Peti's box retired (operator ruling 2026-09-25): hub customer + Storage Box sub-account removed, ep0 held nothing; protected list = DooPlex + ep0; decision 34 (no leg resume, R-686 closed); R-688

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-25 11:04:52 +02:00
parent 6b2176e480
commit eb1c56a981
28 changed files with 398 additions and 28 deletions
@@ -7,7 +7,7 @@
 > **v1.19.0**. Params are LAW (spike-validated): `vmbr9` portless, host `169.254.253.1/30`, guest
 > `169.254.253.2/30` on `net1`, `listen_addr=169.254.253.1:8443`, `lan_resolver.host_ip=<LAN IP>`.
 >
-> **Scope:** ONE host with ONE customer guest (the current fleet shape). A cluster (Peti, 2 nodes) is
+> **Scope:** ONE host with ONE customer guest (the current fleet shape). A cluster (Peti, 2 nodes — RETIRED 2026-09-25) is
 > **out** — it needs bridge parity on both nodes / an SDN vnet; that is Phase C, its own runbook.
 >
 > **The apps never stop.** Only the management channel moves; `cloudflared` + the app containers keep
@@ -435,7 +435,7 @@ label. Filed under E-2.
 | 6 | **Absent-target policy** per §6: decide fallback-vs-fail, and if fallback, alarm that protection is degraded rather than reporting a healthy tier. |
 | 7 | **Retention and space accounting** on a drive the customer also uses — today `keep-last=3` competes with customer data with no reservation and no ceiling. |
 | 8 | The honest **single-drive label**. |
-| 9 | **Migrating the remaining fleet** — `peti-felhom` and any box not covered here. |
+| 9 | **Migrating the remaining fleet** — any box not covered here (`peti-felhom` was RETIRED 2026-09-25 and needs nothing). |
 | 10 | Naming guard: `backupIsPBS` matches the substring `pbs`, so a target so named would be mislabelled to the customer as offsite (§1.5). |

 ---
@@ -41,7 +41,7 @@ stays valid for old history only.
 ## 4. Deploy / live
 Build v0.80.0 → felhom-pve (demo agent) → healthy, 56/56 caps. Publish 0.80.0 to Gitea + bump the hub
 Day-0 agent manifest (the publish-train pattern; the operator-sign step is Viktor's 🛑 as per GL-1).
-**Peti's agent update path:** the agent self-update is operator-signed + pinned — confirm from the go-live
+**[OBSOLETE 2026-09-25 — Peti's box RETIRED; no BYO box remains.]** **Peti's agent update path:** the agent self-update is operator-signed + pinned — confirm from the go-live
 record how a BYO agent updates (self-update channel armed at his install? operator pubkey file was NOT
 passed on his install form) — if his box cannot self-update the agent, REPORT must say so and the ceremony
 waits for the next Peti-touch window (he runs one update command). Do not improvise a new update path.
@@ -6,11 +6,12 @@

 ## The rule

-> **Two machines are protected: `DooPlex` and Peti's box. Everything else is disposable.**
-> Operator decision **D-d**, 2026-08-02. DooPlex because it holds Gitea, the hub, the backups and the
-> registry — everything else rebuilds from it, and it rebuilds from nothing. Peti's box because there
-> is a real person behind it. **Every other box, both demo boxes included, may be broken or
-> reinstalled freely.**
+> **Two machines are protected: `DooPlex` and `ep0`. Everything else is disposable.**
+> Operator decision **D-d**, 2026-08-02, and the ep0 ruling of 2026-08-03. DooPlex because it holds
+> Gitea, the hub, the backups and the registry — everything else rebuilds from it, and it rebuilds from
+> nothing. ep0 for the reason below. **Every other box, both demo boxes included, may be broken or
+> reinstalled freely.** *(Peti's box was the second protected machine until it was RETIRED on
+> 2026-09-25 — operator ruling; `audits/RETIRE-peti-2026-09-25.md`.)*
 >
 > **This is a correction, not a relaxation.** The earlier posture was costing whole sessions to
 > caution and pushing drills onto DooPlex — the one machine that should never host them. If you are
@@ -70,7 +71,7 @@ in `documentation/backlog/OPEN-ITEMS.md`, never `--no-verify`.
 |---|---|---|
 | **0 — disposable. Reach here first.** | Exists to be broken; reinstalling is a routine afternoon, not an incident. **A drill that needs a victim uses one of these.** | `demo-hp` (t740), `demo-felhom` (N100) |
 | **1 — create and destroy freely** | Throwaway VMs, guests, scratch customers — **hosted on a Tier 0 machine** | drill VMs, scratch guests |
-| **2 — protected. Never a drill target.** | Losing it costs the recovery chain or a real relationship | **DooPlex**, **Peti's cluster**, **`ep0`** (operator ruling 2026-08-03) — and nothing else |
+| **2 — protected. Never a drill target.** | Losing it costs the recovery chain or a real relationship | **DooPlex**, **`ep0`** (operator ruling 2026-08-03) — and nothing else (Peti's cluster RETIRED 2026-09-25) |

