dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

transition precondition enforcement + thin-client context poller

Browse Source 
Plan #3 at 100%. Last three items resolved:

1. Transition precondition enforcement (Phase 5):
   - no-inbound-edges: blocks destroy when relationships exist
   - backups-verified, secrets-revoked, ingress-dns-removed: checks attrs
   - age-key-enrolled-if-needed, mesh-joined-if-needed: workstation checks
   - health-check-answering: verifies entity_status health
   - doc-page-complete: requires at least one linked document
   - Soft preconditions (inventory-entry, cancelled-note, etc.): operator
     confirmed via transition request itself
   - Parses {requires: [check-name]} from lifecycle_defs.transitions JSONB

2. bootstrap.sh: already thin-client (fetches only agent files, no git clone,
   calls POST /clients/enroll, embeds context poller)

3. tools/context-poller.sh: standalone version — polls GET /clients/{slug}/context,
   applies file/tool/sops deltas, re-runs changed setup scripts
This commit is contained in:
authentik Default Admin
2026-07-08 11:16:04 +02:00
parent efa66c7321
commit fcd9f23ee1
4 changed files with 203 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
plans/2026-07-07-client-lifecycle-in-go.md
View File

@@ -1,6 +1,6 @@
# Plan: Client lifecycle — enrollment through deprecation in Oikos Go
**Status:** Done (2026-07-08) — API surface complete. All endpoints, lifecycle transitions, provision flow implemented and tested (324-line e2e test). Remaining: bootstrap.sh rewrite + context-poller.sh (thin-client distribution, tracked as follow-up).
**Status:** Done (2026-07-08) — full API surface + transition preconditions + thin-client distribution.
## Goal

33
plans/2026-07-08-plan-implementation-audit.md
View File

@@ -77,12 +77,19 @@ Snapshot each active plan against the actual codebase on disk. No action taken
| Phase 3: MCP tools (`whoami`, `explain`, `preflight`, etc.) | **DONE.** All 6 in mcp/server.go. |
| Tests | **DONE.** `client_lifecycle_test.go`: 324 lines, full e2e: planned→enroll→provisioning→active→migrating→deprecated→failed. Provision rejection, relationship edges, blast radius verified. |
**Score: 95%** (API complete; thin-client distribution scripts are follow-up)
**Score: 100%** (API + preconditions + bootstrap/poller all complete)
**Remaining (non-blocking):**
- `bootstrap.sh` rewrite for thin-client model (fetches AGENTS.md + OIKOS.md instead of git clone)
- `tools/context-poller.sh` (polls GET /context every 5min)
- Transition precondition enforcement (`no-inbound-edges` before destroy, etc.)
**Transition precondition enforcement** (new in Phase 5):
- `no-inbound-edges`: rejects destroy when relationships still point to entity
- `backups-verified`, `secrets-revoked`, `ingress-dns-removed`: checks entity attrs
- `age-key-enrolled-if-needed`, `mesh-joined-if-needed`: checks attrs for workstations
- `health-check-answering`: verifies entity_status health ≠ unknown/down
- `doc-page-complete`: requires at least one linked document
- Soft preconditions (inventory-entry, cancelled-note, etc.): operator-confirmed via transition request
**Thin-client distribution:**
- `bootstrap.sh`: already rewritten — fetches agent files only, calls enroll API, installs context poller
- `tools/context-poller.sh`: standalone file — polls GET /context every 5min, applies file deltas
---
@@ -183,7 +190,7 @@ DecideApproval → verifies token (if provided) → executes gated SSH command
|------|-------|-------------|
| Consolidation | 85% | 5 cutover items + Infisical |
| Prometheus LXC | 10% | Not provisioned; plan references updated to Go |
| Client lifecycle | 95% | DONE — API complete; thin-client scripts are follow-up |
| Client lifecycle | 100% | DONE — API + preconditions + thin-client scripts |
| Audit & next steps | 100% | DONE — all cleanup resolved |
| DB as source of truth | 100% | DONE — wiki archived, FTS live |
| MCP tool surface | 100% | DONE — Matrix approval loop + token verification wired |
@@ -205,13 +212,13 @@ DecideApproval → verifies token (if provided) → executes gated SSH command
## Changelog
### 2026-07-08 — plan 3 completed
Client lifecycle at 95%. Initial audit was wrong — the API was fully implemented
with 324-line e2e test covering planned→enroll→provisioning→active→migrating→
deprecated→failed. Provision endpoint with constraints validation, relationship
edges, and provisioning_steps tracking. Lifecycle transitions validated against
lifecycle_defs with 409 on illegal transitions. Remaining: bootstrap.sh +
context-poller.sh (thin-client distribution scripts).
### 2026-07-08 — plan 3 fully completed
Client lifecycle at 100%. Transition precondition enforcement added: no-inbound-edges,
backups-verified, secrets-revoked, ingress-dns-removed, age-key-enrolled, mesh-joined,
health-check-answering, and doc-page-complete are checked before transitions. Soft
preconditions (inventory-entry, cancelled-note, etc.) confirmed by operator intent.
Thin-client distribution: bootstrap.sh already rewritten; standalone context-poller.sh
created in tools/.
### 2026-07-08 — plan 4 completed
Audit plan at 100%. All cleanup resolved: hermes plans archived to