Repository navigation
T27 OS keys: read and write through /usr/bin/security (no Keychain dialogs after rebuilds), several keys per provider in the KEYS tab - #11276
Merged
Conversation
…red panes wait for their keys (Closes #11241) The rotation lane's four commits on the T27 OS stack (claude/t27os-keyrot-11241, head 30d60eb), applied onto master, whose copies of these five files equal the stack head the lane built on. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ored panes wait for their keys (Closes #11241) Merge of master plus sealing, gates run on the merged tree with t27c from master: tests clean with vacuous passes 0, seal --verify MATCH, tri types ratchet CLEAN, dupe_scan failure set a subset of master's. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…s per provider in the KEYS tab keys_host.t27 no longer calls SecItem*: the ad-hoc-signed window is a new code identity at every rebuild, so each read asked for the login password again. It runs /usr/bin/security (posix_spawn, pipes, poll with a timeout, waitpid): read = find-generic-password -w, delete = delete-generic-password, add = one line on the stdin of `security -i` (a key never on argv). SIGCHLD is set to default for a run (editors_host leaves it ignored, which breaks waitpid) and SIGPIPE is ignored while the line is written; a silent or chatty tool is killed. Security.framework is no longer linked. keys.t27 holds every decision, tested: argv building, the add line, the bytes `security -i` can carry (no space, quote, backslash, control), the exit-status table (44 = not found; quit is not a command there, EOF ends the session), output -> key, the scan rule (stop after two misses), and the KEYS decisions for several keys per provider: next free number, newest key to delete, "full", per-key check status, "6/7 valid", keys withheld from the server one by one. glass_window.t27: the KEYS row text and click handler only. add stores the next free account and never replaces; delete removes the newest key; check probes every key and keeps one status per key. Refs #11241 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
master took the rotation PR (#11256, a squash of the branch this one was cut from), its reseal (#11257), the homes registry (#11261) and csr_map (#11255). keys.t27 and keys_host.t27 on master are byte-identical to this branch's base, so this branch's versions are kept whole; glass_window.t27 keeps this branch's KEYS edits with the #11261 delta applied on top; the two seals (T27osKeys, T27osPtyLogic) are master's, and the T27osKeys seal is stale for the changed keys.t27 until it is resealed on landing. Refs #11241 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…x; keys-orchestration.md says the host reads through security pty_logic.t27 already imports from keys.t27 and keys.t27 does not import pty_logic.t27, so the one definition of "where key k of provider p sits" (p * MAX_KEYS + k) is keys.t27 key_index and pty_logic's private kidx is gone. dupe_scan --like is silent for both specs. keys-orchestration.md: two rows now say the host reads every numbered key, up to 8 per provider, through /usr/bin/security. Refs #11265 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Master took the glass PR (matte glass, panels narrow the terminal, KEYS foot rows, the chip click test following those rows). It merges without a conflict: this branch changes the KEYS row text (status text, add/full word, profile line) and the click and key handlers; the glass lane changed the painting and layout, including the foot rows below the key rows. Refs #11265 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…alogs after rebuilds), several keys per provider in the KEYS tab (Closes #11265) Merge of master plus sealing, gates run on the merged tree with t27c from master: tests clean with vacuous passes 0, seal --verify MATCH, tri types ratchet CLEAN, dupe_scan failure set a subset of master's. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
gHashTag
enabled auto-merge (squash)
October 20, 2026 07:50
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #11265
T27 OS keys: read and write through /usr/bin/security (no Keychain dialogs after rebuilds), several keys per provider in the KEYS tab
Gates run on the merged tree (t27c from master): 2 spec(s) with tests clean and vacuous passes 0, seal --verify MATCH, tri types ratchet CLEAN, dupe_scan failure set a subset of master's (inherited red).
TEST specs/t27os/keys.t27 tests=[81] fail=[0] vacuous=[0]
TEST specs/t27os/pty_logic.t27 tests=[34] fail=[0] vacuous=[0]
SEAL specs/t27os/keys.t27 :: all hashes MATCH
SEAL specs/t27os/pty_logic.t27 :: all hashes MATCH
TYPES RATCHET: CLEAN
DUPE failing=4 extra-vs-master=[]
🤖 Generated with Claude Code