Delete the dead ISO-eject step from provision-vm-from-host #20

Merged

vnprc merged 1 commit from agent/drop-dead-iso-eject into master

2026-07-28 19:48:36 +01:00

allod-agent commented

2026-07-28 19:17:25 +01:00

Member

Deletes the two-line ISO-eject step in scripts/provision-vm-from-host that could never have any effect. virsh change-media was passed neither --config nor --live, so against a running QEMU domain it mutated the live domain only — and that live domain is destroyed on the very next line. The persistent definition, which is exactly what the following virsh start boots from, was never touched. What actually makes the VM come back on the installed disk is that virt-install --cdrom attaches the ISO for the install boot but leaves the media path empty in the persistent definition, so the destroy / sleep 1 / start sequence — deliberately left intact here — brings the domain back with no ISO in the drive.

The step also swallowed its own failure twice, via 2>/dev/null and via an [[ ... ]] && cmd || true chain that guarantees exit 0 regardless of outcome, which is the set -e anti-pattern memory/shell.md names and a violation of architecture.md principle 11. Its awk '/cdrom/ {print $3}' also matched the whole domblklist --details record rather than the Device column, so a Source path containing the substring cdrom would hand back a disk row's Target — harmless for --eject, a live foot-gun for anything destructive. Deleting the step removes both.

The comment and echo above the restart now describe the destroy/start that actually works instead of an eject that no longer exists, and the stale # --no-reboot: ... comment above the nixos-anywhere call is rewritten to describe the --phases disko,install selection that is genuinely in force — the invocation never passed --no-reboot; it relies on the phase list simply omitting the reboot phase.

No replacement step was added. Per the issue's Scope section, a virsh detach-disk to remove the leftover empty CD-ROM device is explicitly out of scope and not to be re-added: the device has no media path, carries no boot risk, and is not a host-to-guest data path, so a detach would arm the wrong-column targeting problem against a genuinely destructive command in order to solve a cosmetic non-problem (architecture.md principles 14 and 15).

The now-unreachable *"domblklist alpha-dev --details"*) case was trimmed from the test suite's virsh stub; the stub still logs every invocation and exits 0, and the suite's only virsh assertion, grep -q 'start alpha-dev', is unchanged.

Closes allod/nexus#19

Risk

R1. One host-side provisioning script; deletion only. Touches no key material, no secrets, no inventory, and no guest-facing state. Blast radius is a single host command sequence run by a human at the terminal, and any error would surface immediately and loudly at the next virsh start during a provisioning run — itself a destructive-and-repeatable operation on a disposable VM. Rollback is a one-commit revert.

Validation

bash tests/provision-vm-from-host.sh — 8 provision-vm-from-host tests passed, 0 failures.
shellcheck -x --source-path=SCRIPTDIR scripts/provision-vm-from-host tests/provision-vm-from-host.sh — clean, no findings.
bash -n on both changed files — clean.

Host-side commands were not run: virsh, virt-install, nixos-anywhere, nixos-rebuild, and the provisioning scripts themselves are human-gated and not installed in the dev VM. The empirical claim that a provisioned dev VM's virsh dumpxml --inactive shows the cdrom disk with no <source> element is carried over from the issue, which recorded it from the host.

Deletes the two-line ISO-eject step in `scripts/provision-vm-from-host` that could never have any effect. `virsh change-media` was passed neither `--config` nor `--live`, so against a running QEMU domain it mutated the live domain only — and that live domain is destroyed on the very next line. The persistent definition, which is exactly what the following `virsh start` boots from, was never touched. What actually makes the VM come back on the installed disk is that `virt-install --cdrom` attaches the ISO for the install boot but leaves the media path empty in the persistent definition, so the `destroy` / `sleep 1` / `start` sequence — deliberately left intact here — brings the domain back with no ISO in the drive. The step also swallowed its own failure twice, via `2>/dev/null` and via an `[[ ... ]] && cmd || true` chain that guarantees exit 0 regardless of outcome, which is the `set -e` anti-pattern `memory/shell.md` names and a violation of `architecture.md` principle 11. Its `awk '/cdrom/ {print $3}'` also matched the whole `domblklist --details` record rather than the Device column, so a Source path containing the substring `cdrom` would hand back a disk row's Target — harmless for `--eject`, a live foot-gun for anything destructive. Deleting the step removes both. The comment and echo above the restart now describe the destroy/start that actually works instead of an eject that no longer exists, and the stale `# --no-reboot: ...` comment above the `nixos-anywhere` call is rewritten to describe the `--phases disko,install` selection that is genuinely in force — the invocation never passed `--no-reboot`; it relies on the phase list simply omitting the reboot phase. No replacement step was added. Per the issue's Scope section, a `virsh detach-disk` to remove the leftover empty CD-ROM device is explicitly out of scope and not to be re-added: the device has no media path, carries no boot risk, and is not a host-to-guest data path, so a detach would arm the wrong-column targeting problem against a genuinely destructive command in order to solve a cosmetic non-problem (`architecture.md` principles 14 and 15). The now-unreachable `*"domblklist alpha-dev --details"*)` case was trimmed from the test suite's `virsh` stub; the stub still logs every invocation and exits 0, and the suite's only virsh assertion, `grep -q 'start alpha-dev'`, is unchanged. Closes allod/nexus#19 ## Risk R1. One host-side provisioning script; deletion only. Touches no key material, no secrets, no inventory, and no guest-facing state. Blast radius is a single host command sequence run by a human at the terminal, and any error would surface immediately and loudly at the next `virsh start` during a provisioning run — itself a destructive-and-repeatable operation on a disposable VM. Rollback is a one-commit revert. ## Validation - `bash tests/provision-vm-from-host.sh` — 8 provision-vm-from-host tests passed, 0 failures. - `shellcheck -x --source-path=SCRIPTDIR scripts/provision-vm-from-host tests/provision-vm-from-host.sh` — clean, no findings. - `bash -n` on both changed files — clean. Host-side commands were not run: `virsh`, `virt-install`, `nixos-anywhere`, `nixos-rebuild`, and the provisioning scripts themselves are human-gated and not installed in the dev VM. The empirical claim that a provisioned dev VM's `virsh dumpxml --inactive` shows the cdrom disk with no `<source>` element is carried over from the issue, which recorded it from the host.

allod-agent added 1 commit

2026-07-28 19:17:25 +01:00

Delete the dead ISO-eject step from provision-vm-from-host 1d615fbca2

virsh change-media was passed neither --config nor --live, so it mutated only
the live domain that the very next line destroys. It could never reach the
persistent definition that the following virsh start boots from, and it
swallowed its own failure twice, via 2>/dev/null and via an [[ ... ]] && cmd
|| true chain that always exits 0. Its awk pattern also matched the whole
domblklist record rather than the Device column.

The destroy / sleep 1 / start sequence stays: virt-install --cdrom leaves the
media path empty in the persistent definition, so that restart is what
actually brings the VM back on the installed disk. The comment and echo above
it now say so. The stale --no-reboot comment above nixos-anywhere is rewritten
to describe the --phases disko,install selection actually in force.

Trim the now-unreachable domblklist case from the virsh stub in
tests/provision-vm-from-host.sh.