fix(auth): harden unified diagnostic execution

2026-08-17 17:25:26 +02:00
parent 30ee9433dc
commit ef244ab56d
18 changed files with 670 additions and 68 deletions
@@ -53,6 +53,9 @@ if (secretTargets.join(",") !== expectedSecrets.join(",")) {
 if (core.environment?.THT_SECRETS_FILE !== "/run/secrets/thothii.secrets") {
  throw new Error(`${name}: core does not use the canonical /run/secrets bundle path`);
 }
+if (core.environment?.THT_PI_AUTH_FILE !== "/home/thoth/.pi/agent/auth.json") {
+  throw new Error(`${name}: core does not declare the mounted Pi authentication source`);
+}
 if ((config.services.frontend?.secrets || []).length !== 0) {
  throw new Error(`${name}: frontend must not receive runtime secrets`);
 }