Files

T

kami b2cd11dd1c Record the #116/#117 storage and viewer work

#117 done: stowage was dead on an arm64 digest pin, not a MinIO fault.
#116 staged: rustfs runs on 9010/9011, buckets not mirrored, no cutover.

Also logs the ISP port 80/443 interception that made three external
reachability measurements worthless, so the next session does not repeat them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-11 22:05:23 +04:00

4.2 KiB

Raw Blame History

JOURNAL

Append-only, newest last. One block per session or run. Not a changelog: this records what happened on the day a number was produced, so a later postmortem can find it.

2026-08-11 Audit second pass [no task]

Command: none. Source reading only. Outcome: finished. AUDIT.md grew from 565 to 771 lines with a ## Second-pass findings section: 4 new P0, 6 new P1, 13 P2, 5 additions to the Phase 1 list. Produced: commit 6d9df5b, AUDIT.md:566.

2026-08-11 Audit Phase 1 implemented [#203]

Command: python worker_scene.py worker_script.py worker_vision.py session_manager.py, pytest -q --ignore=test_api.py in the orchestrator. Outcome: finished. All self-checks pass, 108 orchestrator tests pass. No GPU work, no pipeline run. test_api.py was skipped because fastapi is not installed in the workpc venv. Produced: decisions/audit-phase1.md, caveats/audit-open.md, ROADMAP.md, and this scaffold.

One existing test asserted the bug: test_name_binding.test_conflict_flags_and_stays_unnamed relied on orphan flags leaking into every chapter, because it never created panel rows. It now creates them.

2026-08-11 Orchestrator half committed and deployed [no task]

Command: pytest -q --ignore=test_api.py, then docker compose up -d --build orchestrator on homesrv. Outcome: finished. 108 tests pass. Commits 1c60710 (orchestrator half) and 94bd4d8 (minio pin) in /mnt/server/home/kami/docker-apps. Orchestrator and minio both answer health on homesrv.

The rebuild recreated minio as a side effect and it crash-looped with exec format error: the compose pin was the arm64 manifest digest of minio/minio:latest and homesrv is amd64. Repinned to the amd64 digest. Nothing about Phase 1 caused this, but any compose action that recreates minio would have hit it, so it was latent, not new.

Still unrun against a real chapter.

2026-08-11 S3 viewer and storage swap, tasks #116/#117 [#116 #117]

Command: docker compose on homesrv, dig, openssl s_client. No pipeline, no GPU. Outcome: partial. Viewer works, storage swap staged and unfinished.

#117 needed no new software. stowage at ~/docker-apps/stowage was already configured against the manga MinIO and had been dead since 2026-07-19 with exec /sbin/tini: exec format error: its digest pin was the arm64 manifest. Repinned to amd64 sha256:91be7f13, chowned data/ to uid 65532 for the new image, and it serves. MinIO had the identical bug, repinned to sha256:a1a8bd4a. A sweep of all 470 local images on homesrv found exactly those two arm64; nothing else in the homelab is affected.

#116 is staged, not done. rustfs runs alongside MinIO on 127.0.0.1:9010/9011, pinned sha256:19b105cc, data at /mnt/hdd2/rustfs. Buckets are empty: the mc mirror of audio layers manga panels raw video (350M, all in manga) has NOT run. /mnt/hdd2/minio/data is untouched and is the rollback. RustFS is 1.0.0-beta.12, labeled build-type=prerelease. Cutover would give rustfs 9000/9001 and repoint MINIO_ENDPOINT=minio:9000 in the orchestrator plus stowage/config.yaml; transport.py:95 needs no change if rustfs takes 192.168.1.104:9000.

Side quest, unrelated to the pipeline: the shared 41-domain cert stopped renewing. Root cause was DNS, not nginx. Every *.kvmx.ru name pointed at a hard A record for 109.229.102.117 while the line had moved to 109.229.127.149; the Mercusys DDNS at kvmx-home.mercusysddns.com was correct the whole time but nothing in the zone referenced it. Fixed with CNAME * -> kvmx-home.mercusysddns.com at reg.ru. Certificate now issues.

Two measurement traps worth remembering. The ISP transparently intercepts ports 80 and 443 by Host/SNI, so curl from workpc to ANY address returns kvmx.ru content and proves nothing about external reachability; bare TCP connects also succeed against arbitrary addresses and then hang. Three wrong root causes came out of trusting those probes before checking them.

Also patched ~/scripts/migrate-kvmx-https.sh:54 on homesrv. need_stream_module used sudo -n nginx -V and sudo -n nginx -T; the NOPASSWD rule covers only nginx -t, so it reported "stream module is not loaded" whenever it meant "could not ask for a password". Both checks now run without sudo. bash -n passes and both conditions evaluate true.