From ddc88b130bdc1bd8acc2996ef22de364fefd7eb8 Mon Sep 17 00:00:00 2001
From: Dennis Thiessen <dennis@thiessen.io>
Date: Thu, 23 Jul 2026 13:47:57 +0200
Subject: [PATCH] fix(deploy): configure Dolt author identity

---
 deploy/provision_fundamentals.sh | 40 ++++++++++++++++++++++++++++++++
 docs/fundamentals-deployment.md  | 14 +++++++++--
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/deploy/provision_fundamentals.sh b/deploy/provision_fundamentals.sh
index dcd2ee1..1590b53 100755
--- a/deploy/provision_fundamentals.sh
+++ b/deploy/provision_fundamentals.sh
@@ -13,6 +13,8 @@ APP_GROUP="${APP_GROUP:-deploy}"
 ENV_FILE="${ENV_FILE:-/opt/signalplatform/.env}"
 MIN_FREE_GB="${DOLT_MIN_FREE_DISK_GB:-5}"
 EARNINGS_DIR="${DOLT_DATA_DIR}/${DOLT_EARNINGS_SUBDIR}"
+DOLT_IDENTITY_NAME="${DOLT_IDENTITY_NAME:-Signal Platform}"
+DOLT_IDENTITY_EMAIL="${DOLT_IDENTITY_EMAIL:-signal-platform@localhost}"
 
 fail() {
   echo "ERROR: $*" >&2
@@ -25,6 +27,38 @@ version_ok() {
   grep -Eq "(^|[[:space:]])v?${DOLT_VERSION}([[:space:]]|$)" <<<"$output"
 }
 
+as_app_user() {
+  if [[ "$(id -un)" == "$APP_USER" ]]; then
+    "$@"
+  else
+    command -v runuser >/dev/null 2>&1 || fail "runuser is required"
+    runuser -u "$APP_USER" -- "$@"
+  fi
+}
+
+repo_command() {
+  (
+    cd "$EARNINGS_DIR"
+    as_app_user "$@"
+  )
+}
+
+repo_config_value() {
+  repo_command "$DOLT_BINARY" config --get "$1"
+}
+
+configure_identity() {
+  local name email
+  name="$(repo_config_value user.name 2>/dev/null || true)"
+  email="$(repo_config_value user.email 2>/dev/null || true)"
+  if [[ -z "$name" ]]; then
+    repo_command "$DOLT_BINARY" config --local --add user.name "$DOLT_IDENTITY_NAME"
+  fi
+  if [[ -z "$email" ]]; then
+    repo_command "$DOLT_BINARY" config --local --add user.email "$DOLT_IDENTITY_EMAIL"
+  fi
+}
+
 check_free_space() {
   local available_kb
   available_kb="$(df -Pk "$DOLT_DATA_DIR" | awk 'NR == 2 {print $4}')"
@@ -48,6 +82,7 @@ check_env() {
 }
 
 check_all() {
+  local identity_name identity_email
   id "$APP_USER" >/dev/null 2>&1 || fail "missing service user: $APP_USER"
   [[ -x "$DOLT_BINARY" ]] || fail "missing Dolt binary: $DOLT_BINARY"
   version_ok || fail "expected Dolt $DOLT_VERSION at $DOLT_BINARY"
@@ -62,6 +97,10 @@ check_all() {
   else
     fail "run --check as $APP_USER (or install runuser)"
   fi
+  identity_name="$(repo_config_value user.name 2>/dev/null || true)"
+  identity_email="$(repo_config_value user.email 2>/dev/null || true)"
+  [[ -n "$identity_name" ]] || fail "missing Dolt user.name for $EARNINGS_DIR"
+  [[ -n "$identity_email" ]] || fail "missing Dolt user.email for $EARNINGS_DIR"
   check_free_space
   check_env
   echo "OK: Dolt $DOLT_VERSION and earnings clone are provisioned"
@@ -97,4 +136,5 @@ if [[ ! -d "$EARNINGS_DIR/.dolt" ]]; then
     "$DOLT_BINARY" clone post-no-preference/earnings "$EARNINGS_DIR"
 fi
 
+configure_identity
 check_all
diff --git a/docs/fundamentals-deployment.md b/docs/fundamentals-deployment.md
index fa67d34..1b29408 100644
--- a/docs/fundamentals-deployment.md
+++ b/docs/fundamentals-deployment.md
@@ -49,8 +49,18 @@ curl -fsS http://127.0.0.1:8998/api/v1/health
 
 The provisioner is idempotent. It installs the pinned Dolt version, creates the
 persistent directory as `deploy:deploy`, clones
-`post-no-preference/earnings`, verifies free space and `.env`, and refuses an
-unexpected Dolt version. It does not modify PostgreSQL or start an import.
+`post-no-preference/earnings`, configures a repository-local author identity for
+`dolt pull`, verifies free space and `.env`, and refuses an unexpected
+Dolt version. It does not modify PostgreSQL or start an import. The public clone
+does not require `dolt login`.
+
+For a server provisioned before the author-identity check was added, repair the
+existing clone once with:
+
+```bash
+sudo -u deploy -H /usr/local/bin/dolt config --global --add user.name "Signal Platform"
+sudo -u deploy -H /usr/local/bin/dolt config --global --add user.email "signal-platform@localhost"
+```
 
 Do not replace the pinned version with `latest`. A future Dolt upgrade should be
 a reviewed change to `DOLT_VERSION`, followed by the same provision/check flow.