From fca664ac7131a1f48e864afac700d503fbc3975b Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Fri, 10 Jul 2026 23:07:14 -0500 Subject: docs: add the run-time privilege model as a doctor decision The input and output doctor reaches firmware, ALSA saved state, modprobe, and packages, which need root. The parent spec decided "no sudo anywhere," correct when the feature was user-scope PipeWire. This supersedes that. The doctor resolves its privilege at run time from three signals: passwordless sudo (sudo -n true, which never hangs), a tty to prompt at, and whether it is the GUI panel. Four remedy classes follow. Auto is user-scope and runs anywhere. Privileged needs sudo, so it runs where passwordless sudo exists, prompts on a CLI, and degrades to Guide otherwise. Reboot-tail runs the applicable part, then instructs the reboot. Guide is physical, BIOS, or wait-for-upstream. Passwordless sudo is not consequence-free, so every Privileged and Reboot-tail remedy defaults to Confirm or Arm, never silent Auto. This was Craig's call, and he wants it as a cross-panel standard. I filed a task to factor the privilege resolution into a shared helper the net, bluetooth, maint, and audio doctors all use. --- todo.org | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'todo.org') diff --git a/todo.org b/todo.org index 0ebdbaa..85a8b08 100644 --- a/todo.org +++ b/todo.org @@ -73,6 +73,13 @@ Copy text is per panel but one rule: it pastes as that panel's CLI prints, so th Consistent with the 2026-07-07 scope note on the sibling task above: net's compact glyph overlay is what standardizes, not maint's wide COPY-key header row. +** TODO [#B] Run-time privilege model, standard across every panel doctor :feature:dotfiles: +The audio input/output doctor is gaining a run-time privilege model (see [[file:docs/specs/2026-07-10-audio-doctor-input-side-spec.org][docs/specs/2026-07-10-audio-doctor-input-side-spec.org]], decision "The doctor may use sudo, resolved by context at run time"). Craig's call, 2026-07-10: make it a standard, "revise the other panels to be consistent with these changes." + +The model: a doctor resolves its privilege at run time from three signals — passwordless sudo available (=sudo -n true=, which never hangs), a tty to prompt at, and whether it is the GUI panel. Four remedy classes: Auto (user-scope, reversible), Privileged (needs sudo — runs where passwordless, prompts on a CLI tty, degrades to Guide in a GUI with neither), Reboot-tail (run the applicable part, then instruct the reboot), and Guide (physical/BIOS/wait-for-upstream, nothing to run). Safety floor: every Privileged and Reboot-tail remedy defaults to Confirm or Arm tier, never silent Auto, because passwordless sudo is not consequence-free. + +Work: factor the privilege resolution and the remedy-class machinery into a shared helper the net, bluetooth, maint, and audio doctors all use, and audit each panel's existing remedies against the Confirm/Arm-default floor. maint already has a =priv.py= verb table and sudo handling — reconcile it with the shared model rather than leaving two privilege paths. Depends on the audio input/output doctor landing the model first (it is the reference implementation). + ** TODO [#B] Scrolling/Carousel layout: frame fit + wrap-around :hyprland: :PROPERTIES: -- cgit v1.2.3