pastilhasandClaude Fable 5
6071ded175
TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with frontmatter carrying id, status, created date and order, and the prose body copied across verbatim. TODO.md becomes a generated index (bun run todo:index). Dates: where an item's prose stated one it is used; otherwise its old section's; otherwise 2026-08-20, floored at the day before the split rather than invented. date_source records which. Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is the identity, frontmatter is the machine's half and the body is the owner's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
19 lines
986 B
Markdown
19 lines
986 B
Markdown
---
|
|
id: multi-user/deprovisionosaccount-is-written-but-has-never
|
|
title: "`deprovisionOsAccount` is written but has never run against a real account"
|
|
theme: multi-user
|
|
status: open
|
|
created: 2026-08-12
|
|
date_source: stated
|
|
order: 2
|
|
---
|
|
|
|
**`deprovisionOsAccount` is written but has never run against a real account.** Landed 2026-08-12 in
|
|
`os-user-deprovision.ts` and wired into `deleteUserHandler`, which now refuses to delete the row when
|
|
the Linux teardown fails — so a failure is retryable instead of forgotten. Only the pure guards
|
|
(`guardDeletable`, `guardMemberTree`, `parseSubUidEntry`) have tests; the reap loop, the `chown -R`
|
|
sever and `userdel` have been exercised by nobody. `docs/deprovision-os-account.md` → "What is still
|
|
unproven" has the five-step validation, and it has to happen on the production host with a throwaway
|
|
account that has **a shell left open** and **a container writing as a non-root user** — those are the
|
|
two cases the quiet path passes vacuously.
|