UfwDeleteRule needs a rule number that no action in the catalogue can produce

[vladimirrott]

Line references re-measured 2026-09-05 at 7d19864. command_mechanism("sudo", ["ufw", "status", "verbose"]) sits at line 127 now, not 124.
The defect is unchanged.

UfwDeleteRule is indexed by a rule number, and no action in the catalogue can produce one.

The parameter's own doc says where the value comes from (crates/sysknife-daemon/src/actions/ufw.rs:137):

/// `rule_number` is the 1-based integer shown by `ufw status numbered`.

The catalogue description repeats it to the planner, as "positive integer from 'ufw status numbered'". The only ufw read action runs the other rendering (crates/sysknife-daemon/src/actions/ufw.rs:127):

mechanism: command_mechanism("sudo", ["ufw", "status", "verbose"]),

grep -rn numbered crates/sysknife-daemon/src/actions/ufw.rs returns the doc comment and nothing else. status verbose prints no rule numbers; ufw renders them only for status numbered.

Why it matters

The documented workflow is a dead end. A planner asked to delete a firewall rule has no way to obtain the index, so it either guesses an index into a High-risk firewall deletion or tells the operator to leave SysKnife and run ufw by hand. Guessing is the worse branch: rule numbers shift as rules are added and removed, so a stale index deletes a different rule than the one the operator approved.

Scope

Either shape works:

• Add an optional numbered: bool to UfwStatus, so one action serves both renderings.
• Or add a UfwStatusNumbered read action.

The existing /usr/sbin/ufw grant in packaging/sysknife-sudoers already covers the argv, so no new privilege is needed. Whichever you pick, the new capability needs its KNOWN_ACTIONS entry and its risk level, and docs/action-reference.md regenerates.

A story would be worth adding in the same PR, since UfwDeleteRule currently has none. Correction, 2026-09-07 at adab560: it has one, and has since #206. tests/e2e/stories/story-125.sh drives the intent "delete ufw rule number 3". Read it before you change the action: it is the thing your change has to keep passing, and it was already there when this issue said otherwise.

$ ls tests/e2e/stories/story-125.sh && sed -n '1,7p' tests/e2e/stories/story-125.sh
tests/e2e/stories/story-125.sh
#!/usr/bin/env bash
# Story 125 (ubuntu, high-risk): Delete a numbered ufw rule
# Intent: "delete ufw rule number 3"
# Distro: ubuntu
set -euo pipefail
INTENT="delete ufw rule number 3"
echo "=== Story 125 (ubuntu): UfwDeleteRule ==="
$ git log --oneline -- tests/e2e/stories/story-125.sh
476e68d feat(e2e): give every Debian-only action a story, and make a retried run replay (#206)

Tests first

Assert the argv for the numbered form, then assert that the catalogue description no longer points the planner at a command SysKnife cannot run.

Difficulty

easy. One action or one parameter, and the sudoers grant already exists.

Getting started

CONTRIBUTING.md has the build and test commands. No CLA and no copyright waiver. The project is MIT.

[vladimirrott]

@kragent66-glitch #234 is small and it is the same shape as your #285.

That one pulled a duplicated frame limit into sysknife-types so two crates could not disagree about it. #234 is the other half of that idea: UfwDeleteRule takes a rule_number, documented as "the 1-based integer shown by ufw status numbered", and no action in the 190-action catalogue produces that listing. The parameter is real, the validator is real, and there is no supported way for the model to learn the number it needs.

Labelled easy and good first issue. It is self-contained in the ufw action family.

Say so here and it is yours. If it is not your thing, no need to reply.

[vladimirrott]

@kragent66-glitch checking in, with nothing attached to it. I offered you this one in late August and have not heard back. No obligation either way.

One thing worth knowing, and it is my fault rather than yours: the setup instructions in this repo were wrong until today. CONTRIBUTING.md told you to run pip install pre-commit && pre-commit install, which writes into .git/hooks and is ignored entirely once core.hooksPath points at .githooks, so you ended up with no gate at all. Four files told you to use pnpm, and there is no pnpm lockfile in the tree. And the prerequisites list named no tool that any required check needs, including cargo-nextest, whose absence makes scripts/ci-local.sh print PASS having run zero Rust tests.

All of that is fixed in #354, merged an hour ago. scripts/ci-local.sh --install-hooks is the command that actually installs the hooks, and docs/developer-guide.md now has a section on reproducing each required check, including the live Postgres one that people assume is maintainer-only.

If the build environment is what stalled you, it should be a much shorter road now.

This one is still a good first issue: UfwDeleteRule needs a rule number that no action in the catalogue can give you, so the action is unusable as it stands. Self-contained, no VM, no LLM key.

If you would rather not, say so and I will put it back in the pool.

[vladimirrott]

@sonalisrisivani held this for you as a follow-up to your #375. It is the same shape as the arm you just fixed: an action that asks for input the catalogue cannot give it. No pressure, and no deadline. Reply here that you want it and it is formally yours.

[vladimirrott]

@sonalisrisivani freeing this reservation, and the mistake behind it is mine.

I held #234 for you on 6 September without noticing I had already offered it to somebody else on 2 September, and I told neither of you. Two people aimed at one small fix means whoever finished second lost the evening for nothing.

You have #379 and #380 in flight, so yours is the reservation I release rather than theirs. That is scheduling, not a comment on your work: #380 is approved and waiting on a test-count bump I owe it.

Ask and this is yours again.

[vladimirrott]

@kragent66-glitch freeing this one, with nothing owed and no hard feelings. I offered it on 2 September and checked in on the 3rd, and quiet is a fine answer. It goes back in the pool, and it is yours again the moment you say so.

One correction, because the body was wrong when you read it. It claimed UfwDeleteRule has no story. tests/e2e/stories/story-125.sh has covered it since #206, and the body carries that correction now. What is left is narrower than the version you saw: no action in the catalogue produces the rule number UfwDeleteRule needs, so the number still has to come from somewhere the operator can see.

[QinXi-ai]

I'll take the now-released #234. I plan to add an optional boolean numbered to UfwStatus, preserving the existing verbose default and exposing the numbered form through the planner and direct MCP query. I'll cover fixed argv, invalid parameter rejection, and the catalogue description, and preserve story-125's existing deletion path. Please assign this to me. Codex is assisting implementation and validation.