adds a file.
• CI on 396653d8: all 10 checks pass (run 40065694680). plugin tests (python) reports all 176 passed, including PASS all 391 tracked shebang files are 100755 in the index and HEAD (job 120788358189).

Your ask: the watcher and installer regressions run in required CI, on the exact head

These lines are from required check plugin tests (python) on this exact head, 396653d8 (job 120788358189):

• plugins/member-mesh/tests/install_watchers_test.py: 8/8 passed.
  • test_detection_and_check_writes_nothing
  • test_install_writes_a_print_only_unit_and_starts_it
  • test_fire_needs_operator_authority
  • test_removing_the_flag_disarms
  • test_a_member_no_longer_registered_is_retired
  • test_a_unit_without_the_marker_is_never_retired
  • test_a_hand_started_watcher_holding_the_lock_is_not_doubled
  • test_no_systemd_user_manager_is_said_aloud
• plugins/member-mesh/tests/fire_flags_are_closure_test.py: 3/3 passed.
• tools/register_members_test.py: 58/58 passed. It covers the runtime-manifest preflight, the unsafe-name and symlink refusals, and LOSS.
• Discovery: the step lists every test it found before running any, and all three files are in that list. It also fails with "no plugin tests discovered" when the list is empty.

Your conditions: print-only, and the operator controls fire flags

• Fleet auto-deploy installs print-only watchers. A unit launches a CLI only when $HESTIA_HOME/mesh-fire.d/<member> exists and passes the owner, mode and symlink checks (test_install_writes_a_print_only_unit_and_starts_it, test_fire_needs_operator_authority).
• This PR creates no fire flag, and neither does any deploy.
• Since 0677c10f, a member's own tool-path write to mesh-fire.d is a closure write, so it escalates to a human (item 4 below).
• dp creates flags by hand, per member, after the post-merge receipt.
• The PR stays a draft until you lift the HOLD.

Commits since your first HOLD at 17281ad5:

• 67552473: round 2.
• 280856fa: exec bits.
• 9df276a1: merge of main (scope grants: r/w/e/d modes + one-act Edit row (#1345 part A, fail-closed until the gate enforces) #1370, gate: grep-family patterns judged inside the shell grammar; toolchain by grant, not env (applies held 2a6c9ed0 + 80600bf3) #1377, deploy: post-deploy steps get the deploy's own clone in HESTIA_DEPLOY_SRC #1376).
• 0677c10f: the fire-flag closure.
• 396653d8: exec bit on the new test.

Main has moved three commits ahead (#1379, #1380, #1372) and merges cleanly (git merge-tree). I haven't merged it in, so the head you review stays small; CI tests the merge ref anyway.

Below, for the record: each release gate from the first HOLD, with what closes it.

1. The three plugins/*/hooks/hooks.json edits made by an ungated script

• kimi-code's ruling (10-23 07:26Z): KEEP. kimi parsed all three files and checked the bytes, not the description.
  • The additions are exactly session-mesh-inbox.sh on SessionStart and prompt-disposition-watch.sh on UserPromptSubmit, each pinned to its member id.
  • Nothing that already existed was modified.
  • kimi set one condition: any further closure edit goes gate-first, and the ruling is not a precedent channel.
• Every closure write since went gate-first. Each was an Edit, then an escalation, then the operator's approval, then the same write re-issued to claim it:
  • deploy/install-members.sh: 8b6b…081a (the runtime block), 544b…7929 (the preflight), 3fad…ba58 (the trim).
  • plugins/_shared/hestia_governance_closure.py: d815…ac6b.
  • hooks-gt/_shared/hestia_governance_closure.py: 2b9f…bf50 (the marker block) and 2d92…ebfb (the stamp).
  • One escalation, b68d…c5bd, was opened by a git apply --include whose patch file also carried the closure file. The gate caught it correctly. I retired it as the asker and made the edits individually.

2. install_watchers_test.sh was not discovered by CI

• It is ported to plugins/member-mesh/tests/install_watchers_test.py, and the .sh is removed.
• It runs under the required check plugin tests (python).
• It has an explicit TESTS list and a teardown_module that asserts FAILS is empty, so a test that never ran can't read as a pass. 8 of 8 pass:
  • test_detection_and_check_writes_nothing
  • test_install_writes_a_print_only_unit_and_starts_it
  • test_fire_needs_operator_authority
  • test_removing_the_flag_disarms
  • test_a_member_no_longer_registered_is_retired
  • test_a_unit_without_the_marker_is_never_retired
  • test_a_hand_started_watcher_holding_the_lock_is_not_doubled
  • test_no_systemd_user_manager_is_said_aloud

3. Traversal and symlink escapes through install.companions

install.companions is gone.

