Bernardo Magri
7aae204014
Some checks failed
Check / eval (push) Failing after 2m45s
Bernardo promoted the PROPOSED item live: with fingerprint PAM on, sudo/login should accept whichever factor comes first instead of pam_fprintd's wait-for-the-reader-then-password. Stock PAM cannot express parallel factors (linux-pam#301), so this packages pam-fprint-grosshack v0.3.0 (pkgs/, pinned from GitLab — the field-standard fprintd fork), source-reviewed before packaging: every failure path (no reader, no prints, fprintd absent/hung, timeout, password typed) returns PAM_AUTHINFO_UNAVAIL and falls through; a typed password is only ferried via PAM_AUTHTOK to the stock `auth sufficient pam_unix.so … try_first_pass` rule — the module never validates passwords itself, so it cannot lock out password login. New option nomarchy.hardware.fingerprint.parallel, default TRUE (the better UX is what opting into fingerprint PAM buys; false = stock sequential). Wiring swaps the modulePath of stock fprintd's rule slot (mkForce) so the sufficient-before-pam_unix ordering is inherited, not recomputed. README + downstream template rows added. Verified: V2 — checks.hardware-toggles extended to three nodes, green: parallel node asserts the grosshack auth line precedes pam_unix in /etc/pam.d/sudo and that with NO reader a correct password still passes sudo while a wrong one fails (the lockout-safety invariant); seqpam node gets stock pam_fprintd and no grosshack; nopam gets neither. flake check + option-docs + template-sot green. V3 pending (HARDWARE-QUEUE, AMD dev box): the real type-or-touch race, fprintd-stopped fallback, hyprlock/greeter after a fingerprint win. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Agent instructions + loop state
Everything an AI agent needs to work on Nomarchy, vendor-neutral and git-tracked. Protocol: LOOP.md. Entry point for every harness: repo-root AGENTS.md.
Instructions (how to work)
| File | Who writes | Role |
|---|---|---|
| LOOP.md | Human | One-iteration protocol (orient → pick → work → verify → commit → record) + the V0–V3 ladder |
| VERIFICATION.md | Human (agents propose) | Enforcement: preflight, honesty rules, visual protocol, hardware-blocked checks, reporting |
| DELEGATION.md | Human (agents propose) | Capability tiers, scout/runner roles, token economy, parallel fan-out |
| GOALS.md | Human (agents propose) | Pillars, quality bars, non-goals |
| CONVENTIONS.md | Human (agents propose) | How to write code/menu/state while shipping |
| THEME-DESIGN.md | Human (agents propose) | Theme/visual design instructions |
State (what's happening)
| File | Who writes | Role |
|---|---|---|
| BACKLOG.md | Both | Prioritized queue — only executable work list |
| JOURNAL.md | Agents | Append-only iteration log (read last 3–5 entries; older → JOURNAL-ARCHIVE.md) |
| MEMORY.md | Agents | Curated durable gotchas |
| HARDWARE-QUEUE.md | Agents append, human checks | On-hardware V3 tests only Bernardo can run |
Product / design docs (not a queue)
| File | Role |
|---|---|
| ../docs/VISION.md | v1.0 product themes — agents slice into BACKLOG PROPOSED |
| ../docs/ROADMAP.md | Design history + shipped log |
| ../docs/README.md | Full docs map |
Harness adapters (vendor-specific, thin)
Shared content never lives in an adapter — adapters only register/route into the files above, in whatever format their harness requires.
| Path | Harness | Role |
|---|---|---|
| ../AGENTS.md | any | Entry point (CLAUDE.md is a symlink to it) |
| ../.claude/settings.json | Claude Code | Tool permissions |
| ../.claude/agents/ | Claude Code | nomarchy-scout / nomarchy-runner role defs (contracts in DELEGATION.md) |
Do not put backlog items, vision text, or policy under an adapter directory — it is not shared with other agent runners.
Rules of thumb
- Execute from BACKLOG only (NOW → NEXT; never PROPOSED without human triage).
- Orient with GOALS + CONVENTIONS + MEMORY + last journal + BACKLOG; when the task is product-shaped, also read the relevant VISION §.
- Record lasting design in ROADMAP ✓ when something ships that future humans should know; delete the BACKLOG line.
- v1 branch is human-only — never advance from an agent session.