From af80c5994201bc6d49834b54bf8dc8438403cbb7 Mon Sep 17 00:00:00 2001 From: dan-claude-bot Date: Sun, 19 Jul 2026 19:37:34 +0000 Subject: [PATCH] docs(readme): rewrap the empty-users-file paragraph to the file's width MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The inserted sentences left the pre-existing "And on `host=yes` with `RIG_SKIP_BOX_INSTALL=1`" sentence appended to a line that ran to 124 columns, against the 75-78 band the rest of the file wraps in. Reflowed the paragraph at 76. Prose only — no behavior, no code, no test change. Co-Authored-By: Claude Opus 4.8 --- README.md | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 737967d..cb9d443 100644 --- a/README.md +++ b/README.md @@ -154,17 +154,18 @@ A bad users file is caught **up front**, in the same breath as a bad `apt`, before the hostname change, and before a single-use pre-auth key is spent. A file that names **no users** is refused there too — empty, comments-only and whitespace-only files all parse fine, but bootstrapping -with one converges the same root-only box `--no-users` asks for, via the flag -that exists to guarantee the opposite. The refusal names `--no-users`, because -that box is reachable; it just has to be asked for out loud. This is +with one converges the same root-only box `--no-users` asks for, via the +flag that exists to guarantee the opposite. The refusal names `--no-users`, +because that box is reachable; it just has to be asked for out loud. This is bootstrap's contract only: `rig users apply` against an emptied file is a -genuine de-provisioning operation and stays available. And on `host=yes` with `RIG_SKIP_BOX_INSTALL=1`, a box-role user with -no `incus` group refuses immediately rather than a hundred lines later — -that is the one case where the outcome is already certain, since the run has -been told it will not install box. rig still **never** installs Incus or runs -`box setup-host` on its own account; the box CLI's own installer does that -(see the `host` trait), and every other way that step can fail lands in -apply's existing refusal at the end. +genuine de-provisioning operation and stays available. And on `host=yes` +with `RIG_SKIP_BOX_INSTALL=1`, a box-role user with no `incus` group refuses +immediately rather than a hundred lines later — that is the one case where +the outcome is already certain, since the run has been told it will not +install box. rig still **never** installs Incus or runs `box setup-host` on +its own account; the box CLI's own installer does that (see the `host` +trait), and every other way that step can fail lands in apply's existing +refusal at the end. `--users` does **not** reach the box TENANT roles (`claude`, `codex`, `grok`, `staging`). A tenant is a box-minted *guest*: box auto-runs its bootstrap at