germinate/seed: fix two cold-start blockers (seed branch resolution + dind MTU) #1

Merged

plat merged 1 commit from fix/cold-start-seed-branch-and-mtu into main

2026-06-23 17:05:27 +00:00

plat commented

2026-06-23 05:16:19 +00:00

Owner

Two outstanding cold-start blockers on a fresh machine, validated end-to-end with a depth-2 germination chain (genesis → daughter → granddaughter) on real k3d clusters, all run under an adversarial init.defaultBranch=master.

#2 — empty checkout when git's default branch isn't `main`

The gitops/mitosis seed bundles are built by explicit refspec and record no HEAD, so git clone falls back to the operator's init.defaultBranch; a master default checks out an empty tree → germinate dies with a misleading kustomization.yaml: No such file.

germinate clones every seed bundle with explicit --branch "$FLUX_BRANCH" (repairs already-shipped seeds)
seed records HEAD in the gitops/mitosis bundles so future seeds self-describe (the --all code bundles already did)

#3 — image builds stall on a dind MTU mismatch

dind's docker0 defaults to MTU 1500 while the k3d/flannel overlay is 1450, so large build pulls are silently dropped and the mcp/agents chart builds hang forever. Pin "mtu":1450 into the forgejo docker-daemon-config when restoring gitops; the edit is swept into the rekey commit (fork_rekey_sops's git add -A) and pushed to the daughter. Idempotent via the "mtu" guard; no-ops if the file is absent. The canonical fix belongs in the gitops manifest + re-seed.

Validation — depth 2, real clusters

#2 germinate: all 3 generations germinated the HEAD-less genesis gitops bundle under master default and reached "all 9 forged secrets sovereign-sealed" (empty checkout → that step is impossible).
#2 seed: daughter-seed and grand-seed record HEAD on all 7 bundles; master-default clone self-describes to main, non-empty.
#3: live dind docker0 = mtu 1450; 9/9 chart builds (ci-builder+mcp+agents × 3 gens) landed on attempt 1; mtu:1450 propagated through the chain and the shim idempotently no-ops on inherited seeds.

Lineage recorded: open-platform.sh → plat.local → daughter.local → grand.local.

Not exercised: the agent app-build layer (needs a Claude credential) — orthogonal to these germination/seed/MTU fixes.

🤖 Generated with Claude Code

Two outstanding cold-start blockers on a fresh machine, validated end-to-end with a **depth-2 germination chain** (genesis → daughter → granddaughter) on real k3d clusters, all run under an adversarial `init.defaultBranch=master`. ## #2 — empty checkout when git's default branch isn't `main` The `gitops`/`mitosis` seed bundles are built by explicit refspec and record no `HEAD`, so `git clone` falls back to the operator's `init.defaultBranch`; a `master` default checks out an empty tree → germinate dies with a misleading `kustomization.yaml: No such file`. - **germinate** clones every seed bundle with explicit `--branch "$FLUX_BRANCH"` (repairs already-shipped seeds) - **seed** records `HEAD` in the gitops/mitosis bundles so future seeds self-describe (the `--all` code bundles already did) ## #3 — image builds stall on a dind MTU mismatch dind's `docker0` defaults to MTU 1500 while the k3d/flannel overlay is 1450, so large build pulls are silently dropped and the `mcp`/`agents` chart builds hang forever. Pin `"mtu":1450` into the forgejo `docker-daemon-config` when restoring gitops; the edit is swept into the rekey commit (`fork_rekey_sops`'s `git add -A`) and pushed to the daughter. Idempotent via the `"mtu"` guard; no-ops if the file is absent. The canonical fix belongs in the gitops manifest + re-seed. ## Validation — depth 2, real clusters - **#2 germinate:** all 3 generations germinated the HEAD-less genesis gitops bundle under `master` default and reached "all 9 forged secrets sovereign-sealed" (empty checkout → that step is impossible). - **#2 seed:** `daughter-seed` and `grand-seed` record `HEAD` on all 7 bundles; master-default clone self-describes to `main`, non-empty. - **#3:** live dind `docker0` = `mtu 1450`; **9/9** chart builds (ci-builder+mcp+agents × 3 gens) landed on **attempt 1**; `mtu:1450` propagated through the chain and the shim idempotently no-ops on inherited seeds. Lineage recorded: `open-platform.sh → plat.local → daughter.local → grand.local`. > Not exercised: the agent app-build layer (needs a Claude credential) — orthogonal to these germination/seed/MTU fixes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

plat added 1 commit

2026-06-23 05:16:19 +00:00

germinate/seed: fix two cold-start blockers (seed branch resolution + dind MTU) d243683914

Applies an externally-contributed patch (mitosis-cold-start-fixes), verified
against the shipped genesis seed before landing.

#2 seed bundle branch resolution — the gitops/mitosis bundles are created by
explicit refspec (refs/heads/$FLUX_BRANCH) and so record no HEAD. `git clone`
then falls back to the operator's init.defaultBranch; when that's the git
default `master` and content lives on `main`, the clone checks out an empty
tree and germinate dies with a misleading `kustomization.yaml: No such file`.
  - germinate: clone every seed bundle with explicit --branch "$FLUX_BRANCH"
    (repairs already-shipped seeds; verified all 7 bundles carry refs/heads/main)
  - seed: include HEAD in the gitops/mitosis bundles so future seeds
    self-describe their default branch (the --all code bundles already do)

#3 dind bridge MTU vs cluster overlay — dind's docker0 defaults to MTU 1500
while the k3d/flannel overlay is 1450, so large image-pull packets are silently
dropped and mcp/agents builds stall forever. Pin "mtu":1450 into the forgejo
docker-daemon-config.yaml when restoring the gitops bundle; the edit is swept
into the rekey commit (fork_rekey_sops' git add -A) and pushed to the daughter.
Idempotent via the "mtu" guard; no-ops if the file is absent. Canonical fix
belongs in the gitops manifest + re-seed; this shim keeps shipped seeds working.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat force-pushed fix/cold-start-seed-branch-and-mtu from d243683914 to 2e2d88dd12

2026-06-23 17:00:43 +00:00

Compare

plat merged commit 1c05ffb3bc into main

2026-06-23 17:05:27 +00:00

plat referenced this pull request from a commit

2026-06-23 17:05:27 +00:00

Merge pull request 'germinate/seed: fix two cold-start blockers (seed branch resolution + dind MTU)' (#1) from fix/cold-start-seed-branch-and-mtu into main

plat referenced this pull request

2026-06-29 19:45:39 +00:00

SECURITY: builder agent holds the Forgejo admin PAT (3 channels) -> prompt-injected agent can exfiltrate ALL production secrets #16

plat referenced this pull request