From 28eb7531e527b0e264c343160136b595058d2281 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Sun, 30 Aug 2026 18:30:34 -0700
Subject: [PATCH] udev: world-writable compute nodes for spawn-independent GPU
 access

The comfyui container is spawned by a systemd user unit whose spawn context
carries no supplementary groups, so render-group access to /dev/kfd and
renderD128 was structurally unreachable (keep-groups preserved an empty set;
named group_add 'render' fails name lookup inside the userns). World-mode on
the compute nodes is the only spawn-context-independent grant; display cards
keep their modes. Apply: install to /etc/udev/rules.d, udevadm control
--reload-rules, then trigger by subsystem to re-apply modes to live nodes.

Also maps dankclaw/udev/* in the focused-test selector (not bats-testable).
---
 dankclaw/udev/99-comfyui-gpu-access.rules | 21 +++++++++++++++++++++
 scripts/test-changed.sh                   |  4 ++++
 2 files changed, 25 insertions(+)
 create mode 100644 dankclaw/udev/99-comfyui-gpu-access.rules

diff --git a/dankclaw/udev/99-comfyui-gpu-access.rules b/dankclaw/udev/99-comfyui-gpu-access.rules
new file mode 100644
index 0000000..b79c78d
--- /dev/null
+++ b/dankclaw/udev/99-comfyui-gpu-access.rules
@@ -0,0 +1,21 @@
+# /etc/udev/rules.d/99-comfyui-gpu-access.rules
+#
+# Why world-writable compute nodes: the comfyui container is spawned by a
+# systemd user unit (comfyui.service, Type=oneshot). User-unit processes are
+# spawned by the user manager with NO supplementary groups, so any spawn path
+# through systemd loses `render`/`video` membership regardless of how the
+# container is launched (keep-groups and named group_add both depend on the
+# spawning process already holding the group — verified 2026-08-31: keep-groups
+# preserved an empty group list under the user manager and /dev/kfd open still
+# failed with EACCES). A mode that grants access to "everyone in this uid
+# domain" is the only spawn-context-independent option short of running the
+# stack rootful.
+#
+# Blast radius: any local process (every container here runs as the same uid
+# domain) can already ptrace the GPU userspace through an existing holder's
+# fd inheritance; on a private single-administrator home server this trades a
+# capability gate that could never be held by the intended user anyway.
+# Render nodes and /dev/kfd are compute nodes only — display outputs (card0,
+# card1) keep their owner/group/mode.
+KERNEL=="kfd", SUBSYSTEM=="misc", MODE="0666"
+KERNEL=="renderD*", SUBSYSTEM=="drm", MODE="0666"
diff --git a/scripts/test-changed.sh b/scripts/test-changed.sh
index b263720..4cf3fa5 100755
--- a/scripts/test-changed.sh
+++ b/scripts/test-changed.sh
@@ -192,6 +192,10 @@ for path in "${CHANGED[@]}"; do
             add_test tests/docs_completeness.bats
             add_test tests/deployment_scoping.bats
             ;;
+        dankclaw/udev/*)
+            # Host-level udev rules are applied by manual sudo install + udevadm
+            # trigger, not dispatched as a service; nothing here is bats-testable.
+            ;;
         .AGENTTRASH/*)
             # Trash moves are not testable; skip.
             ;;