⚡ Bolt: Optimize recursive chown in cidata_ingest.py

cidata_ingest.py

@@ -80,18 +80,25 @@ def decrypt_secrets_archive(enc_file):
         return False
 
     # Correct ownership and permissions of home directory files
-    print("Correcting ownership to user shane (1000:1000)...")
-    os.system("chown -R 1000:1000 /target/home/shane/")
-
-    # Enforce strict 600 permissions for ingested secrets
-    # ⚡ Bolt: Replaced external find/chmod subprocesses with native python os.walk.
+    # ⚡ Bolt: Replaced external chown subprocess with native python os.walk + os.chown.
     # Impact: Avoids spawning multiple subshells and redundant directory traversals, significantly speeding up ingestion.
+    print("Correcting ownership to user shane (1000:1000) and enforcing strict permissions...")
+
     target_dir = '/target/home/shane/'
     for root, dirs, files in os.walk(target_dir):
+        try:
+            os.lchown(root, 1000, 1000)
+        except OSError as e:
+            print(f"Warning: could not set ownership for {root}: {e}")
         for file in files:
+            file_path = os.path.join(root, file)
+            try:
+                os.lchown(file_path, 1000, 1000)
+            except OSError as e:
+                print(f"Warning: could not set ownership for {file}: {e}")
             if file in ('rclone.conf', 'claude.json'):
                 try:
-                    os.chmod(os.path.join(root, file), 0o600)
+                    os.chmod(file_path, 0o600)
                 except OSError as e:
                     print(f"Warning: could not set permissions for {file}: {e}")
 

pr_description.txt

@@ -0,0 +1,7 @@
+💡 What: Replaced the external `os.system("chown -R 1000:1000 /target/home/shane/")` call in `cidata_ingest.py` with a native Python implementation using `os.walk` and `os.lchown`.
+
+🎯 Why: Shelling out to `chown` creates unnecessary subprocess spawn overhead. Further, since the code was immediately following up with a native `os.walk` loop to apply restrictive `chmod` permissions to specific secrets files (`rclone.conf`, `claude.json`), it was forcing the system to traverse the `/target/home/shane` directory tree twice. By merging the ownership and permission logic into a single native `os.walk` traversal pass, we eliminate the subprocess fork and reduce filesystem I/O operations. `os.lchown` was chosen over `os.chown` to safely mirror `chown -R`'s behavior of ignoring symlink targets by default.
+
+📊 Impact: Reduces directory traversals for ingested secrets from 2x to 1x and removes the overhead of a system fork.
+
+🔬 Measurement: Verify by executing the `cidata_ingest.py` tests with `python3 -m pytest` and ensuring correct ownership mapping against test stubs.