I2674 — A node is provisioned as an S3 cache provider, idempotently, with no secret in the repository
Provision a MinIO service on a chosen node: native or declared service, persistent storage on a bounded path, a private bucket with expiry, a least-privilege client identity, and a bounded bind.
BLOCKED wave 1 · p1 · implementation profile · runs alone
Part of development-runtime — The runtime has a development surface.
Blocked. This issue cannot start until I2670 is done. The status is derived from that, not declared.
Objective
Provision a MinIO service on a chosen node: native or declared service, persistent storage on a bounded path, a private bucket with expiry, a least-privilege client identity, and a bounded bind.
Why
The owner, 2026-10-13, with full clearance: set up MinIO, an sccache server and every mesh node, verified and validated. The cluster compiles the same Rust on every machine from a cold cache; two declared offload hosts were under their disk minimum that day. See ADR 0157.
Current state
Measured on master b29cf4e487 on 2026-10-13: no provisioning exists; the Jetson that was to host it is off the tailnet and answers on the LAN only slowly.
Desired state
A typed provisioning capability that discovers host facts, applies the service, bucket, lifecycle and policy, can be re-applied with no change, and writes credentials to a 0600 file outside the repository.
Scope
- apps/majordomus-cli/src/capability/builtin/
- apps/majordomus-cli/src/mesh/build_cache/
- docs/BUILD_CACHE.md
Out of scope
- A second provider
- Public exposure of the store or its console
Dependencies
What waits on this
Acceptance criteria
- Applied twice, the second run changes nothing
- An unauthenticated write is refused by the store
- No credential appears in git, .ai, a log, an API answer or the docs
- The provider is not tied to MinIO: dl.min.io serves no binaries since 2025 (410 Gone), so the provisioning names a supported S3 server or records that it builds an unpatched release from source
- The data path cannot exhaust the root filesystem under the policy's floor
Validation
- bin/majordomus plan validate
- majordomus mesh build-cache provision --dry-run
Evidence required
- provision_idempotent
- write_refused_unauthenticated
Evidence
None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.
Timeline
- started
- —
- verified
- —
- completed
- —
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I2674.yaml. Read it back with majordomus plan show I2674.