Phase 8 — Coordinated OS Patching

Date: 2026-06-23 Status: Live (pass-1) — see 2026-06-23 check-in.

Context

The homelab monorepo was originally motivated by aligning Linux patching to a single command-and-control host. Phases 0–7R built inventory, ansible-pull, monitoring, backups, and network — but never implemented coordinated OS updates.

What shipped in repo

• Phase 8 added to PLAN.md (former Phase 8–10 renumbered to 9–11)
• roles/patching/ + roles/patch-controller/ + playbooks/patch.yml
• Inventory groups: patch_controller, patching_targets, patching_wave0|1|2
• Weekly homelab-patch-orchestrate.timer on infra-services
• Pass-1 observability: orchestrator metrics, Discord rich embeds, ntfy critical, Prometheus/Alertmanager alerts, Grafana dashboard, ansible_pull.prom fix
• ARA client on ansible-pull hosts (ara_default, ara-callback.env)
• Docs: architecture/patching.md, runbooks/coordinated-os-patching.md

Live deploy (2026-06-23)

1. Converged infra-services, saltierpoop, prox (ansible-pull + ARA)
2. Live patch orchestrator run — all three waves green
3. Notification test matrix — Discord + ntfy live probes pass
4. ARA UI shows site.yml, patch.yml, and smoke runs

Wave order

saltierpoop → prox → infra-services (C&C last).