From a2500532c3f7a9fee7acf0decd2e1b06f564f454 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 25 Jul 2026 14:36:56 +0200 Subject: [PATCH] R-50: A4 fresh-provision validated (agent auto-net1 live); spike caveat closed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - A4: scratch guest provisioned from golden on the island-configured drill came up with net1 automatically (zero manual edits) — the v0.96.0 provisioning path proven live. Spike method caveat CLOSED. - REPORT: Phase A done + vouched 0.96.0; B0/B1/A4 done; B2/B3 await operator go. --- REPORT.md | 20 ++++++++++++++----- .../audits/SPIKE-island-bridge-2026-07-25.md | 16 ++++++++------- 2 files changed, 24 insertions(+), 12 deletions(-) diff --git a/REPORT.md b/REPORT.md index f0defa4..eb8268a 100644 --- a/REPORT.md +++ b/REPORT.md @@ -26,8 +26,18 @@ fresh install writes island config an older agent ignores → guest has no islan plane. This is the one hard ordering constraint. ## Status of the phases -- **Phase A (artifacts): DONE + committed** (agent `dfd5d73`; this repo this commit). Agent build/publish - + hub deploy + golden unchanged (net1 comes from the agent, so no re-bake). -- **Phase B (migration): pending** — `RUNBOOK-island-migration.md` + drill migration (B1) + fresh-install - validation (A4), then demo-hp (B2) and demo-felhom (B3) behind operator go/no-go STOP points. -- **Phase C (Peti cluster): parked** — its own supervised runbook + a new ROADMAP row. +- **Phase A (artifacts): DONE.** Agent v0.96.0 committed (`dfd5d73`), **published** (sha `af938601…`) and + **VOUCHED** in the hub Day-0 manifest (agent 0.96.0; golden 0.161.0 / min_agent 0.93.0 / wrapper + preserved). host-install v1.19.0 + hub sync committed (`485321f`). Golden unchanged (net1 comes from the + agent). Live site serves 1.19.0. +- **Phase B (migration): B0+B1+A4 DONE; B2/B3 pending operator go.** + - **B0** `RUNBOOK-island-migration.md` written (`4650493`). + - **B1** drill migration ran verbatim → island `/storage` **HTTP 200**, LAN DNS held on the LAN IP + (Finding-1 pin), apps healthy, hub reports 0.96.0. No rollback. + - **A4** the agent auto-attached `net1` on the island at provision (scratch guest from golden, **zero + manual edits**) → the provisioning path is proven live (spike method caveat CLOSED). F1 replay + cold + reboot were proven on the same drill (spike P6/P7). *(A literal ISO wipe-reinstall was not run — the + surgical provision proves the R-50-specific behavior; the ISO/first-boot/day-0 glue is unchanged.)* + - **B2 demo-hp / B3 demo-felhom:** await your go/no-go (each its own STOP). The runbook + rollback table + are ready; apps stay up throughout. +- **Phase C (Peti cluster): parked** — its own supervised runbook + a new ROADMAP row (to add at Phase 5). diff --git a/documentation/audits/SPIKE-island-bridge-2026-07-25.md b/documentation/audits/SPIKE-island-bridge-2026-07-25.md index 1093b95..6b20842 100644 --- a/documentation/audits/SPIKE-island-bridge-2026-07-25.md +++ b/documentation/audits/SPIKE-island-bridge-2026-07-25.md @@ -18,13 +18,15 @@ confirmed live AND its fix proven, and the whole topology survives a cold host r See **“## Empirical validation (2026-07-25 PM) — probes P1–P8”** below. The two earlier BLOCKED attempts (no drill existed) are retained further down for provenance. -### Method caveat (honest scope) -The probes drove the mechanism via **manual, surgical config edits** on the drill (append a `vmbr9` -stanza + `ifreload`, `pct set -net1`, hand-edit `agent.json` `listen_addr`/`lan_resolver.host_ip` and -the host-side `bootstrap.json` endpoint, restart). They prove the **runtime chain** is sound and -reboot-durable. They do **not** exercise the *provisioning* path that a real rollout needs -(`felhom-host-install.sh` writing these at install/golden-bake time) — that is Phase A of the impl spec, -still a future task. What is now de-risked: every assumption the spec rests on is empirically true. +### Method caveat (honest scope) — **CLOSED 2026-07-25 by the implementation.** +The probes drove the mechanism via **manual, surgical config edits** on the drill. That caveat is now +**resolved**: R-50 shipped (agent **v0.96.0** — `buildBringUpConfig` attaches the island `net1` from +`local_api.island_bridge`/`island_guest_addr`; host-install **v1.19.0** creates `vmbr9`, writes the +island bind + `island_*` + the `lan_resolver.host_ip` LAN pin). The *provisioning* path is now proven +live, not just the runtime: (a) the migration runbook ran verbatim on the drill (`RUNBOOK-island-migration.md`, +B1); and (b) a scratch guest provisioned by the agent from the golden came up with `net1` on the island +**automatically, zero manual edits** (A4). Fleet migration of the two demo boxes remains (Phase B, operator +go/no-go). See `felhom-agent/CHANGELOG.md` v0.96.0 + `scripts/CHANGELOG.md` v1.19.0. ## Empirical validation (2026-07-25 PM) — probes P1–P8, ALL PASS