55 lines
3.7 KiB
Markdown
55 lines
3.7 KiB
Markdown
# REPORT — R-50 island-bridge SPIKE, empirical attempt 2 (t740): STILL BLOCKED (2026-07-25)
|
||
|
||
**Overwritten** per the standing rule. This session re-attempted the empirical half of
|
||
`SPIKE-island-bridge-2026-07-25.md` on the t740 (per the operator's 2026-07-25 drill-host ruling).
|
||
Docs-only; no code, no version bumps.
|
||
|
||
## t740 access method
|
||
Discovery was read-only (no LAN scan): the SSH config's `demo-hp` entry (t740 = Tailscale
|
||
`100.76.96.79` / LAN `192.168.0.87`, host_id `demo-hp-bb76ea`) + the hub registry. The t740 has **no
|
||
baked SSH key**, so access used the **hub-vaulted G1 break-glass root credential** —
|
||
`host_recovery/demo-hp-bb76ea` (read from the hub SQLite via `kubectl cp` + `sqlite3`), `sshpass -e`
|
||
(secret redacted, never printed). Connected: `felhom-host`, PVE 9.2.2.
|
||
|
||
## P1 inventory — the finding: there is NO drill VM to probe
|
||
- **t740 (`demo-hp`):** `qm list` → **empty**; `/etc/pve/qemu-server/` → **empty**; standalone (no
|
||
cluster); only its own LXC guest 9201 + the guest-9201 LVM volumes. **No nested drill PVE VM.**
|
||
- **Hub registry:** only `demo-hp-bb76ea` (t740) + `demo-felhom-8363b5` (N100) — **no drill appliance**
|
||
(no `2f4b00`/`demo-vm`/`drill` host).
|
||
- **felhom-pve:** `qm list` empty (confirmed in attempt 1).
|
||
- **DooPlex:** the historical drill appliance `drill.qcow2` exists (`/mnt/5_hdd/felhom.eu/drill/`, 18G)
|
||
but is **powered off** — a **golden-bake** VM (bake logs to 0.153.0, last Jul 18–20) whose nested
|
||
guest is purged after each bake, so it has **no island-bridge topology** (agent + nested guest +
|
||
bootstrap) to probe. DooPlex is the production k3s node and is loaded (~17G of 62G free).
|
||
|
||
**Snapshot: N/A** (no drill VM existed to snapshot).
|
||
|
||
## Per-probe outcomes
|
||
P2–P7 (bridge create / NIC hot-add / island bind / pin / **F1 replay** / survival) — **NOT RUN.** The
|
||
operator's ruling ("drill+build VMs on the HP from now on") is **forward-looking and not yet realized**:
|
||
no probeable drill appliance exists on the t740, and the only artifact is a stale bake VM on the
|
||
production node. **Per the hard rule ("do not improvise on production"), felhom-pve, the t740 host
|
||
networking, and guest 9201 were left UNTOUCHED.** No config was changed anywhere → **the rollback table
|
||
is empty**, and there is no island end-state to leave in place.
|
||
|
||
## GO/NO-GO: PENDING (unchanged) — the design half still stands
|
||
The source-grounded half of the parent doc (address plan `169.254.253.1/30`↔`.2/30`; the F1 two-place
|
||
literal; the **dnsmasq trap** — `LANResolverConfig.WithDefaults` derives the DNS listen-addr from
|
||
`listen_addr`, so the spec MUST set `lan_resolver.host_ip = LAN IP`; leaf-DER pin → no cert re-issue
|
||
expected; provisioning inventory; cluster parity) is unchanged and ready. Only the **empirical**
|
||
validation remains blocked.
|
||
|
||
## Operator decision + docs
|
||
**Operator chose (2026-07-25): they will provision a nested-PVE drill VM on the t740 (agent + a nested
|
||
guest); this spike re-runs then.** Commits (docs-only): the spike doc amended (attempt-2 section +
|
||
verdict), ROADMAP R-50 note appended, `documentation/operations/nodes.md` gains a "designated drill+build
|
||
VM host" subsection (t740 ruling + the not-yet-realized state + break-glass recipe), and the
|
||
controller/agent `CLAUDE.md` env tables gain a `demo-hp` row/note. **The build-PIPELINE relocation to the
|
||
t740 is explicitly NOT ruled or implemented — only the VM-hosting ruling is recorded.**
|
||
|
||
## Observations
|
||
- The t740 is a genuinely better drill host than DooPlex (dedicated demo node, ~30G RAM / ~49G free
|
||
local-lvm, not the production k3s node) — the ruling is sound; it just needs the VM created.
|
||
- The t740's agent is **0.93.0**, behind demo-felhom's 0.95.0 — a publish-when-convenient gap (noted in
|
||
nodes.md), unrelated to this spike.
|