[aitrawog]

Summary

charly deploy add persisted a deploy node's per-host entry without its authored security: block. The entry's security came only from the image labels plus auto-detected devices, so an authored cap_add never reached charly config's MergeDeployOntoMetadata step and the emitted quadlet had no AddCapability= line. The container then ran with a narrower boundary than its tree declares — the measured symptom in opencharly/pod-crabbox-k3s#6, where ip link add k3s0 type dummy failed with RTNETLINK answers: Operation not permitted.

The fix seeds the authored block into the per-host entry after a successful deploy add dispatch, at the same position and through the same locked cycle as the existing selector persist. It MERGES into any existing block instead of replacing it: list fields (cap_add, devices, security_opt, group_add, mount) are unioned with deploykit.AppendUnique, so a device detection already recorded is never emitted twice; an authored scalar or privileged: true wins; a field the tree leaves unset keeps the existing value. charly config then runs its unchanged path: MergeDeployOntoMetadata folds the entry onto the image metadata and AppendUnique adds the detected devices. A node with no security: is a no-op, so the detection-only path is byte-identical; a first-ever image-bearing pod entry is seeded so the documented deploy add then charly config sequence works. Dotted in-substrate child paths and host-rooted / external in-place nodes are skipped, mirroring deploykit.PersistBedDeployOverrides' own guards.

The change is four files:

• candy/plugin-fleet/deploy_node_security.go — new: the merge and the seeded persist.
• candy/plugin-fleet/walk.go — one call after a successful dispatch.
• candy/plugin-fleet/deploy_node_security_test.go — new: the regression tests.
• candy/plugin-fleet/bed_persist_writer_test.go — the test-scoped node decoder learns the security: block the tests assert.

Closes #42.

Head bd97a334a973f5c446603658f19b55f7073ed879

$ git rev-parse HEAD
bd97a334a973f5c446603658f19b55f7073ed879
$ git rev-parse 'HEAD^{tree}'
ec07105b65f643532100541022550b68d2db3190
$ git log --oneline origin/main...HEAD
bd97a33 fix(deploy): carry the authored security block into the persisted deploy node
$ git diff --stat origin/main...HEAD
 candy/plugin-fleet/bed_persist_writer_test.go   |  44 ++++++
 candy/plugin-fleet/deploy_node_security.go      | 136 ++++++++++++++++
 candy/plugin-fleet/deploy_node_security_test.go | 199 ++++++++++++++++++++++++
 candy/plugin-fleet/walk.go                      |   9 ++
 4 files changed, 388 insertions(+)

How tested

R9 binary. The binary under test is built from the umbrella's charly checkout (clean; HEAD b0454eb5bd326eb877b065e7cc85f53b2c3d1484, newest tag v2026.309.1009) with the plugin-fleet worktree on the workspace, CalVer-stamped. It is not a shared install.

$ git -C /home/atrawog/Sync/Atrapub/mo/claude/opencharly/charly status --short
$ git -C /home/atrawog/Sync/Atrapub/mo/claude/opencharly/charly describe --tags --abbrev=0
v2026.309.1009
$ cat /tmp/pf42-go.work
go 1.26.8

use (
	/home/atrawog/Sync/Atrapub/mo/claude/opencharly/charly/charly
	/home/atrawog/Sync/Atrapub/mo/claude/opencharly/.worktrees/containerd-crabbox-program/pf42/plugin-fleet/candy/plugin-fleet
)
$ cd /home/atrawog/Sync/Atrapub/mo/claude/opencharly/charly/charly
$ GOWORK=/tmp/pf42-go.work go build -buildvcs=false -ldflags "-X main.BuildCalVer=$(cd .. && bash scripts/calver.sh)" -o /tmp/pf42-charly .
$ /tmp/pf42-charly version
2026.309.1009
$ strings /tmp/pf42-charly | grep -c 'persisting authored security'
1

The repo's change-class gate, on this committed tree. This repo declares no Go CI workflow (.github/workflows/ holds only tag-on-merge.yml; the merge gate is the org-wide charly/pr-validator), so the gate is the repo's own declared minimum (plugin-fleet/AGENTS.md): build, vet, test, gofmt -l, and charly box validate.

