evening: rules file in place; R-483 CLOSED (catalog, operator-confirmed); R-479 CLOSED (controller v0.241.0, proven live); R-481 blocked on the one-host-one-customer model; R-491 filed
gates / gates (push) Successful in 18s
gates / gates (push) Successful in 18s
This commit is contained in:
@@ -1,43 +1,45 @@
|
||||
# REPORT — the first "be a customer for the night" run: adventurelog on demo-hp (2026-09-13/14)
|
||||
# REPORT — the four evening items before the second night (2026-09-13)
|
||||
|
||||
*Overwritten each session. Every finding below has a register row. The controller report is
|
||||
*Overwritten each session. The night's own report (adventurelog rotation, v0.240.0) is preserved as
|
||||
`audits/nightly-2026-09-13-adventurelog/` and the register; the controller report is
|
||||
`felhom-controller/REPORT.md`, the catalog's `app-catalog-felhom.eu/REPORT.md`.*
|
||||
|
||||
> One app walked end to end as a household would; seven product defects found; a controller release
|
||||
> (v0.240.0) shipped the same night by the managed floor; two catalog fixes; two docs fixes. The
|
||||
> morning note is the top block of `STATUS.md`.
|
||||
## 1. The rules file
|
||||
|
||||
## Step 0 — the rules file
|
||||
`.claude/rules/unprompted-work.md` copied byte-identical into `felhom-controller`, `felhom.eu` and
|
||||
`app-catalog-felhom.eu` (documents-only pushes). `instructions_gate.py` refused the first push: a rule
|
||||
file needs `paths:` or `unconditional: true`; all four copies (root included) now start with the
|
||||
three-line `unconditional: true` frontmatter — sha256 `d1aa3af83ae3b220…` everywhere.
|
||||
|
||||
`.claude/rules/unprompted-work.md` is in none of the three repos and the brief's text block did not
|
||||
reach this session (searched the workspace, the transcript and memory). Not created — the operator's
|
||||
rules cannot be invented byte-identically. The brief's own fences were applied instead.
|
||||
## 2. R-481 — the scratch guest (ruled; NOT built, and why)
|
||||
|
||||
## What changed here
|
||||
The ruling ("a second enrolled LXC … enrolled as a scratch customer") collides with the model: the hub
|
||||
keys a host to one customer (`hosts.host_id` PK) and the box runs one agent with one host identity;
|
||||
re-running the installer with another customer-id would rewrite demo-hp's enrolment. Options and a
|
||||
recommendation are in the row and STATUS; 9201's shape and the disk placement (`pct move-volume`
|
||||
onto a `dir` storage at `/mnt/hdd_1`) are recorded for whichever is chosen.
|
||||
|
||||
- `documentation/runbooks/nightly-rotation.md` — new: the tick list (standing nine first, blocked on
|
||||
R-481; then the catalog); `actualbudget` recorded (no non-browser front door), `adventurelog` ticked.
|
||||
- `scripts/observations_gate.py` — R-471: every observations section is read (`scripts/CHANGELOG.md`).
|
||||
- `documentation/runbooks/target-selection.md` — R-461: `/mnt/hdd_1` is the NVMe; `drill-r50` exists
|
||||
on neither box (measured), fence kept with the fact beside it; R-93 carries the fact.
|
||||
- `09-update-architecture.md` §6.1 + §8.2 (R-452 lifted), `07-backup-architecture.md` §6, `CONTEXT.md` — v0.240.0 notes.
|
||||
- Catalog (`app-catalog-felhom.eu`): the `catalog-since` gate (R-452), see its REPORT.
|
||||
- Register: R-465 (audited: five readers fall back, one is inert and unreachable → R-490), R-452, R-473, R-474, R-466, R-471, R-453, R-461, R-477, R-478, R-480, R-482, R-484, R-485, R-486
|
||||
closed and compressed; R-481, R-482..R-489 opened (R-482 closed the same night). 212 → 206 open,
|
||||
177 → 189 closed (byte sizes: see the commit).
|
||||
- Evidence: `documentation/audits/nightly-2026-09-13-adventurelog/` (01–08), `audits/v0240-2026-09-13/`
|
||||
(release log, floor, validation, red-proofs incl. R-471).
|
||||
## 3. R-483 — photos (re-ranked P2, catalog)
|
||||
|
||||
Diffed against `homelab-manifests` `adventurelog-system/adventurelog.yaml`: the k3s ingress sends
|
||||
`/media`, `/static`, `/admin`, `/accounts` to the backend **service port 80**; the catalog sent
|
||||
everything to the frontend. Two catalog cuts (`3172258`, `ed62cfd`): a backend traefik router for the
|
||||
four prefixes, then port 80 instead of 8000 — the backend image runs nginx in front of gunicorn and
|
||||
Django serves a photo by `X-Accel-Redirect`, so port 8000 returned 200 with an empty body. Applied to
|
||||
the operator's own instance through the guarded Update; proven without a browser
|
||||
(`audits/nightly-2026-09-13-adventurelog/11-R483-repro.txt`): `GET /media/images/<id>.webp` with a
|
||||
session → 200 `image/webp`, RIFF/WEBP magic; anonymous 403 (the app's rule). **Confirmed by the operator in a browser at 21:49 — closed.** The frontend's 500 on scripted multipart uploads is upstream and
|
||||
recorded in the row; browser uploads work.
|
||||
|
||||
## 4. R-479 — tier order for bind-data apps (ruled; controller v0.241.0)
|
||||
|
||||
Ruling 9 in `09-update-architecture.md` §3. Built, tested, red-proofed; delivered by the floor and
|
||||
live-checked on a nextcloud throwaway — see `felhom-controller/REPORT.md` and
|
||||
`audits/v0241-2026-09-13/`.
|
||||
|
||||
## Observations
|
||||
|
||||
1. **The brief's rules block was not delivered; the file is absent in all repos.** NOT-A-FINDING: an input gap for the operator, recorded in STATUS "needs you", not a product defect.
|
||||
2. **No scratch guest on demo-hp; the standing nine cannot be throwaways on 9201.** FILED: R-481
|
||||
3. **adventurelog ran Django DEBUG=True on the public origin.** FILED: R-482
|
||||
4. **Photo upload fails 500 from every non-browser client (frontend proxy body-length bug).** FILED: R-483
|
||||
5. **PostGIS not recognised as a database.** FILED: R-484
|
||||
6. **The backup card reads dead paths.** FILED: R-485
|
||||
7. **Removal with backups kept forgot the Tier-2 record; the restore was refused.** FILED: R-486
|
||||
8. **A removed app is on neither backup page.** FILED: R-487
|
||||
9. **The backup test package takes 5½ minutes of real waits.** FILED: R-488
|
||||
10. **`volumes_removed: null` over removed volumes, five times.** FILED: R-489
|
||||
11. **The monitoring page's memory-distribution card never renders — `/api/system/info` is shadowed by `ServeSystemAPI` (found by the R-465 audit).** FILED: R-490
|
||||
0. **A removed app keeps its update hold; a reinstall would start held.** FILED: R-491
|
||||
|
||||
1. **The controller's evening release rides the same session as the night's — two releases in one calendar day, one per session.** NOT-A-FINDING: the rule is per session; both are recorded with their MinAgent lines.
|
||||
2. **`homelab-manifests` is not in the workspace; its manifests were read from Gitea's API.** NOT-A-FINDING: the workspace CLAUDE.md says non-felhom repos are unrelated; a read-only fetch was enough.
|
||||
|
||||
Reference in New Issue
Block a user