oikos/.agents/skills/lifecycle-destroy-node/SKILL.md

name, risk_class, inputs, verification, docs_update_checklist, transition

name	risk_class	inputs	verification	docs_update_checklist	transition
lifecycle-destroy-node	destructive	node_name	MCP get_blast_radius returns unknown-entity; pct list on the backend no longer shows it	archaeology_entry containers_index_update	deprecated -> destroyed

Lifecycle: destroy a node

Destructive. Requires operator approval + typed confirmation phrase per seeds/policy.yaml. Requires (ontology): backups verified, secrets recipients removed + re-keyed, ingress/DNS removed, archaeology entry, ledger entry.

1. Confirm the node is deprecated with zero affected_by edges (MCP get_blast_radius) — do not skip this even if the deprecation runbook was followed recently; state can drift.
2. If it's an enrolled client: no current tool for revoking its age key / removing its Infisical identity. The old homelab client remove (age key revocation + SOPS re-key + inventory removal, all one destructive-class CLI call) is retired along with the rest of that CLI and hasn't been re-verified against the current enrollment architecture (POST /api/v1/clients/enroll + Infisical machine identities) — see the "Open questions" section in agent-enrollment.md. Until that's confirmed, treat key/identity revocation as a manual step: at minimum remove the client's age_pubkey from any SOPS recipient lists and rotate credentials whose ciphertext it already decrypted.
3. Remove any ingress route (Caddy config repo) and DNS record still pointing at it.
4. Verify backups of anything on it are retained per policy before the disk goes away (see backs-up-to).
5. Destroy the LXC/VM (pct destroy / qm destroy).
6. Update the entity's state to destroyed in seeds/inventory.yaml (or move it to an archaeology:-style section if the schema still has one) — pve_id, destroyed date, reason — then oikos seed to ingest. Add a row to the legacy archive/knowledge/containers/index.md "Recently destroyed" table (kept for human-readable browsing alongside the structured data in the DB).
7. No manual ledger step — mutations through the API are recorded automatically in the audit_log table (MCP get_audit_trail, get_change_history). The old oikos/ledger.py append was retired when this became automatic.

If the destroy fails partway (e.g. secrets not fully revoked but pct destroy errors), finish the remaining steps manually and note the partial state in an investigation (MCP upsert_knowledge, kind: investigation).