feat(mother): add mother-sync-hive-keys — rebuild authorized_keys from vault #140

Merged

clawdie merged 1 commit from mother-sync-hive-keys into main

2026-06-21 20:31:17 +02:00

clawdie commented

2026-06-21 20:19:51 +02:00

Owner

Mother side of the vault-mediated hive key exchange. Pulls the hive-pubkey-* items agents publish to Vaultwarden and rebuilds the colibri user's authorized_keys, each entry restricted to the MCP command (command="colibri-mcp",restrict,no-pty,no-*-forwarding).

Rebuild, not append → deleting an agent's vault item revokes it next run.
Fail-safe → a vault/login failure leaves authorized_keys untouched.
Atomic write (mktemp + mv), colibri-owned 0600.
Tunable via PROVIDER_ENV / COLIBRI_HOME / COLIBRI_USER / MCP_COMMAND — mother = osa for now; a dedicated host is just a config change.
Cron-driven (sample in header). Uses the bitwarden-cli-vault skill patterns.

Verified: sh -n clean; parse/rebuild core tested (filters non-key items, strips key comments, applies the restriction wrapper). Needs Hermes hardware validation on osa (bw + the hive-pubkeys items + sshd).

🤖 Generated with Claude Code

Mother side of the vault-mediated hive key exchange. Pulls the `hive-pubkey-*` items agents publish to Vaultwarden and **rebuilds** the colibri user's `authorized_keys`, each entry restricted to the MCP command (`command="colibri-mcp",restrict,no-pty,no-*-forwarding`). - **Rebuild, not append** → deleting an agent's vault item revokes it next run. - **Fail-safe** → a vault/login failure leaves `authorized_keys` untouched. - Atomic write (mktemp + mv), colibri-owned `0600`. - Tunable via `PROVIDER_ENV` / `COLIBRI_HOME` / `COLIBRI_USER` / `MCP_COMMAND` — **mother = osa for now**; a dedicated host is just a config change. - Cron-driven (sample in header). Uses the `bitwarden-cli-vault` skill patterns. Verified: `sh -n` clean; parse/rebuild core tested (filters non-key items, strips key comments, applies the restriction wrapper). Needs Hermes hardware validation on osa (bw + the `hive-pubkeys` items + sshd). 🤖 Generated with Claude Code

clawdie added 1 commit 2026-06-21 20:19:53 +02:00

feat(mother): add mother-sync-hive-keys — rebuild authorized_keys from vault

CI / rust (pull_request) Has been cancelled

Details

CI / markdown (pull_request) Has been cancelled

Details

CI / port (pull_request) Has been cancelled

Details

CI / agent-jail-pkgs (pull_request) Has been cancelled

Details

7f0782635d

Mother side of the vault-mediated hive key exchange (direction B — agents call
mother). Pulls the hive-pubkey-* items agents publish to Vaultwarden and rebuilds
the colibri user's authorized_keys, each entry restricted to the MCP command
(command="colibri-mcp",restrict,no-pty,no-*-forwarding).

- Rebuild, not append: deleting an agent's vault item revokes it next run.
- Fail-safe: a vault/login failure leaves authorized_keys untouched.
- Atomic write (mktemp + mv); colibri-owned 0600.
- Tunable via PROVIDER_ENV / COLIBRI_HOME / COLIBRI_USER / MCP_COMMAND
  (mother = osa for now; a dedicated host is a config change).
- Cron-driven (sample line in the header). Uses the bitwarden-cli-vault skill's
  session + authorized_keys-rebuild patterns.

sh -n clean; parse/rebuild core tested (filters non-key items, strips key
comments, applies the restriction wrapper).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>