From 72692e1d9c753d6dbe0ed01cc8fc3e5bb56d2a92 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 27 Jul 2026 15:43:28 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20OPEN-ITEMS.md=20=E2=80=94=20one=20autho?= =?UTF-8?q?ritative=20register=20of=20open=20work?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Open state was spread across ROADMAP, CONTEXT.md, four audits/, three runbooks, per-session REPORT.md files and a chat log. This is the one page to read first: every row has a state (BLOCKED/READY/WAITING-ON-OPERATOR/WATCHING) and an owner, and the READY rows are ranked with reasoning. R-88 is the recommended next task — quiesce's nil-age fail-open stops every app stack every 5 minutes with no backoff and bypasses the maintenance window, and its trigger (a PBS read failure) is live given ep0's demonstrated OOM. CONTEXT.md now records that OPEN-ITEMS.md is authoritative and that REPORT.md is overwritten per session. --- CONTEXT.md | 4 +++ documentation/backlog/OPEN-ITEMS.md | 38 +++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 documentation/backlog/OPEN-ITEMS.md diff --git a/CONTEXT.md b/CONTEXT.md index 59f4edb..2dcf0a2 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -3,6 +3,10 @@ > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub), > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`. +> **`documentation/backlog/OPEN-ITEMS.md` is the single source of truth for open work** (2026-07-27). +> Read it first; `ROADMAP.md` holds the full history and reasoning behind each item. **`REPORT.md` is +> per-session and overwritten — nothing durable may live only there.** + ## Standing rulings **S-1 — N.5 gains a third leg: architecture docs are same-session coupled (2026-07-26, R-81).** diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md new file mode 100644 index 0000000..9397075 --- /dev/null +++ b/documentation/backlog/OPEN-ITEMS.md @@ -0,0 +1,38 @@ +# OPEN-ITEMS — the single source of truth for open work + +**Rebuilt 2026-07-27 by read-only triage.** `ROADMAP.md` keeps the full history and reasoning; this +page keeps only what is **open**, and it is the file to read first. `REPORT.md` is per-session and +**overwritten** — nothing durable may live only there. + +State: `BLOCKED` · `READY` · `WAITING-ON-OPERATOR` · `WATCHING`. Every row has an owner. + +| ID | What | State | Blocked on | Next action | Owner | +|---|---|---|---|---|---| +| **R-88** | Unreachable backup target reads as *no backup exists* → quiesce loop, no backoff, maintenance window bypassed | **READY #1** | — | Make an unreachable read UNKNOWN; fix the `AgeSecs==nil` window bypass in the same slice | CC | +| **R-95** | restic offsite credential **can delete** (`readonly=False`, `forget --prune` runs from the box); SFTP cannot express append-only | **READY #2** | — | Snapshot plan as the stopgap (row below), then split prune off-box or move to REST `--append-only` | CC | +| **R-94** | Hub hands out host-install `1.19.0`; `1.20.0` is what carries R-82's backup default | **READY #3** | — | Bump `configs.go:28`, and stop hand-syncing a version constant across repos | CC | +| **R-86** | Restore-tests are interval-scheduled, not backup-aligned | **READY #4** | R-90 (ep0 headroom) informs cadence | Trigger a tier ~24 h after **its own** newest archive | CC | +| **R-87** | The restic tier is never restore-tested | **READY #5** | — | Design a controller-side test (no scratch-guest analogue transfers) | CC | +| — | Enable Hetzner Storage Box **snapshots** on `storage-box-pool-1` — `snapshot_plan=null`, 0/10 used, server-side so SFTP cannot delete them | WAITING-ON-OPERATOR | operator ruling | One console/API call; immediate immutability for the restic tier | operator | +| — | `PBS-storage-1` (u629193, box 611421) still `status=active`, 19.9 MB | WAITING-ON-OPERATOR | operator console | Delete the box | operator | +| **R-90** | ep0: 3.8 GB, **no swap**, OOM'd 2026-07-27 killing PBS for ~15 min | **BLOCKED** | Hetzner CX33 availability | Rescale; or add a swapfile as an interim (needs no console) | operator | +| **R-91** | Old 13 GB datastore copy at `/srv/pbs-felhom` on ep0's root disk | WATCHING | demo-felhom's first **post-migration** PBS backup | Delete once it lands; fix `CONTEXT.md:1018` same commit | CC | +| — | First-ever **GC** on `felhom-offsite` (armed today 13:11 UTC, never run) | WATCHING | schedule | **Sun 2026-08-02 04:30 UTC** — confirm it completes | CC | +| — | demo-felhom's next weekly PBS backup (newest is 2026-07-26) | WATCHING | schedule | ~2026-08-02; also releases R-91 | CC | +| — | demo-felhom's next restore-test (84 h cadence, last 2026-07-27 06:38 UTC) | WATCHING | schedule | ~2026-07-30 18:38 UTC | CC | +| **R-89** | Retention as a per-customer **commercial** policy on the hub | READY (increment 2) | — | Policy object + reconciler → ep0 prune job; keep box tokens write-only | CC | +| **R-96** | Two standing rules agreed in chat, never committed | READY (XS) | — | Add both beside `CONTEXT.md` S-1/S-2 | CC | +| **R-92** | Hub PBS-DR gauge is 0.1 GB-granular — small deltas unverifiable | READY (XS) | — | Widen precision when retention becomes customer-visible | CC | +| **R-93** | `drill-r50` is both a blocked customer and the only drift fixture | READY (XS) | — | Retire it for a synthetic fixture, or unblock + silence per-customer | CC | + +## Why the READY rows rank this way + +1. **R-88** — the only item causing *active harm*: it stops every customer app stack every 5 minutes, + with no backoff, and the `AgeSecs==nil` path also disables the maintenance-window gate, so it runs + in business hours. Its trigger is a PBS read failure, which R-90 shows is live. +2. **R-95** — the largest *data* exposure: the tier holding the customer's documents and photos is the + one whose credential can delete, and the mitigation is a console click nobody has made. +3. **R-94** — a one-line constant, but until it moves every hub-driven install gets the pre-R-82 + backup default. Cheapest high-consequence fix on the list. +4. **R-86** — an operator ruling already exists; it only waits on knowing what load ep0 can take. +5. **R-87** — real and unbuilt, but needs its own design, so it should not jump work that is specified.