[gregoryfoster]

Closes #8.

What changed

• Host (done, live): tailscale set --accept-dns=true on co-processor. tailscaled ranked at OOMScoreAdjust=-950 by a tracked drop-in, below processor.service (-500).
• deploy/tailscaled.service.d/90-processor-oom.conf: one directive, the cohort's -950 (power-map#588, replicator, observo#631).
• The broker by name: broker, never 100.97.91.19, in AGENTS.md, docs/DEPLOYMENT.md (the handoff's printf and PING, the env sample), the settings.py comment, and the spec's Bus URL row (amended 2026-10-01).
• docs/DEPLOYMENT.md → Tailscale DNS: how DNS works on exeuntu here, the CorpDNS check, the drop-in install, names at boot, post-reboot checks, rollback.
• Tests:
  • tests/test_tailscaled.py (modelled on observo's test_infra_tailscaled.py):
    • drop-in shape and rank;
    • the runbook installs it and never writes over resolv.conf except to restore Tailscale's backup;
    • no doc or settings file names the broker by address;
    • installed parity, live oom_score_adj and live CorpDNS, which skip off this node;
    • broker resolves to a tailnet address.
  • tests/test_consumer.py: a broker that fails to resolve twice (EAI_AGAIN) is retried, logged as a warning, and the consumer starts once it resolves. This confirms the boot retry; a mutation that re-raises fails it.

Why DNS was off

Nothing deliberate. The journal has the provisioning command, sudo tailscale up --auth-key=file:… --advertise-tags=tag:processor --hostname=co-processor --accept-dns=false, run at 2026-09-29 22:52:30Z from the observo#629 session, while observo-primary still ran DNS off. There is no setup script and no shell history giving a reason.

Differs from observo-primary:

• No /etc/resolv.pre-tailscale-backup.conf existed, because DNS had never been on here.
• exe-init (the kernel's init=) writes /etc/resolv.conf as nameserver 169.254.169.254 at boot, before systemd: the file shares the boot's mtime with /etc/hosts.
• tailscaled now keeps that file as the backup and forwards public names to it.

Host change, measured (2026-10-01 UTC)

When	What
00:09:08	Before: CorpDNS: false, resolv.conf = nameserver 169.254.169.254; both saved to /var/backups/processor/8/. 10-min revert timer armed (processor-8-dns-revert). tailscale set --accept-dns=true.
00:09:10	All of these resolved: api.anthropic.com, github.com, storage.googleapis.com, oauth2.googleapis.com, exe.dev, pypi.org, broker, and broker.taild0fb76.ts.net.
00:09:18	Drop-in installed, daemon-reload, tailscaled restarted. broker resolved again 2.4 s later. adj 0 → -950, oom_score 670 → 37. Same names re-checked: all resolve.
00:09:25	TCP connect to broker:6379 by name: ok. Timer disarmed. tailscale debug prefs before vs after differs only in CorpDNS.

Not done / open

• Authenticated PING as processor: there is no credential yet (/etc/processor/ is empty; broker#75). The TCP connect by name stands in. Run the runbook's PING (now -h broker) when the handoff completes.
• index / index.taild0fb76.ts.net don't resolve yet. MagicDNS answers only for netmap peers, and broker is the only one. That waits on Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5's tailnet-policy item, not DNS. I'm ticking Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5's name-resolution item on that basis.
• Reboot proof: this VM hasn't rebooted with DNS on. The checks are in DEPLOYMENT.md → At boot. A transient revert timer doesn't survive a reboot, so do it with the operator at the console.
• AutoUpdate.Apply: true is unchanged and left to New skill: patching-hosts — probe, plan and apply OS updates, with environment profiles learned per run gregoryfoster/skills#313, as on observo.

Review

Two CR --fix rounds, one commit per finding (CR 1–9):

• CR 1: the boot-retry test resolves broker.invalid. Since DNS is on, plain broker would reach the real broker if the resolver patch were ever bypassed.
• CR 2: the test's wait is capped at 10 s, so a consumer that never starts fails instead of hanging.
• CR 3: the runbook's rollback is now tailscale set --accept-dns=false alone. Measured on the host: that moves Tailscale's backup back over /etc/resolv.conf, so the old cp from the backup failed with cannot stat. The cp stays as a last resort while tailscaled is down.
• CR 4, CR 8: the two repo-wide checks (no broker address, no writes over /etc/resolv.conf) scan every committable file, not hand-picked ones.
• CR 5: the write check also catches redirects, sed -i, ln, rm and dd.
• CR 6: the drop-in and the test docstring say oom_score 670, as measured.
• CR 7: the boot-retry test sets its own log level.
• CR 9: AGENTS.md says a test that connects never names broker.

Gate

uv run pytest: 215 passed (184 unit + 31 integration), 0 skipped. The live tests ran on this node. ruff check, ruff format --check and uv lock --locked are clean, and the scratch Redis is clean. The authenticated PING moves to the broker#75 handoff (its step 3 already PINGs -h broker).

🤖 Generated with Claude Code