dan-claude-bot ceceb71e34 docs(users): own the runner-row divergence from #17 — server class keeps root, deliberately, runner included ... #17's table said runner 'can close root once an admin user is proven'; the class model (#26) superseded the per-role call, and close-root refuses on class=server — runner's class. The gate does not change: the refusal message now explains itself (server-class machines are automation identities whose management plane IS root SSH; a CI box meant to be administered like a human machine is --class human at bootstrap, not an exception), and the README's identity-model section records the divergence in one paragraph. README also documents the @root seed token and close-root's reachability proofs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-18 14:54:03 +00:00
..
cli.sh	docs(users): own the runner-row divergence from #17 — server class keeps root, deliberately, runner included	2026-07-18 14:54:03 +00:00
db-integration.sh	test(db): add real dump/restore round-trip probe + CI job + manual proof docs	2026-07-17 15:48:51 +00:00