jschoubben
cb2117f1c4
Two birth-address outages and a registry that would have been the third; a container that keeps a stale environment after its file changes; a host command that applied a converged declaration to an adopted node; the hub and the vault without seats. And the decision the operator made under it all: the hub adopts the predecessor's tunnel in place, key and peers and range and port.
2.7 KiB
status, opened, located-in, fixed-by, amended-design
| status | opened | located-in | fixed-by | amended-design | |
|---|---|---|---|---|---|
| located | 2026-09-23 |
|
104 — reconcile applies the declaration the host was installed with, and refuses nothing
What was observed
The control-node, 2026-09-23, adopted, twelve modules assigned, two services already cut over.
Chasing why an assignment had not finished, an operator ran the host's own reconcile command by
hand.
It did not reconcile the node against the controller's declaration. It applied the declaration the host carries — the genesis bundle: foundation only, converged. In order: it recreated the store, tried to recreate the broker and failed on a held port, wrote the converged base filter to disk, enabled and started its service, and stopped at the first failing action with "nothing after it was attempted".
The base filter is the ruleset ADR 0100 exists to keep off an adopted node: input policy drop, three ports allowed. It closed the machine to the internet for about forty-five minutes — every site, the forge's path to its database — and was removed by hand.
Nothing about the command said any of this would happen. It printed what it did after it did it. The node's mode was known to the host — it reports "adopted" in every report — and the declaration it applied said "converged", and no comparison was made.
Why it matters beyond this instance
The host has two declarations and one command that does not say which it means. The bundle is right at genesis and stale a minute later; on an adopted node it is actively dangerous, because it is a converged declaration for a machine that is not converged. A command an operator would reasonably reach for under pressure — "make the machine match" — is the one that must not be run.
The operator error here was real and is recorded as such. But a design that turns "I ran the obvious command" into a closed machine has a hole of its own, and the runbook's line "never bypass the controller" was standing in for a refusal the host should make itself.
Open questions
- Should
reconcilerefuse outright when the declaration it carries is older than the one the controller last sent, or says a different mode than the node reports — naming both? - Should a converged declaration be refused on an adopted node at the point of application, whatever command delivered it, since the mode is a fact the host already knows?
- Should the host preview before applying from a file — the way
convergepreviews — and stop at the first action before running it rather than after? - Does the bundle need to remain applicable after genesis at all, or should genesis consume it?