felhom.eu/REPORT.md

REPORT — R-50 island control plane: Phase A artifacts (felhom.eu) (2026-07-25)

Phase A of the R-50 implementation (spike GO). Fresh appliance installs are now born on the island (F1-immune). Pairs with agent v0.96.0 (which attaches the guest's island net1). byo unchanged.

Changed here

• scripts/felhom-host-install.sh → v1.19.0: ensure_island_bridge() (portless vmbr9, 169.254.253.1/30, idempotent); appliance default binds local_api on the island (169.254.253.1:8443), writes island_bridge/island_guest_addr, and pins lan_resolver.host_ip to the LAN IP explicitly (Finding-1 — else moving the bind silently kills LAN DNS). --no-island opt-out; explicit --bridge-ip overrides. Gate hostinstall_gates.py ALL PASS.
• hub/internal/web/configs.go → hostInstallVersion 1.16.0 → 1.19.0 (F-1 sync; clears prior drift). Hub CHANGELOG → v0.73.2. Web render test green.

Determination (A0/A3) — recorded

• A0 = config-only for the bootstrap endpoint (main.go sets it from listen_addr); the version bump lives in the agent's net1-attach. The operator chose agent-bringup (v0.96.0) over golden-bake to eliminate the golden-coupling failure mode.
• A3 = healer verify-only — eth0-only (parseMode dev-scoped); red-proof test in the agent.
• net1 deviation from the spike inventory (it placed net1 in host-install, but host-install doesn't create the guest — the agent does) resolved by attaching net1 in the agent at bring-up.

Coupling / deploy order (important)

An island host-install REQUIRES agent ≥ 0.96.0. Vouch 0.96.0 before island installs go live, else a fresh install writes island config an older agent ignores → guest has no island NIC → broken control plane. This is the one hard ordering constraint.

Status of the phases

• Phase A (artifacts): DONE. Agent v0.96.0 committed (dfd5d73), published (sha af938601…) and VOUCHED in the hub Day-0 manifest (agent 0.96.0; golden 0.161.0 / min_agent 0.93.0 / wrapper preserved). host-install v1.19.0 + hub sync committed (485321f). Golden unchanged (net1 comes from the agent). Live site serves 1.19.0.
• Phase B (migration): B0+B1+A4 DONE; B2/B3 pending operator go.
  • B0 RUNBOOK-island-migration.md written (4650493).
  • B1 drill migration ran verbatim → island /storage HTTP 200, LAN DNS held on the LAN IP (Finding-1 pin), apps healthy, hub reports 0.96.0. No rollback.
  • A4 the agent auto-attached net1 on the island at provision (scratch guest from golden, zero manual edits) → the provisioning path is proven live (spike method caveat CLOSED). F1 replay + cold reboot were proven on the same drill (spike P6/P7). (A literal ISO wipe-reinstall was not run — the surgical provision proves the R-50-specific behavior; the ISO/first-boot/day-0 glue is unchanged.)
  • B2 demo-hp — DONE (2026-07-25). Agent 0.95.0→0.96.0, vmbr9, guest 9201 net1, island bind, DNS pinned to .87. Verify: island /storage 200, LAN DNS OK, 7/7 apps unchanged (cloudflared/traefik uptime 42h = never restarted), public URL 302, hub reports 0.96.0. No rollback.
  • B3 demo-felhom — DONE (2026-07-25). Same procedure; DNS pinned to .162. Verify: island /storage 200, LAN DNS OK, 15/15 apps unchanged, public URL 302, hub reports 0.96.0. No rollback.
  • Both boxes' .bak-0.95.0 agent + /etc/network/interfaces.pre-island.bak retained for rollback.
• Phase 5 (closing docs): DONE. Capability-map "site/network change" row → PROVEN-LIVE; ROADMAP R-50 → SHIPPED (fleet-migrated); R-74 added (island on Peti's cluster); nodes.md updated (both boxes island, agent 0.96.0). Firewall (runbook §8): on both boxes the island bind already moved the listener off the LAN (nothing on <LAN>:8443) — the LAN surface is closed by the bind; the portless-bridge narrowing is moot.
• Phase C (Peti cluster): parked as R-74 — its own supervised runbook (SDN/bridge parity), coordinated with Peti.