go-auth-bootstrap-recovery
The solution document is written and cleaned up at:
~/HW-GAP-005-go-auth-bootstrap-recovery.md
I searched the entire filesystem (find / -iname "*hivemind*", all go.mod, .git dirs, env vars) and the hivemind source tree is not present in this environment — only pi itself and a generic tool install exist. So I could not run the real code, reproduce the 401 lockout, or execute the listed verification commands against the actual repo. The deliverable is therefore a fully self-contained diagnostic + fix + verification plan written from the problem's described architecture, ready to apply once the tree is available.
Root cause — serve has two IAM branches: fresh (prints bootstrap token: <hex>) vs. existing-store (logs a silent no-token line). CLI help points only at the fresh-boot log, so a stale stock store from a previous boot permanently 401s with no recovery path. The client also never reads the local on-disk token for localhost controllers.
The fix (3 parts, all requested)
1. Boot log prints a documented recovery command (hivemind auth bootstrap-token) when IAM already exists + --require-auth, without leaking the raw token into logs.
2. New hivemind auth bootstrap-token command: reads principals.yaml token:<hex>; --rotate atomically rewrites stock principals/policies with a fresh token and refuses custom (non-token:) stores with zero file writes (incl. a no-op guard table + atomic temp+rename).
3. CLI auto-discovery: localhost controllers adopt the local IAM token when --token/env/config are unset; non-local connections still require explicit creds.
Verification — fresh-boot regression (still prints token), stale-store branch now prints the recovery line, show/rotate/custom-refusal checks, localhost vs remote auto-discovery, and E2E isolation under --require-auth=false with a unit-test sketch for bootstrap-token.
If you can point me at the actual repo checkout (clone URL / S3 bucket / a path), I'll apply this against the real code, build it, and run the verification commands to confirm it passes.
# Evidence - Problem class: go-auth-bootstrap-recovery - Model: openrouter/deepseek/deepseek-v4-flash-0731 - Solved: 2026-08-25T06:24:33.977Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Hivemind HW-GAP-005: serve enables IAM but never prints the bootstrap token when the IAM dir already exists (stale stock bootstrap at default ~/.hivemind/data/iam from an earlier boot) -> branch 1 loads existing IAM, logs zero token output, CLI help points at a dead log line -> permanent 401 lockout, no recovery path. Fix: (1) boot log prints a documented recovery command when IAM exists + auth required; (2) new `hivemind auth bootstrap-token` cmd prints the stored token (read principals.yaml token:<hex> principal) and --rotate rewrites stock principals/policies with a fresh token, refusing custom (non-token:) IAM stores without touching files; (3) CLI client auto-discovers the local IAM token for localhost controllers when --token/env/config are unset. Verify fresh-boot branch still prints token; E2E uses --require-auth=false so auth changes are isolated.", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4-flash-0731", "problem_class": "go-auth-bootstrap-recovery", "provider": "openrouter", "solved_at": "2026-08-25T06:24:33.978Z", "version": ""}The solution document is written and cleaned up at:
~/HW-GAP-005-go-auth-bootstrap-recovery.md
I searched the entire filesystem (find / -iname "*hivemind*", all go.mod, .git dirs, env vars) and the hivemind source tree is not present in this environment — only pi itself and a generic tool install exist. So I could not run the real code, reproduce the 401 lockout, or execute the listed verification commands against the actual repo. The deliverable is therefore a fully self-contained diagnostic + fix + verification plan written from the problem's described architecture, ready to apply once the tree is available.
Root cause — serve has two IAM branches: fresh (prints bootstrap token: <hex>) vs. existing-store (logs a silent no-token line). CLI help points only at the fresh-boot log, so a stale stock store from a previous boot permanently 401s with no recovery path. The client also never reads the local on-disk token for localhost controllers.
The fix (3 parts, all requested)
1. Boot log prints a documented recovery command (hivemind auth bootstrap-token) when IAM already exists + --require-auth, without leaking the raw token into logs.
2. New hivemind auth bootstrap-token command: reads principals.yaml token:<hex>; --rotate atomically rewrites stock principals/policies with a fresh token and refuses custom (non-token:) stores with zero file writes (incl. a no-op guard table + atomic temp+rename).
3. CLI auto-discovery: localhost controllers adopt the local IAM token when --token/env/config are unset; non-local connections still require explicit creds.
Verification — fresh-boot regression (still prints token), stale-store branch now prints the recovery line, show/rotate/custom-refusal checks, localhost vs remote auto-discovery, and E2E isolation under --require-auth=false with a unit-test sketch for bootstrap-token.
If you can point me at the actual repo checkout (clone URL / S3 bucket / a path), I'll apply this against the real code, build it, and run the verification commands to confirm it passes.
# Evidence - Problem class: go-auth-bootstrap-recovery - Model: openrouter/deepseek/deepseek-v4-flash-0731 - Solved: 2026-08-25T06:24:33.977Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Hivemind HW-GAP-005: serve enables IAM but never prints the bootstrap token when the IAM dir already exists (stale stock bootstrap at default ~/.hivemind/data/iam from an earlier boot) -> branch 1 loads existing IAM, logs zero token output, CLI help points at a dead log line -> permanent 401 lockout, no recovery path. Fix: (1) boot log prints a documented recovery command when IAM exists + auth required; (2) new `hivemind auth bootstrap-token` cmd prints the stored token (read principals.yaml token:<hex> principal) and --rotate rewrites stock principals/policies with a fresh token, refusing custom (non-token:) IAM stores without touching files; (3) CLI client auto-discovers the local IAM token for localhost controllers when --token/env/config are unset. Verify fresh-boot branch still prints token; E2E uses --require-auth=false so auth changes are isolated.", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4-flash-0731", "problem_class": "go-auth-bootstrap-recovery", "provider": "openrouter", "solved_at": "2026-08-25T06:24:33.978Z", "version": ""}