From cf6058544f3dc0e0563e03bacc4b7eccd5100223 Mon Sep 17 00:00:00 2001 From: bot-claude Date: Tue, 20 Oct 2026 18:07:31 -0500 Subject: [PATCH 1/2] Docs: identity is Samba AD with Authelia, not LLDAP LLDAP was retired on 2026-10-20 (infra/identity#3); agents' accounts are in Samba AD, still signed in through Authelia. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012qTZm2xcsS8SGngGQ9369K --- docs/Architecture.md | 4 ++-- docs/Development-Plan.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/Architecture.md b/docs/Architecture.md index 00cbd14..8f149ae 100644 --- a/docs/Architecture.md +++ b/docs/Architecture.md @@ -555,7 +555,7 @@ can do rather than trying to prevent steering. - **Only credentials are secrets;** every other setting is reviewable configuration. -**Identity:** each agent is its own LLDAP principal in a tightly scoped Authelia +**Identity:** each agent is its own Samba AD principal in a tightly scoped Authelia group, never the operator's account, with its own account and token in each service it uses (X5). @@ -1131,7 +1131,7 @@ so every upstream action traces to one agent. ### X5. Supporting services All self-hosted: Matrix (Synapse), Gitea, LiteLLM, the local inference host, -Vaultwarden, LLDAP with Authelia, and SilverBullet for the operator's view of +Vaultwarden, Samba AD with Authelia, and SilverBullet for the operator's view of the vault. Each agent has its own account, token and room in each; nothing is shared between agents. diff --git a/docs/Development-Plan.md b/docs/Development-Plan.md index 147db0e..a4840db 100644 --- a/docs/Development-Plan.md +++ b/docs/Development-Plan.md @@ -47,7 +47,7 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders. ## 2. The environment today -- **Supporting services** (X5): Matrix, Gitea, LiteLLM, Vaultwarden, LLDAP with +- **Supporting services** (X5): Matrix, Gitea, LiteLLM, Vaultwarden, Samba AD with Authelia. The infrastructure repository exists in Gitea. - **Local inference:** llama-swap on an RTX 4090 host (320 W cap). The benchmark (PR #55) chose `qwen3.8-27b` for local work. @@ -572,7 +572,7 @@ SilverBullet so far (M5.4). (D7, X2), collection when idle. **M6.3 Secrets and identity.** *Pre-approved.* Per-agent secret sets on the host, -LLDAP principal (L12). +Samba AD principal (L12; LLDAP until 2026-10-20). **M6.4 Delivery.** *Pre-approved.* Watchtower, restarts gated on an idle flag (X4). -- 2.54.0 From 073e0caf1a9698f17513ec46b122b399caad9c29 Mon Sep 17 00:00:00 2001 From: Don Garrett Date: Tue, 20 Oct 2026 23:11:47 +0000 Subject: [PATCH 2/2] Docs: rewrap the identity lines; M6.3 names only today's directory Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk --- docs/Architecture.md | 6 +++--- docs/Development-Plan.md | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/Architecture.md b/docs/Architecture.md index 8f149ae..148a81e 100644 --- a/docs/Architecture.md +++ b/docs/Architecture.md @@ -555,9 +555,9 @@ can do rather than trying to prevent steering. - **Only credentials are secrets;** every other setting is reviewable configuration. -**Identity:** each agent is its own Samba AD principal in a tightly scoped Authelia -group, never the operator's account, with its own account and token in each -service it uses (X5). +**Identity:** each agent is its own Samba AD principal in a tightly scoped +Authelia group, never the operator's account, with its own account and token in +each service it uses (X5). **Logging:** structured JSON lines to the host journal and the log stack. Every durable state change emits exactly one line, with a fixed envelope (time, agent, diff --git a/docs/Development-Plan.md b/docs/Development-Plan.md index a4840db..5719cfe 100644 --- a/docs/Development-Plan.md +++ b/docs/Development-Plan.md @@ -47,8 +47,8 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders. ## 2. The environment today -- **Supporting services** (X5): Matrix, Gitea, LiteLLM, Vaultwarden, Samba AD with - Authelia. The infrastructure repository exists in Gitea. +- **Supporting services** (X5): Matrix, Gitea, LiteLLM, Vaultwarden, Samba AD + with Authelia. The infrastructure repository exists in Gitea. - **Local inference:** llama-swap on an RTX 4090 host (320 W cap). The benchmark (PR #55) chose `qwen3.8-27b` for local work. - **Models by role today:** driver and helper `claude-opus-5-5`, expert @@ -572,7 +572,7 @@ SilverBullet so far (M5.4). (D7, X2), collection when idle. **M6.3 Secrets and identity.** *Pre-approved.* Per-agent secret sets on the host, -Samba AD principal (L12; LLDAP until 2026-10-20). +Samba AD principal (L12). **M6.4 Delivery.** *Pre-approved.* Watchtower, restarts gated on an idle flag (X4). -- 2.54.0