Status Date · 2025年10月25日
Window · 2025年10月31日 (single-day, maintenance)
Change Scope · Kernel 6.17.x adoption, Python 3.14 side-by-side, Forky (Debian 14) pathfinders (pinned), memory schema v2, governance registry seed, ops hardening

P0 hard gates — do not proceed unless all pass.

• PF-01 Confirm backups present and readable

  • ~/huey/mem/ (DB and logs), /etc, and current wiki export

  • Target: Storage Hub (X9QRI-F+) with date-stamped path

• PF-02 Record current versions

  • Kernel: uname -r

  • Python: python3 --version

  • Vulkan path: vulkaninfo | head -n 20 (optional)

• PF-03 Confirm console access (local keyboard/monitor) on Portal and Core

• PF-04 Ensure SSH keys-only auth works between nodes

• PF-05 Freeze non-essential cron/systemd timers during window

Snapshot script (reference)

set -euo pipefail
SNAP="/mnt/storage/huey-snapshots/$(date +%F)"
mkdir -p "$SNAP/etc" "$SNAP/huey-mem"
rsync -a --delete ~/huey/mem/ "$SNAP/huey-mem/"
rsync -a --delete /etc/ "$SNAP/etc/"
sha256sum $(find "$SNAP" -type f -maxdepth 2 -print) | tee "$SNAP/SHA256SUMS.txt"

• OCT31-01 — Kernel 6.17.x-huey (install, keep previous in GRUB)

  • Build or install signed .deb packages; retain last-known-good entry

  • Post-install: sudo update-grub

  • Verify: grep -E "amdgpu|EFI_STUB" /boot/config-$(uname -r) || true

• OCT31-02 — Python 3.14 side-install at /opt/python-3.14

  • Keep system /usr/bin/python3 untouched

  • Recreate Huey venv against 3.14 when ready

  • Verify: ~/huey/.venv/bin/python -V → Python 3.14.x

• OCT31-03 — Forky pathfinders (Debian 14) sources (pinned)

  • Add forky.sources (deb822) disabled by default or pinned lower than Trixie

  • Verify: apt-cache policy | sed -n '1,120p' shows correct pinning

• OCT31-04 — AMDGPU early KMS and visible boot logs on Portal

  • GRUB: keep loglevel=4 vga=normal and confirm amdgpu KMS

  • Verify: dmesg -T | grep -i amdgpu | head

• OCT31-05 — Remove splash globally

  • Ensure no splash in GRUB, Plymouth disabled where present

  • Verify: next boot shows full kernel log scroll

Kernel speedrun (reference)

cd ~/kernels && mkdir -p src && cd src
wget -O linux.tar.xz https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.17.5.tar.xz
tar -xf linux.tar.xz && cd linux-6.17.5
cp -v /boot/config-$(uname -r) .config
yes "" | make olddefconfig
make -j"$(nproc)" bindeb-pkg
sudo dpkg -i ../linux-image-6.17*.deb ../linux-headers-6.17*.deb
sudo update-grub

• OCT31-10 — SQLite schema v2 migration

  • Tables: events, facts, artifacts (+ indices)

  • Plan: create v2 tables → migrate data → atomically swap

  • Verify: pragma integrity_check; returns ok

• OCT31-11 — Daily signed snapshots on Storage Hub

  • Install timer/service or cron job; include SHA256SUMS.txt

  • Verify: snapshot appears with current date and signed manifest

• OCT31-12 — Clause registry seed with stable IDs and hashes

  • ~/huey/config/clauses.yml (append-only)

  • Verify: file exists; IDs unique; SHA-256 populated

Schema v2 DDL (canonical)

CREATE TABLE IF NOT EXISTS events(
 id INTEGER PRIMARY KEY AUTOINCREMENT,
 ts TEXT NOT NULL, actor TEXT NOT NULL, action TEXT NOT NULL,
 payload_json TEXT NOT NULL, sha256 TEXT);
CREATE INDEX IF NOT EXISTS idx_events_ts ON events(ts);
CREATE TABLE IF NOT EXISTS facts(
 key TEXT NOT NULL, value TEXT NOT NULL, ts TEXT NOT NULL,
 PRIMARY KEY(key, ts));
CREATE TABLE IF NOT EXISTS artifacts(
 id INTEGER PRIMARY KEY AUTOINCREMENT, path TEXT NOT NULL,
 sha256 TEXT NOT NULL, ts TEXT NOT NULL, event_id INTEGER,
 FOREIGN KEY(event_id) REFERENCES events(id));
CREATE INDEX IF NOT EXISTS idx_artifacts_sha ON artifacts(sha256);

