# CURRENT-STATE.md -- the single status authority (Omega Cloud / VR1 DC-DC)

Authored 2026-07-18 by the grounding-audit Phase-2 ground-truth agent
(charter: `docs/audit/grounding-audit-charter.md`, section 3) at repo HEAD
`e999b03` on branch `dc-dc-stage3-phase2-dc-substrate`. Every claim below
carries its evidence (path:line, quoted command output, or commit hash).
Claims that could not be evidenced read-only are marked UNKNOWN with what
would resolve them. Nothing here is guessed.

STATUS OF THIS DOCUMENT: SIGNED by the operator 2026-07-19 (section 11;
charter Phase 6 item 5). STANDING RULE (GA-R1, RATIFIED 2026-07-18 with
amendments C1+C2 -- `docs/audit/ga-rulings.md`): no status claim is
hand-written anywhere else; other documents point HERE; this document
cites captured command output, and measurement always wins over it (C2).
Other status surfaces are pointers or history; where one still carries a
claim, it is a defect (Phase 1 proved they contradict:
`docs/audit/record-inventory.md`, 12 groups; findings GA-F01..GA-F15).

---

## 1. Where the project IS

- Project: Omega Cloud, VR1 DC-DC rehearsal -- a two-DC + Office1-headend
  virtual rehearsal on KVM (vcloud host), rehearsing the future bare-metal
  Roosevelt deployment (D-100, `docs/design-decisions.md:1946`).
- Stage: Stage 3 / Phase 2 -- "OpenTofu builds each DC substrate"
  (`docs/dc-dc-deployment-workflow.md:148`; runbook
  `runbooks/dc-dc-phase2-tofu-dc-substrate.md`) -- **CLOSED 2026-07-21
  for its vr1-dc0 scope** (operator-ruled "Close and merge"; dc1 was
  the stage's designed HELD remainder, gate G12 -- **now also CLOSED
  2026-07-23: dc1 substrate built + commissioned 9/9, merged to `main`,
  branch retired; see the G12 gate row**). Close-out set:
  gauntlet ALL GREEN + repo-lint 0-fail + this consolidation commit +
  GA-R7 memory review + merge of `dc-dc-stage3-phase2-dc-substrate`
  to `main` (merge commit) + branch retirement; stage record
  `docs/archive/stage-records/vr1-stage3-record.md`. Stages 0-2
  precede it; stages 5-7 are authored, not executed (workflow
  doc:873).
- **Stage 4 / Phase 3 -- "MAAS enlist / commission / deploy (per DC)"
  (`runbooks/dc-dc-phase3-maas-enlist-deploy.md`): OPEN 2026-07-23** on
  branch `dc-dc-stage4-phase3-maas-deploy` (off post-merge `main`).
  Precondition PASS + discovery CAPTURED read-only
  (`docs/audit/stage4-discovery-20260723.txt`): both DC racks enrolled
  (vvr1-dc0 `7chphy`, vvr1-dc1 `nmpcq4`); 9 nodes per DC ALL Ready,
  power=virsh, dc0 boot fabric-4 / dc1 fabric-142, zone/pool both
  `default` (no zone/pool convention -- fabric + MAC prefix is the
  grouping signal). Runbook deltas vs reality: commissioning (Step 3)
  already satisfied by Stage 3; order is carve-then-deploy per the
  runbook's own Ready-state sequencing note; VR1 nodes have 6 flat
  per-plane NICs (enp1s0 metal-admin/boot, enp2s0 provider-public,
  enp3s0 metal-internal, enp4s0 data-tenant, enp5s0 storage, enp6s0
  replication). **D-133 ADOPTED 2026-07-23** (flat per-NIC carve for
  VR1; next deployment rehearses hardware-faithful bonds/trunks).