$ cd /home/atrawog/Sync/Atrapub/mo/claude/opencharly/.worktrees/containerd-crabbox-program/pf42/plugin-fleet/candy/plugin-fleet
$ gofmt -l . > /tmp/pf42-final-gofmt.log 2>&1; echo "gofmt_rc=$?"
gofmt_rc=0
$ wc -l < /tmp/pf42-final-gofmt.log
0
$ go build ./... > /tmp/pf42-final-build.log 2>&1; echo "build_rc=$?"
build_rc=0
$ go vet ./... > /tmp/pf42-final-vet.log 2>&1; echo "vet_rc=$?"
vet_rc=0
$ go test -race -count=1 ./... > /tmp/pf42-final-test.log 2>&1; echo "test_rc=$?"
test_rc=0
$ cat /tmp/pf42-final-test.log
ok  	github.com/opencharly/plugin-fleet/candy/plugin-fleet	4.549s
?   	github.com/opencharly/plugin-fleet/candy/plugin-fleet/cmd/serve	[no test files]
$ cd .. && /tmp/pf42-charly box validate > /tmp/pf42-final-boxvalidate.log 2>&1; echo "box_validate_rc=$?"
box_validate_rc=0
$ tail -1 /tmp/pf42-final-boxvalidate.log
charly box validate: OK — checked 1 candy, 7 distros, 7 builders; 0 warnings, 0 errors

The regression tests.

$ go test -race -count=1 -run 'TestDeployAddSecurit' -v . 
=== RUN   TestDeployAddSecurity_CarriesAuthoredBlockIntoPersistedNode
--- PASS: TestDeployAddSecurity_CarriesAuthoredBlockIntoPersistedNode (0.01s)
=== RUN   TestDeployAddSecurity_NoAuthoredSecurityLeavesDetectionPathUntouched
--- PASS: TestDeployAddSecurity_NoAuthoredSecurityLeavesDetectionPathUntouched (0.00s)
=== RUN   TestDeployAddSecurity_SeedsFreshPodEntry
--- PASS: TestDeployAddSecurity_SeedsFreshPodEntry (0.00s)
PASS
ok  	github.com/opencharly/plugin-fleet/candy/plugin-fleet	1.092s

The first test is the #42 reproduction at the persist boundary: the entry already carries the detected devices a previous charly config recorded, the tree declares cap_add + cgroupns + security_opt, and /dev/kvm is declared by BOTH — all three authored fields must come back with the detected devices and /dev/kvm exactly once. The second pins "no authored security ⇒ the detection path is byte-identical" (the mutation reports no change and the file is not rewritten). The third pins the fresh deploy add-then-charly config sequence.

It fails on origin/main. A detached worktree at origin/main (d623e1495f8d113f5da3422663badb4e359926e0) received the new test file and the decoder change (the test references the new symbol, so this is the compile-time witness; the live witness is the negative control below):

$ git -C /tmp/pf42-main-proof rev-parse HEAD
d623e1495f8d113f5da3422663badb4e359926e0
$ cd /tmp/pf42-main-proof/candy/plugin-fleet
$ go test -run 'TestDeployAddSecurit' . > /tmp/pf42-main-proof-test.log 2>&1; echo "main_test_rc=$?"
main_test_rc=1
$ cat /tmp/pf42-main-proof-test.log
# github.com/opencharly/plugin-fleet/candy/plugin-fleet [github.com/opencharly/plugin-fleet/candy/plugin-fleet.test]
./deploy_node_security_test.go:47:10: undefined: applyAuthoredSecurity
FAIL	github.com/opencharly/plugin-fleet/candy/plugin-fleet [build failed]
FAIL

End to end on this host — a disposable fixture. The fixture is a temporary project whose pod: node is marked disposable: true and authors cap_add: [NET_ADMIN], cgroupns: host, security_opt: [label=disable]; its box re-bases the already-built ghcr.io/opencharly/probe-engine-image (the same keepalive image the pod beds use, so no build is needed and the image labels carry no cap_add of their own):

probe-engine-image:
    candy:
        base: ghcr.io/opencharly/probe-engine-image:2026.309.1938
        description: |-
            e2e fixture for opencharly/plugin-fleet#42 — an already-built pod image re-based
            unchanged, so `deploy add`/`charly config` exercise the deploy path without a build.
        build: [rpm]
        distro: ["fedora:43", fedora]
pf42-security-proof:
    pod:
        image: probe-engine-image
        disposable: true
        security:
            cap_add:
                - NET_ADMIN
            cgroupns: host
            security_opt:
                - label=disable

