Add the microvm persistent volumes plan #29

Merged

vnprc merged 2 commits from agent/microvm-persistent-volumes into master

2026-07-31 11:56:43 +01:00

allod-agent commented

2026-07-31 08:23:41 +01:00

Member

Adds the dev plan for allod/archetypes#25, the second slice of milestone 4 in microvm-framework-adoption.md. Implementation is allod/archetypes#26.

Refs allod/strategy#20
Refs allod/archetypes#25

Risk

R0. One plan document.

Validation

Reviewed by gpt-5.6-sol at high effort — a cross-vendor rotation from the Opus-authored draft — and the review refuted the draft's central safety claim.

The draft argued that omitting neededForBoot on the home volume causes silent data loss: a machine that boots healthy and discards work. Measured, that is wrong. The home entry renders defaults with no nofail, so systemd requires the mount for local-fs.target and a corrupt image fails the boot loudly into emergency. The real justification is contract 13's own — neededForBoot moves validation into the initrd, ahead of any writer using the tmpfs directory beneath an unmounted mount point. The plan keeps the correction visible rather than quietly rewriting the section, because it changes what the acceptance test is for.

Four other findings folded in: an impossible assertion-ordering claim (NixOS collects every failed assertion into one throw, so neither reporter precedes the other); a wrong error-model claim (an unmatched option definition is catchable by tryEval, unlike a raw missing-attribute read); the image root needing validation in this slice rather than leaning on host-composition checks it excludes; and several load-bearing volume fields left to upstream defaults instead of being stated as the deployer's contract.

The labelling decision survived with a corrected rationale: appending a volume does not necessarily renumber devices, but any later reorder silently remaps two valid images onto each other's mount points, and a wrong label fails loudly instead.

Adds the dev plan for allod/archetypes#25, the second slice of milestone 4 in `microvm-framework-adoption.md`. Implementation is allod/archetypes#26. Refs allod/strategy#20 Refs allod/archetypes#25 ## Risk R0. One plan document. ## Validation Reviewed by `gpt-5.6-sol` at `high` effort — a cross-vendor rotation from the Opus-authored draft — and the review refuted the draft's central safety claim. The draft argued that omitting `neededForBoot` on the home volume causes silent data loss: a machine that boots healthy and discards work. Measured, that is wrong. The home entry renders `defaults` with no `nofail`, so systemd requires the mount for `local-fs.target` and a corrupt image fails the boot loudly into emergency. The real justification is contract 13's own — `neededForBoot` moves validation into the initrd, ahead of any writer using the tmpfs directory beneath an unmounted mount point. The plan keeps the correction visible rather than quietly rewriting the section, because it changes what the acceptance test is for. Four other findings folded in: an impossible assertion-ordering claim (NixOS collects every failed assertion into one throw, so neither reporter precedes the other); a wrong error-model claim (an unmatched option definition *is* catchable by `tryEval`, unlike a raw missing-attribute read); the image root needing validation in this slice rather than leaning on host-composition checks it excludes; and several load-bearing volume fields left to upstream defaults instead of being stated as the deployer's contract. The labelling decision survived with a corrected rationale: appending a volume does not necessarily renumber devices, but any later reorder silently remaps two valid images onto each other's mount points, and a wrong label fails loudly instead.

allod-agent added 2 commits

2026-07-31 08:23:41 +01:00