Files

dtoro f6b57cbe3a Oikos Week 2: Service Console v0, change ledger, node relations, runbooks

Adds the shared kernel modules (oikos/policy.py, oikos/relations.py,
oikos/ledger.py) that let every surface — CLI, MCP, context-card
generator — agree on risk classification and ontology graph walks
from one implementation.

homelab CLI: `service <name> explain|health|docs|log|actions|history`
(Service Console v0), `change preflight <service>`, `node <name>
relations`. Restart and client add/remove now append change-ledger
entries (ledger/*.jsonl, committed alongside the change they record).

mcp/server.py mirrors explain/preflight/get_relations/get_change_history
as MCP tools, card-first so agent orientation is one call instead of
several search_docs/get_page round-trips.

oikos/gen-topology.py now also emits a compact context card per host
and service (oikos/cards/*.md) — identity, blast radius, safe actions +
risk class, doc pointer, recent ledger history.

runbooks/*.md: service health check, config change + deploy, client
enrollment, incident investigation, and the five node lifecycle
transitions (provision/activate/migrate/deprecate/destroy), each with
machine-readable frontmatter (risk class, inputs, verification,
docs-update checklist). Wired into HERMES.md so agents load these
instead of rediscovering topology per-task.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-05 23:02:32 +02:00

2.0 KiB

Raw Blame History

name, risk_class, inputs, verification, docs_update_checklist, transition

name

risk_class

inputs

verification

docs_update_checklist

transition

lifecycle-destroy-node

destructive

node_name

homelab node <name> relations returns unknown-entity; pct list on the backend no longer shows it

archaeology_entry

containers_index_update

deprecated -> destroyed

Lifecycle: destroy a node

Destructive. Requires operator approval + typed confirmation phrase per oikos/policy.yaml. Requires (ontology): backups verified, secrets recipients removed + re-keyed, ingress/DNS removed, archaeology entry, ledger entry.

Confirm the node is deprecated with zero affected_by edges (homelab node <name> relations) — do not skip this even if the deprecation runbook was followed recently; state can drift.
If it's an enrolled client: homelab client remove <name> — revokes the age key, re-keys SOPS, removes the inventory entry. This is already destructive-class and confirmed in the CLI.
Remove any ingress route (Caddy config repo) and DNS record still pointing at it.
Verify backups of anything on it are retained per policy before the disk goes away (see backs-up-to).
Destroy the LXC/VM (pct destroy / qm destroy).
Move the hosts.<name>: block (if any inventory remnant survives client remove, e.g. infra-only LXCs with no age key) into inventory.yaml's archaeology: section: pve_id, destroyed date, reason. Add a row to containers/index.md "Recently destroyed" table (kept for human-readable browsing alongside the structured data).
oikos/ledger.py append host:<name> destroy destructive --result ok.
Regenerate: python3 mcp/build_host_files.py && python3 oikos/gen-topology.py — the node drops out of hosts/*.yaml and appears in the topology doc's archaeology table.

If the destroy fails partway (e.g. secrets revoked but pct destroy errors), do not re-run step 2 — client remove is not idempotent against a second revocation attempt on the issuance server. Finish the remaining steps manually and note the partial state in an investigation.

2.0 KiB Raw Blame History

Lifecycle: destroy a node

2.0 KiB

Raw Blame History