admin
dfd5d731ee
- LocalAPIConfig.island_bridge + island_guest_addr (+ IslandEnabled, Validate all-or-nothing + CIDR guard) - buildBringUpConfig attaches static net1 (island) on provision + DR when set; absent otherwise (pre-R-50 byte-for-byte). Plumbed from cfg.LocalAPI at both RunBringUp sites. Endpoint already follows listen_addr (A0: no template change). - healer stays eth0-only (A3 verify-only) — red-proof test locks the scoping - example config + firewall example rewritten for the island; REUSE updated - 3 non-hollow tests; full green. MinAgent unchanged. Coupling: host-install island config requires agent >= 0.96.0 (vouch first).
32 lines
2.1 KiB
Markdown
32 lines
2.1 KiB
Markdown
# REPORT — v0.96.0: R-50 island NIC (provisioning half) (2026-07-25)
|
|
|
|
Implements the agent half of the R-50 island control plane (spike GO,
|
|
`felhom.eu/documentation/audits/SPIKE-island-bridge-2026-07-25.md`). A fresh install is born immune to
|
|
F1 (a LAN/DHCP/site move can no longer take the control plane down).
|
|
|
|
## What changed
|
|
- `internal/config/config.go` — `LocalAPIConfig.IslandBridge` + `IslandGuestAddr`; `IslandEnabled()`;
|
|
`Validate()` all-or-nothing + CIDR guard.
|
|
- `internal/reconcile/bringup.go` — `BringUpSpec` island fields; `buildBringUpConfig` attaches a static
|
|
`net1` (island NIC) on provision AND DR when configured; absent otherwise.
|
|
- `cmd/felhom-agent/main.go` — both `RunBringUp` call sites plumb `cfg.LocalAPI.Island*`.
|
|
- `configs/agent.example.json` — island shape (island bind + island_bridge/guest_addr + lan_resolver.host_ip).
|
|
- `configs/felhom-localapi-firewall.example` — rewritten for the island (the portless bind IS the LAN close).
|
|
- `REUSE.md` — island-NIC provisioning pattern + the "endpoint follows listen_addr" note.
|
|
|
|
## A0/A3 determination
|
|
- **A0 = config-only for the endpoint:** `main.go` sets the bootstrap `Endpoint: cfg.LocalAPI.ListenAddr`;
|
|
moving the bind to the island moves the guest dial with no template change. The version bump is for the
|
|
net1-attach (the operator chose agent-bringup over golden-bake to eliminate the golden-coupling risk).
|
|
- **A3 = healer verify-only:** the guestnet healer is eth0-only (`parseMode` dev-scoped); the static island
|
|
eth1 is outside its scope. Locked with a red-proof test — no healer change.
|
|
|
|
## Tests (green, non-hollow)
|
|
`TestBuildBringUpConfig_IslandNIC`, `TestLocalAPIConfig_IslandValidation`,
|
|
`TestParseMode_IslandStaticNICDoesNotConfuseEth0`. Full `go build/vet/test ./...` green.
|
|
|
|
## Coupling / deploy order
|
|
A host-install that writes the island config REQUIRES agent ≥ 0.96.0 (to read `island_guest_addr` and
|
|
attach net1). **Vouch 0.96.0 before island installs go live.** MinAgent unchanged (no controller coupling).
|
|
Fleet migration of existing boxes = `felhom.eu/documentation/runbooks/RUNBOOK-island-migration.md` (Phase B).
|