Distillation

Date: Sep 8, 2026

• 🔴 (09:42) User approved abandoning the root supervisor architecture for the OpenCode V2 pilot and matching the existing production trust model: OpenCode and model-controlled PTYs run as byk under the existing systemd service with NoNewPrivileges=yes and the account’s normal supplementary groups.
• 🔴 (09:42) User stated the approved direct architecture requires no root service, dedicated user, helper, readiness marker, SCM_RIGHTS, transient systemd unit, or cgroup supervisor.
• 🔴 (09:42) User explicitly directed that PTY execution must never use supervisor transport.
• 🔴 (09:42) User accepted the known limitation that a malicious command running as trusted byk may deliberately daemonize or escape its original process group; plugin cleanup cannot guarantee killing such descendants because model shell commands already have byk authority, matching the existing production opencode-pty trust model.
• 🔴 (09:42) User directed: never claim cleanup catches descendants that call setsid or daemonize.
• 🔴 (09:42) User restricted work to /home/byk/.local/share/opencode-v2-pilot/config/opencode, /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service, /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md, and /tmp/opencode/pty-plugin-smoke.ts.
• 🔴 (09:42) User prohibited modifying /home/byk/.local/share/opencode-v2-pilot/supervisor; it may only be read if useful.
• 🔴 (09:42) User prohibited installing, starting, stopping, or restarting any service and prohibited modifying production.
• 🔴 (09:42) [enforced-workflow] User required all edits to use apply_patch.
• 🟡 (09:42) User requested these implementation tasks in exact order: 1. rewrite plugins/pty.ts with the hardened direct Node-safe backend; 2. preserve all listed in-process correctness/security work; 3. implement the specified /usr/bin/script direct-backend behavior; 4. remove plugins/pty-transport.ts and update typecheck configuration if needed; 5. create/update /tmp/opencode/pty-plugin-smoke.ts with adversarial tests and run it 10 times; 6. update opencode-v2.service; 7. rewrite CUTOVER.md; 8. ensure config has no obsolete supervisor artifacts; 9. run canonical tsgo, optional dedicated typecheck, smoke 10 times, and systemd-analyze verify without a full SEA build.
• 🔴 (09:42) User required plugins/pty.ts to use node:child_process spawning util-linux /usr/bin/script as the current byk service process. User rejected bun-pty, @opencode-ai/pty, and supervisor transport.
• 🔴 (09:42) User required preserving the Plugin.define API and exactly five tools in this order: 1. pty_spawn, 2. pty_write, 3. pty_read, 4. pty_list, 5. pty_kill.
• 🔴 (09:42) User required canonical ctx.permission.assert immediately before spawn, write, and kill, using the active tool source and save: []; write authorization must cover the exact decoded bytes.
• 🔴 (09:42) User required Session ownership checks on every PTY operation; atomic global/per-owner reservations before the first await; closing/deleted admission gates; and cleanup of in-flight spawns.
• 🔴 (09:42) User required a fixed safe environment with no inherited secrets or startup variables; command/argument byte, count, and aggregate bounds; and POSIX single-quote argument preservation.
• 🔴 (09:42) User required realpath-based external_directory authorization, a post-approval recheck, an open-directory-FD binding, and cwd use through /proc/self/fd/<fd>.
• 🔴 (09:42) User required bounded buffering, reads, writes, regex workers, teardown, notification fields, and notification time; JSON model-visible envelopes with no raw XML; a synthetic steer notification; lifecycle listener registration before awaiting spawn; process closure independent of notification; process-group TERM followed by KILL with bounded waits; the line-paging fix; and no polling instructions.
• 🔴 (09:42) User stated /usr/bin/script must provide a real PTY. The wrapper shell may be non-interactive, but the requested command itself receives a PTY and model stdin through pty_write; documentation must describe this accurately.
• 🔴 (09:42) User required detached spawning so termination can target the process group, a fixed PATH of /usr/bin:/bin or the already reviewed fixed environment, and no caller environment.
• 🔴 (09:42) User required the approved cwd to be bound through its open directory descriptor and required that spawn, error, and fast-close paths close the descriptor and safely settle every promise.
• 🔴 (09:42) User required deleting plugins/pty-transport.ts because plugin auto-discovery treats every plugin source as a plugin and the supervisor transport architecture has been abandoned.
• 🔴 (09:42) User required canonical typechecking to cover pty.ts, followup.ts, and tests without stale references.
• 🔴 (09:42) [requested-tests] User required /tmp/opencode/pty-plugin-smoke.ts to adversarially test: exact tool names/order; permissions with exact write input and empty save; ownership; interactive stdin/output; notification; timeout; process-group TERM-to-KILL escalation; deletion during an in-flight spawn; atomic reservations; argument preservation; UTF-8; line paging; regex bounds; resource bounds; and cleanup.
• 🔴 (09:42) [requested-tests] User requested fail-first checks where feasible and required the PTY smoke test to run exactly 10 times.
