From 72a01c0b2f94eb92470f442cc2c3e07c660c2337 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 21 Aug 2026 09:32:47 +0200 Subject: [PATCH] docs(RMGR-WP-0005): record that the registrar was never stood up T01 shipped the guard but no instance satisfies the registrar condition, so nothing drains the queue -- 12 sync requests had accumulated from four agents. Survey of railiance01: hostname does not match the railiance* heuristic and STATEHUB_REGISTRAR is unset; repo-manager was not cloned; the statehub CLI will not install (ResolutionImpossible); 999 files are root-owned because the state-hub pod bind-mounts /home/tegwick as root; and the checkouts still point at gitea-remote rather than forgejo-remote, so its evidence-binder cannot see EBIND-WP-0002 at all. Also flags that the pod mounts /home/tegwick/.ssh, and that the forgejo remote-URL sweep appears incomplete beyond this host. Co-Authored-By: Claude Opus 5 --- ...gistrar-consolidation-deterministic-ids.md | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md b/workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md index f305afb..8acb103 100644 --- a/workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md +++ b/workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md @@ -75,6 +75,36 @@ removes the need for the trade. this instance is not the registrar. Read/project checks are unchanged. Cost documented in `docs/repository-standards_v0.1.md`. +**The registrar was never stood up (found 2026-08-21).** T01 shipped the guard — +non-registrar instances correctly refuse to mint — but no instance satisfies the +registrar condition, so nothing drains the queue. Twelve registrar-sync requests +had accumulated from `evidence-binder`, `kaizen-agentic`, `glas-harness` and +`agentic-resources` before anyone noticed. + +Surveyed on `railiance01`, the designated production registrar: + +| Prerequisite | State | +| --- | --- | +| Registrar signal | **fails** — hostname is `239.62.205.92.host.secureserver.net`, so the `railiance*` prefix heuristic never matches, and `STATEHUB_REGISTRAR` is unset | +| `repo-manager` clone | was absent; cloned 2026-08-21, `rmgr` installed into `~/.venvs/registrar` | +| `statehub` CLI | **not installable** — `pip install ~/state-hub` fails `ResolutionImpossible`; `hub-core` installs, the conflict is elsewhere | +| Checkout ownership | **999 files under `~/state-hub` owned by root**, because the `state-hub` pod bind-mounts `/home/tegwick` as a hostPath and runs as root. Blocks `git pull` and editable installs | +| Checkout lineage | **points at `gitea-remote`, not `forgejo-remote`** — the host was never swept by `forgejo-tier3-remote-url-sweep-playbook`. Its `evidence-binder` tracks a different lineage and cannot see `EBIND-WP-0002` at all | + +The hostname heuristic is the cheapest fix and the most misleading defect: it +reads as though a registrar exists whenever a host is named `railiance*`, but the +production host is not. Prefer the explicit `STATEHUB_REGISTRAR` signal and treat +the hostname fallback as unreliable, or drop it. + +Two consequences beyond this task: + +- **Security.** The `state-hub` pod mounts `/home/tegwick` **and + `/home/tegwick/.ssh`** as hostPath volumes. A workload with the operator's + private keys is a larger exposure than the registrar problem it surfaced. +- **The remote sweep is incomplete.** If `railiance01` was missed, other hosts + may also still point at `gitea-remote`; anything reconciling from them compares + against a stale lineage. + ## Re-register identifiers minted outside the registrar ```task