Extends the checkin/apply cycle to cover the "auftraege" list from the
check-in response (see ADR-0010) alongside the existing workspace
blueprints: both are merged into one ansible-pull invocation, with
--tags the union of all involved roles (a catalog role needs to run
even when its target state is absent, so its removal branch executes)
and a new --extra-vars payload (tuxflotte_auftrag_states, role ->
present/absent) that ansible-content's site.yml threads down into each
role.
After the pull, reports the outcome of each Auftragskatalog entry back
via the new POST /api/v1/agent/report endpoint (applied/apply_failed/
removed/remove_failed). This is intentionally coarse: ansible-pull has
one exit code for the whole run, not per-role results, so all entries
in a given run share that outcome. Workspace blueprints are not
reported on, matching ADR-0010's scope.
Verified end to end against anode and the QEMU test VM: selecting
browser-brave as a catalog entry produced an "applied" event and the
marker file; deselecting it removed the marker and produced a
"removed" event - both written by the agent's own report call, not
simulated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Erste lauffaehige Version: laedt Credentials, meldet sich per Bearer-Token
bei anode/api/v1/agent/checkin, wendet zugewiesene Blueprints per
ansible-pull an und schlaeft bis zum naechsten Intervall.