• 🔴 (09:42) User required opencode-v2.service to retain User=byk, NoNewPrivileges=true, the current isolated XDG/config/database paths, the current final SEA binary, and port 4096.
• 🔴 (09:42) User required removal from opencode-v2.service of all supervisor readiness ExecCondition, dependency, marker, and root references, while leaving the production unit unchanged.
• 🔴 (09:42) User required CUTOVER.md to remove all supervisor, root, helper, transient-unit, and readiness-marker instructions and to state the exact accepted trust model and daemonization/process-group limitation.
• 🔴 (09:42) User required CUTOVER.md to preserve explicit approval before stopping production, isolated database handling, one-origin UI/API checks, activation checks for both plugins, PTY and follow-up smoke tests, and rollback that never rewrites or deletes either database.
• 🔴 (09:42) User stated rollback never rewrites or deletes either database.
• 🔴 (09:42) User required OpenCode config to retain $schema and auto-discovered plugins while removing any obsolete supervisor configuration.
• 🔴 (09:42) User required canonical tsgo to run from the isolated config, allowed /tmp/opencode/pty-tsconfig.json if still useful, required systemd-analyze verify on the uninstalled candidate unit if possible, and prohibited a full SEA build because the parent will perform it after review.
• 🟡 (09:42) User requested the final implementation report include exact edits, exact commands/results, the residual limitation, and confirmation that no production or service action occurred.
• 🟡 (09:43) Inspected /home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json: TypeScript is strict, no-emit, target ESNext, module Preserve, resolution Bundler, allowImportingTsExtensions: true, libs ESNext, DOM, and DOM.Iterable, skipLibCheck: true, Bun types, and path aliases mapping @opencode/plugin and @opencode/plugin/* into /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/; includes are currently plugins/**/*.ts and test/**/*.ts.
• 🟡 (09:43) Inspected /home/byk/.local/share/opencode-v2-pilot/config/opencode/opencode.json: it contains only "$schema": "https://opencode.ai/config.json", so plugins are left to auto-discovery and no supervisor artifact is configured there.
• 🟡 (09:43) Inspected /home/byk/.local/share/opencode-v2-pilot/config/opencode/package.json: it is private ESM, depends on effect via file:/home/byk/Code/opencode-v2-pilot/node_modules/.bun/effect@4.0.0-rc.112/node_modules/effect, and has @types/bun version 1.2.21 as a dev dependency.
• 🟡 (09:43) Inspected /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service: stale supervisor coupling remains as After=network.target opencode-pty-supervisor.service, Requires=opencode-pty-supervisor.service, and ExecCondition=/usr/local/libexec/opencode-pty-verify-readiness.
• 🟡 (09:43) The candidate opencode-v2.service currently uses User=byk, WorkingDirectory=/home/byk, NoNewPrivileges=true, ProtectSystem=strict, ProtectHome=read-only, ReadWritePaths=/home/byk, PrivateTmp=yes, and an empty SupplementaryGroups= directive.
• 🟡 (09:43) The candidate opencode-v2.service currently loads /home/byk/.opencode/env and /home/byk/.local/share/opencode-v2-pilot/server.env; sets isolated OPENCODE_CONFIG_DIR, OPENCODE_DB, XDG_DATA_HOME, XDG_CACHE_HOME, XDG_CONFIG_HOME, and XDG_STATE_HOME; and starts /home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node serve --hostname=0.0.0.0 --port=4096.
• 🟡 (09:43) The candidate opencode-v2.service currently has Restart=always, RestartSec=5, Nice=-5, LimitNOFILE=65535, LimitNPROC=4096, MemoryMax=13G, and MemoryHigh=12G.
• 🟡 (09:43) Inspected /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md: it already preserves one-origin API/UI operation with no nginx; production health on port 4096; isolated-candidate checks on port 14102; both-plugin activation; mode-0600 server.env; explicit approval before stopping production; post-cutover checks for /api/health, /, /site.webmanifest, /sw.js, and /openapi.json; followup and local-pty activation; one follow-up and one PTY smoke session; and rollback to opencode.service.
• 🔴 (09:43) User’s existing cutover policy states: never create the readiness marker before the old root-acceptance and complete transient-cgroup cleanup proof passes; this gate is now obsolete under the approved architecture and must be removed rather than retained.
• 🔴 (09:43) User’s existing cutover policy states Node 24 never satisfies the old exact-host authenticated-socket gate; this gate is now obsolete under the approved direct-backend architecture and must be removed.
• 🟡 (09:43) /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md still contains obsolete instructions for supervisor/ROOT-ACCEPTANCE.md, three root-owned binaries, authenticated sockets, cwd descriptor transfer, transient-cgroup cleanup, Node 26.4, same-UID impersonation resistance, three binary hashes, /usr/local/libexec/opencode-pty-verify-readiness, /etc/opencode/pty-supervisor-verified, and supervisor service/slice verification.
• 🟡 (09:43) /tmp/opencode/pty-plugin-smoke.ts did not exist when checked and must be created within the approved scope.