v0.6 acceptance: the delete-the-volume dogfood #159

New issue

Closed

opened 2026-08-09 03:17:59 +00:00 by Cordy · 1 comment

Cordy commented

2026-08-09 03:17:59 +00:00

Owner

Closes the milestone; runs on the live dogfood after #152–#157 ship. The acceptance criteria from #138, executed for real:

The definitive test: scale cairn-enc to zero, delete its /data PVC entirely, recreate it empty, start the pod against the same bucket + same config secret → license, settings, share links, legal holds, peering trust (keys + peers + toggle), app passwords and notification watermarks all intact. The instance IS the bucket.
Update cycle with no persistence: a full tag→deploy round trip on an instance with ephemeral /data loses nothing.
posix parity: a posix-driver instance (throwaway, the #106 pattern) behaves identically before/after — state under the data root, no backend calls.
Sovereignty: pull a .cairn-state/ object raw from Garage; prove it is an age file the recovery key decrypts to readable JSON and nothing else opens.
Guard rails fire: boot with a live foreign lock refuses (#156); a manufactured migration conflict refuses with the documented message (#154); .cairn-state is invisible via UI, WebDAV and shares (#155 spot checks against the live instance).

Whatever this surfaces gets filed as new issues in this milestone before it closes — the #106 lesson: the dogfood IS the test.

Closes the milestone; runs on the live dogfood after #152–#157 ship. The acceptance criteria from #138, executed for real: 1. **The definitive test:** scale `cairn-enc` to zero, delete its `/data` PVC entirely, recreate it empty, start the pod against the same bucket + same config secret → license, settings, share links, legal holds, peering trust (keys + peers + toggle), app passwords and notification watermarks all intact. The instance IS the bucket. 2. **Update cycle with no persistence:** a full tag→deploy round trip on an instance with ephemeral `/data` loses nothing. 3. **posix parity:** a posix-driver instance (throwaway, the #106 pattern) behaves identically before/after — state under the data root, no backend calls. 4. **Sovereignty:** pull a `.cairn-state/` object raw from Garage; prove it is an age file the recovery key decrypts to readable JSON and nothing else opens. 5. **Guard rails fire:** boot with a live foreign lock refuses (#156); a manufactured migration conflict refuses with the documented message (#154); `.cairn-state` is invisible via UI, WebDAV and shares (#155 spot checks against the live instance). Whatever this surfaces gets filed as new issues in this milestone before it closes — the #106 lesson: the dogfood IS the test.

Cordy added this to the v0.6 — Stateless instance (state-in-backend) milestone

2026-08-09 03:17:59 +00:00

Cordy referenced this issue

2026-08-09 03:18:12 +00:00

State-in-backend: instance state lives encrypted in the storage backend, not on local disk #138

Cordy referenced this issue

2026-08-09 03:41:24 +00:00

State-in-backend: instance state lives encrypted in the storage backend, not on local disk #138

Cordy referenced this issue

2026-08-09 07:02:59 +00:00

Storage connect from the WebUI: bootstrap layer, setup mode, and the wizard #160

Cordy commented

2026-08-09 23:51:40 +00:00

Author

Owner

Executed live 2026-08-10, passed. Nikola deleted the cairn-enc Deployment and the cairn-enc-data PVC outright (kubectl delete deploy, kubectl delete pvc; dynamic provisioning meant the volume itself was gone, not retained). A Git push then recreated both from the manifests: a brand-new empty volume (pvc-489ae953…) and a fresh v0.5.6 pod.

The pod booted through the empty disk directly into its full identity from the bucket: all nine state names bound with zero migration events (backend-only → adopt, per #154), advisory lock acquired, instance peering constructed … enabled=true in the boot log — a setting that exists nowhere but the bucket's encrypted state. Nikola then verified in the UI: license present, settings intact (peering on), peer registry and issued keys intact, user files intact.

The claim this milestone was named for is now demonstrated, not asserted: the instance's identity is the bucket, not the volume. The PVC that remains carries only scratch (tus spool, peering blob staging) and would-be bootstrap pointer; the *.migrated fallbacks from #154 died with the old volume, which is exactly the retirement path the design intended.

Same session also served as #160's live acceptance: a second, storage-less instance ran the full first-run flow — setup mode → wizard (Directory) → probe → bootstrap pointer → self-restart → /setup admin creation → login → upload — surfacing the two wizard UX faults fixed in v0.5.6 (#166).

**Executed live 2026-08-10, passed.** Nikola deleted the `cairn-enc` Deployment and the `cairn-enc-data` PVC outright (`kubectl delete deploy`, `kubectl delete pvc`; dynamic provisioning meant the volume itself was gone, not retained). A Git push then recreated both from the manifests: a brand-new empty volume (`pvc-489ae953…`) and a fresh v0.5.6 pod. The pod booted through the empty disk directly into its full identity from the bucket: all nine state names bound with zero migration events (backend-only → adopt, per #154), advisory lock acquired, `instance peering constructed … enabled=true` in the boot log — a setting that exists nowhere but the bucket's encrypted state. Nikola then verified in the UI: license present, settings intact (peering on), peer registry and issued keys intact, user files intact. The claim this milestone was named for is now demonstrated, not asserted: **the instance's identity is the bucket, not the volume.** The PVC that remains carries only scratch (tus spool, peering blob staging) and would-be bootstrap pointer; the `*.migrated` fallbacks from #154 died with the old volume, which is exactly the retirement path the design intended. Same session also served as #160's live acceptance: a second, storage-less instance ran the full first-run flow — setup mode → wizard (Directory) → probe → bootstrap pointer → self-restart → `/setup` admin creation → login → upload — surfacing the two wizard UX faults fixed in v0.5.6 (#166).

Cordy closed this issue

2026-08-09 23:51:46 +00:00

Cordy referenced this issue

2026-08-10 00:25:44 +00:00

v0.6 docs: backup story, sharp-edge table, ARCHITECTURE section (write last, from fact) #158

Cordy referenced this issue

2026-08-10 00:26:00 +00:00

State-in-backend: instance state lives encrypted in the storage backend, not on local disk #138