Skip to content
Cockpit0.29.0
A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I2674

A node is provisioned as an S3 cache provider, idempotently, with no secret in the repository

Where it stands

devtask.issue
Readiness
blocked 1 of its dependencies is not DONE
Status
BLOCKED
Can start
not now
Milestone
development-runtime
Milestone status
ACTIVE
Wave
1
Waiting on
I2670
Holds back
I2676
Behind it in all
1
Evidence
0 of 2
In the waySubjectDetail
issueI2670I2670 is not DONE

Moves

plan.transition
A move writes the repository: it stamps one field of this issue's record and appends one event to the ledger, and a commit will carry both.
The same moves from a terminal

majordomus plan start I2674

majordomus plan verify I2674

majordomus plan done I2674

What it is

Objective
Provision a MinIO service on a chosen node: native or declared service, persistent storage on a bounded path, a private bucket with expiry, a least-privilege client identity, and a bounded bind.
Why
The owner, 2026-10-13, with full clearance: set up MinIO, an sccache server and every mesh node, verified and validated. The cluster compiles the same Rust on every machine from a cold cache; two declared offload hosts were under their disk minimum that day. See ADR 0157.
Now
Measured on master b29cf4e487 on 2026-10-13: no provisioning exists; the Jetson that was to host it is off the tailnet and answers on the LAN only slowly.
Wanted
A typed provisioning capability that discovers host facts, applies the service, bucket, lifecycle and policy, can be re-applied with no change, and writes credentials to a 0600 file outside the repository.
Done when
unknown: the record declares no `completion`
Risk
unknown: the record declares no `risk`

Acceptance

  • Applied twice, the second run changes nothing
  • An unauthenticated write is refused by the store
  • No credential appears in git, .ai, a log, an API answer or the docs
  • The provider is not tied to MinIO: dl.min.io serves no binaries since 2025 (410 Gone), so the provisioning names a supported S3 server or records that it builds an unpatched release from source
  • The data path cannot exhaust the root filesystem under the policy's floor
Validation
bin/majordomus plan validatemajordomus mesh build-cache provision --dry-run
Evidence required
provision_idempotentwrite_refused_unauthenticated
Evidence present
unknown: the record carries no `evidence` entries

Scope

Touches
apps/majordomus-cli/src/capability/builtin/apps/majordomus-cli/src/mesh/build_cache/docs/BUILD_CACHE.md
Not
A second providerPublic exposure of the store or its console
Depends on
I2670
Priority
p1
Profile
implementation
Parallel safe
false
Owner
unknown: the record declares no `owner`

The work so far

Branches
none
Merged
none
Commits
0
Trunk
master
Sessions
none
Created
2026-10-13
Updated
2026-10-13
Started
unknown: the record declares no `started_at`
Verified
unknown: the record declares no `verified_at`
Completed
unknown: the record declares no `completed_at`

Synchronisation

Adapter
scripts/github-sync
Repository
unknown: the derived plan's header carries no repository
External issue
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.