Decisions and open work
This register captures instance choices and remaining gates, not a second issue tracker. Confirm current issue state before changing an item. The owning references below are in private implementation repositories.
| Decision or transition | Current recorded state | Owning evidence |
|---|---|---|
Shared stable-v1 workflow channel | Owner selected 2026-10-13. Promotion 838 and fresh owning Terraform runs 80/81 on 2026-10-15 bind v1.42.2 at workflow source 2418f947a9339774a674bf4b7f1a9f577d3882ea. Promotion 854 selected v1.42.3 at workflow source 2f32073eb071e372c93a495d47d90f6468751dd6 on 2026-10-16, with passing canary 7545. It retains prior identity/event/plan-review/cleanup fixes and adds exact Core/init profiles and safe version diagnostics. Plan 80 contained only three self-revocation policy updates; owner-authorized apply 81 applied them and converged. The current stable-v1 RKE2 adapter was verified on 2026-10-17 to bind v1.44.1 at workflow_release_sha 6999b5326fb4c4ac7a06114c592f0d69a0b4873b, through snapshot 2716c0bde2095d7a77986fb98b6daffaac38075c; Platform retry 5015 exercised automatic selection and safe permission details. Incremental caller adoption and existing required check names remain unchanged. | workflows #93, v1.42.3; delivery procedure |
| Reusable external PostgreSQL provisioning | Owner selected 2026-10-13 for future applications, starting with Harbor. Dedicated provisioner and PostgreSQL credentials in OpenBao are not set up. Manual first-time administrator bootstrap is accepted; reusable database/login/OpenBao seed source is prepared, while protected callers, backend readiness and hosted dev acceptance remain pending. | Private Homelab/terraform-modules#8; provisioning boundary |
| Security tool image with embedded library | Owner selected 2026-10-11. Signed image tool-security-v2026.10.13-r6990 is published; hosted run 587 passed legacy and image startup on 2026-10-13. Workflows v1.34.0 is released with explicit preinstalled-* entry points preserving existing execution and check names. Application delivery acceptance, measured savings and reviewed caller adoption remain pending. | Private Homelab/base-images #39, tools/security; workflows #86, startup evidence; procedure |
| UDS packages and bundles on RKE2 | Selected routine delivery model; the owner confirmed installed Core v1.13.1 and operator CLI v0.39.0 on 2026-10-14. Tenant/admin gateways remain established. The full-platform example is not a proven fresh-cluster installer. | Homelab/platform deployment runbook |
| Cluster upgrades before Harbor completion | Owner-selected order on 2026-10-16: RKE2 1.36.5+rke2r1; Core 1.14.1 plus init 0.86.0; Core 1.15.0; RKE2 1.37.1+rke2r1; RKE2 auto updates; Harbor deployment; image migration. The authenticated package list confirms current init 0.73.0. Terraform apply 75 created/converged eight RKE2 identities; plan/apply 80/81 converged three self-revocation policy updates under promoted workflows v1.42.2. Bootstrap 4975 passed issuance/probes/revocation but stopped before deployment at the future-init guard. Workflows #110 merged and publication 852 published v1.42.3 with the exact initial Core 1.13.1/init 0.73.0 profile; promotion 854 selected it with passing canary 7545. Platform #130 passed all five checks (4982/4983/4984), received PorteGumi approval and was owner-merged on 2026-10-16. Build 4988 passed and published signed rke2-bootstrap-bundle-v0.1.0-r7557 from merged main. Owner-authorized deployment 4989 verified init expected=observed=0.73.0 and credential checks, then stopped before mutation/deployment because an unowned retained RKE2 resource needs explicit scoped adoption. Session revocation passed; retained-resource review was the next gate at that checkpoint. The owner later resumed the task. Read-only review found five matching unowned leftovers and 28 absent objects; the exact released ownership check passed for all 33 with mutation disabled. Deployment 4992 passed using the same signed release with scoped adoption enabled: namespace creation, adoption, signed archive delivery and admission/ownership/target postflight completed; init remained 0.73.0 and session revocation passed. Work stopped at bootstrap