dan-claude-bot ceceb71e34 docs(users): own the runner-row divergence from #17 — server class keeps root, deliberately, runner included ... #17's table said runner 'can close root once an admin user is proven'; the class model (#26) superseded the per-role call, and close-root refuses on class=server — runner's class. The gate does not change: the refusal message now explains itself (server-class machines are automation identities whose management plane IS root SSH; a CI box meant to be administered like a human machine is --class human at bootstrap, not an exception), and the README's identity-model section records the divergence in one paragraph. README also documents the @root seed token and close-root's reachability proofs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-18 14:54:03 +00:00
..
lib	docs(users): own the runner-row divergence from #17 — server class keeps root, deliberately, runner included	2026-07-18 14:54:03 +00:00
bootstrap.sh	feat(bootstrap): host-class installs box + runs setup-host	2026-07-17 22:45:40 +00:00
coolify-backup-install.sh	fix(coolify): validate the dump bindings, and stop printing $EDITOR	2026-07-12 19:55:39 +00:00
coolify-install.sh	feat(coolify): install the control-plane dump as a systemd timer	2026-07-12 19:14:07 +00:00
db.sh	feat(db): bring ad-hoc dump/restore on-box as rig db	2026-07-17 15:16:35 +00:00
runner-install.sh	fix(runner): install refuses a box registered to another repo	2026-07-13 14:57:28 +00:00
runner-remove.sh	feat(runner): status, remove, and repoint — the runner lifecycle verbs	2026-07-13 13:25:27 +00:00
runner-repoint.sh	fix(runner): install refuses a box registered to another repo	2026-07-13 14:57:28 +00:00
runner-status.sh	fix(runner): install refuses a box registered to another repo	2026-07-13 14:57:28 +00:00
users-apply.sh	feat(users): @root seeds the admin's keys from root's own — the one source that cannot lock you out	2026-07-18 14:53:30 +00:00
users-close-root.sh	feat(users): close-root proves the door opens, not that it should — sudo -n and per-user sshd -T join the gate	2026-07-18 14:53:50 +00:00
users-status.sh	fix(users): review findings — invoker gate, real SSH revocation, StrictModes-shaped close-root gate, trait-aware box role	2026-07-17 20:01:19 +00:00