Negative control — the same sequence with the umbrella charly binary (v2026.309.1009, pinned plugin-fleet v0.2026286.700, i.e. without this branch). The persisted entry carries the detected devices only, and the emitted quadlet has no capability or security-opt line:

$ cd /tmp/pf42-e2e/fixture
$ CHARLY_DEPLOY_CONFIG=/tmp/pf42-e2e/run-main/charly.yml /home/atrawog/Sync/Atrapub/mo/claude/opencharly/charly/bin/charly deploy add pf42-security-proof > /tmp/pf42-e2e/run-main/add.log 2>&1; echo "add_rc=$?"
add_rc=0
$ CHARLY_DEPLOY_CONFIG=/tmp/pf42-e2e/run-main/charly.yml /home/atrawog/Sync/Atrapub/mo/claude/opencharly/charly/bin/charly config pf42-security-proof > /tmp/pf42-e2e/run-main/config.log 2>&1; echo "config_rc=$?"
config_rc=0
$ sed -n '/pf42-security-proof:/,$p' /tmp/pf42-e2e/run-main/charly.yml
pf42-security-proof:
    pod:
        image: probe-engine-image
        network: charly
        security:
            devices:
                - /dev/kvm
                - /dev/vhost-net
                - /dev/vhost-vsock
                - /dev/fuse
                - /dev/net/tun
                - /dev/hwrng
$ grep -nE 'AddCapability|SecurityLabelDisable|PodmanArgs|AddDevice' ~/.config/containers/systemd/charly-pf42-security-proof.container
14:AddDevice=/dev/kvm
15:AddDevice=/dev/vhost-net
16:AddDevice=/dev/vhost-vsock
17:AddDevice=/dev/fuse
18:AddDevice=/dev/net/tun
19:AddDevice=/dev/hwrng

Positive arm — the same project and sequence with the branch binary. deploy add alone already carries the authored block; charly config unions the detected devices into it and the quadlet emits all three authored fields:

$ cd /tmp/pf42-e2e/fixture
$ CHARLY_DEPLOY_CONFIG=/tmp/pf42-e2e/run-fix/charly.yml /tmp/pf42-charly deploy add pf42-security-proof > /tmp/pf42-e2e/run-fix/add.log 2>&1; echo "add_rc=$?"
add_rc=0
$ sed -n '/pf42-security-proof:/,$p' /tmp/pf42-e2e/run-fix/charly.yml
pf42-security-proof:
    pod:
        image: probe-engine-image
        security:
            cgroupns: host
            cap_add:
                - NET_ADMIN
            security_opt:
                - label=disable
$ CHARLY_DEPLOY_CONFIG=/tmp/pf42-e2e/run-fix/charly.yml /tmp/pf42-charly config pf42-security-proof > /tmp/pf42-e2e/run-fix/config.log 2>&1; echo "config_rc=$?"
config_rc=0
$ sed -n '/pf42-security-proof:/,$p' /tmp/pf42-e2e/run-fix/charly.yml
pf42-security-proof:
    pod:
        image: probe-engine-image
        network: charly
        security:
            cgroupns: host
            cap_add:
                - NET_ADMIN
            devices:
                - /dev/kvm
                - /dev/vhost-net
                - /dev/vhost-vsock
                - /dev/fuse
                - /dev/net/tun
                - /dev/hwrng
            security_opt:
                - label=disable
        volume_project_checked: true
$ grep -nE 'AddCapability|SecurityLabelDisable|PodmanArgs|AddDevice' ~/.config/containers/systemd/charly-pf42-security-proof.container
14:AddCapability=NET_ADMIN
15:AddDevice=/dev/kvm
16:AddDevice=/dev/vhost-net
17:AddDevice=/dev/vhost-vsock
18:AddDevice=/dev/fuse
19:AddDevice=/dev/net/tun
20:AddDevice=/dev/hwrng
21:SecurityLabelDisable=true
22:PodmanArgs=--cgroupns=host

