[ai-mountain]

Stacked on #1896. This is B4 from the canary blocker decisions: default-off Platform control signer wiring and the validator trust-registration path. No seed is generated, transported, templated, copied or read. Seed creation, backup, placement and production trust activation stay a separate protected ceremony. Nothing is enabled or run.

Platform app (platform_app role)

• Defaults and rendering:

  • platform_coding_hosted_control_enabled: false; the env renders DITTO_CODING_HOSTED_CONTROL_ENABLED=false.
  • When enabled it renders only true, the fixed literal seed path /etc/ditto-platform/coding-hosted-signer/seed (a variable can't move it) and the reviewed public SS58 hotkey.
  • The seed file is owned by deploy, the pm2 user running ditto-api, which read_private requires.

• When enabled, before any host change, metadata-only checks (follow: false, get_checksum: false):

  • fixed paths; valid 48-char SS58 hotkey, distinct from the screener hotkey; non-root API user;
  • ancestors are real directories owned by root or deploy, with no group/world write;
  • the directory is a deploy-owned 0700;
  • the seed is a regular single-link 0600 32-byte file owned by deploy.

  A missing or unsafe seed fails the converge with a pointer to the ceremony doc.

• Disabled: the check tasks aren't included, so the path is never touched, matching the Python loader's disabled no-read behaviour.

Validator trust (validator_stack role and compose)

• validator_stack_coding_hosted_control_enabled: false and validator_stack_coding_hosted_platform_hotkey: "". They render VALIDATOR_CODING_HOSTED_CONTROL_ENABLED and VALIDATOR_CODING_HOSTED_PLATFORM_HOTKEY (feat(validator): default-off hosted-v2 control command for signed evaluate, status and acknowledge #1896's command reads only these).
• When enabled, a pre-change assert requires a valid SS58 that differs from validator_stack_hotkey.
• docker-compose.yml ditto-subnet passes both through as false and empty by default, so community validators are unaffected.

Docs: new infra/docs/coding-hosted-control-signer-v2.md covers:

• Ceremony properties: generated on an offline/protected machine; never in CI, Git, chat/Telegram, tickets or workflow artifacts; fresh randomness, distinct from the curator, validator, screener and wallet keys; only the public address recorded; placed directly with the required owner/mode; custodians hold the backup.
• Enable order: seed placed → reviewed host_vars → Platform converge and restart → hosted_control_configured=true → reviewed validator trust change → validator converge.
• Rotation and revocation.

Tests

• The Ansible test playbook renders both env templates for real (disabled, disabled with staged values, enabled). It runs the real asserts against bad inputs and the seed check against 11 temporary trees:

  • missing, 0640, symlink, hard link, 64 bytes;
  • 0750 directory, symlinked directory, group-writable parent, foreign owners.

  Deliberately breaking the link check or the disabled template fails it.

• Root: 369 pass. Platform: 42 pass. Ruff and mypy are clean.

• Syntax checks pass for gcp-platform-app.yml, gcp-validator-prod.yml and gcp-validator.yml. The CI compose config check passes, resolving to false and empty.

Questions for Peyton

1. The loader fails closed at startup, so a later-missing seed stops ditto-api at the next deploy. Should scripts/update.sh run the same metadata check before reload?
2. The relay processes don't read the three DITTO_CODING_HOSTED_* keys. Blanking them in ecosystem.config.js/deploy-relay-release.sh would trigger a relay rollout. Add it anyway?
3. Is Secret Manager ruled out as the custodian backup location, or allowed?
4. The Ansible ancestor rule forbids group/world write even on root-owned sticky dirs the Python loader accepts. Is stricter OK?
5. Merging marks validator_stack (compose) and platform_api (test/doc) for release, with no runtime behaviour change. Validators need a stack release containing both feat(validator): default-off hosted-v2 control command for signed evaluate, status and acknowledge #1896 and this PR.

