Read the full diff rather than trusting the "docs" framing — this session already had a PR
labelled docs(...) that shipped three breaking behavior guards. This one is genuinely
documentation: 7 files, +150/-13, no executable code.
What it changes:
- integration-preflight becomes a mandatory step 0, with a new non-skippable procedure step
6: one real authenticated request against every external dependency FROM THE RUNTIME
CONTEXT, with the status code pasted into the plan.
- onboard-host, integrate-service and finish-migration each gain an explicit entry gate, so
it is a checklist item rather than a judgment call. onboard-host previously said "run it
first IF any existing drift could interact" — that conditional is exactly how it got
skipped twice.
- Two new failure classes: F12 (external dependency never smoke-tested from the runtime
context) and F13 (preflight treated as a judgment call), written in the catalog's existing
style with real issue refs.
- Output becomes TWO tables (layers + dependencies); either left blank means the preflight
did not run.
- plugin.json 1.0.0 -> 1.0.1, required for the plugin cache to pick the change up.
The worked example is the right one: oleks/armer#171, where the token was byte-identical and
correctly injected, 127.0.0.1 returned 200 and the ZeroTier IP returned 401. Nothing about
the credential was wrong — the source address was. That distinction is the whole lesson.
NOT closing oleks/cluster#271 on this merge: the repo has no CI (verified two ways — find
returns nothing, and Woodpecker GET /repos/lookup 404s), and the remaining acceptance items
need a human. Docs efficacy cannot be proven by a lint gate; the real test is whether the
next rollout actually invokes it.
Refs oleks/cluster#271, oleks/armer#171, oleks/cluster#260
Closes-part-of oleks/cluster#271.
- integration-preflight: framed as the non-skippable step 0 of any
multi-step rollout; new procedure step 6 requires ONE real authenticated
request against every external endpoint FROM THE RUNTIME CONTEXT, with
the allowManagementFrom case (oleks/armer#171) as the worked example;
output now carries a dependency table alongside the layer table;
description rewritten so the skill actually routes on rollout-shaped work.
- onboard-host / integrate-service / finish-migration: each names
integration-preflight as its step 0 entry gate.
- failure-catalog: adds F12 (external dependency never smoke-tested from
the runtime context, oleks/armer#171) and F13 (preflight treated as a
judgment call, oleks/cluster#260 + oleks/armer#171).
- README + plugin.json 1.0.0 -> 1.0.1.
Six integration playbooks (integration-preflight, onboard-host,
integrate-service, ephemeral-lifecycle, add-watchdog, finish-migration)
plus the F1-F11 failure catalog, distilled from the 2026-07-21
k3s-over-ZeroTier connectivity research (oleks/cluster wiki:
K3s-over-ZeroTier-Connectivity). Failure classes over current facts;
live sources of truth over restated values.
oleks
Oleks