dtoro
5c5016b3c7
Problem: runbooks are agent-executable procedures but lived at the repo root, separate from the other agent instruction now under .agents/. Change: - Move runbooks/<name>.md -> .agents/skills/<name>/SKILL.md (folder per skill, matching the wiki-hq skills layout). Frontmatter (name, risk_class, inputs, verification, docs_update_checklist, transition) preserved. - Rewrite links (inbound from plans; between-skill siblings) via the move map. - Update prose references in AGENTS.md, HERMES.md, .agents/OIKOS.md, and the operations schema; fix a pre-existing stale link to operations/commands.md. No code consumed runbooks/ by path, so nothing else changes. Verification: all SKILL.md frontmatter parses with valid risk_class; every lifecycle transition resolves to an oikos/ontology.yaml state; broken-link count 127 -> 126 (fixed one, introduced none). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
2.0 KiB
Markdown
43 lines
2.0 KiB
Markdown
---
|
|
name: lifecycle-destroy-node
|
|
risk_class: destructive
|
|
inputs: [node_name]
|
|
verification: "homelab node <name> relations returns unknown-entity; pct list on the backend no longer shows it"
|
|
docs_update_checklist: [archaeology_entry, containers_index_update]
|
|
transition: "deprecated -> destroyed"
|
|
---
|
|
|
|
# Lifecycle: destroy a node
|
|
|
|
**Destructive.** Requires operator approval + typed confirmation phrase
|
|
per `oikos/policy.yaml`. Requires (ontology): backups verified, secrets
|
|
recipients removed + re-keyed, ingress/DNS removed, archaeology entry,
|
|
ledger entry.
|
|
|
|
1. Confirm the node is `deprecated` with zero `affected_by` edges
|
|
(`homelab node <name> relations`) — do not skip this even if the
|
|
deprecation runbook was followed recently; state can drift.
|
|
2. If it's an enrolled client: `homelab client remove <name>` — revokes
|
|
the age key, re-keys SOPS, removes the inventory entry. This is
|
|
already destructive-class and confirmed in the CLI.
|
|
3. Remove any ingress route (Caddy config repo) and DNS record still
|
|
pointing at it.
|
|
4. Verify backups of anything on it are retained per policy before the
|
|
disk goes away (see `backs-up-to`).
|
|
5. Destroy the LXC/VM (`pct destroy` / `qm destroy`).
|
|
6. Move the `hosts.<name>:` block (if any inventory remnant survives
|
|
`client remove`, e.g. infra-only LXCs with no age key) into
|
|
inventory.yaml's `archaeology:` section: `pve_id`, `destroyed` date,
|
|
`reason`. Add a row to `containers/index.md` "Recently destroyed"
|
|
table (kept for human-readable browsing alongside the structured
|
|
data).
|
|
7. `oikos/ledger.py append host:<name> destroy destructive --result ok`.
|
|
8. Regenerate: `python3 mcp/build_host_files.py && python3
|
|
oikos/gen-topology.py` — the node drops out of `hosts/*.yaml` and
|
|
appears in the topology doc's archaeology table.
|
|
|
|
If the destroy fails partway (e.g. secrets revoked but pct destroy
|
|
errors), do not re-run step 2 — `client remove` is not idempotent
|
|
against a second revocation attempt on the issuance server. Finish the
|
|
remaining steps manually and note the partial state in an investigation.
|