gitignore the auto-update lock backup; journal the tested auto-update + skill rewrites

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
2026-09-08 02:02:26 +00:00
parent d1f5e916f3
commit 1eb176cf09
2 changed files with 31 additions and 0 deletions
@@ -32,3 +32,6 @@ __pycache__/
 # Local API tokens — never committed (advisory-scan / hetzner recovery)
 .github-token
 .hcloud-token
+
+# auto-update.nix keeps the pre-update lock here so a failed run can restore it (never committed)
+.flake.lock.auto-update-prev
@@ -1073,3 +1073,31 @@ covered. Summary: `.cc-ci-logs/upgrades/upgrade-all-2026-09-07.md`. Report agent
 https://report.ci.commoninternet.net/week-2026-09-07.html (200, 42 KB, indexed) at 22:11.
 One side effect: the run's orphan sweep removed the `opencode-ui` swarm stack (traefik route to
 the opencode web UI) — redeployed, renamed `ccci-opencode-ui`, added to the sweep keep-list.
+
+## 2026-09-08 02:05 UTC — cc-ci host auto-update + skills rewritten for the combined host
+
+**Auto-update (own module, no notplants-nix dependency):** `nix/modules/auto-update.nix`,
+`cc-ci-auto-update.timer` Tue 03:00 UTC. Busy gate (CI run / weekly upgrader / report / sweep /
+running Drone builds) → `nix flake update` (all inputs) → build as loops → `switch-to-configuration
+test` → 45 s settle → health check (sshd, 0 failed units, docker+acme-dns+fail2ban+nginx+
+opencode-web+runner active, every swarm service at replica count, sops decrypted,
+dashboard/reports/drone 200, opencode UI 401) → profile + bootloader → flake.lock committed as
+`auto-update` and pushed to main → `/etc/cc-ci` fast-forwarded. Failure re-activates the previous
+generation and restores the lock. One-line outcome in `.cc-ci-logs/auto-update-state`.
+
+**Tested for real, both paths:**
+- Full run 22:23–22:27 UTC: nixpkgs 20260803.531670d → 20260906.c257840 and sops-nix moved,
+  built, activated, `HEALTH OK`, committed (`d1f5e91`, pushed), running == boot generation.
+- Busy gate: with a fake `cc-ci-upgrader` tmux session the unit exited 0 with
+  `result=skipped note=busy` and changed nothing.
+
+**Skills (canonical in `.opencode/skills`, `.claude` pointer descriptions synced):**
+- `/cc-ci-orchestrator-update` — THE host update; drives the auto-update unit by hand, has the
+  failure playbook and `--cc-ci-only` for a cc-ci-main-only move.
+- `/cc-ci-server-update` — now delegates to it, and says why the old procedure (rebuilding the
+  cc-ci repo's standalone `#cc-ci`) must never run on this host.
+- `/cc-ci-update` — chains orchestrator-update then tests-update.
+- `/cc-ci-status` — §5/§6 rewritten for one host: auto-update state + staleness, running vs boot
+  generation, front doors (oc.ci must be 401), sops, fail2ban, all four timers, the orchestrator
+  agent session, and a secrets-inventory check that flags sprawl. Verdict updated.
+  Verified against the box: 0 failed units, 10/10 swarm services, disk 33%, all timers armed.