docs(readme): rewrap the empty-users-file paragraph to the file's width

The inserted sentences left the pre-existing "And on `host=yes` with
`RIG_SKIP_BOX_INSTALL=1`" sentence appended to a line that ran to 124
columns, against the 75-78 band the rest of the file wraps in. Reflowed
the paragraph at 76. Prose only — no behavior, no code, no test change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
dan-claude-bot 2026-07-19 19:37:34 +00:00
parent b982399d3c
commit af80c59942

View file

@ -154,17 +154,18 @@ A bad users file is caught **up front**, in the same breath as a bad
`apt`, before the hostname change, and before a single-use pre-auth key is
spent. A file that names **no users** is refused there too — empty,
comments-only and whitespace-only files all parse fine, but bootstrapping
with one converges the same root-only box `--no-users` asks for, via the flag
that exists to guarantee the opposite. The refusal names `--no-users`, because
that box is reachable; it just has to be asked for out loud. This is
with one converges the same root-only box `--no-users` asks for, via the
flag that exists to guarantee the opposite. The refusal names `--no-users`,
because that box is reachable; it just has to be asked for out loud. This is
bootstrap's contract only: `rig users apply` against an emptied file is a
genuine de-provisioning operation and stays available. And on `host=yes` with `RIG_SKIP_BOX_INSTALL=1`, a box-role user with
no `incus` group refuses immediately rather than a hundred lines later —
that is the one case where the outcome is already certain, since the run has
been told it will not install box. rig still **never** installs Incus or runs
`box setup-host` on its own account; the box CLI's own installer does that
(see the `host` trait), and every other way that step can fail lands in
apply's existing refusal at the end.
genuine de-provisioning operation and stays available. And on `host=yes`
with `RIG_SKIP_BOX_INSTALL=1`, a box-role user with no `incus` group refuses
immediately rather than a hundred lines later — that is the one case where
the outcome is already certain, since the run has been told it will not
install box. rig still **never** installs Incus or runs `box setup-host` on
its own account; the box CLI's own installer does that (see the `host`
trait), and every other way that step can fail lands in apply's existing
refusal at the end.
`--users` does **not** reach the box TENANT roles (`claude`, `codex`, `grok`,
`staging`). A tenant is a box-minted *guest*: box auto-runs its bootstrap at