admin
72692e1d9c
Open state was spread across ROADMAP, CONTEXT.md, four audits/, three runbooks, per-session REPORT.md files and a chat log. This is the one page to read first: every row has a state (BLOCKED/READY/WAITING-ON-OPERATOR/WATCHING) and an owner, and the READY rows are ranked with reasoning. R-88 is the recommended next task — quiesce's nil-age fail-open stops every app stack every 5 minutes with no backoff and bypasses the maintenance window, and its trigger (a PBS read failure) is live given ep0's demonstrated OOM. CONTEXT.md now records that OPEN-ITEMS.md is authoritative and that REPORT.md is overwritten per session.
4.2 KiB
4.2 KiB
OPEN-ITEMS — the single source of truth for open work
Rebuilt 2026-07-27 by read-only triage. ROADMAP.md keeps the full history and reasoning; this
page keeps only what is open, and it is the file to read first. REPORT.md is per-session and
overwritten — nothing durable may live only there.
State: BLOCKED · READY · WAITING-ON-OPERATOR · WATCHING. Every row has an owner.
| ID | What | State | Blocked on | Next action | Owner |
|---|---|---|---|---|---|
| R-88 | Unreachable backup target reads as no backup exists → quiesce loop, no backoff, maintenance window bypassed | READY #1 | — | Make an unreachable read UNKNOWN; fix the AgeSecs==nil window bypass in the same slice |
CC |
| R-95 | restic offsite credential can delete (readonly=False, forget --prune runs from the box); SFTP cannot express append-only |
READY #2 | — | Snapshot plan as the stopgap (row below), then split prune off-box or move to REST --append-only |
CC |
| R-94 | Hub hands out host-install 1.19.0; 1.20.0 is what carries R-82's backup default |
READY #3 | — | Bump configs.go:28, and stop hand-syncing a version constant across repos |
CC |
| R-86 | Restore-tests are interval-scheduled, not backup-aligned | READY #4 | R-90 (ep0 headroom) informs cadence | Trigger a tier ~24 h after its own newest archive | CC |
| R-87 | The restic tier is never restore-tested | READY #5 | — | Design a controller-side test (no scratch-guest analogue transfers) | CC |
| — | Enable Hetzner Storage Box snapshots on storage-box-pool-1 — snapshot_plan=null, 0/10 used, server-side so SFTP cannot delete them |
WAITING-ON-OPERATOR | operator ruling | One console/API call; immediate immutability for the restic tier | operator |
| — | PBS-storage-1 (u629193, box 611421) still status=active, 19.9 MB |
WAITING-ON-OPERATOR | operator console | Delete the box | operator |
| R-90 | ep0: 3.8 GB, no swap, OOM'd 2026-07-27 killing PBS for ~15 min | BLOCKED | Hetzner CX33 availability | Rescale; or add a swapfile as an interim (needs no console) | operator |
| R-91 | Old 13 GB datastore copy at /srv/pbs-felhom on ep0's root disk |
WATCHING | demo-felhom's first post-migration PBS backup | Delete once it lands; fix CONTEXT.md:1018 same commit |
CC |
| — | First-ever GC on felhom-offsite (armed today 13:11 UTC, never run) |
WATCHING | schedule | Sun 2026-08-02 04:30 UTC — confirm it completes | CC |
| — | demo-felhom's next weekly PBS backup (newest is 2026-07-26) | WATCHING | schedule | ~2026-08-02; also releases R-91 | CC |
| — | demo-felhom's next restore-test (84 h cadence, last 2026-07-27 06:38 UTC) | WATCHING | schedule | ~2026-07-30 18:38 UTC | CC |
| R-89 | Retention as a per-customer commercial policy on the hub | READY (increment 2) | — | Policy object + reconciler → ep0 prune job; keep box tokens write-only | CC |
| R-96 | Two standing rules agreed in chat, never committed | READY (XS) | — | Add both beside CONTEXT.md S-1/S-2 |
CC |
| R-92 | Hub PBS-DR gauge is 0.1 GB-granular — small deltas unverifiable | READY (XS) | — | Widen precision when retention becomes customer-visible | CC |
| R-93 | drill-r50 is both a blocked customer and the only drift fixture |
READY (XS) | — | Retire it for a synthetic fixture, or unblock + silence per-customer | CC |
Why the READY rows rank this way
- R-88 — the only item causing active harm: it stops every customer app stack every 5 minutes,
with no backoff, and the
AgeSecs==nilpath also disables the maintenance-window gate, so it runs in business hours. Its trigger is a PBS read failure, which R-90 shows is live. - R-95 — the largest data exposure: the tier holding the customer's documents and photos is the one whose credential can delete, and the mitigation is a console click nobody has made.
- R-94 — a one-line constant, but until it moves every hub-driven install gets the pre-R-82 backup default. Cheapest high-consequence fix on the list.
- R-86 — an operator ruling already exists; it only waits on knowing what load ep0 can take.
- R-87 — real and unbuilt, but needs its own design, so it should not jump work that is specified.