aios/docs/gitops/OWNER_LOCAL_AUTH_INGRESS.md

AIOS Local Owner Authentication Ingress

This component closes the Owner authentication bootstrap gap without creating a long-lived Owner PAT.

Trust model

The ingress is deliberately one-shot and local-only.

1. A root-run server creates a Unix socket.
2. The peer must be the configured OS Owner account (aiman).
3. The server verifies Unix SO_PEERCRED, all four process UIDs, Linux audit loginuid, and ownership of the controlling TTY.
4. A sudo -u aiman / runuser process from another authenticated login is rejected because its audit loginuid does not equal the Owner UID.
5. The human Owner sees the exact task/base/branch/capability request and types a random one-time challenge.
6. The server constructs only:
   • identity: aiman
   • role: owner
   • authenticated scope: commit:create
   • token scopes: [commit:create]
7. It calls the existing OwnerAuthorizationBroker; it does not call the provisioner directly.
8. It exits and removes the socket after the single authorization attempt.

No reusable token is minted and no production/tag/baseline/main capability is granted.

Current V2R1C7 bootstrap binding

The bootstrap request is expected to authorize only:

• task: V2R1C7_PRODUCTION_EXECUTOR_BOOTSTRAP
• branch: agent/v2r1c7-production-executor-bootstrap-20260807-r2
• base: exact live refs/heads/main
• repository: aios/aios
• scope: commit:create
• TTL: <= 900 seconds
• production/tag/baseline/main write: false

Installation model

For the current trust-root bootstrap, the exact SHA-verified script may be staged under /run/aios-owner-bootstrap/ and run by a transient root systemd service. This staging step has no Git/Tag/Registry/Baseline side effect.

The Owner must connect from a real interactive login session as the OS account aiman.

After the governed writer is issued, the same module and tests are committed through the resulting protected engineering PR so future bootstrap uses code from main rather than an out-of-band artifact.