ops(rs2000-legacy): validate zero legacy bind mounts and green smokes #556

New issue

Closed

opened 2026-05-28 01:37:57 +02:00 by codex · 2 comments

codex commented

2026-05-28 01:37:57 +02:00

Collaborator

Scope

Validate that all live dependencies have moved off /opt/vps-home-platform-infra before any destructive cleanup issue is allowed to run.

Depends on

All M01 legacy bind-mount migration issues created on 2026-05-28.

Acceptance criteria

docker inspect across all running containers finds zero sources under /opt/vps-home-platform-infra.
Zero unhealthy containers.
Latest platform smoke green.
Affected service smokes green.
No new Traefik/Infisical/Iskra/Honcho regression.
48h green window starts after zero legacy bind mounts are confirmed.
Output is a sanitized validation artifact or issue comment.

Out of scope

Deleting backups.
Deleting legacy state/control-plane material.
Moving data/config.

Common safety rules

Recommended executor: Gemini 3.5 Flash local for repo/doc/plan work.
Do not delete, rename, prune, or edit /opt/vps-home-platform-infra in this issue.
Do not print secrets, env values, private messages, emails, or Iskra memory.
Runtime execution requires a separate explicit operator approval in the PR/issue thread.
First step is always read-only evidence refresh.
Preserve ownership, modes, symlinks, and timestamps when copying data/config.
Update compose/module docs through a PR before recreating affected services.
Recreate only affected service(s), never the whole platform, unless a later operator gate says otherwise.

## Scope Validate that all live dependencies have moved off `/opt/vps-home-platform-infra` before any destructive cleanup issue is allowed to run. ## Depends on All M01 legacy bind-mount migration issues created on 2026-05-28. ## Acceptance criteria - `docker inspect` across all running containers finds zero sources under `/opt/vps-home-platform-infra`. - Zero unhealthy containers. - Latest platform smoke green. - Affected service smokes green. - No new Traefik/Infisical/Iskra/Honcho regression. - 48h green window starts after zero legacy bind mounts are confirmed. - Output is a sanitized validation artifact or issue comment. ## Out of scope - Deleting backups. - Deleting legacy state/control-plane material. - Moving data/config. ## Common safety rules - Recommended executor: Gemini 3.5 Flash local for repo/doc/plan work. - Do not delete, rename, prune, or edit `/opt/vps-home-platform-infra` in this issue. - Do not print secrets, env values, private messages, emails, or Iskra memory. - Runtime execution requires a separate explicit operator approval in the PR/issue thread. - First step is always read-only evidence refresh. - Preserve ownership, modes, symlinks, and timestamps when copying data/config. - Update compose/module docs through a PR before recreating affected services. - Recreate only affected service(s), never the whole platform, unless a later operator gate says otherwise.

codex added this to the 01 - RS2000 closeout and legacy cleanup milestone

2026-05-28 01:37:57 +02:00

codex added the

kind/ops

ready-for-agent

risk/runtime

class/security-sensitive

labels

2026-05-28 01:37:57 +02:00

codex commented

2026-05-29 01:05:26 +02:00

Author

Collaborator

Current zero-bind gate status after PRs #583-#593:

total legacy mounts across all containers: 16
running legacy mounts: 14
exited legacy mounts: 2
zero unhealthy containers observed after latest Vault apply

Remaining blockers:

#544 OpenClaw Mail Docker/tmp-compose drift
#545 Matrix/Synapse/Element orphan re-canonicalization
#546 NP core + Obsidian orphan re-canonicalization
#547 NP app/Radicale orphan re-canonicalization
#555 exited Vault-bootstrap env/scripts cleanup decision

Do not start 48h green window until running legacy mounts are zero.

Current zero-bind gate status after PRs #583-#593: - total legacy mounts across all containers: 16 - running legacy mounts: 14 - exited legacy mounts: 2 - zero unhealthy containers observed after latest Vault apply Remaining blockers: - #544 OpenClaw Mail Docker/tmp-compose drift - #545 Matrix/Synapse/Element orphan re-canonicalization - #546 NP core + Obsidian orphan re-canonicalization - #547 NP app/Radicale orphan re-canonicalization - #555 exited Vault-bootstrap env/scripts cleanup decision Do not start 48h green window until running legacy mounts are zero.

codex commented

2026-05-29 01:48:40 +02:00

Author

Collaborator

Zero-bind validation is green as of 2026-05-28T23:45Z.

Evidence:

TOTAL_LEGACY_MOUNTS=0 across docker ps -aq inspect.
RUNNING_LEGACY_MOUNTS=0.
EXITED_LEGACY_MOUNTS=0.
UNHEALTHY_COUNT=0.
/proc/*/mountinfo references to /opt/vps-home-platform-infra: 0.
platformctl validate all --json: exitCode 0, 88 module results, 0 failed.
Affected orphan-remounted containers checked running / healthy: OpenClaw Mail gateway/worker, Synapse, Element, NP, Radicale, Memos, OpenHabitTracker, Tududi, Silverbullet.

Caveat:

tests/smoke.sh run from inside RS2000 has known self-SSH/DNS false failures for some modules (ssh: Could not resolve hostname rs2000). Direct Docker health and targeted external OpenClaw Mail health were green.

This starts the post-zero-bind observation/quarantine decision window. Destructive backup cleanup remains gated by #557 and the operator phrase.

Zero-bind validation is green as of 2026-05-28T23:45Z. Evidence: - `TOTAL_LEGACY_MOUNTS=0` across `docker ps -aq` inspect. - `RUNNING_LEGACY_MOUNTS=0`. - `EXITED_LEGACY_MOUNTS=0`. - `UNHEALTHY_COUNT=0`. - `/proc/*/mountinfo` references to `/opt/vps-home-platform-infra`: `0`. - `platformctl validate all --json`: exitCode `0`, 88 module results, 0 failed. - Affected orphan-remounted containers checked `running` / `healthy`: OpenClaw Mail gateway/worker, Synapse, Element, NP, Radicale, Memos, OpenHabitTracker, Tududi, Silverbullet. Caveat: - `tests/smoke.sh` run from inside RS2000 has known self-SSH/DNS false failures for some modules (`ssh: Could not resolve hostname rs2000`). Direct Docker health and targeted external OpenClaw Mail health were green. This starts the post-zero-bind observation/quarantine decision window. Destructive backup cleanup remains gated by #557 and the operator phrase.

codex closed this issue

2026-05-29 01:48:40 +02:00