dtoro
d80a394b7f
Documentation and repo-hygiene pass following the client/server split:
Plan drift (audited all other active plans against current code):
- oikos-gaps-and-improvements.md: mark Section C and D.5 resolved (both
described cmd/hermes, renamed to cmd/nomos with a real LLM loop since);
refresh ~10 stale file:line citations; fix tool-count (33, not 28).
- liveness-drift-and-ux-cohesion.md: fix stale default-model claim (now
deepseek-v4-pro since 2026-07-10) and "not yet deployed" status.
- nomos-agent-code-review.md: fix C1's citation (one unauthenticated route
to nomos now, not two, after the client/server split).
- wails-desktop-app.md: record the production deploy outcome.
Repo structure: added missing directories to README/CONTRIBUTING layout
tables (checks/, tools/, cmd/webhook/, docs/operations/), fixed a broken
link, added ADR 0015 documenting the auth/CORS/client-split model (there
wasn't one despite CONTRIBUTING's own process requiring it), normalized
ADR 0013/0014's format drift, added an Authentication section to
AGENTS.md/CLIENTS.md (every example call was missing the now-required
bearer header).
Retired the Goose+Nomos workstation flow (bootstrap.sh --with-nomos,
tools/setup-nomos-soul.sh, .agents/operations/nomos-agent.md) and the
Caveman auto-install tooling (tools/setup-caveman.sh, tools/caveman/) —
both superseded by the production containerized Nomos agent, which has
never used either. Kept .agents/shared/caveman.md itself (the terse
writing-style convention agents still follow by reading it).
Deleted the orphaned legacy Python oikos/ directory — nothing imports it,
and bin/homelab (the CLI it was kept for) no longer exists in the repo.
Rewrote .agents/operations/agent-enrollment.md (365 -> ~110 lines) and
commands.md to match the current architecture instead of the retired
`homelab` CLI; migrated the still-true networking prerequisites (Netbird,
split-horizon DNS, SSH key distribution) into the knowledge base as a
runbook via upsert_knowledge rather than duplicating them in markdown.
Updated all 10 .agents/skills/ runbooks referencing the dead CLI with
their real MCP tool / REST API equivalents, or flagged them as needing
verification where no equivalent is confirmed yet.
Two real bugs found and fixed, not just docs:
- The tools/setup-*.sh auto-setup glob was tools/*.setup.sh in THREE
places (tools/post-pull.sh, bootstrap.sh, and internal/httpapi/impl.go's
GetClientContext handler) since the mechanism's introduction on
2026-06-02 — never matched any real filename, so no client has ever
picked up an auto-setup script via git-pull or the context-poller sync.
Fixed all three; the Go server-side fix is the one that actually matters
since it's what the current context-poller mechanism depends on.
- bootstrap.sh removed dead vestigial --gitea-token/--gitea-user flags
(parsed, never consumed) left over from an earlier clone-based model.
Also flagged, not fixed (documented as an open gap in
client-enrollment/SKILL.md): bootstrap.sh tells a freshly-enrolled client
to call POST /api/v1/clients/{slug}/activate to finish enrollment, but
that route doesn't exist in api/openapi.yaml — EnrollClient sets entities
to provisioning and nothing currently transitions them to active.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
51 lines
2.6 KiB
Markdown
51 lines
2.6 KiB
Markdown
---
|
|
name: client-enrollment
|
|
risk_class: config_mutation
|
|
inputs: [hostname, kind, role]
|
|
verification: "MCP whoami(hostname) shows the entity active"
|
|
docs_update_checklist: [hosts_narrative_page_if_lxc_or_vm]
|
|
---
|
|
|
|
# Client enrollment
|
|
|
|
Goal: bring a new host (workstation, LXC, VM) into inventory and the
|
|
secrets model, with mesh membership only where it's actually needed. See
|
|
[CLIENTS.md](../../../CLIENTS.md#enrollment) for the actual current
|
|
flow and [operations/agent-enrollment.md](../../operations/agent-enrollment.md)
|
|
for operational notes; this runbook is the risk/lifecycle framing.
|
|
|
|
1. The entity must exist in `planned`/`provisioning` state before the new
|
|
host can self-enroll — add a `hosts.<name>:` block to
|
|
`seeds/inventory.yaml` and `oikos seed` to ingest it (lifecycle
|
|
`planned` → `provisioning`, per
|
|
[seeds/ontology.yaml](../../../seeds/ontology.yaml)).
|
|
2. Netbird join is **optional, not a required step** — only needed for
|
|
hosts that must be reachable off-LAN (workstations that roam, e.g.
|
|
`mac-mini`). A node reachable on the household LAN (192.168.8.0/24 —
|
|
most LXCs/VMs) doesn't need it. Skip for LAN-only nodes; do it
|
|
(out-of-band, console or setup key) only for hosts that need
|
|
independent off-LAN reachability.
|
|
3. On the new host: run `bootstrap.sh`. This calls
|
|
`POST /api/v1/clients/enroll`, which validates the entity exists and
|
|
the mesh IP is in an expected subnet, then returns an age keypair and
|
|
Infisical machine identity in one response — provisions
|
|
`/etc/age/key.txt`, `/etc/infisical/identity`, and the context poller.
|
|
4. **Known gap, confirmed 2026-07-12: `provisioning → active` has no
|
|
working path.** `EnrollClient` (`internal/httpapi/impl.go`) sets the
|
|
entity's state to `provisioning`, never `active`. `bootstrap.sh` prints
|
|
`POST /api/v1/clients/ws:$HNAME/activate` as the next step, but that
|
|
route doesn't exist — `api/openapi.yaml` only has `/clients/enroll`,
|
|
`/clients/{slug}/context`, `/clients/{slug}/secrets`. Until this is
|
|
fixed (add the route, or use the generic entity PATCH to flip `state`),
|
|
a freshly-enrolled client is stuck in `provisioning` — MCP `preflight`
|
|
and policy's `lifecycle_overrides` for `provisioning` still apply, but
|
|
nothing transitions it onward automatically.
|
|
5. Verify: MCP `whoami(hostname)` shows the entity in `active` state with
|
|
its peers and health.
|
|
|
|
Docs-update checklist: if the new host is an LXC/VM, add its narrative
|
|
page under `containers/` or `vms/` and set `doc_page` in its inventory
|
|
entry (host-level cards don't have a `doc_page` field yet — services do;
|
|
narrative pages are still found via the generated `see_also` in
|
|
`inventory.yaml`).
|