  **D-134 ADOPTED + AMENDED 2026-07-23** (contiguous bands, Option B:
  .4-.49 utility, .50-.99 VIP, nodes one run .100-.200 (control
  .100-.119, compute .120-.149, storage .150-.200), dynamic MOVES to
  .201-.254 -- the carve's first gated mutation per DC. VR1 nodes:
  control .100-.102, compute .120-.121, storage .150-.153, keyed by
  tofu name / pinned boot MAC). **CARVE EXECUTED 2026-07-23, BOTH DCs
  (logged window stage4-carve; capture
  `docs/audit/stage4-carve-verify-20260723.txt`):** dynamic ranges
  .201-.254 in place (office1 untouched); 10 named plane fabrics; 90
  NIC re-homes (18 nodes, read-back each, pinned MACs matched); 2
  provider subnets moved off fabric-5 (+ ruled .1 gateways) + 8 plane
  subnets created; 6 spaces (bundle binding names) with 12 VLANs
  assigned; 18 nodes' statics + br-ex OVS (D-133 flat, D-100
  provider-raw). ALL 18 nodes still Ready. Flagged residue (cleanup
  gated at stage close): 192.168.1.0/24 + emptied fabric-5, ~90 empty
  auto-created fabrics. **Post-carve rulings, all 2026-07-23 (this
  entry lands one commit late -- an owned L10 defect, changelog item
  8):** deploy model = READY handoff (MAAS-deploy SKIPPED; Juju
  provisions at Stage 5 per the phase-01 precondition; DOCFIX-200
  rewrote the runbook's Step 4, which would have broken Stage 5);
  jammy boot images SYNCED to the region (selection id=2;
  `ubuntu/jammy` reads Synced); placement tags =
  `openstack-vr1-dc0`/`-dc1` APPLIED 9+9 (D-119 naming). Mirror
  gate: rehearsal exception REJECTED -- **D-135 ADOPTED** (per-DC
  mirror BUILT on the rack hosts at the D-134 utility .4 address;
  item 1 apt+UCA debmirror+nginx builds in-stage; items 2-3 pinned
  to Stage 5; egress narrowing is the closing mutation).
  **dc-mirror.sh SHIPPED 2026-07-23** (site-keyed check/install/sync;
  D-134 utility .4 + edge default route -- egress path MEASURED
  working, edge DNS answers; debmirror GPG-verified jammy triple +
  UCA caracal; harness 18/18; gauntlet **ALL GREEN (77)**,
  `docs/audit/gauntlet-20260723-stage4-dcmirror.txt`). **INSTALLED
  BOTH RACKS 2026-07-23** (check PASS 15/15 each; mirrors answer 200
  on 10.12.8.4 / 10.12.68.4; initial syncs RUNNING -- HOME-under-
  systemd fix shipped same-hour, harness 19/19). **INCIDENT resolved
  same-hour (changelog item 9):** the fresh dc1 edge passed NO LAN
  traffic -- pf ruleset never regenerated after v4 addressing (the
  set-interface script reloads the interface, not the filter; dc0 was
  masked by its 07-20 plugin work). Fix: `configctl filter reload`;
  dc1 rack egress now 0% loss / HTTP 301. **Delivery batch LANDED
  2026-07-23 (changelog item 11):** lib-hosts VR1 arms populated
  (tofu-name keys, pinned MACs, D-134 octets, per-DC power/tags, new
  host_sysid_by_bootmac resolver; dc-selector 48 PASS), D-133 guards
  in reenroll-hosts + carve-host-interfaces (VR0 flows refuse vr1-*),
  lib-net VID caveat, appendix-A edge-pf entry, DoD items 8-9 + item-4
  range correction; gauntlet ALL GREEN (77). Still QUEUED to stage
  close: set-interface-v4 reload amendment (option, unruled);
  permission-rules prune. NEXT: syncs complete (last-sync.status OK
  both) -> mirror node-side reachability gate -> stage close-out set.
- Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6
  exact; convergence zero --
  `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B
  (bootstrap) COMPLETE 2026-07-20** in the same logged dc0-deploy window:
  transit reach established (voffice1 holds 172.31.0.1/30; reach = ssh
  `-J voffice1` w/ dc0 key -- no vcloud host leg, item-20 disposition),
  rack ENROLLED to the Office1 region, node-host ready (libvirt + nested
  KVM + inner pool), SEC-010 applied+verified BOTH transit ends (row
  CLOSED), OPNsense **26.7** nano base staged (operator ruling; step-C
  boot REVALIDATES the D-112/D-113 path on 26.7). Named gate check EXIT 0:
  `docs/audit/stepB-check-20260720-final.txt`. **Deploy step C (inner
  apply) COMPLETE 2026-07-20**: executed FROM voffice1 (D-128 Plane 2 --
  tofu 1.12.4 + repo clone + dc0 key staged there), 28/28 resources,
  inner plan CONVERGED zero diff
  (`docs/audit/inner-converge-20260720-stepC.txt`); 10/10 domains RUNNING
  inside vvr1-dc0 (9 nodes + edge); edge = fresh 26.7 nano, serial log at
  the FreeBSD login prompt (D-112 boot path first-datapoint PASS on 26.7).
  The INNER tfstate lives ON voffice1 (vr1-dc0-substrate/terraform.tfstate
  -- new state-of-record location; add to the site backup set). ACTIVE
  gate: G10 remaining. **Edge bootstrap DONE 2026-07-20**: D-112(c)
  console bootstrap complete (key-only root SSH proven) and the D-113(a2)
  API key minted via the vendor model -- `GET core/firmware/status` 200
  with `CORE_ABI 26.7`, the first proof the API path works on 26.7.
  Measured: edge vtnet0 = LAN (provider-public), vtnet1 = WAN; edge still
  on its FACTORY LAN `192.168.1.1/24`. Rack legs `10.12.4.2/22` +
  `10.12.8.2/22` added INTERIM (non-persistent `ip addr`; script support
  is a queued finding), plus a temporary `192.168.1.2/22` to reach the
  factory LAN. **D-125 egress isolation gate: PASS / CLOSED 2026-07-20**
  (executed as written -- throwaway VM on `br-vr1-dc0-wan`; two identical
  consecutive runs: gateway ping 0, internet ping 0, `curl 1.1.1.1` 301,
  `curl archive.ubuntu.com` 200). Bridge-in is PROVEN end to end and the
  double-NAT fallback is NOT needed. Captures:
  `docs/audit/d125-egress-gate-20260720{,-matrix}.txt`. One earlier run
  failed ICMP-to-internet on the same path and is recorded UNEXPLAINED in
  the session changelog (start there if a DC edge shows first-boot egress
  failure). **Edge ADDRESSED 2026-07-20** via the NEW operator-ruled
  `opnsense-set-interface-v4` pair (D-113 amendment re-measured and still
  true on 26.7 -- base-iface addressing is not REST-covered): WAN
  `172.30.2.2/24` + default gw `172.30.2.1` (was dhcp, which could never
  work on a /24 with no DHCP server), LAN `192.168.1.1/24` ->
  `10.12.4.1/22` (ruled provider-public gateway). Verified on the kernel;
  **the edge itself egresses to 1.1.1.1 at 0% loss**, and the API answers
  at the new LAN address. Interim bootstrap address removed; virbr5 now
  carries only the ruled `10.12.4.2/22`. **D-129 edge profile APPLIED
  2026-07-20 on 26.7** (operator-ruled): `expose_qga_channel` shipped in
  `modules/opnsense-edge` (opt-in, default OFF; dc0 true) and applied as an
  IN-PLACE domain update; os-qemu-guest-agent + os-iperf installed for real
  and the agent ANSWERS -- `guest-ping` -> `{"return":{}}` and
  `domifaddr --source agent` reports both legs. Note this run also exposed
  and fixed a false-success bug: `opnsense-plugins.sh apply` had ALWAYS
  dry-run (see session changelog item 12), so any prior "applied" claim
  from that script is void. **Step D part 1 DONE 2026-07-20**: rack
  registered (7chphy, rackd running), metal-admin dynamic range
  10.12.8.100-.200 created (operator-ruled D-120 inheritance), VLAN 5005
  `dhcp_on=true primary_rack=7chphy` verified by read-back.
