admin
655b69f37d
R-97 collapsed to its shipped one-liner in ROADMAP and closed in OPEN-ITEMS. PROMPT-TEMPLATE N.5 now names FOUR coupled artifacts instead of two: the capability map, ROADMAP, the owning architecture doc (ruled as S-1 in CONTEXT.md but never reflected in the template CC actually reads, so it bound nobody), and OPEN-ITEMS.md. Tasks must now report which register rows they opened, closed or re-ranked. Ops: R-90 swap done (interim; CX33 still blocked), R-95 mitigation armed but zero snapshots taken so it moves to WATCHING rather than closed, R-91 gate still not satisfied. CONTEXT.md datastore path corrected to /mnt/pbs-datastore.
4.8 KiB
4.8 KiB
OPEN-ITEMS — the single source of truth for open work
Rebuilt 2026-07-27 by read-only triage. ROADMAP.md keeps the full history and reasoning; this
page keeps only what is open, and it is the file to read first. REPORT.md is per-session and
overwritten — nothing durable may live only there.
State: BLOCKED · READY · WAITING-ON-OPERATOR · WATCHING. Every row has an owner.
| ID | What | State | Blocked on | Next action | Owner |
|---|---|---|---|---|---|
| R-88a | SHIPPED (controller v0.176.0, 2026-07-27) | — | Live on both boxes; breaker 15m→4h, per-tier, never permanent | — | |
| R-88b | /backup/due cannot say unknown — "read errored" and "never backed up" are byte-identical, so nil still bypasses the window gate |
READY #1 | — | Agent wire change: give unknown its own representation; compat rule both ways + MinAgent floor | CC |
| R-95 | restic offsite credential can delete (readonly=False, forget --prune runs from the box); SFTP cannot express append-only |
READY #2 | — | Root exposure still open. Mitigation now ARMED — split prune off-box or move to REST --append-only |
CC |
| R-94 | Hub hands out host-install 1.19.0; 1.20.0 is what carries R-82's backup default |
READY #3 | — | Bump configs.go:28, and stop hand-syncing a version constant across repos |
CC |
| R-86 | Restore-tests are interval-scheduled, not backup-aligned | READY #4 | R-90 (ep0 headroom) informs cadence | Trigger a tier ~24 h after its own newest archive | CC |
| R-87 | The restic tier is never restore-tested | READY #5 | — | Design a controller-side test (no scratch-guest analogue transfers) | CC |
| — | Storage Box snapshots on storage-box-pool-1 — plan SET (daily 00:00, keep 7) but 0 taken yet |
WATCHING | first run tonight 00:00 | Confirm size_snapshots > 0 tomorrow; until then the mitigation is armed, not proven |
CC |
| — | PBS-storage-1 (u629193, box 611421) still status=active, 19.9 MB |
WAITING-ON-OPERATOR | operator console | Delete the box | operator |
| R-90 | ep0 RAM headroom — 4 GiB swap added 2026-07-27 (persistent, verified without reboot); 3.8 GB RAM unchanged | BLOCKED (interim done) | Hetzner CX33 availability | Rescale when available; swap now covers Sunday's first GC | operator |
| R-91 | Old 13 GB datastore copy at /srv/pbs-felhom on ep0's root disk |
WATCHING | demo-felhom's first post-migration PBS backup | Delete once it lands; fix CONTEXT.md:1018 same commit |
CC |
| — | First-ever GC on felhom-offsite (armed today 13:11 UTC, never run) |
WATCHING | schedule | Sun 2026-08-02 04:30 UTC — confirm it completes | CC |
| — | demo-felhom's next weekly PBS backup (newest is 2026-07-26) | WATCHING | schedule | ~2026-08-02; also releases R-91 | CC |
| — | demo-felhom's next restore-test (84 h cadence, last 2026-07-27 06:38 UTC) | WATCHING | schedule | ~2026-07-30 18:38 UTC | CC |
| R-97 | SHIPPED (controller v0.177.0 + hub v0.78.0, 2026-07-27) | — | Operator-only events proven end-to-end; app suppression is cycle-keyed with a 180 s expiring grace | — | |
| R-89 | Retention as a per-customer commercial policy on the hub | READY (increment 2) | — | Policy object + reconciler → ep0 prune job; keep box tokens write-only | CC |
| R-92 | Hub PBS-DR gauge is 0.1 GB-granular — small deltas unverifiable | READY (XS) | — | Widen precision when retention becomes customer-visible | CC |
| R-93 | drill-r50 is both a blocked customer and the only drift fixture |
READY (XS) | — | Retire it for a synthetic fixture, or unblock + silence per-customer | CC |
Why the READY rows rank this way
- R-88b — the loop itself is fixed (R-88a, v0.176.0), so the active harm is gone; what remains is that an unknown still fires the safety valve, so a read failure can take one out-of-window quiesce. Bounded now, but it is the fourth appearance of this class and the only one still open.
- R-95 — the largest data exposure: the tier holding the customer's documents and photos is the
one whose credential can delete. The snapshot mitigation is now armed (daily 00:00, keep 7),
but it has taken zero snapshots so far and it does not touch the root cause — the box can still
forget --pruneits own repo. - R-94 — a one-line constant, but until it moves every hub-driven install gets the pre-R-82 backup default. Cheapest high-consequence fix on the list.
- R-86 — an operator ruling already exists; it only waits on knowing what load ep0 can take.
- R-87 — real and unbuilt, but needs its own design, so it should not jump work that is specified.