Review fixes (rebased onto #1896 c9057350d; head 057abae9c)

• Seed exposure (unresolved; needs a decision): any process running as deploy can read the seed: both relays, the cleanup job, deploy-time npm ci/uv sync and sudo -iu deploy users. deploy is also effectively root: it is in the docker group and has a sudo journalctl * grant with a known pager escape. The doc now says this plainly and gives options A–D for a dedicated ditto-api user. The flag stays off.
• Rotation and revocation: they now disable, redeploy through update.sh (pm2 … --update-env), and confirm hosted_control_configured=false before touching the seed. pm2 autorestarts reuse the saved environment.
• Deploy-time preflight: python -m ditto.api_server.coding_hosted_signer_preflight --check-metadata reuses read_private's checks with lstat only, and a test proves the seed is never opened. update.sh runs it before migrations and reload whenever the flag is on. This is now a real platform_api runtime change.
• Other fixes:
  • hotkeys are compared only after an exact 48-char SS58 match;
  • import_tasks for the guards, with the fixture running the real entry point and new negative cases;
  • no configurable seed path variables;
  • activation tests fail only on truthy flags that aren't in the reviewed table;
  • platform-ci triggers on the two infra inputs;
  • fixture cleanup always runs.
• Results: fixture 0 failed / 28 expected rejections; root 88 and Platform 110 focused tests pass; 19 mutations caught.
• Questions for Peyton: the seed-exposure option (A–D); whether narrowing deploy's docker/journalctl access should happen regardless; recovery if a reviewed hotkey is wrong; Secret Manager as the backup location.

Update 2026-09-15: Peyton's isolation decision implemented (16 commits)

Decision: a dedicated locked-down ditto-api identity; only the signer reads the online seed; narrow deploy's docker and journalctl access regardless. All 14 findings from an independent review of the first 8 commits are fixed in the last 8.

• Identity:
  • ditto-api and ditto-api-build are system users with no login, locked passwords and no supplementary groups. The converge refuses them in docker, sudo, adm, systemd-journal or google-sudoers.
  • The seed and its 0700 directory are owned by ditto-api, with parents owned only by root or ditto-api.
  • The signer requires both new switches, and update.sh refuses to deploy an enabled signer under pm2.
• Supervision: ditto-platform-api.service runs as ditto-api through a root-owned launcher, which resolves current once, runs the metadata preflight from that release and execs the server.
  • Hardening: NoNewPrivileges, empty capabilities, ProtectSystem=strict, the deploy checkout and Docker socket inaccessible, and namespace and syscall filters.
  • systemd-analyze security: 1.4.
• Sealed releases: a root installer fetches a main-reachable revision into root-only repos. It builds as ditto-api-build in a sandbox, with hash-pinned build backends (--require-hashes --no-build, then --no-build-isolation).
  • Links are resolved hop by hop, and any that escape the release are refused.
  • The installer seals the tree and records a manifest digest, re-checked at activation.
  • Deploy gets exactly four sudo commands (install, activate, stop, logs), with requests on stdin.
• Journal and sudo (ungated, per "regardless"):
  • Removed sudo journalctl * and sudo systemctl status ditto-* (pager or cursor-file root escapes).
  • The team rules are now exact systemctl start|stop|restart <unit> for 15 services and 6 timers, as (root) only, applied to %ditto,!deploy.
  • No automation used the removed rules.
• Docker (gated by platform_pylon_root_unit_enabled): a root-owned Pylon unit runs compose from root-owned inputs with an empty root-owned wallet mount, and deploy leaves docker. A live root-run probe refuses the signer (converge, install/activate and update.sh) if deploy, or any deploy-UID process, still has the docker group, or if the socket isn't root-only.
• Deploy scripts: start.sh, stop.sh, profile-python.sh and update.sh follow the supervisor setting.
  • activate runs reset-failed first.
  • Activation failures go through fail_deploy, printing unit state and journal.
  • pm2 save runs before activate.
• Default path: unchanged with all switches off.
• Tests:
  • root 127 passed;
  • Platform update.sh harness 53 passed, signer tests 54 passed;
  • the Ansible fixture passed with failed=0;
  • 22 guard mutations caught.
• Residual risks:
  • OS Login admins and the deploy workflow's osAdminLogin identity are root;
  • deploy still influences what is signed (migrations, DB, env), but can't copy the key;
  • any main revision can be installed;
  • the builder's uv cache persists between builds;
  • GitHub's host key is trusted on first use.
• Questions for Peyton:
  1. Should release-build-requirements.txt hashes (compiled offline) be regenerated online in review?
  2. Please review the team unit list.
  3. Can you confirm production Pylon has no signing identity in deploy's wallet directory?
  4. A rootless Docker started by deploy is out of scope. Is that OK?
  5. Release tags vs any main revision?
  6. Should the deploy workflow move off osAdminLogin?
  7. Is building releases on the host (disk and time cost) OK?
  8. Should the unit start at boot?

