feat: provision non-root Hub service

2026-07-10 15:59:35 +08:00
parent 5f791c5ce4
commit 73fa28a178
19 changed files with 1608 additions and 134 deletions
@@ -1,7 +1,7 @@
 # Provision a runnable non-root Hub service

 Type: task
-Status: open
+Status: resolved

 ## Question

@@ -11,3 +11,30 @@ configuration, honor the configured bind host, and fail preflight before unit
 installation when any required value or prerequisite is invalid. The persistent
 workspace root must be outside all release trees, and preflight must reject any
 path that overlaps rsync, release switching, rollback, or release pruning.
+
+## Answer
+
+The installer now creates or strictly validates a dedicated non-root,
+non-login service identity with no supplementary groups; provisions its
+home/state/cache/workspace directories at mode `0750`; and refuses persistent
+paths that overlap the deployment tree after both lexical and physical path
+resolution. A missing production environment file is seeded completely and
+exits with status 78; invalid configuration or prerequisites fail before the
+unit is written or enabled.
+
+Preflight validates the configured bind host/port, authenticated PostgreSQL
+access, Node/cph/Prisma, configured and canonical path traversal, and a real
+bubblewrap namespace. The post-provision phase runs the built Hub dependency
+graph, a database query, cph and bubblewrap as the service user under
+`no_new_privs`, matching the systemd security context. HTTP binding is awaited
+before the Feishu listener starts, so bind failure rejects startup instead of
+leaving a listener-only process alive.
+
+Verification evidence:
+
+- `npm run check`, `npm run build`, and `npm run prisma:validate`
+- 166 unit tests and 86 integration tests passed; one external-model test skipped
+- `bash -n deploy/install_service.sh` and `shellcheck deploy/install_service.sh`
+- `prisma migrate deploy`: 9 migrations found, none pending
+- production-mode HTTP smoke test on `127.0.0.1:8878` returned `/api/healthz`
+- final Standards and Spec reviews found no remaining Issue 10 gap
@@ -44,6 +44,7 @@ rollback and recovery, and no known critical security or data-integrity gaps.
 - [Audit the accepted product surface for production completeness](issues/07-audit-product-surface-completeness.md) — retain the guarded Organization APIs and single-app Feishu vertical slice, but require explicit Organization-scoped Feishu/provider connections and external-identity namespaces, private platform and Organization admin control planes, and the full ADR-0022 capacity surface before release.
 - [Decide the platform-administrator identity and audit boundary](issues/42-decide-platform-admin-identity-audit.md) — use a dedicated platform Feishu issuer, one peer administrator role, guarded bootstrap and identity-bound invitations, revocable server-side sessions, atomic append-only Platform Audit, and dual-factor offline recovery without a standing break-glass account.
 - [Restore the checker formatting gate](issues/09-restore-checker-format-gate.md) — pin local and CI Rust/rustfmt/clippy to 1.92.0, apply the canonical workspace format, and keep the full fmt + clippy + 53-test checker gate green.
+- [Provision a runnable non-root Hub service](issues/10-provision-nonroot-service.md) — install a strictly validated service identity and persistent layout, reject release/workspace overlap, validate complete production configuration and real bind settings, and execute Hub/Prisma/cph/bubblewrap probes as the service user under `no_new_privs` before writing the unit.

 ## Fog