fix(provision): grant user lire (251) so the checkpoint armed probe passes; probes distinguish 401/403 #36

Merged

arcodange merged 1 commits from arcodange/provision-user-lire-probe into main

2026-07-11 18:04:52 +02:00

Author	SHA1	Message	Date
arcodangeandClaude Fable 5	0240c519b1	fix(provision): grant user lire (251) to ai_agent_sandbox so the armed probe passes The checkpoint status/relink-env armed probe calls GET /users/info, which requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it, so a freshly provisioned agent answered 403 on the probe — reported NOT armed — while its key actually authenticates (GET /thirdparties -> 200). Right 251 was granted live in SQL on the sandbox (fk_user=4) today; this persists it in WRITE_IDS so every future provision grants it. Also teach both probes to tell the failure modes apart instead of one opaque message: 401 = key rejected (stale/instance-encrypted -> re-provision), 403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed. Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111). Co-Authored-By: Claude Fable 5 <[email protected]>	2026-07-11 17:38:30 +02:00

Author

SHA1

Message

Date

arcodangeandClaude Fable 5

0240c519b1

fix(provision): grant user lire (251) to ai_agent_sandbox so the armed probe passes

The checkpoint status/relink-env armed probe calls GET /users/info, which
requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it,
so a freshly provisioned agent answered 403 on the probe — reported NOT armed
— while its key actually authenticates (GET /thirdparties -> 200). Right 251
was granted live in SQL on the sandbox (fk_user=4) today; this persists it in
WRITE_IDS so every future provision grants it.

Also teach both probes to tell the failure modes apart instead of one opaque
message: 401 = key rejected (stale/instance-encrypted -> re-provision),
403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed.
Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write
SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111).

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-07-11 17:38:30 +02:00