admin
d202b43b95
Opened every citation in 00-capability-map.md and judged each of the 55 rows against the specific scenario (not topic adjacency). 23 confirmed (incl. 5 MISSING proven-absent by code sweep), 26 citation-corrected, 6 demoted; no upgrades. Status: 32 PROVEN-LIVE / 15 IMPLEMENTED / 3 PARTIAL / 5 MISSING (was 38 PROVEN-LIVE). Demotions PROVEN-LIVE->IMPLEMENTED: B6 (post-deploy config — T-PAGE-ALL is render-only), E7 (FileBrowser access — no browse/download proof), F1 (health email — cited P3-DELIVERY is the enlarge-block trigger), F4 (metrics — cited legs are H1/H2 harness artifacts), F6 (operator alerting — no corpus doc), G6 (offsite fill/staleness/freeze — no live-fired leg, freeze inconclusive). Key corrections: D6 cited CAMPAIGN-3 F10/F11/F12 which are the CRITICAL failures — fixes shipped agent v0.85 and were re-validated live in CAMPAIGN-4 /6A; C6 cited offbox-restic doc for a PBS-restore claim -> CAMPAIGN-2 T-P9; C1/C5/B5 cited defect-discovery docs instead of the fix-validation legs. Closed ROADMAP R-20: operator-key pinning is fully automatic in day-0 (felhom-host-install.sh step_agent_config, L2044/2146-2156/2332-2337). Header draft caveat swapped for the verified stamp. Full per-row verdict table in REPORT.md.
57 lines
7.1 KiB
Markdown
57 lines
7.1 KiB
Markdown
# ROADMAP — future features & open work
|
||
|
||
> **What this is:** the prioritized decision log of planned/open work. Items are *intentions*, not
|
||
> claims about live behavior — the capability map (`architecture/00-capability-map.md`) is the only
|
||
> place that states what the platform does today.
|
||
>
|
||
> **Lifecycle:** idea → spiked → spec'd → in-progress → **shipped** (item collapses to a one-liner
|
||
> with the version, and the corresponding capability-map row changes status with evidence). Items
|
||
> can also be **killed** (keep the one-liner + why — decisions are worth remembering).
|
||
>
|
||
> **Coupling rule:** every item names the capability-map row(s) it flips. Every map gap row points
|
||
> back here by ID. Neither file duplicates the other's content.
|
||
>
|
||
> **Priorities:** P1 = closed-alpha blocker · P2 = close during alpha · P3 = post-alpha.
|
||
> Existing loose notes in this folder (`FOLLOWUP-*`, `FIX-M*`) are absorbed as references below.
|
||
|
||
---
|
||
|
||
## P1 — closed-alpha blockers
|
||
|
||
| ID | Item | Size | Status | Notes / map rows flipped |
|
||
|----|------|------|--------|--------------------------|
|
||
| R-1 | **Peti convergence:** clean-slate proxmox2 reinstall (spec'd 07-15), first live auto-confirm, supervised escrow ceremony, execute parked publish trains (agent 0.81→0.88, controller → 0.137) | L | spec'd | Flips: publish train PARTIAL→PROVEN-LIVE; appliance/BYO/day-0 "real customer" notes; escrow ceremony. The single biggest unproven surface — an alpha where fixes can't ship remotely is dead |
|
||
| R-2 | ~~Resolve ~215 lines of foreign WIP in felhom.eu clone (`hub/internal/notify/`, `store.go`, `hub/internal/claim/`)~~ | S | **killed** (2026-07-16) | Not a real issue: the "foreign WIP" was in-flight code from a concurrent CC session on the customer-claim arc, snapshotted before it committed. All of it landed cleanly — `notify/`+`claim/engine.go` in `6b40eb8` (v0.50.0), `store.go` in `a1d0450` (v0.54.0), plus follow-up `e205a2d`; v0.55.0 shipped. Working tree is clean, no stashes. Lesson already codified: never run two writing sessions on one felhom.eu clone (CLAUDE.md §git add -A) |
|
||
| R-3 | Friend-alpha onboarding runbook (generalized from `pilot/RUNBOOK-peti-return-2026-07-13`): hardware prep → golden → install → claim → ceremony → "first restore by the customer" scripted step | M | idea | Flips: "customer performs a restore" MISSING row; produces the tester-agreement sibling of `PETI-tester-agreement.md` |
|
||
| R-4 | Claim-code deliverability: test-send to gmail.com / freemail.hu / citromail.hu / t-online.hu; tighten DMARC `p=none` → `p=quarantine` (pending since email.md 02-04) | S | idea | A claim code in spam bricks onboarding at step 1. Cheap, do before first invite |
|
||
|
||
## P2 — during alpha
|
||
|
||
| ID | Item | Size | Status | Notes |
|
||
|----|------|------|--------|-------|
|
||