completion; controller/Plan delivery and node/Core upgrades remain pending. The following Core/init transition source is merged, not deployed. Routine credential checks 4993/4994 passed; Terraform plan/apply 86/87 retired only the temporary bootstrap JWT role/policy and converged. The earlier controller image blockers are resolved: workflows #111 and private Platform #131 merged; build 5004 published signed rke2-controller-bundle-v0.1.0-r7636. Deploy 5005 stopped at adoption; deploy 5007 passed scans, permissions and ownership but failed during UDS archive deployment, with the underlying error withheld. Partial deployment and controller acceptance remain unverified. Plan build 5006 separately failed on 28 blocking findings in the Rancher upgrade image and published no bundle. Workflows #114 is merged/released/promoted in v1.44.0, and private Platform #132 is merged. Fresh controller deploy 5012 passed automatic signed release selection, scans, 77 required/14 forbidden probes, init and ownership preflight, then failed during UDS archive deployment with kubernetes_authorization. Session revocation passed; the denied operation, partial state and controller acceptance remain unverified. Workflows #115 merged/promoted in v1.44.1. Controller retry 5015 on 2026-10-17 passed scans/preflight and identified denied list access to uds.dev/exemptions in uds-policy-exemptions; session revocation passed. Workflows #116, private Platform #133 and Terraform #16 prepare the narrow namespaced list/watch correction and temporary bootstrap authorization. Review/release/promotion, paired merges, Terraform authorization, new signed bootstrap delivery, routine verification, temporary-login retirement and controller retry remain pending; live Roles are not established as corrected. Later versions and automation remain planned; upgrade compatibility and full recovery remain pending. | Private Homelab/platform #128, #123 and runs 4972/4974/4975/4988/4989/4992/4993/4994/4995/5004/5005/5006/5007/5012/5015; private Terraform runs 62/72/75/80/81/86/87; workflows #110, bounded evidence, current versions |
| Human-readable release tags | Owner selected 2026-09-27 for all future image, bundle and recovery releases. Name the component and version; deploy by that exact signed tag. Hashes stay in signed provenance. Shared support and paired callers are prepared; older pinned callers require migration before their next release. | Release naming implementation #64; delivery procedure |
| Core candidate upstream vulnerability/configuration risk | On 2026-09-27, the owner accepted the reviewed remaining upstream vulnerabilities for the Core 1.13.1 Iron Bank/init candidate and subsequently accepted its six recorded configuration findings through 2026-10-27. Acceptance uses stable advisory/rule IDs, package/version, component, path and occurrence scope. Iron Bank management records upstream ownership; residual risk and original findings remain. Run 4698 passed scan/build/sign/private publication; deployment was skipped in that run. The owner later confirmed installed Core v1.13.1 on 2026-10-14; this does not add validation evidence to the historical scan. | Private Homelab/platform issue #47, PR #73 and run 4698; scanner support #63 |
| Core retained scan evidence | Prepared 2026-09-27 after owner feedback: reuse signed reports for the exact retained bundle by default, with current signature/integrity/inventory and mitigation expiry checks. A fresh image scan remains optional; new builds always scan. Reused reports retain their original date and do not discover later advisories. Run 4699 rescanned 29 images but skipped deployment; the submitted checkbox value is not visible in its job page. A pending explicit operation choice fails early if unselected. Review/merge and hosted reuse/deployment remain pending. | Private Homelab/platform issue #47; Core delivery procedure |
| Tenant/admin Istio gateways with MetalLB L2 VIPs | Established. Tenant 10.0.0.241, admin 10.0.0.240 (LAN only). Complete public forwarding and all-host acceptance remain separate. | Platform #1 |
