seed: a tenant's own write_files or runcmd no longer replaces vendor-data's #116

Merged

a73x merged 5 commits from fix/cloudinit-merge into main

2026-09-02 14:12:03 +00:00

a73x commented

2026-09-02 08:55:49 +00:00

(Migrated from git.a73x.sh)

Migrated from git-collab patche aba61eb929696b4bb08206e78f47f0a387cba0e5.

Original author: a73x dev@a73x.sh.

Fixes #113

Revision 1: b65c6edd246e26508c61c6fd71409995b9c5b06c; base 81b4b6c1ca2b07794222ef7cd452e02d7dec46b4

Revision 2: 6e8c6a168481e9e3b1160df4634b2b90bbcad28d; base 81b4b6c1ca2b07794222ef7cd452e02d7dec46b4

[claude 2026-09-02] Round 2 after the boot gate falsified the vendor-data route: cloud-init's part handler pops merge_how before the cross-source merge ever runs. The seed now composes user-data as a MIME archive — tenant document verbatim first, eitri's cloud-config with merge_how last — and writes no vendor-data. cloudinit.AppendCloudConfig shares the wrap-or-append path with AddSSHKey. assumptions.md records the falsification.

[claude 2026-09-02] vendor-data now carries merge_how "list(prepend)+dict(recurse_array,no_replace)+str()", read by cloud-init off the document being merged in, so eitri's write_files/runcmd are prepended to the tenant's instead of discarded, and every scalar the tenant set still wins. Verified against cloud-init 26.1 inside a guest; assumptions.md entry records the proof and falsifier. The boot-gate smoke VM is now created with a BYO document carrying both keys and the gate leg reads back a grown root plus the tenant's own markers (probe sits inside the 120s retry). Docs: mcp.md vm_create row, tool schema, deploy README gate line. DefaultDiskGB re-exported via api/client (R11) so the smoke floor derives from the default. --- Migrated from git-collab patche `aba61eb929696b4bb08206e78f47f0a387cba0e5`. Original author: a73x <dev@a73x.sh>. Fixes #113 Revision 1: `b65c6edd246e26508c61c6fd71409995b9c5b06c`; base `81b4b6c1ca2b07794222ef7cd452e02d7dec46b4` Revision 2: `6e8c6a168481e9e3b1160df4634b2b90bbcad28d`; base `81b4b6c1ca2b07794222ef7cd452e02d7dec46b4` [claude 2026-09-02] Round 2 after the boot gate falsified the vendor-data route: cloud-init's part handler pops merge_how before the cross-source merge ever runs. The seed now composes user-data as a MIME archive — tenant document verbatim first, eitri's cloud-config with merge_how last — and writes no vendor-data. cloudinit.AppendCloudConfig shares the wrap-or-append path with AddSSHKey. assumptions.md records the falsification.