# hal0 — privileged seam grant for an UNPRIVILEGED hal0-api / hermes provisioner
# (D hardened-perms).
#
# When hal0-api runs as the `hal0` system user, it cannot write the per-agent
# .env files that the hardened model pins root:root:
#   * /var/lib/hal0/secrets/agents/<agent>.env  (0600 root:root secrets vault)
#   * /etc/hal0/agents/<agent>.env              (0644 root:root driver env)
# It delegates exactly those writes to /usr/lib/hal0/bin/hal0-agentenv, which is
# the entire privileged surface: the helper validates the agent name, builds the
# target path itself, takes content on stdin, and only ever touches
# <agent>.env under those two fixed directories — no wildcards, no shell, no
# arbitrary file writes.
#
# Install (as root):
#   install -m 0440 packaging/sudoers/hal0-agentenv /etc/sudoers.d/hal0-agentenv
#   visudo -cf /etc/sudoers.d/hal0-agentenv
#
# Keep this grant pinned to the helper binary; a broader file-write grant would
# let the API clobber arbitrary root-owned files.

hal0 ALL=(root) NOPASSWD: /usr/lib/hal0/bin/hal0-agentenv
