admin
05dfaa1a10
Per the 2026-07-21 refresh brief: R-39 interim blocks (B4/E1) and the R-36 manual-Save block (C4) deleted — both shipped and proven live; freemail.hu gate proven (R-4 COMPLETE); golden/floor-lift note now cites two shapes (rehearsal + virgin HP t740 day-0 lift 0.153.0->0.156.0); A3 loader table per operations/nodes.md (N100=mkimage/SB-off per record, HP t740=shim/SB ENABLED); B2 multi-NIC cabled-port gotcha (R-59/R-60 pending); new A5 gate (agent >=0.93.0 deployed box-side before the first escrow ceremony); D offboarding pointer to §G (R-25b). DRAFT status and the C7 graduation gate unchanged. ROADMAP R-25b pointer follows the rename. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UuFPHmHNrCJj1VhY6QdDMU
57 lines
4.0 KiB
Markdown
57 lines
4.0 KiB
Markdown
# REPORT — Runbook refresh: RUNBOOK-onboarding-draft v3 → v4 (docs-only, XS)
|
|
|
|
**Date:** 2026-07-22 · **Repo:** `felhom.eu` · **Scope:** documentation only — no code, no version
|
|
bump, no deploy. The onboarding runbook was refreshed against what shipped 2026-07-18..21 and
|
|
against the second full onboarding on virgin hardware (HP t740, 2026-07-21).
|
|
|
|
## What changed
|
|
|
|
`documentation/runbooks/RUNBOOK-onboarding-draft-v3.md` → **`RUNBOOK-onboarding-draft-v4.md`**
|
|
(git mv, one commit), per the project-Claude refresh brief of 2026-07-21:
|
|
|
|
1. **R-39 interim blocks DELETED** (B4 descriptor caveat + E1 manual `pvesm status` check) —
|
|
replaced with one sentence each: the DR tier self-detects a dead credential (loud `auth_failed`)
|
|
and self-heals via damped re-issue; the hub gauge is trustworthy. Cited: `backlog/ROADMAP.md`
|
|
R-39 (CLOSED, proven live 2026-07-21, hub 0.68.1 + agent 0.91.2, 13 s chain
|
|
`applied → auth_failed → applied`).
|
|
2. **R-36 workaround block in C4 DELETED** (re-onboarding manual-Save) — replaced with the shipped
|
|
behaviour: enabled-but-unprovisioned raises an amber banner (hub v0.67.0). R-31 (Save-once/504)
|
|
and the R-32 orphan-card note KEPT. Consistency follow-through: A1 and the B3 note now say the
|
|
self-bind link is **auto-minted at create/RESET** (also R-36) — the manual mint is the re-mint
|
|
fallback.
|
|
3. **C1 freemail gate** — freemail.hu PROVEN 2026-07-21 (operator test-send received; R-4 COMPLETE
|
|
per `backlog/ROADMAP.md`); the check-spam habit line kept.
|
|
4. **A1 golden note** — golden 0.153.0 carries all four infra images; floor-lift proven on TWO
|
|
shapes (rehearsal 0.143→0.145 in 5 s; virgin HP t740 0.153.0→0.156.0 during day-0, `CONTEXT.md`).
|
|
"Rebuild before first tester" softened to a pointer at the standing rule in F.
|
|
5. **A3 loader note** — the single F1 line replaced with the loader table. **Deviation from the
|
|
brief, on the record's side:** the brief said "N100/AMI = shim"; the record
|
|
(`operations/nodes.md` + `tests/VALIDATION-n100-baremetal-2026-07-16.md` F1) says the N100
|
|
installed with **mkimage, SB off** — the AMI AN3PLUS firmware cannot relocate the signed GRUB,
|
|
which is exactly why shim was not usable there. Table written per the record, as the brief's
|
|
"(SB state as recorded)" directs. HP t740 = shim with Secure Boot ENABLED (2026-07-21).
|
|
6. **B2/B3 second datapoint** — the HP onboarding walked register → pairing banner → unclaimed
|
|
list → self-bind (code + passphrase) → day-0 → dashboard on never-seen hardware (cited
|
|
`CONTEXT.md` + `operations/nodes.md`). New B2 gotcha: on multi-NIC boards verify the CABLED
|
|
port got the lease during install (the t740 4-port trap; R-59/R-60 pending).
|
|
7. **New A5 checklist item** — agent train ≥ v0.93.0 (hyphen-free recovery wordlist,
|
|
`felhom-agent/CHANGELOG.md`) must be BUILT + DEPLOYED to the customer's box before the FIRST
|
|
real tester's escrow ceremony; ceremonies run box-side, source-only does not count.
|
|
8. **D offboarding pointer** — R-25b ruling noted: full teardown = DELETE cascade (TASK-I),
|
|
RESET = identity-preserving re-onboarding; pointer to §G.
|
|
9. **KEPT unchanged:** DRAFT status, the C7 graduation-gate paragraph (still the last unwalked
|
|
step), all reference wall-clocks, all F rules, all of §G.
|
|
|
|
Also: `backlog/ROADMAP.md` R-25b's live pointer updated `…draft-v3.md` → `…draft-v4.md` so the
|
|
citation resolves (historical references in the rehearsal validation doc and past REPORTs left
|
|
as-is — they describe the file as it was named then).
|
|
|
|
## Not done / unchanged
|
|
|
|
- C7 not flipped; the capability-map row untouched; no other runbook touched.
|
|
- No CHANGELOG entry: this repo's changelogs are per-area (`hub/`, `scripts/`, `website/`) and none
|
|
of those areas changed; prior docs-only commits (e.g. TASK-H nodes.md) followed the same pattern.
|
|
|
|
*(Previous REPORT — TASK-I, hub v0.69.0/v0.70.0 DELETE cascade — preserved in git history at
|
|
`9b3381b` and summarized in `backlog/ROADMAP.md` R-25b.)*
|