cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(automation): support qualified single-user Windows operation

Browse Source
This commit is contained in:
cesnimda
2026-10-29 18:27:17 +01:00
parent c1663df44c
commit 1e6c80f708
30 changed files with 2213 additions and 807 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/automation/SINGLE_USER_PLAN.md
+11
View File
@@ -0,0 +1,11 @@
# AUTONOMOUS-ROADMAP-02
Implement on `codex/autonomous-roadmap-single-user`, based on `c1663df`, in the existing isolated tooling worktree. No real roadmap, main merge or production operation.
- [x] Add `single-user-local` setup under the current Windows SID, a dedicated auth-only CODEX_HOME, and short PowerShell commands. Preserve the explicit disabled baseline. Never copy tokens or change the normal Codex configuration.
- [x] Retain legacy dedicated-runner checks. In the new mode use an explicit MXC permission profile: deny filesystem root, allow minimal tools and the worker only, deny control/auth/normal Codex roots, keep command network off and plugins disabled. Apply the exact same profile to worker and test subprocesses.
- [x] Implement real canary read/write, loopback network, and certificate/CNG signing probes. A successful startup alone is insufficient. Record failed/not-tested boundaries independently.
- [x] Default to operator-controlled pause. Only a current successful qualification, protected signed approvals and explicit phase authorization can enable unattended operation. No writable approval-JSON fallback. Approval UI requires a real operator terminal and no active workers.
- [x] Extend tests while retaining all existing tests. Verify disabled setup/dry-run, auth-home isolation, pause/recovery/locking/publication, and actual native sandbox canaries; publish truthful acceptance and usage.
Choice: the existing owner account and same ChatGPT account are supported; different accounts/VMs are optional, not setup prerequisites. Same-account approval is conditional on an inaccessible signing key and protected filesystem boundaries. If either fails, keep workers stopped and require operator action rather than claim equivalence to an independently administered runner.