• OCT31-20 — Validate AMD Vulkan path (Ollama)

  • Environment:
    export VK_ICD_FILENAMES=/usr/share/vulkan/icd.d/radeon_icd.x86_64.json
export OLLAMA_LLM_LIBRARY=vulkan

  • Verify: vulkaninfo | grep -E 'GPU|driver' shows RADV path

• OCT31-21 — Model manifest pinned

  • ~/huey/models/manifest.json with names, paths, SHA-256

  • Verify: checksum pass on launch

• OCT31-22 — Separate Spark and Zap processes with distinct logs

  • Log files: ~/huey/logs/spark-*.log, ~/huey/logs/zap-*.log

  • Verify: both emit heartbeat lines on start

• OCT31-30 — SSH keys-only enforced

  • /etc/ssh/sshd_config.d/000-huey.conf: PasswordAuthentication no

  • Verify: password login fails; key login passes

• OCT31-31 — VNC bound to localhost + SSH tunnel

  • VNC server: 127.0.0.1:1995, security None (tunnel only)

  • Verify: remote connections only succeed via SSH port-forward

• OCT31-32 — Storage Hub RAID and NVMe notes updated

  • Document layout; scrub cadence; clear stale MD superblocks where needed

  • Verify: mdadm --detail or zpool status clean (if used)

• OCT31-40 — Export wiki artifacts

  • ZIP, single-file MD, single-file TXT from current wiki

  • Verify: links resolve; Mermaid diagrams render on GitHub

flowchart TD
 P["Preflight complete"]
 S["System updated (Kernel and Python)"]
 M["Memory schema v2 and snapshots live"]
 A["Agents online (Spark and Zap)"]
 O["Ops hardened (SSH and VNC)"]
 D["Docs exported"]
 P --> S --> M --> A --> O --> D

Kernel

uname -r | grep 6.17
journalctl -b | sed -n '1,120p' | grep -i amdgpu | head

Python / venv

~/huey/.venv/bin/python -V
~/huey/.venv/bin/python -c "import sqlite3,sys; print(sys.version); sqlite3.connect(':memory:').execute('select 1')"

Memory

sqlite3 ~/huey/mem/sqlite/huey.db 'pragma integrity_check;'
test -f ~/huey/mem/logs/$(date +%F).log || touch ~/huey/mem/logs/$(date +%F).log

Vulkan

vulkaninfo 2>/dev/null | grep -E 'GPU|driver' | head -n 5

SSH / VNC

• Attempt password login (expect failure)

• Tunnel and connect VNC to 127.0.0.1:1995 (expect success)

• Kernel: Select previous entry in GRUB (Advanced options) → confirm uname -r back to known-good.

• Python: Point venv back to system Python (python3 -m venv --upgrade ~/huey/.venv) and reinstall pins.

• Forky pathfinders: Disable the forky.sources file or raise Trixie pins to supersede.

• Memory v2: Repoint to pre-migration DB snapshot and restore from SNAP/SHA256SUMS.txt verified tree.

• Agents: Stop services, clear new logs, restart with previous configs.

• All OCT31- tasks checked and verified

• Last boot uses 6.17.x-huey, amdgpu early KMS confirmed

• ~/huey/.venv on Python 3.14.x

• Memory schema v2 in place; snapshots scheduled and present

• Spark and Zap processes running with distinct logs

• SSH keys-only confirmed; VNC locked to localhost and usable over tunnel

• Wiki exported; diagrams render on GitHub; no broken links

# ~/.config/systemd/user/huey.service
[Unit]
Description=HueyOS Orchestrator
After=default.target
[Service]
Type=simple
Environment=HUEY_CONFIG=%h/huey/config/huey.toml
ExecStart=%h/huey/bin/huey-run
Restart=on-failure
RestartSec=2
[Install]
WantedBy=default.target

version: 1
clauses:
 - id: CL-0001
 title: "Safety: Hard E-Stop"
 text: "Any subsystem may request an immediate hard stop; override requires physical interlock."
 sha256: "<fill>"
 - id: CL-0100
 title: "Memory Integrity"
 text: "Decisions must record inputs, outputs, and content digests; logs are append-only."
 sha256: "<fill>"

End of plan.