[ops] 第一次纸面重建演练(hub):8 步里 5 步覆盖、2 步已标 NOT COVERED、1 步是新发现的缺口(bun 怎么装没写)

[vansin]

第一次纸面重建演练(hub 链)

AGENTS.md §19 与 owner 定的判据是「任一服务器被删库,单凭 GitHub 就要能复现在跑的系统」。
deploy/hub/README.md 目前的自评是「已知正确的操作手册,不是已验证的灾难恢复方案」。

本条是第一次按纸面走一遍:只看仓,写出从空机到 hub 可服务的每一步,
写不出来的那一步就是缺口。没有真起机器,所以这是纸面演练不是实机演练。

逐步核对

步骤	仓里是否给全	依据
1. OS / node / npm	⬜ 未覆盖(合理省略)	通用前置
2. bun	🔴 缺口	见下
3. 固化安装目录 + npm install	✅ 覆盖	README 给了 mkdir + 钉版本的 package.json + npm install
4. 安装 hub-daemon.sh	✅ 覆盖	install -m 700 deploy/hub/hub-daemon.sh …,并要求 git hash-object 比对
5. PM2 进程定义	✅ 覆盖	pm2 start deploy/hub/ecosystem.config.cjs --only commhub-hub + pm2 save
6. hub.env / ANET_HUB_SECRET_VAULT_KEY	⬜ 明确标注 NOT COVERED	README 写明「补齐前不得宣称数据恢复闭环」
7. 反代 / 隧道	✅ 模板在仓	deploy/tunnel/caddy.example、frpc.example.toml
8. 数据(SQLite)	⬜ 明确标注来自备份	README 已说明

🔴 唯一新发现的缺口:bun 怎么来,仓里没写

hub-daemon.sh 对 bun 是硬依赖,解析器本身写得很好:

_resolve_bun() {           # BUN_BIN → ~/.nvm/…/v20.20.0/bin/bun → PATH → 扫任意 nvm 版本
  …
}
[ -x "$BUN_BIN" ] || fail_slow "找不到 bun:$BUN_BIN"

注释也点明了脆弱性(升级 node 会让这个路径失效),并且是 fail-closed,不会静默起不来。

但整份 runbook 没有任何一步说 bun 该怎么装。
grep -i bun deploy/hub/README.md 的命中全是「用 bun 跑某某命令」,没有安装步骤。

空机照仓走会停在 找不到 bun:,而手册在这一步没有下一句。

顺带:脚本注释里写了 「bun 是通过 nvm 下的 npm 装的」 —— 这其实就是安装方法,
只是它躺在注释里,不在步骤里。

建议(小,但正好补上链条最后一环)

在 deploy/hub/README.md 的「空机安装」一节里加一步,并说清与路径的关系:

# bun 必须装在 nvm 的当前 node 下,否则 hub-daemon.sh 的 nvm 路径解析会失效
npm i -g bun          # 或 https://bun.sh/docs/installation
command -v bun        # 记下来:换 node 版本后要重装

⚠️ 不要写 curl … | bash 一行流 —— 那是 #729/#733/#743 一整条线在修的 fail-open 形状。

这次演练没有验证的部分(不要据此宣称可恢复)

• 没有真起过空机;
• 第 6 步(vault key)仍是断链 —— 只要它没解决,「仅凭 repo 恢复」在数据面就不成立;
• 第 8 步(数据)同上。

所以 deploy/hub/README.md 那句自评现在仍然准确,本条只是把缺口从「未知」变成「已列出」。

[vansin]

Follow-up after #779 merged: the recovery step is now present, but its unpinned npm i -g bun does not satisfy the empty-host reproducibility requirement because it resolves a future latest release. Draft PR #781 pins the currently deployed Bun 1.3.14, verifies the resolved binary reports that exact version, and corrects the runbook wording to match hub-daemon.sh (PATH or explicit BUN_BIN; nvm is the current layout, not the only supported layout). Scope is docs-only and does not mutate production. Keep this issue open until #781 receives independent review and lands.

[vansin]

Resolved by #779 plus the corrective #781 (merged as 19044c56). The Hub recovery runbook now includes a pinned Bun 1.3.14 install, resolves the executable through PATH, and fails closed if the installed version differs; it also accurately documents explicit BUN_BIN as an alternative to the current nvm layout. Independent review: #781 (comment)

Closing this issue means the new Bun-step gap found by this paper exercise is fixed. It does not upgrade the runbook to a proven disaster-recovery claim: the issue body’s existing limits remain true—no fresh-host rehearsal was performed, the vault/data restoration inputs still come from their documented external sources/backups, and the README must keep its NOT COVERED boundary until those are independently exercised.