Files

B.D. Murphy 0c9bea72e0 Add enterprise/infra tooling and repoint Qwen3-TTS submodule to internal fork

Two groups of changes, committed together as the follow-up to the initial push:

1. .gitmodules — submodule Qwen3-TTS now points at the internal Gitea fork
   (ssh://git@mini-eq:2222/umbragit/Qwen3-TTS.git) instead of upstream GitHub,
   so a clone actually gets the UmbraAudio branding/integration commit
   012e452 rather than vanilla upstream.

2. New infra/ tooling for the cross-machine work in spec 21: agent_bridge,
   remote_credential_broker (Keychain-backed, secrets read at runtime and
   generated via read_secret/random_secret — no hardcoded credentials), the
   enterprise bootstrap scripts, and the oldbox SSH/auth prompts. Plus
   backup/ restore scripts, two specs (18 UmbraTrans, 19 enterprise control
   plane), umbraaudio/voices/lmstudio_gate.py, and in-flight edits to the
   discovery/attribution/profiling modules, config, chapter_builder, emotion,
   pronunciation, qwen_tts and routes.

Also adds *.db to .gitignore: SQLite project databases are runtime state and no
.db file was tracked before.

Verified before staging: .env's only change is UMBRA_TTS__QWEN_TTS_HELPER_URL and
the committed copy has zero secret-looking values; the broker ships only
config.example.json.

2026-10-06 06:57:41 -07:00

3.2 KiB

Raw Permalink Blame History

One-hour temporary UmbraTrans access setup

You are the OpenCode agent running on oldbox. The human operator has authorized a one-hour temporary access window for finishing the UmbraTrans workspace and communication setup.

Goal

Create a temporary, unprivileged Linux account for Mac-side automation, using a password entered locally in a hidden prompt. The Mac broker will use the same one-hour credential for SSH. After one hour, the account and credential must no longer work.

Account

Use this exact temporary username:

umbracontrol-temp

Create it with:

home /home/umbracontrol-temp, mode 0700
shell /bin/bash
no membership in sudo, docker, mysql, lpadmin, or other privileged groups
account expiry exactly one hour from creation
a locally entered hidden password; never print, log, echo, or place it in a file, command argument, environment variable, report, or MCP message

Use a local hidden prompt in the oldbox terminal. For example, adapt this pattern safely in the agent's shell:

read -rsp 'Temporary UmbraTrans password: ' TEMP_PASSWORD
printf '\n'
test -n "$TEMP_PASSWORD"

Pass the value to chpasswd through standard input, not an argument. Clear the shell variable immediately afterward. Do not repeat the value in output.

Set the account password and expiration with sudo locally. The human may enter the sudo password in the terminal; never request it in chat.

Schedule cleanup for one hour using a root-owned transient systemd timer or an equivalent root-owned one-shot cleanup. Cleanup must:

lock and delete umbracontrol-temp
remove /home/umbracontrol-temp
remove any temporary authorized-key or agent files
leave umbra, Qwen, Docker, MySQL, Samba, Webmin, XRDP, and PostgreSQL unchanged

Verify before reporting:

id umbracontrol-temp
getent passwd umbracontrol-temp
passwd -S umbracontrol-temp

Do not print hashes or secret values.

Temporary Mac broker profile

After creating the account, write a sanitized report containing:

username umbracontrol-temp
host oldbox.bdmurphy.me
port 22
account expiry timestamp
cleanup mechanism/timer name
home path and permissions

Do not include the temporary password in the report. The Mac operator will enter the same one-hour password through the local secure popup.

Workspace

Use the temporary account only for safe, unprivileged workspace operations:

create /home/umbracontrol-temp/UmbraTrans
report the path and ownership
do not alter /home/umbra ownership or permissions
do not modify existing services
do not grant sudo
do not install packages
do not change firewall rules

Root-required application/database/backup work remains a separate explicit operation after the temporary SSH path is verified.

Sanitized diagnostic report

Send the report through the local agent-comm MCP server if it is already available. Otherwise write it atomically to:

/tmp/umbracontrol-temp-setup-report.json

The report may contain only non-secret account, expiry, permission, and service-status data. Use mode 0600.

At the end print:

TEMP_SETUP_READY
READY_FOR_MAC_AGENT

Do not claim the Mac has connected until the Mac broker reports a successful SSH status probe.

3.2 KiB Raw Permalink Blame History