ax on Agent Substrate across the fleet: one switch

[mecattaf]

Tom's ruling (2026-09-23, verbatim)

this is a dotfiles task to do on my nixos fleet. the decisions there were already made: hypervisor on NAS, agent harnesses on coordinator, halogen inference mainly on worker (can also run on coordinator if we need redundancy or a second parallel halogen task). i am certain that this can be knocked down in one issue>pr>nixos switch motion.

Placement

• nas: k3s server, Agent Substrate (server at upstream d277088b), Postgres, RustFS object store, registry, Redis, ax-server and ax-controller.
• coordinator: a k3s agent with the gVisor worker pool, where ax Tasks with coding agents land.
• worker: Halogen at :8731, reached from sandboxes through the NAS egress gateway. The worker is not a cluster node in this motion.

Acceptance (post-switch)

• kubectl get nodes shows nas and coordinator Ready.
• Substrate is healthy.
• An ax Task placed on the coordinator runs in gVisor (/proc/version shows 4.19.0-gvisor), reaches Halogen, and completes.
• Four Tasks on the 2-worker pool never hit ResourceExhausted.
• Rollback returns the coordinator to its prior generation with tailnet, Caddy, herdr and Halogen unaffected.

Evidence and design: ~/today/evals-2026-09-23/ax-fleet/ (DESIGN.md, INTEGRATE.md, REVIEW-LOG.md) and ~/today/evals-2026-09-23/substrate/.

🤖 Generated with Claude Code

[mecattaf]

Status (overnight run 09-23): the fleet stack is on main. #467 (ax/fleet-zero, zero ax patches, egress fail-open closed without an ax patch, substrate-link vendored with gate OFF) merged as e1a8a1db; #464 closed as superseded. 4-VM checks.ax-fleet 58/58 on 40a2ec87, same drvPath on the merged head (MEASURED). No host switched yet; ax-fleet-smoke still needs the floor-report shape before the switch verify block relies on it. Left open until the switch.

[mecattaf]

Closing per 06-SHEET-DOTFILES-NAS.md §C: ax is parked (ruling B1/C10/F2-1, 07-RULINGS-SHEET.md); unused k3s volumes torn down, tracked in the new device-cleanup issue.