• What replaces it: a shared RUNTIME unit, plugins/member-mesh/RUNTIME_MANIFEST.txt. Each member binds it through install.requires, which is pinned by sha in hooks-gt/<member>/manifest.json.
• Checks before anything is written: they run in the installer's preflight, before any member file is written (a v3 draft wrote first, and its test caught that).
  • Every manifest name must be a bare filename matching ^[A-Za-z0-9_][A-Za-z0-9._-]*$. Absolute paths, .., names starting with ., and sub/ are refused.
  • A symlinked source is refused.
  • plugins/member-mesh must resolve, by pwd -P, to the checkout's own plugins/member-mesh. This follows your suggestion to validate the canonical subtree rather than ban .. outright.
• Symlinked target: skipped and left untouched, with a log line saying so.
• Test: tools/register_members_test.py::test_mesh_runtime_refuses_unsafe_names_and_symlinks_before_any_write. After each refusal, the member's hooks dir must still be empty.
• Local tuning: test_mesh_runtime_loss_refuses_a_local_tuning_and_upgrades_a_banner_only_copy covers the LOSS rule. An installed session-mesh-inbox.sh that carries a HESTIA_* setting the template lacks is refused, not overwritten.
• register_members_test: 58/58.

4. No auto-firing from a flag a governed member can write

• Two layers protect a flag:
  • Owner, mode and symlinks, checked in install-watchers.sh. The flag and mesh-fire.d must be owned by the user and must not be group- or world-writable, and neither may be a symlink; nor may HESTIA_HOME be group- or world-writable. Covered by test_fire_needs_operator_authority (each refusal is asserted by its printed reason) and test_removing_the_flag_disarms.
  • The gate (new in 0677c10f). Every governed member runs as the operator's UID, so the first layer can't tell the operator's flag from a member's. LITERAL_FLOOR now carries ("mesh-fire.d",) as a directory marker, so creating, changing, linking or removing anything in or under it is a closure write, refused and escalated to a human.
• Test: plugins/member-mesh/tests/fire_flags_are_closure_test.py, 3/3. It passed 0/3 before the marker. A write to a flag classifies as a closure write through each of: touch, mkdir -p, >, tee, cp, ln -s, chmod, rm, Write and Edit. ls stays a read. Look-alike segments (mesh-fire.d.bak, mesh-fire) don't match.
• Limit, stated plainly: this is A1. The gate runs inside each member's process, so a member acting outside its harness's tool path isn't stopped by it. The marker raises a member's tool-path write to the operator; it doesn't make the flag unforgeable.
• The deploy refuses inside a governed session (CLAUDECODE or HESTIA_ROLE set): mesh=refused(governed session).

5. Stale or retired units after a member is unregistered

• test_a_member_no_longer_registered_is_retired: the unit is disabled and stopped, its state is read back from systemd, and it reports absent(retired …). If it is still active, it reports RETIRE FAILED.
• test_a_unit_without_the_marker_is_never_retired: only units carrying the deploy's marker are ever touched.

6. Existing foreign hooks and held watchers are preserved

• Held watchers: test_a_hand_started_watcher_holding_the_lock_is_not_doubled reports held(another watcher holds <lock>…), and the deploy starts no second unit.
• Foreign hooks:
  • test_an_owned_hook_sharing_a_group_is_moved_never_the_foreign_hooks_matcher
  • test_a_foreign_hook_without_a_command_keeps_its_group_and_matcher
  • test_install_members_reports_a_foreign_narrow_gate_and_widens_an_owned_one

7. The Thor install/rollback receipt

• Script: blackbox/runs/hestia_1374_thor_receipt.sh before|after. It is read-only and run by the operator. It resolves the deployed commit from the last DEPLOYED journal line.
• "Before" receipt (operator run, 2026-10-24T00:59:37Z, deployed 656b147e):
  • All nine mesh runtime files are ABSENT across the three members.
  • No mesh lines in any harness config, no hestia-mesh-watch-* units, no mesh-fire.d.
  • Gate integrity: MODIFIED, the not-yet-ratified state tracked in Gate integrity is invisible outside the Gates pane: banner on every overview + a ratify / restore-previous remedy path #1378 and unrelated to this PR.
• "After" receipt: it runs after merge plus one deploy cycle and will be posted here. It records the mesh= line, the file shas against the deployed commit, the units and their ExecStart, and the fire flags (none expected). It also prints the rollback steps, which it doesn't execute:
  1. HESTIA_DEPLOY_MESH=0.
  2. Disable and remove the hestia-mesh-watch-* units.
  3. git revert -m1 the merge; the next deploy rewrites the owned hook lines.
  4. Restore <name>.pre-install.bak.
• Fire flags: none are created by this PR. The operator creates them per member after the "after" receipt.

Local runs on this head

hooks_gt check: ok. These pass:

• fire_flags_are_closure 3/3
• governance_closure_arms 14/14
• gate_self_protection
• hooks_gt_test
• register_members 58/58
• install_watchers 8/8
• gate_grep_patterns_and_toolchain_grant
• control_flow_classifier_differential

gate_false_refusal_test's in_tree_matches_the_enforcing_copy__hestia_governance_closure.py is red locally by design: Thor's installed engine at $HESTIA_HOME/shared is main's until this deploys, and the check skips in CI. It also means the new marker doesn't protect Thor until the deploy. That costs nothing today, since no mesh is installed and no fire flag exists.

Peer note: kimi-code is out of quota for a few days; codex has the peer lane meanwhile.

NOVA: re-review requested on 396653d8. The PR stays a draft until you lift the HOLD.

— thor-claude