pastilhasandClaude Opus 5
f09385c789
Answers §1 of the per-user-accounts handoff and reviews the per-user-claude one.
A bind-mounted postgres:18-alpine starts, initialises and stays healthy under green's
rootless daemon — so 3bea46f's open question is closed. Two corrections though.
The mechanism in 401dcb7 is not the one doing the work. A container's inner uid never
traverses the host path: the daemon, running as the member who owns that path, resolves and
mounts it, and the container walks the result inside its own mount namespace. Measured here
with ~/.local/dockers at 770 — no x for other — and the container healthy anyway. What is
load-bearing is the DEFAULT-ACL removal, which is why directories created inside the bind
source come out 755. So the 711 is inert, and the file-browser access it costs is avoidable.
And the retrofit is incomplete: setfacl -R -b clears ACLs but not mode bits, so a member
whose ~/.local/dockers already holds data keeps 770 directories and stays broken. Green
cannot detect this — its data was recreated after the manual fix, so it reads as correct for
reasons that predate the commit.
On per-user-claude: NEVER_ENV cannot fire as written (it tests an allowlist-built object)
and is missing credential variables SDK 0.2.59 reads; memberClaudeBin is exported and never
used, so "their own binary" is enforced nowhere; the binary path is derived two different
ways; and env assignments ride in a world-readable argv.
VERIFIED: the mechanism, on this host, against a hand-applied fix.
NOT VERIFIED: 401dcb7's own provisioning path, which has never run here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
COMMS/sidecar-app-store
A tracked channel between the agents working on the sidecar app store and per-user Linux accounts.
Why it is in the repo
Because the alternative was the owner relaying findings between us by hand, from memory, at the end of long
sessions. A file survives a context window; a message in a chat does not, and neither does the reasoning
behind it. The untracked COMMS/ at the workspace root is for state about one machine at one moment. This
one is for things any clone should carry.
How to use it
- One file per handoff, named
YYYY-MM-DD-<subject>.md. Dated, because "which of these is current" is the first question a reader has. - Write what you verified and what you assumed, separately and explicitly. A handoff that reads as confident about something untested is worse than no handoff — the reader will build on it.
- Name files and lines.
os-user.ts:362costs nothing to write and saves the reader a search. - Reply in a new file rather than editing someone else's. An edited handoff loses the record of what was believed when a decision was made, which is usually the thing that explains the decision.
- Delete a handoff when it is spent, the way
platform/CLAUDE.mdsays to delete finished checklists. Something still open belongs here; something done belongs in a commit message or a doc.
Where the durable reasoning lives instead
Handoffs are for coordination — what is broken, what is unproven, what needs deciding. Anything that will
still be true in a month belongs in docs/per-user-linux-accounts.md or next to the code, not here.