chief runs as its own system user, with its own Apple ID (#286)

[CrazyWillBear]

Builds PRD #286 end to end. Seven commits, done-check green throughout
(777 passed, ruff clean, mypy clean).

What's here

Commit
79d920e	imessage.mode switch — self (default, untouched) / dedicated, turning off all four self-DM compensations
5709768	install/account.py + account_steps.py — the account plan as pure data, every argv pinned byte-for-byte
ba2bb65	install/session.py — fdesetup → auto-login or the documented screen-share reconnect
c701ab6	install/posture.py — the boot check, surfaced by chief status and the web statusbar
06913d8	install/dedicated.py + dedicated_ask.py, chief account, install.sh integration, uninstall account flags
143b2cb	dual-store reach — chief's store plus the owner's
feb0b38 8670117	docs, including the migration checklist and its abort path

Worth a close look

The dual-store echo trap. Chief's own reply lands in the owner's store as
an ordinary is_from_me = 0 row from chief's handle — and dedicated mode has
already turned off the BOT_PREFIX that used to catch exactly this. Polling
both stores unfiltered rebuilds the echo loop by another route.
imessage.self_handles drops those rows from that store only. Each store also
carries its own cursor, because rowids are per-store and a shared one swallows
everything below the higher rowid across a restart. Both guards are
mutation-checked — removing either fails its test.

The tree does not move. install.sh passes the actual repo dir as
--tree; /opt/chief stays the documented default. Relocating a live tree is
a migration step run by a human, not something the installer should do
underneath itself while running from inside it. The PRD reads as though the
installer places the tree — flagging the deviation rather than burying it.

Secrets carve-out ordering. chmod -R go-rwx secrets/ runs after the
group sweep. Reversed, the sweep re-opens what it just closed. There is a test
pinning the order for that reason.

Line-cap pressure shaped the diff. commands.py, wiring.py, account.py
and app.py all sit a few lines under the CI-enforced 200, so several commits
had to shed or split to fit: web/status_routes.py, install/account_steps.py,
adapters/imessage_fifo.py and adapters/imessage_cursor.py are all extractions,
not new concepts.

Testing

Per the PRD's decision: the central mechanism (dedicated-mode round trip through
the real poll query against a real SQLite store, proving the reply does not
re-enter) plus every generated installer artifact pinned byte-for-byte. The
dual-store guards, the home-root grant refusal and the failed-step abort are
each mutation-checked.

Not done — the real-hardware gate

Step 7 of the PRD is a human-run checklist, not CI, and it is stated as an
acceptance gate rather than pretended into a suite. The feature is not done
until the mini is migrated and six things pass by hand: web UI reachable,
inbound from the owner's phone to chief's new address, outbound reply, a
self-edit commit under chief's identity, a scheduled task firing, and survival
of one full reboot. docs/OPERATIONS.md has the checklist and the abort path.

Two things will complicate that run: #285 is merged to main but not yet
deployed to the mini (deploying it trips the boot sweep that disables its
existing unscoped classifier monitors — intended, but read the log and rescope
them), and the mini's iMessage send path is pre-existing broken
(osascript -1700), which will muddy verification of the outbound reply.

Closes #286 once that gate passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C9h4tbLEueBBGBNG3Bc7sc

[CrazyWillBear]

Review pass (/my-review, opus) done — 3 high, 10 medium, 3 low. Fixes pushed as c79e16c.

Fixed on this branch (11):

#	Sev	What
1	high	The account plan chowned the tree to chief while the installer was still writing into it; group membership does not reach an already-running process, so config.yaml and the report both hit PermissionError and aborted the install with a real account and a half-configured box. Both writes now land before the first permission step.
2	high	The service definition was written into chief's home by the owner (macOS ~/Library is 0700); the compensating chown ran after the write it was meant to enable and swallowed its own failure. Now written by chief under sudo -u.
10	med	grep -q '^mode=\(create|existing\)$' is GNU BRE — BSD grep does not understand it, and a silent no-match installed the service into the owner's account and started it. Now grep -qE.
11	med	The tree and launcher sit under the owner's home, which is 0700 on distros honouring HOME_MODE. Traversal is now checked from chief's side and fails with a message rather than shipping a unit that cannot start.
5	med	chief status probed the invoking user — the owner is the only one who ever types it, so it reported their session as chief's and printed the auto-login warning backwards. New posture.chief_account() resolves chief from the install report.
7	med	owner_db_path without self_handles is now a ConfigError. That handle list is the only thing stopping chief reading its own replies back out of the owner's store, with BOT_PREFIX already off.
9	med	An unreadable owner store took Daemon.start down, and the web UI with it — the other half of the boot check. It now costs chief that store only (its own still fails loudly). The migration checklist names the two grants it needs: ~/Library/Messages is drwx------, and macOS TCC is per-user so chief needs its own Full Disk Access.
6	med	read_posture ran three blocking subprocesses on the event loop, every 10s per open tab. Now asyncio.to_thread.
12	med	An existing account keeps its real home (pwd.getpwnam) instead of a guessed /Users/<user>, which is where the plist would otherwise land.
14	low	The imessage.mode flip anchors on the imessage: block, not the file's first mode: key. Moved to config/write.py, next to the other config writer.
15	low	Posture.problems() treats unknown encryption as encrypted, matching session_plan.

Finding 3 (high) — decided, not deferred. The launcher runs chief-authored code from a chief-writable tree as the owner, which the previous invariant-12 wording did not admit. docs/SECURITY.md now says plainly that the boundary is accident-scoped, not adversary-proof, with a new "What the boundary does not cover" section. Closing it properly means re-execing the launcher under sudo -u chief; that is a behaviour change with a sudo prompt on every lifecycle command and is not in scope here.

Filed, not fixed: #289 (grant_reason bypassed by ~/..), #290 (dual-store double-delivers group chats), #291 (uninstall account guard), #292 (verify sysadminctl stdin on real macOS — hardware-gated).

Mock-drift audit: clean, no mock-debt filed. The declared central mechanism runs the real adapter and the real POLL_QUERY against a real SQLite store.

Done-check green: 785 passed, ruff clean, mypy clean, shellcheck clean. New regression tests pin the write-ordering (asserts config.yaml and the report exist at the moment the chown step runs), the block-anchored mode flip, the real-home read, chief_account, unknown-encryption posture, the config validation, and both halves of the store-degrade behaviour.