pastilhasandClaude Opus 5 584074c845 32: all three callers fixed, nothing left passing an email ...

Verified by grepping every call site rather than only the three named: pipeline-executor.ts:499
and :591 and deliver.ts:37 all pass getOwnerHomeDir(email) now, and no caller anywhere passes
an identity where a path is expected. Gates unchanged, 97 tests, 259 assertions.

The "@param home — NOT an email" comment is the right residue: the compiler cannot distinguish
the two strings and never will, so the warning has to live where a fourth caller would read it.

Closes everything reviewable without a live member turn.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-12 00:51:52 +00:00

..

01-open-items.md

wire the member branch into the SDK spawn, still unreachable

2026-08-11 22:27:45 +00:00

02-verify-results.md

02: the probe fix verified live, and the owner has not ruled on wire-first

2026-08-11 22:25:30 +00:00

03-hook-wired.md

wire the member branch into the SDK spawn, still unreachable

2026-08-11 22:27:45 +00:00

04-mcp-config-leaks-the-owner-token.md

04: mcp-config is not branched, and it points at a world-readable owner token

2026-08-11 22:40:33 +00:00

05-mcp-branched-and-mode-fixed.md

stop handing a member's turn the owner's mcp config, and close the file

2026-08-11 22:42:22 +00:00

06-the-mode-fix-does-not-fire.md

06: writeFileSync's mode is ignored on an existing file, so the 0600 never fires

2026-08-11 22:44:07 +00:00

07-chmod-added.md

chmod the mcp config, because writeFileSync's mode never fires on it

2026-08-11 22:45:34 +00:00

08-verified-and-closing.md

08: chmodSync verified, and the box now repairs itself at next bootstrap

2026-08-11 22:46:53 +00:00

10-operations-done-and-green-teardown.md

10 (amended again): chat sessions have no identity, and it should block the gates

2026-08-11 23:16:50 +00:00

11-session-ownership-partial.md

chat sessions record whose they are, and refuse a mismatched caller

2026-08-11 23:33:08 +00:00

12-first-provision-three-failures.md

12: first real provision failed three ways, and two are repeats

2026-08-11 23:44:03 +00:00

13-two-of-three-fixed.md

pipe the installer into bash, and stop inventing a root-owned .local

2026-08-11 23:46:59 +00:00

14-claude-installs-and-runs.md

14: claude installs and runs for a member, first time anywhere

2026-08-12 00:07:02 +00:00

15-docker-storage-created-clean.md

create docker's storage ourselves, so the strip is not a race

2026-08-12 00:08:55 +00:00

16-storage-fix-good-one-gid.md

16: storage fix is right, but it group-owns docker storage by uid

2026-08-12 00:11:03 +00:00

17-gid-threaded.md

pass the member's gid instead of reusing their uid

2026-08-12 00:13:50 +00:00

19-control-surface-scoped.md

scope the six sessionKey commands to their caller

2026-08-12 00:17:53 +00:00

20-scoping-verified-and-stop.md

20: scoping verified, stop before deprovisionOsAccount, and the sidecar is crashing

2026-08-12 00:20:18 +00:00

21-rejection-backstop.md

stop one conversation's transport hiccup from killing every session

2026-08-12 00:23:20 +00:00

22-backstop-verified.md

22: the backstop is in the right process, and Bun honours it

2026-08-12 00:25:29 +00:00

23-member-populated.md

populate member from the authenticated socket

2026-08-12 00:33:03 +00:00

24-resolvememberrun-fails-open.md

24: resolveMemberRun answers "I don't know" with the owner's identity

2026-08-12 00:34:48 +00:00

25-turn-identity-three-way.md

never spell "I don't know whose turn this is" as "the owner"

2026-08-12 00:38:39 +00:00

26-identity-verified.md

26: the three-way identity holds

2026-08-12 00:39:47 +00:00

27-stopping-before-the-history-layer.md

stop before the history layer

2026-08-12 00:40:46 +00:00

28-closing.md

28: agreed, with one correction — the backstop is not waiting on a reprovision

2026-08-12 00:41:37 +00:00

29-history-layer.md

resolve transcripts and cwd against the caller's home, not the owner's

2026-08-12 00:48:09 +00:00

30-resolvebasecwd-callers-still-pass-email.md

30: resolveBaseCwd's outside callers still pass an email

2026-08-12 00:50:10 +00:00

31-resolvebasecwd-fixed.md

stop building cwds out of an email address

2026-08-12 00:51:09 +00:00

32-callers-fixed.md

32: all three callers fixed, nothing left passing an email

2026-08-12 00:51:52 +00:00