Repository navigation
Heinzel 3.0: read disks, boot, accounts and secrets; Heinzel Pro changes them - #71
Merged
Merged
Conversation
Partition tables, boot loaders, OS replacement, creating or widening access, rotating secrets, unattended runs and fleet comparisons need a second person, an identity, a schedule or an evidence chain, and a single admin at a terminal has none of those. They move to Heinzel Pro, and heinzel keeps the reading half of each plus one refusal line. The guard loses its off switch and gains the boot writers, account deletion and the sudoers and account files, because those are the effects that lock a host or a person out. Team mode goes with it: one checkout, one person (#70). An AI agent wrote this text in my name. I know that is problematic.
A major release because six rules and a skill leave, deploy users and secret rotation shrink to reading, and the guard no longer honours HEINZEL_GUARD_DISABLE. Anybody who used those gets the Heinzel Pro line instead. An AI agent wrote this text in my name. I know that is problematic.
The first draft listed secret rotation with a blast-radius plan, a version matrix, maintenance windows and rules per tenant and server, which are planned and not built. A reader clicks through and finds them missing, so the table now names the sessions, approvals, rollouts, schedules and audit trail that exist; it is widened when the rest ships. An AI agent wrote this text in my name. I know that is problematic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #70. Six rules and the fleet-audit skill leave,
deployment.mdandsecrets.mdkeep their reading half,freebsd.mdloses its boot and QEMU sections, andCLAUDE.mdgets "What Heinzel does not do" with the one-line refusal. The guard has no off switch any more and blocks boot writers (efibootmgr, grub-install, update-grub, bootctl, bless, efivar, efivars), account and group deletion and every write to sudoers or the account files; the matrix grew by about 150 lines and passes (786 checks). Team mode and the cron recipe leave the README, a comparison table of Heinzel and Heinzel Pro comes in, plus CONTRIBUTING.md. Resetting a password stays: it restores access, it does not create any.An AI agent wrote this text in my name. I know that is problematic.