coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(RMGR-WP-0005): record that the registrar was never stood up

Browse source 
T01 shipped the guard but no instance satisfies the registrar condition, so
nothing drains the queue -- 12 sync requests had accumulated from four agents.

Survey of railiance01: hostname does not match the railiance* heuristic and
STATEHUB_REGISTRAR is unset; repo-manager was not cloned; the statehub CLI
will not install (ResolutionImpossible); 999 files are root-owned because the
state-hub pod bind-mounts /home/tegwick as root; and the checkouts still
point at gitea-remote rather than forgejo-remote, so its evidence-binder
cannot see EBIND-WP-0002 at all.

Also flags that the pod mounts /home/tegwick/.ssh, and that the forgejo
remote-URL sweep appears incomplete beyond this host.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-21 09:32:47 +02:00
parent 350c4110a5
commit 72a01c0b2f
1 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

30
workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md
View file

@ -75,6 +75,36 @@ removes the need for the trade.
this instance is not the registrar. Read/project checks are unchanged.
Cost documented in `docs/repository-standards_v0.1.md`.
**The registrar was never stood up (found 2026-08-21).** T01 shipped the guard —
non-registrar instances correctly refuse to mint — but no instance satisfies the
registrar condition, so nothing drains the queue. Twelve registrar-sync requests
had accumulated from `evidence-binder`, `kaizen-agentic`, `glas-harness` and
`agentic-resources` before anyone noticed.
Surveyed on `railiance01`, the designated production registrar:
| Prerequisite | State |
| --- | --- |
| Registrar signal | **fails** — hostname is `239.62.205.92.host.secureserver.net`, so the `railiance*` prefix heuristic never matches, and `STATEHUB_REGISTRAR` is unset |
| `repo-manager` clone | was absent; cloned 2026-08-21, `rmgr` installed into `~/.venvs/registrar` |
| `statehub` CLI | **not installable** — `pip install ~/state-hub` fails `ResolutionImpossible`; `hub-core` installs, the conflict is elsewhere |
| Checkout ownership | **999 files under `~/state-hub` owned by root**, because the `state-hub` pod bind-mounts `/home/tegwick` as a hostPath and runs as root. Blocks `git pull` and editable installs |
| Checkout lineage | **points at `gitea-remote`, not `forgejo-remote`** — the host was never swept by `forgejo-tier3-remote-url-sweep-playbook`. Its `evidence-binder` tracks a different lineage and cannot see `EBIND-WP-0002` at all |
The hostname heuristic is the cheapest fix and the most misleading defect: it
reads as though a registrar exists whenever a host is named `railiance*`, but the
production host is not. Prefer the explicit `STATEHUB_REGISTRAR` signal and treat
the hostname fallback as unreliable, or drop it.
Two consequences beyond this task:
- **Security.** The `state-hub` pod mounts `/home/tegwick` **and
`/home/tegwick/.ssh`** as hostPath volumes. A workload with the operator's
private keys is a larger exposure than the registrar problem it surfaced.
- **The remote sweep is incomplete.** If `railiance01` was missed, other hosts
may also still point at `gitea-remote`; anything reconciling from them compares
against a stale lineage.
## Re-register identifiers minted outside the registrar
```task