dispatcher: null-default founderSmsSenderFile for sender-dependent SMS routing (#40) #278

Open

infra wants to merge 1 commit from infra/sms-sender-routing-40 into main

infra commented

2026-09-14 02:02:28 +00:00

Member

Implements the key.store-side config surface for Redmine #40 sender-dependent inbound SMS routing (founder -> assistant/assistant, others -> support/manager).

What this PR does:

Adds services.agent-dispatcher.founderSmsSenderFile (nullOr path, default null): plaintext file holding the founder SMS sender (E.164). Null default = zero behavior change.
Wires --founder-sms-sender-file on the dispatcher api ExecStart plus ReadOnlyPaths confinement, mirroring the existing sms-secret-file pattern.
Records the #40 routing policy as a comment in org/organization.toml (no secret in the registry; the flat source_default_* entries stay in force until enforcement lands).

What it explicitly does NOT do:

No dispatcher runtime support yet: the Go handler must learn --founder-sms-sender-file, normalize the webhook sender to E.164, match, and route (dispatcher owner). Leave the option UNSET on both hosts until then.
No secret material, no host config changes, no merges.

Rollback: revert the single commit (null default means nothing references the new flag while unset).
On-host verification (root, post-merge, pre-set): nixos-rebuild dry-build on HQ/forge; journalctl -u key-store-agent-dispatcher-api shows unchanged ExecStart while unset.
Journald paths: key-store-agent-dispatcher-api (dispatcher api unit).

Implements the key.store-side config surface for Redmine #40 sender-dependent inbound SMS routing (founder -> assistant/assistant, others -> support/manager). What this PR does: - Adds services.agent-dispatcher.founderSmsSenderFile (nullOr path, default null): plaintext file holding the founder SMS sender (E.164). Null default = zero behavior change. - Wires --founder-sms-sender-file on the dispatcher api ExecStart plus ReadOnlyPaths confinement, mirroring the existing sms-secret-file pattern. - Records the #40 routing policy as a comment in org/organization.toml (no secret in the registry; the flat source_default_* entries stay in force until enforcement lands). What it explicitly does NOT do: - No dispatcher runtime support yet: the Go handler must learn --founder-sms-sender-file, normalize the webhook sender to E.164, match, and route (dispatcher owner). Leave the option UNSET on both hosts until then. - No secret material, no host config changes, no merges. Rollback: revert the single commit (null default means nothing references the new flag while unset). On-host verification (root, post-merge, pre-set): nixos-rebuild dry-build on HQ/forge; journalctl -u key-store-agent-dispatcher-api shows unchanged ExecStart while unset. Journald paths: key-store-agent-dispatcher-api (dispatcher api unit).

infra added 1 commit

2026-09-14 02:02:28 +00:00

dispatcher: add null-default founderSmsSenderFile for sender-dependent SMS routing (#40 ) de14d7958c

Null default: no behavior change. Wires --founder-sms-sender-file plus
ReadOnlyPaths confinement when set; records the #40 routing policy
(founder -> assistant/assistant, others -> support/manager) as a comment
in org/organization.toml. Enforcement needs dispatcher runtime support
for the new flag (dispatcher owner); the option stays unset until then.