permissions normalize without --apply prints an intent, not a diff #46

New issue

Open

opened 2026-08-02 07:03:25 +00:00 by PerishFire · 0 comments

PerishFire commented

2026-08-02 07:03:25 +00:00

Owner

Environment: concord v0.9.0.

Observed

Run across every task in the domain space, each one printed the identical line:

plan: permissions.normalize
  chmod <task root> (task structure 0700 and managed memory private)

Meanwhile audit reported zero permission faults for all of them — nothing was actually out of true. The plan is emitted unconditionally.

Consequence

There is no read-only way to answer "do any of my tasks have wrong modes?". audit reports permission hygiene without naming the paths, and the plan output cannot distinguish a task that needs repair from one that does not, so it cannot be used to find drift.

This also makes the plan misleading in the one place plans matter most: the skill documents --dry-run/plan output as what lets an operator review a mutation before it happens, and here the review carries no information about what would change.

Proposal

Make the plan a real diff: list only the paths whose mode would change, as current -> target, and print nothing (or an explicit "already private") when the task is already correct.

Environment: concord v0.9.0. ## Observed Run across every task in the domain space, each one printed the identical line: ``` plan: permissions.normalize chmod <task root> (task structure 0700 and managed memory private) ``` Meanwhile `audit` reported zero permission faults for all of them — nothing was actually out of true. The plan is emitted unconditionally. ## Consequence There is no read-only way to answer "do any of my tasks have wrong modes?". `audit` reports permission hygiene without naming the paths, and the plan output cannot distinguish a task that needs repair from one that does not, so it cannot be used to find drift. This also makes the plan misleading in the one place plans matter most: the skill documents `--dry-run`/plan output as what lets an operator review a mutation before it happens, and here the review carries no information about what would change. ## Proposal Make the plan a real diff: list only the paths whose mode would change, as `current -> target`, and print nothing (or an explicit "already private") when the task is already correct.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

PerishFire/concord#46

No description provided.

Rows
Columns