Agents cannot apply reviewed edge/server config: propose a narrow privilege wrapper modelled on homeboy-upgrade

[chubes4]

The gap

An agent provisioned by wp-coding-agents cannot apply edge/server configuration, even when the change is small, reviewed, and git-tracked. Every such fix stalls waiting for a human with a shell.

Concrete case from today. An nginx hardening rule was 403ing every /.well-known/ path on the network:

# Deny access to hidden files
location ~ /\. {
    deny all;
}

/.well-known/ is an IANA-registered public path (RFC 8615), so this broke OAuth discovery (oauth-authorization-server, oauth-protected-resource), security.txt, and apple-app-site-association. It is fatal to MCP client authorization — ChatGPT and Claude both begin by fetching those two documents.

I diagnosed it, wrote the fix, opened a PR syncing the repo copy — and then could not apply it. The actual change is one location block and a reload.

Current envelope on this host:

User opencode may run the following commands on extra-chill:
    (root) NOPASSWD: /usr/local/sbin/homeboy-upgrade *

That is the only root-capable path, and it is correctly scoped to upgrades. homeboy server list shows a root-capable entry (chubes-net, 178.156.237.104) but that is a different machine — this host is 178.156.238.82, registered as user opencode.

What I am not asking for

Not blanket sudo, not an interactive root shell, and not homeboy deploy / homeboy release — those are deliberately operator-gated and should stay that way.

The distinction that matters: "the agent can edit nginx" is dangerous; "the agent can apply the reviewed, git-tracked config" is auditable. Only the second is worth building.

Proposal: a narrow privilege wrapper, modelled on homeboy-upgrade

/usr/local/sbin/homeboy-upgrade is already a well-built example and should be the template. It does everything right:

• set -Eeuo pipefail, hardened PATH, umask 077
• unsets BASH_ENV CDPATH ENV GITHUB_TOKEN GH_TOKEN HOMEBOY_CONFIG HOMEBOY_CONFIG_DIR
• strict argument validation ([[ $TAG =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]])
• absolute paths for every binary
• syslog via logger -t "$PROGRAM"

A sibling wrapper — call it homeboy-edge-apply — granted the same way:

(root) NOPASSWD: /usr/local/sbin/homeboy-edge-apply *

Critical design constraint: it must not accept config text as an argument. It takes a named, allowlisted target and syncs from a git-tracked source of truth, so the content is always something a human reviewed in a PR:

1. Resolve the target from a fixed allowlist (e.g. nginx-site), never an arbitrary path.
2. Read the new content from the checked-out repo copy at a pinned path, not from the caller.
3. Snapshot the current file with a timestamp.
4. nginx -t. On failure: restore snapshot, log, exit non-zero, never reload.
5. Reload. Run a post-reload health probe against a configured URL set.
6. On probe failure: restore snapshot, reload again, log, exit non-zero.
7. Log the before/after hashes to syslog.

That makes the blast radius "apply a diff that already passed review and nginx -t, with automatic rollback" rather than "agent has root".

Secondary problem this would fix

/etc/nginx/sites-available/extrachill and /etc/nginx/sites-enabled/extrachill are separate regular files, not a symlink, differing by 1,142 bytes:

-rw-r--r-- root root 2334  sites-available/extrachill
-rw-r--r-- root root 3476  sites-enabled/extrachill
Files ... differ

sites-enabled is what nginx serves. Editing the conventional file changes nothing, and the drift is invisible until someone diffs them. A wrapper that syncs from a single git-tracked source of truth eliminates the whole class of problem — which is the real value here, beyond unblocking one agent.

Worth deciding

• Scope of the allowlist. nginx only, or a general "edge config" surface that could later cover Cloudflare rules? extrachill-network/docs/nginx/ already tracks both, and its README declares itself source of truth for each.
• Whether the repo copy or the live file is authoritative, and whether the wrapper should refuse to apply when the live file has drifted from git — i.e. detect manual edits rather than silently overwrite them.
• Whether this belongs in wp-coding-agents' installer at all, or in Homeboy proper. wp-coding-agents provisions the agent's environment and already writes the sudoers grant for homeboy-upgrade, which argues for here — but Homeboy owns deploy and server registration, which argues for there. Worth settling explicitly rather than by default.

