AGENTS.md@talos git:20260820.1a6373eA

Immutable. This exact content never changes and is served at /api/v1/blob/36a3950cd6a36340.

# Talos Guidance

- Read [the README](README.md) for the layer model and the recipe list before changing machine
  configuration, and the Talos entries in [learned workspace facts](../.agents/learned-workspace.md).
- **Always** run `just talos diff-node <node> <ip>` against every node and confirm each reports
  `No changes.` before applying anything. A config that merely validates is not evidence; the
  dry-run diff against the running node is.
- Ask before applying configuration or upgrading a live node.
- Machine configs are **never** applied automatically. Nothing in Flux, CI or tuppr pushes them;
  merging a change to `talos/` only changes what `render-config` produces.
- A node rejects the whole config if it contains a document its version does not know, so during
  any mixed-version window a new document in `cluster.yaml.j2` breaks `diff-node` fleet-wide.
- `control-1` is the TrueNAS VM and the only dGPU host. Upgrade it last, and never taint it or
  GPU workloads have nowhere to schedule.