 **DooPlex is Tier 2 because it *is* the recovery chain** — hub, Gitea, registry, PBS, k3s + Longhorn.
 Everything else rebuilds from it; it rebuilds from nothing. A bad moment in a DR drill there costs the
@@ -79,10 +80,14 @@ thing under test, the source of truth for it, and the backups, at once.
 **`ep0` is Tier 2 — PROTECTED. Operator ruling, 2026-08-03.** D-d named two protected machines and did
 not name ep0 either way, so this page carried the question in writing for two days and read it the
 narrow way meanwhile (not protected, but not wipeable). The ruling settles it and **extends D-d's
-protected list to three machines**: DooPlex, Peti's cluster, ep0.
+protected list to three machines**: DooPlex, Peti's cluster, ep0. **Since 2026-09-25 (Peti's box
+retired) it is two: DooPlex and ep0.**

-The reason it was never really in doubt: ep0 holds the **PBS-DR datastore and the restic copy of a
-real customer's data**, which is the only off-premises copy that exists. So *deleting datastores,
+The reason, as it stands on 2026-09-25: ep0 holds the **PBS-DR datastore with the demo boxes' (and
+tester-1's) whole-guest copies, the WireGuard hub every box's off-site path runs through, and the
+operator's out-of-band path**; the Hetzner Storage Boxes hold each box's restic copy. There is no paying
+customer yet, but ep0 is the only off-premises tier of the whole product, and a mistake there cannot be
+rebuilt from DooPlex. So *deleting datastores,
 prune jobs, tunnel config or nftables rules* was already forbidden by what it would destroy; the
 ruling makes the classification say so plainly instead of leaving each session to re-derive it.
 **Reads are fine** — including the ordinary off-site read a restore-test performs (R-86) — and it is
@@ -158,12 +163,12 @@ against.
  builds if `df -h /mnt/5_hdd /` shows either over 90 %. **Because it is the recovery chain and a live
  k3s node.**

-### `Peti's cluster` (`peti-felhom`) — **Tier 2**
+### `Peti's cluster` (`peti-felhom`) — **RETIRED 2026-09-25** (operator ruling)

-**Do not touch, at all.** A real external pilot with a real person behind it; its whole-guest backup
-still shares a device with its guest, so a drive failure is **offsite-only recovery**. Deliberately not
-migrated, parked until the tester reinstalls (`PETI` in `backlog/OPEN-ITEMS.md`). Currently DOWN, no
-enrolled host. No access route from DooPlex, and nothing here needs one.
+No longer protected and no longer a machine this project knows: the tester wiped his server and it will not
+return. Its hub customer, Storage Box sub-account (`u629488-sub2`, which never held a backup) and records were
+removed through the hub's own customer delete; ep0 held nothing of it. The audit trail stays (events, the
+deletion and reset tombstones). Record: `audits/RETIRE-peti-2026-09-25.md`.

 ### `ep0` (`felhom-hetzner`, `ep0.felhom.eu`) + the Hetzner Storage Boxes — **Tier 2, PROTECTED** (operator ruling 2026-08-03)

@@ -212,8 +217,9 @@ The fixture would have shown a controller nobody installs.
  from `backlog/OPEN-ITEMS.md`; **no direct access attempted or confirmed.** Tier 2 by what they hold.
 - **`felhotest`** (legacy, `ssh -p 33022 kisfenyo@router.abonet.hu`) — **`Connection refused`**
  2026-07-30; that was the only route tried. Untiered; assume nothing.
- **Peti's cluster** hardware/storage layout — unverified. Tier 2 rests on the relationship, which
-  needs no verification.
+- **Peti's cluster** — RETIRED 2026-09-25 (operator ruling: the tester wiped his server; it will not
+  return). Its hub records, its Storage Box sub-account and folder are gone; ep0 never held anything of
+  it. `audits/RETIRE-peti-2026-09-25.md`.

 ## The gap this page closes