🤖 Generated with Claude Code

Note

Add default-off hosted-v2 control signer wiring, dedicated ditto-api identity, and validator trust registration

• Adds default-off hosted-v2 control signer with fixed seed paths, stat-only metadata preflight, and live Docker-access probe that blocks deployment if platform_owner can still reach the Docker daemon
• Introduces a dedicated ditto-api system user and systemd-supervised sealed-release pipeline (ditto-platform-api.service), replacing pm2-managed deploys when platform_api_service_identity_enabled is true; deploy scripts (start.sh, stop.sh, update.sh) gain a systemd branch alongside the default pm2 path
• Adds a root-owned Pylon unit (ditto-platform-pylon.service) that runs the sidecar via root-owned Docker Compose and removes platform_owner from the docker group when enabled
• Registers validator-side hosted-control trust: validates the Platform control-signer hotkey is a distinct 48-char SS58 address from the validator's own hotkey, rendered through validator.env.j2
• Hardens team sudoers in users.yml: replaces wildcard systemctl/journalctl rules with exact command aliases, restricts root-only commands, and adds systemd-journal group membership to team accounts
• Risk: enabling platform_api_service_identity_enabled or platform_pylon_root_unit_enabled changes the API process owner to ditto-api, removes platform_owner from the docker group, and shifts supervision from pm2 to systemd — existing deployments relying on pm2-managed ditto-api or deploy-user Docker access will break unless the migration path in update.sh is followed

^{Macroscope summarized d8b0961.}

[github-actions]

No dashboard preview for this commit. This PR resolved to preview profiles stack with no dashboard profile: it changes no apps/platform/dashboard/ path, so there is no dashboard build to publish. Profile selection fails closed rather than guessing, which is why a PR touching no recognized runtime path still reads as stack.

Stack previews are never automatic. A maintainer can provision one for this PR:

gh workflow run preview-stack.yml -f pr=1901                    # provision
gh workflow run preview-stack.yml -f pr=1901 -f action=retire   # free the slot

It runs on the default branch, resolves the head commit from the API, and comments dashboard, Platform, and isolated Backroom URLs once readiness succeeds. profile defaults to auto, which picks stack-copy when the PR touches apps/platform/alembic/. Eight slots cap every active preview; a re-dispatch reuses the slot this PR already holds. Reconciliation keeps it while the PR is open, up to a 24-hour lease cap, and retires it four hours after the PR closes.

Exact SHA: d8b09614da806960feda127a3a87fd888fb32b62

[Peyton-Spencer]

Validated finding from Open Code Review through the Ditto Code Review endpoint.

[Peyton-Spencer]

Open Code Review pass completed at c5d3911bd7472cda0f24e70c5fb8639d35fcdf59 using z-ai/glm-5.3-flash through Ditto’s Code Review endpoint. Coverage: 49/49 added, modified, renamed, or type-changed files in the PR diff.

Model candidates were checked against the source; independently confirmed actionable findings, if any, are posted separately as inline review comments. This was a static review; no PR code or test suite was executed. This comment is not a merge approval.

[ditto-code]

Ditto Review · Beta

Review completed for d8b09614da806960feda127a3a87fd888fb32b62.

No actionable findings in the reviewed files. This is not an approval or proof that the PR is bug-free.

Configure Ditto Review. Inference is billed through your Ditto Router endpoint; targeted verification is included during beta.