Turn user

Nothing that starts a provider's program runs as root: a turn, a skill's inference and its program, a sign-in, a sign-out, a status check. Root is the worker itself and nothing else.

Whose user a run goes out as is asked of the Cloud before every run and never remembered: someone who has left the tenant stops running as themselves on their next message. And whose old login may be brought into a home follows that answer: a person who has left runs as the agent's user, and their own login is never brought into it.

On an agent where each person signs in, a turn runs as the person speaking. On an agent with one shared login, it runs as the agent's user: the people who share that agent share one sandbox. Unattended work — a skill on a schedule, an announcement — runs as the agent's user.

e.g. Ana and Ben both talk to a shared-login agent → both turns run as the agent's user; on a per-person agent → Ana's turn as Ana's user, Ben's as Ben's.

Someone the tenant does not know — no account, or no membership — never gets a user of their own: their turn runs as the agent's user, with no brains, as today. Once only the allowed are answered (AGENTACCOUNT-ONLY-THE-ALLOWED) this is about someone ALLOWED who is not a member; someone not allowed gets no turn to run as anyone.

The Cloud allots the number, once, for a person in a tenant and for an agent; the worker only makes the user it is told. Every worker that ever serves that tenant uses the same number, so a home means the same thing wherever its volume is mounted.

A user's home is outside the worker's own folders, owned by that user and closed to everyone else. Its logins and its history live inside it. A turn's working folder does NOT: it is made where only the worker can write and handed over (TURNUSER-ROOT-STAYS-OUT), so its owner can change what is in it and nothing about where it is.

Running as its user, a program cannot read or change another user's home, the tenant's secret files, the brains' checkouts, or the worker's own state. What it runs — the worker's code and tonoman — it may READ and must not be able to change. What it may write is its own home, the working folder of its own turn, and the machine's ordinary scratch places (/tmp, /var/tmp, /dev/shm) as any Linux user may. It cannot write anywhere that is another user's, the platform's, or the code's.

e.g. a turn for Ana tries to read Ben's Codex login, /etc/tonoman/secrets, or a brain's clone → refused by the system, whatever the agent was told.

What a turn is meant to use is where it can use it: tonoman and its tool are installed where every user can run them and none can change them; what is private to one turn is made owned by that turn's user.

The worker, which is root, never opens, writes, re-owns, deletes, or goes into anything by a path inside a folder a user controls: there a user could put a link where a folder was, and root would follow it. What a user's home needs is done as that user — reading a file, looking for one, deleting, making folders; what the worker prepares for it is prepared where only the worker can reach, and handed over before the user can touch it. A program goes to its folder after it has become the user, never the worker first. Turn folders are made in a folder only root can write, so their owner can change what is in one and nothing about where it is. Whether a folder has been handed over is what the worker remembers having done, not what it finds by looking. A sign-in's link and code are what the sign-in itself printed down a pipe the service holds — not a file the user could have written — and a device login may only send a person to the provider's own pages.

e.g. the map of which Codex session is which conversation is kept in the worker's own state, not in the user's home, where a link could turn the worker's write into an overwrite of any file.

A program started as a user is given an environment made for it — a path, a home, where its login is, the turn's own credential — not the worker's with some names removed. What is the run's own is handed over by name from where it was made, never picked out of the worker's environment. A Bedrock agent gets the AWS settings it cannot run without, by name, and only then; a proxy's address is passed on, a proxy's password is not. The AWS keys a Bedrock worker holds must themselves allow inference and nothing else: a turn can read them.

Every program is started as a user through one launcher, which drops to that user and its own group with no other groups, and makes sure the program cannot get privileges back. It checks that this held before the program's first line runs, and refuses to start otherwise.