Teardown — both arms were removed with the sanctioned verbs; the container was never started (only deploy add + config ran):

$ cd /tmp/pf42-e2e/fixture
$ CHARLY_DEPLOY_CONFIG=/tmp/pf42-e2e/run-fix/charly.yml /tmp/pf42-charly remove pf42-security-proof > /tmp/pf42-e2e/run-fix/remove.log 2>&1; echo "remove_rc=$?"
remove_rc=0
$ CHARLY_DEPLOY_CONFIG=/tmp/pf42-e2e/run-fix/charly.yml /tmp/pf42-charly deploy del pf42-security-proof -y > /tmp/pf42-e2e/run-fix/del.log 2>&1; echo "del_rc=$?"
del_rc=0
$ ls ~/.config/containers/systemd/charly-pf42-security-proof.container
ls: cannot access '/home/atrawog/.config/containers/systemd/charly-pf42-security-proof.container': No such file or directory
$ grep -n 'pf42-security-proof' /tmp/pf42-e2e/run-fix/charly.yml; echo "grep_rc=$?"
grep_rc=1

The negative-control arm was torn down the same way (remove_rc=0, del_rc=0), and the test deploys' temporary overlays live under /tmp — the operator's real ~/.config/charly/charly.yml was never written by this work.

R10 bed. This repo declares no disposable: true bed: its root charly.yml is discover:-only and the candy's plan: is a build-context check (plugin-fleet/AGENTS.md: the live R10 roster belongs to the consumer repos, and deploy add is every bed's entry point). The live proof is therefore the disposable fixture deployment above, driven on the changed path (deploy add → config → emitted quadlet boundary), with the teardown quoted.

Rulebook compliance

• R0 — The skill set the dispatcher selects for this repo was loaded from the plugins cache before any action: git-workflow, strict-policy, root-cause-analyzer, check, plugin, and install-plan (the set plugin-fleet/AGENTS.md names); the repo's own AGENTS.md was read first.
• R1 — The issue's four RCA fields hold against the source, not re-derived: the only writers of a per-host security: were charly config (image labels + detected devices) and deploykit.PersistBedDeployOverrides; nothing carried the deploy node's authored block. One separable finding was filed as charly deploy add --disposable (and a node's disposable: true) is never persisted — the documented flag is inert #43 (--disposable is inert); it does not affect this change's claim or gate. The gate ran zero warnings.
• R2 — One new merge/persist helper. It reuses deploykit.AppendUnique, the shared locked cycle deploykit.MutateDeployConfig, and this package's existing loadDeployConfig/saveDeployConfig callbacks; it adds no second lock and no second device-detection implementation (detection stays in plugin-deploy-pod and still runs, unchanged, at config time).
• R3 — No sleep, retry, magic value, or ad-hoc engine command. The live run used only charly deploy add, charly config, charly remove, and charly deploy del.
• R4 — No doc change was needed: the documented charly deploy add then charly config sequence now carries the authored security block, and every command used works with the charly binary alone.
• R5 — No code path, alias, shim, or doc was deleted, and nothing legacy was added; the change is a new file plus one call.
• R6 — git status --short was empty before and after the commit; the charly submodule checkout is clean and was not edited; the work is on fix/deploy-add-carry-security off origin/main d623e1495f8d113f5da3422663badb4e359926e0; no force-push, no bypass, no direct push to main.
• R7 — The new tests fail on origin/main (pasted above) and pass on this tree; the changed path executed live on this host, and the emitted quadlet — the artifact boundary — was inspected with grep AddCapability.
• R8 — No live boundary was mocked: the run resolved the real plugin-deploy-pod provider and the real host device-detection probe.
• R9 — The binary is the worktree build described above; /tmp/pf42-charly version prints 2026.309.1009, the checkout's newest tag v2026.309.1009, and it carries the new code (the strings | grep -c line in the R9 fence prints 1).
• R10 — The final-tree change-class gate passed with zero warnings (pasted above). The repo declares no disposable: true target, so the live R10 form is the disposable fixture deployment on the changed path, torn down with charly remove rc 0 and charly deploy del rc 0 (pasted above).

