From 4de1457eaa167ad319f13076aa8398ac85b4f697 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Wed, 2 Sep 2026 20:23:38 -0500
Subject: [PATCH] docs(agents): dhcpd AppArmor /etc/dhcp path constraint field
 lesson [#728]

---
 AGENTS.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 6b92641..806be5e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -301,6 +301,10 @@ Hard-won operational gotchas. One line each; keep them short and load-bearing.
   Pi-holes; use `tailscale status` peer IPs + the chokepoint env overrides
   (NETINFRA01_HOST/NETINFRA02_HOST, VM_IP) to reach hosts by Tailscale
   while names are unresolvable. Fix one node, verify, then the other.
+- **dhcpd + AppArmor:** on the netinfra pair, dhcpd can only read configs
+  under `/etc/dhcp/**` — staging a candidate config in /tmp fails dhcpd -t
+  with "Permission denied" even as root. Stage as /etc/dhcp/*.candidate,
+  test, then move into place.
 
 ## Questions (NON-NEGOTIABLE)