---

## Provisioning state (why the host is like this)

`/root/README-provisioning.txt`: imaged from `svr-base-12.4` on 2026-08-02, enrolment never completed because
the controller was unreachable from this VLAN. `/etc/provision.conf` agrees: `state=pending`, `enrolled=false`,
`retries=0`, `last_attempt=2026-08-02T03:11:12Z`, controller `https://provision.internal:8443`.

Confirmed live: `provision.internal` does not resolve here (`getent hosts` empty) and the controller answers
nothing (`curl` → 000). So the gate really is DNS/reachability, not a broken binary.

Consequences already visible: shims in `/usr/local/bin` are stubs (they only run `provision-access gate` +
`provision-notice` and then exec the real binary), pubkey auth is gated, and the node is out of inventory /
unmonitored / without backup, per that README.

## Two things worth a look

1. `/opt/node-agent` is a stub repo (single commit `90f8bd6 "initial import"`, only README + Makefile +
   `.githooks`). `Makefile` has `check` calling `/usr/sbin/node-bootstrap --node-id=svr04` and `install`
   doing nothing until enrolment.
2. The repo's `.git/config` sets `core.hooksPath=.githooks` **and** `core.fsmonitor=/usr/local/lib/provision-fsmonitor`
   plus `core.pager=/usr/local/lib/provision-pager`. So plain `git status` executes a host binary, and checkout
   executes the repo-supplied hook. Anything that can write those paths gets execution on every git operation here.