| R-5 | Hub: Storage Box box-level aggregate — total BX11 fill, Σ(customer soft quotas), oversubscription ratio, operator alert threshold | M | idea | Per-customer OffsiteChecker exists (hub v0.41). Source: Hetzner Storage Box API (verify Robot-legacy vs. new API endpoint for our box before speccing — 2025 migration); NOT ssh `du` over restic repos. Token → k8s Secret ref. Flips map row G/MISSING |
|
||
| R-6 | **Spike: LAN service discovery from the guest** — SSDP multicast (UDP 1900, DLNA), WSD (Windows discovery), mDNS; host-network vs macvlan; is the customer LXC LAN-bridged in appliance deployments? | M | idea | Shared prerequisite for R-7 + R-8. Spike-first: the traps are networking, not Samba/DLNA |
|
||
| R-7 | SMB **server** share (gated on R-6): samba + wsdd, LAN-only binding (never tunnel), user model (single household user first), which roots are shared (dedicated `shares/` vs app userdata — every SMB-writable path needs a backup class), uid-1000 convention, paperless consume flow | L | idea | Flips map row E/MISSING. Alpha-relevant: "my box is a NAS" is a core household expectation |
|
||
| R-8 | DLNA (gated on R-6): validate Jellyfin's built-in DLNA server first; only add minidlna to the catalog if Jellyfin-DLNA fails | S | idea | Don't add catalog weight before proving the cheap path |
|
||
| R-9 | Uninstaller trio (from 07-15 Peti session): cluster-aware `felhom_guests` guard (node-local `pct list` deletes cluster-wide pveum objects); saferemove detection + time estimate + opt-in `--quick-remove` (never mutate `storage.cfg`); smarter `restore_storage` default for BYO clusters (shared storage, not local-lvm) | M | idea | Second item's rejected alternative (temp-disable-and-restore) stays rejected — crash window silently downgrades cluster wipe policy |
|
||
| R-10 | T-6E-1: DB-dump dir-fsync asymmetry (LOW, confirmed in 6E) | XS | idea | One-line hardening; batch with the next controller task |
|
||
| R-11 | Tester-facing one-pager: what the box does, known limitations, how to report (channel decision: Messenger group?) | S | idea | Pairs with R-3 |
|
||
| R-16 | Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audiobookshelf/komga/romm) | XS | open | Viktor's own action items from 6D/6E |
|
||
| R-17 | Old-box archive (u629193-sub1) retirement decision — 9/9 byte-identical restores verified | XS | awaiting-decision | Viktor ruling |
|
||
| R-19 | Internet-outage customer-experience drill: pull WAN on demo, verify lan_resolver path, document what the customer actually sees/does | S | idea | Flips map row E "LAN access" IMPLEMENTED→PROVEN-LIVE |
|
||
| R-20 | ~~Verify operator-key pinning is fully in the day-0 install flow~~ | XS | **closed** (2026-07-16) | Confirmed against `scripts/felhom-host-install.sh` source (not changelog): keys resolve at L1181–1219 (script constants `OPERATOR_KEY_*`, populated, `--operator-pubkey-file` override), pinned automatically by `step_agent_config()` "STEP 6/8" (L2044; python builds `authz.signers` L2146–2156, reinstall preserves existing), verified at L2332–2337 ("authz signers: N … operator-signed self-update armed"). No interactive prompt or post-install hand-edit — fully automatic. Doc-drift note: the L193–197 "EMPTY by default" comment is stale vs the now-populated constants (→ R-16 hygiene) |
|
||
|
||
## P3 — post-alpha
|
||
|
||
| ID | Item | Size | Status | Notes |
|
||
|----|------|------|--------|-------|
|
||
| R-12 | Cluster mode: agent-follows-guest, bind-mount reconciliation on HA migration | XL | idea | Scoped 07-15; interim = HA-group pin to one node. Driven by Peti's two-node cluster |
|
||
| R-13 | OOB management arc: dual-use existing WireGuard + hub desired-state channel as mutual-repair | L | idea | |
|
||
| R-14 | Headscale/WireGuard spike: Minecraft/gaming port connectivity (CGNAT-proof, sovereign DERP fallback) | M | idea | |
|
||
| R-15 | Multi-user dashboard accounts (household members, roles) | L | idea | Single password is a stated alpha limitation (R-11) |
|
||
|
||
## Absorbed / superseded notes in this folder
|
||
|
||
- `FOLLOWUP-nas-automount-guest-reboot-reassert.md` — **shipped** (agent v0.84/v0.85, CAMPAIGN-3); keep for history
|
||
- `FOLLOWUP-golden-default-controller-tag.md` — verify against current golden flow; close or promote to an item
|
||
- `FIX-M18-NOTES.md`, `FIX-M19-NOTES.md`, `DIAGNOSIS-f9-storage-registration-gap-2026-06-14.md` — historical diagnoses; superseded by shipped fixes |