Deliver vault_op_service_account_claude to the agent hosts and install a
role-owned ~multica/.local/bin/op shim that exports OP_SERVICE_ACCOUNT_TOKEN
to /usr/bin/op only. op run / op plugin run get env -u spliced after "--"
so the child never sees the token. The daemon unit is untouched (WDWL-18).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agents get `op` so op:// references resolve at command time and secret
values stay out of prompts and transcripts. Installed per 1Password's
apt instructions (signed-by keyring, debsig policy + keyring,
1password-cli), with the key fingerprint-checked before it is trusted;
EL via their yum repo. multica_op_version pins, "" tracks the repo.
Tag: multica_op.
Optional, default-off hook writes OP_SERVICE_ACCOUNT_TOKEN from the
playbook (ansible-vault) to a 0600 file owned by the daemon user. It is
deliberately not wired into the daemon environment: the user unit
belongs to the multica CLI, and the delivery design is pending.
Rolled out with --tags multica_op to haunted-mansion and spaceship-earth;
second run changed=0, op 2.41.1 as multica, debsig verifies the .deb.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Found provisioning spaceship-earth:
- Login was not idempotent: `multica auth status` prints to stderr (0.6.5),
and the guard read stdout only, so every run re-logged in and restarted
the daemon. The guard now reads both streams; the status read is no_log
because it echoes a token prefix.
- `multica daemon start` / `daemon restart` fork the daemon inside the
caller's session (Ansible's SSH session scope), outside the systemd user
unit, which stays inactive: the same orphan seen on haunted-mansion on
2026-10-21. Start/restart now go through `systemctl --user`, after a
daemon-reload when autostart was (re)registered. A daemon found running
outside its unit is stopped first. The unit name is read from
`autostart status`, so --profile hosts resolve their own unit.
spaceship-earth: second run changed=0, daemon in multica-daemon.service.
Not yet run against haunted-mansion.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rblundon