Change classification

Bug fix, additive, no contract change. charly deploy add now persists a deploy node's authored security: block into the per-host overlay entry, merged with any existing block, so charly config's existing MergeDeployOntoMetadata step emits the declared capabilities, devices, and security options into the quadlet. A node with no security: keeps the previous behaviour exactly; dotted in-substrate child paths and host-rooted / external in-place nodes are skipped. No schema, wire type, CLI flag, or config format changed.

Breaking change + rollback: none — the change only ADDS a persisted field that every binary built from main already understands (MergeDeployOntoMetadata has merged overlay.Security field-by-field since before this branch), and no existing entry is rewritten except to union the authored block into it. Rollback is a revert of the squash commit; entries already written remain valid because they only carry the values the tree itself declares.

Filed issues

• charly deploy add --disposable (and a node's disposable: true) is never persisted — the documented flag is inert #43 — charly deploy add --disposable (and a node's disposable: true) is never persisted; the documented flag is inert. Found on the same run; separable from deploy add drops the authored security.cap_add, so the container runs without a capability the tree declares #42 (the security carry does not depend on it).

Agent: containerd-crabbox-program/pf42 · session 8b1c01cf-7f79-4a75-bff8-240415a06208
Assisted-by: Claude Code deepseek-v4.1-flash:cloud (fully tested and validated)

[aitrawog]

STATUS — opened for review.

• Head: bd97a334a973f5c446603658f19b55f7073ed879 (branch fix/deploy-add-carry-security, off origin/main d623e1495f8d113f5da3422663badb4e359926e0).
• Done: the authored security: block is carried into the per-host entry on deploy add, merged (not replaced), so charly config emits AddCapability=/SecurityLabelDisable=true/PodmanArgs=--cgroupns=host and unions the detected devices. Regression tests added (fail on origin/main, pass here). Live end-to-end on a disposable fixture project, torn down with charly remove rc 0 and charly deploy del rc 0. Gate: gofmt -l empty, go build/go vet/go test -race -count=1 rc 0, charly box validate 0 warnings. Body lint: 0 findings.
• Next: the charly/pr-validator verdict on this head. Any finding will be fixed in one new commit (no re-push of this head otherwise).
• Filed: charly deploy add --disposable (and a node's disposable: true) is never persisted — the documented flag is inert #43 (--disposable inert, separable).

Agent: containerd-crabbox-program/pf42 · session 8b1c01cf-7f79-4a75-bff8-240415a06208
Assisted-by: Claude Code deepseek-v4.1-flash:cloud (fully tested and validated)

[github-actions]

Review — PASS

Head SHA: bd97a334a973f5c446603658f19b55f7073ed879 (branch: fix/deploy-add-carry-security)

Security screen: PASS — no scope mismatch (all 4 files accounted for), no secrets/exfiltration, no weakened guardrails, no supply-chain changes; does not touch the validator spec / rulebook / gates (T4 not triggered, no maintainer sign-off required).

Checklist: All applicable rules PASS or NA — A1 (summary, how-tested, tier, rule-compliance, footer all present and consistent with the diff), A2 (code change → repo's declared gate + disposable-fixture live e2e on the changed path; repo declares no eval beds), A3 (fully tested and validated justified by the live deploy add→config→quadlet run), R0–R10 (zero-warning gate, #43 filed as separable, no duplication/ad-hoc/dead code, fresh rebuild + version + strings cross-check consistent, no mock, disposable fixture torn down), PIL/SDD/CONC/HC (no schema/wire/candy-def changes, single atomic commit, no forbidden framing), ARCH (placement: CORRECT — capability code in the candy/plugin-fleet plugin, not core/sdk; no alias file, no core sdk-kit import), DISP (fixture disposable: true, manual teardown, no autonomous destroy), QUAL (gofmt clean per gate; no visible lint issues).

Comment intake: 1 comment (by @aitrawog, STATUS) — verified-non-blocking: coordination status only, claims re-derived against current body/diff and consistent; raises no finding. (A minor test-coverage nit — persistDeployNodeSecurity's dotted-path / host-rooted / external guards are exercised only on the happy path, not by the unit tests — is noted as non-blocking: the core merge/seed behavior is tested and proven live, and the guards mirror existing PersistBedDeployOverrides helpers.)

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run