| Retain Pi-hole | Retain LAN split DNS and ad blocking on Pi-hole; no Technitium migration is planned. Keep independent LAN DNS placement, the actual DHCP/client resolver path and filtering. Future DNS/routing changes require validation and rollback. | Owner decision, 2026-09-16, reconfirmed 2026-10-18; private platform #25 records the owner cancellation and is closed; DNS boundary |
| NPM → Istio per-host handoff | Native routes for accepted apps coexist with an explicit legacy SNI allowlist. Do not remove the global passthrough until all retained hosts pass. | Homelab/platform issues #1 and #45 |
| OpenBao + ESO for runtime values | Selected and later operator records report deployed/working managed credentials. Recheck independent persistence, unseal and recovery evidence when changing the backend. | Homelab/platform secrets deployment runbook |
| Cloudflare DNS-01 cert-manager | Controllers, issuer and trusted initial certs reported working; observed future renewal and gateway reload remain distinct tests. | Homelab/platform certificate validation |
| TrueNAS for shared data, local PV for hardware-bound data | CSI NFS/iSCSI tested; app data retains workload-specific ownership. ComfyUI needs an off-node backup and restore check before final cutover. | Homelab/platform storage; Homelab/Comfy-UI issue #1 |
| SeaweedFS for new object storage | Owner reports routing working and its native SSE-S3 key configured on 2026-10-14. Existing UDS gateways/certificates terminate HTTPS; the NAS hop stays HTTP. Private Terraform run 62 on 2026-10-15 passed scoped OpenBao/S3 authentication, state-bucket privacy/versioning/default AES256, encrypted readback and conditional-write checks. Concurrent Terraform locking, restart/off-system recovery and application compatibility remain pending. Application stacks and AIStor consumers are not migrated. | Storage transition and recovery gates; private Homelab/terraform-modules run 62 and platform SeaweedFS runbook |
| Global disposable Linux runners | Owner accepted 2026-09-10 cutover, four ci plus one deploy slots. Subsequent 0.1.3 onboarding API egress needs live confirmation. | Homelab/platform runner record |
| ComfyUI automatic candidates, manual deployment | Weekly/manual change checks chosen; candidate publication, notification and production/GPU acceptance must be proved by current runs. | ComfyUI #1 |
| Homelab-owned workflow and build bases | Owner selected 2026-10-05: use images built, scanned, signed and published in house for workflow jobs and application building/bundling. Add a new base when an application cannot use an accepted base. Official upstream inputs remain pinned provenance inputs. Ubuntu foundation was published and owner-accepted 2026-10-06 as base-ubuntu-v2026.10.06-r6354; Python and Node publication can now proceed from its digest. Identical runner tool requirements were consolidated to tools/main-runner, then published on 2026-10-07 as tool-main-runner-v2026.10.07-r6415 in the separate homelab/tool-images/main-runner OCI namespace, with passing source/full-image scans and clean ClamAV evidence. Source stays in base-images. Both existing labels will use the same published digest after hosted compatibility acceptance, trusted-signature verification and reviewed platform delivery; CI/deploy security pools remain separate. Live label replacement and exact-digest rollback acceptance remain pending. | Private Homelab/base-images issues #2–#4 and #28, merged PR #30, and signed Ubuntu/main-runner releases; Homelab/platform issue #56 and PR #97; adoption boundary |
| New applications on standard UDS hostname | Normally <app>.app.gitchegumi.com with the existing tenant gateway/certificate. Migrated apps keep established production names. | Platform standard edge |
Additional intentionally open questions include a stable control-plane API VIP, exact installed UDS flavor/image digests for reproducible Core adoption, final Jellyfin placement, optional Sager GPU use, and whether a separate UDP gateway is ever needed. Record a decision and owning issue before treating any of these as established.
Every migration should state current state → intended cutover → validation → rollback, and distinguish source/configuration work from owner-confirmed production deployment. Close an issue or move its roadmap card only after its own acceptance criteria are met.