Document real host agent installations

host_agent/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mrblake-netbox-store-agent"
-version = "0.1.0"
+version = "0.1.1"
 description = "Fail-closed host agent for curated NetBox plugin lifecycle operations"
 readme = "README.md"
 requires-python = ">=3.11"

host_agent/src/netbox_store_agent/managed_files.py

@@ -56,7 +56,10 @@ class ManagedFiles:
     def _read_previous(self, path: Path) -> PreviousFile:
         self._validate_target(path)
         if not path.exists():
-            return PreviousFile(path, None, 0o640)
+            # These generated files contain no secrets and must remain readable
+            # by the unprivileged NetBox service after the root agent replaces
+            # them atomically.
+            return PreviousFile(path, None, 0o644)
         metadata = path.stat()
         if metadata.st_size > self.MAX_MANAGED_FILE_BYTES:
             raise PolicyError("managed file exceeds the safe backup limit")

host_agent/tests/test_managed_files.py

@@ -47,6 +47,11 @@ class ManagedFilesTests(unittest.TestCase):
         self.assertEqual(self.config.paths.include_path.read_text(), "old include")
         self.assertEqual(self.config.paths.requirements_path.read_text(), "old requirements")
 
+    def test_new_managed_files_are_readable_by_netbox(self) -> None:
+        previous = self.files._read_previous(self.config.paths.include_path)
+
+        self.assertEqual(previous.mode, 0o644)
+
     def test_conflicting_locked_distribution_rejected(self) -> None:
         other_requirement = {**self.plugin.requirements[0], "version": "2.0.0"}
         other = ManagedPlugin(