Why it is worth building

This is not a one-off. Over one working session the same shape recurred: the agent diagnoses precisely, produces the fix, and cannot apply it — so the change sits in a PR while the actual defect stays live in production. Today that defect is breaking OAuth discovery, security.txt, and iOS universal links simultaneously.

Related

• Extra-Chill/extrachill-network#203 — the /.well-known/ 403
• Extra-Chill/extrachill-network PR fix(upgrade): adopt service identity from existing unit instead of assuming root #205 — repo-copy sync, blocked on a human to apply
• Extra-Chill/extrachill-network#204 — dedicated auth host decision, which will add more edge config

[chubes4]

Built and shipped the mechanism half of this tonight, with two corrections to the proposal above that are worth recording.

The wrapper exists and is in production: Extra-Chill/homeboy#14726 (homeboy-edge-apply), with the nginx /.well-known/ 403 that motivated this already fixed and the live server block now tracked in Extra-Chill/extrachill-network#206. The agent applies it with sudo homeboy-edge-apply extrachill-nginx — no systems request.

Correction 1 — step 2 of the design above would have granted root.

Read the new content from the checked-out repo copy at a pinned path, not from the caller.

Every extrachill-network checkout on the host is opencode-owned and opencode-writable:

drwxrwxr-x opencode opencode  /var/lib/datamachine/workspace/extrachill-network
drwxrwxr-x opencode opencode  /mnt/extrachill-workspace/dmc-workspace/extrachill-network

An allowlist of destinations constrains where bytes land, not what they are — the caller just writes what it wants into the checkout first. And arbitrary nginx config is arbitrary root: root / plus alias serves /etc/shadow, proxy_pass reaches any loopback service.

The shipped wrapper fetches the repository itself into a root-owned mirror the caller cannot write, and reads content with git cat-file from the object store, never a working tree. A requested commit must be an ancestor of refs/heads/main, so the only applicable content is content a human merged. Verified from the agent's seat, before and after the merge:

$ sudo homeboy-edge-apply extrachill-nginx        # before merge
ERROR: deploy/nginx/sites-enabled/extrachill does not exist at aa2eda7a
exit=2

$ sudo homeboy-edge-apply extrachill-nginx        # after merge
extrachill-nginx already current at ad588cdb (b741d897…); no reload
exit=0

Same command, same grant. The only variable is a merged pull request.

Correction 2 — the stated reason for choosing this repo is factually wrong.

wp-coding-agents provisions the agent's environment and already writes the sudoers grant for homeboy-upgrade, which argues for here

It does not. The only sudoers this repo writes is the kimaki dispatch grant, and that is ALL=(opencode) — same-user, never root. /usr/local/sbin/homeboy-upgrade and /etc/sudoers.d/homeboy-upgrade were hand-placed on the host in August and are tracked in no repository.

The conclusion still lands here, for a better reason: the grant lifecycle belongs to whatever provisions the host. Filed as #601, which also documents that this repo already contains a correct, validated sudoers installer with zero call sites — while the bridge that needed one wrote its own that installs before it validates.

On the secondary problem: sites-available was the stale copy, not the live one. sites-enabled carried the abuse mitigation, Matrix delegation, and /wp-json/ rate limit that sites-available lacked — so "restore the convention by symlinking" would have silently deleted protections that ended an outage. The live file is now committed byte-for-byte and is the applied source of truth.

---

AI assistance: implementation and this analysis by Claude Opus 4.5 via Claude Code, driven by Chris. The model found the agent-writable-checkout flaw while verifying host state, wrote the wrapper and its test suite, applied the production fix, and verified the trust gate from the unprivileged account.