Find the claims behind the settled decisions that no source supports #363

Activity

1. ExtraToast

   added

   type: docsDocumentation-only change.Documentation-only change.

   area: deployhomelab-deploy, deploy-v2, manifests, and rollout flow.homelab-deploy, deploy-v2, manifests, and rollout flow.

   wayfinder:researchWayfinder ticket resolved by reading primary sources (AFK)Wayfinder ticket resolved by reading primary sources (AFK)

   on Oct 12, 2026
2. ExtraToast

   added a parent issue on Oct 12, 2026

   • Map: re-establish deploy-kit's goals, rewrite its spec, and order the work until the estate is handed over #341
3. ExtraToast

   added

   status: in-progressActively being worked.Actively being worked.

   on Oct 12, 2026
4. ExtraToast

   self-assigned this

   on Oct 12, 2026
5. ExtraToast commented on Oct 12, 2026

   

   ExtraToast

   on Oct 12, 2026

   ContributorAuthor

   More actions

   Resolution

   Researched on 2026-10-12. The cited table is docs/research/unsupported-claims.md, landing through #365 (branch research/unsupported-claims, commit 2161456).

   Method. Every line under the map's "Decisions so far" was read with the resolution it links. A claim is listed when a decision depends on it and neither docs/research/ nor a primary source cited in the resolution backed it. Each was traced to the tool's own documentation or source at the version the cluster runs, or to the live estate: JorisJonkers-dev/fleet-infra at 4e4a9bb, JorisJonkers-dev/nix-config at 606e400, JorisJonkers-dev/estate at be99537, and read-only kubectl get against the cluster (k3s v1.35.2+k3s1).

   Result. 49 claims: 22 hold, 21 hold with a condition, 6 fail. Only the four live-need decisions and two lines of the versioning and handover-order decisions lean on third-party behaviour; the other resolutions decide the repository's own shape.

   The six that fail

   id	claim	what is true instead	decision it sits under
   C4	The wildcard has one consumer, the public Traefik	The LAN Traefik serves it on ten routes, and an ACME certificate is not a Secret another instance can read	Decide how the foundation's HelmReleases are rendered and owned
   C28	Alloy is a host-privileged node agent	It tails logs through the Kubernetes API, with no host mount, host network or privilege	same
   C17	A LoadBalancer is the one L4 mechanism, so stalwart leaves hostPort	The Frankfurt node has no address pool and one public address; the public Traefik there uses hostPort too	Decide how the model meets the live needs no chapter covers
   C33	A non-root process cannot bind a port below 1024	k3s sets containerd's enable_unprivileged_ports, so it can, in any pod off the host network (from source, not drilled)	same
   C8	agents-api reads a RabbitMQ dynamic credential today	It reads the static KV path; the dynamic credential was dropped after an outage	same
   C43	A dashboard without a uid collides like a duplicate one	grafana-operator falls back to the object's Kubernetes UID, so the address changes on recreation and nothing is overwritten	Decide how the model meets human access grants and Grafana content

   Each is flagged in a comment on the ticket whose decision rests on it, and on Order the Project handovers and what the spec must settle before each for C17 and C49. Five of them were spot-checked a second time against the k3s and grafana-operator source and the fleet-infra manifests before flagging.

   Conditions and gaps

   The 21 conditions are stated per row in the file. Not verified, with the reason for each, is its own section there: the LAN certificate by handshake, whether any image reads the injected Vault token, Vault's own state, a second address for the Frankfurt node, dcgm-exporter's host requirements, a backup image for Garage, and which other charts template their CRDs. Four claims are reasoned from documentation or source and still need a drill: the rollout stall under across: node (C21), the single immediate run on unpark (C22), the low-port bind as non-root (C33) and the VIP failover time (C18).

   Consequences for other tickets

   This ticket reopens nothing. Two tickets carry what it found:

   • Decide what each settled decision does about the claim under it that failed takes the six failures.
   • Decide which conditions on the settled decisions change the model takes the conditions that need a choice, and waits for the first.
6. ExtraToast

   closed this as completedon Oct 12, 2026
7. ExtraToast

   removed

   status: in-progressActively being worked.Actively being worked.

   on Oct 12, 2026