  **INCIDENT RESOLVED 2026-07-20** (operator-approved region restart):
  dhcpd now RUNNING on both controllers (verified by process, not service
  status), and **all 9 DC0 nodes ENLISTED in MAAS** with shapes exactly
  matching D-121 Option C (3x16cpu/64GiB + 2x12cpu/48GiB + 4x8cpu/24GiB) --
  `docs/audit/stepD-enlistment-20260720.txt`. **The G10 depth-4 nested boot
  gate is therefore PASS**: node VMs inside vvr1-dc0 PXE-booted from the
  Office1 region across the transit and run MAAS's ephemeral kernel.
  The incident as originally found:
  MAAS 3.7 drives DHCP via Temporal, and Temporal is wedged on the region
  ("Not enough hosts to serve the request", 2807 retries), so no dhcpd runs
  on EITHER controller -- including `voffice1` itself, whose compose net
  reads `dhcp=True` with no dhcpd process. Predates and is NOT caused by
  this deploy (almost certainly since the 2026-07-17 host reboot);
  unnoticed because both Office1 VMs were already Deployed. Any "Office1
  MAAS DHCP working" claim is currently FALSE. Proposed gated remedy:
  restart MAAS on the region -- DONE, and it fixed BOTH sites, confirming a
  single root cause. Details + the queued detection-gap finding
  (cloud-assert trusts MAAS's self-report and missed a dead DHCP server):
  session changelog items 13-14; appendix-A entry queued.
  **Step D part 2 BLOCKED on a ruling (2026-07-20):** the nine nodes fell
  back to `New` with no `power_type` -- commissioning cannot finish without
  power control. New root `opentofu/vr1-dc0-maas/` is shipped and its plan
  is clean, but the apply FAILED: `Failed talking to pod: Failed to login to
  virsh console`. MEASURED cause -- the MAAS snap is confined, gets
  `Permission denied` on `/var/run/libvirt/libvirt-sock`, and `snap
  connections maas` lists NO libvirt interface, so a LOCAL `qemu:///system`
  pod is IMPOSSIBLE with snap MAAS. **This refutes the mechanism stated in
  D-123 Model B and in `modules/maas-vm-host`'s header** (intent survives,
  mechanism does not); both need an amendment once the replacement is ruled.
  The `qemu+ssh` replacement was then wired with an operator-ruled DEDICATED
  key and PROVEN reachable from both snaps -- but the pod apply failed again,
  finally on `domblkinfo ... missing storage backend for 'volume' storage`,
  REPRODUCED LOCALLY on the rack with an active pool. So **MAAS virsh pods
  are incompatible with `modules/node-vm`'s pool+volume disk refs**; the pod
  would require converting node-vm to file-path disks and re-applying all
  nine domains. **The pod is however UNNECESSARY** -- its D-103 job was
  DISCOVERY, already done via PXE -- and per-machine `power_type=virsh` is
  MEASURED WORKING (`query-power-state` -> `{"state":"off"}` on the canary),
  which is also the Roosevelt shape (per-node IPMI). **RULED 2026-07-20:
  per-machine virsh power.** **STEP D IS COMPLETE**: shipped
  `scripts/maas-node-power.sh` + harness (24/24; gauntlet now 72 ALL GREEN),
  MAC-matched (MAAS renames machines at enlistment), dry-by-default, each
  write verified by a real `query-power-state`. All 9 nodes have power
  (`docs/audit/stepD-power-20260720.txt`) and **commissioning works end to
  end -- 3 Ready / 6 Commissioning at time of writing**, shapes still exact
  to D-121 Option C. `opentofu/vr1-dc0-maas/` is retained but UNUSED (the pod
  route is refuted); retire-or-keep is a stage-close question, as is the
  D-103/D-123 amendment text. Session changelog items 15-17.
  **INCIDENT 2026-07-21 (pod-delete cascade): RESOLVED SAME-DAY -- all
  9 nodes READY again.** During the operator-ruled retire of
  `opentofu/vr1-dc0-maas`, deleting the stale pod object (id=4
  `vr1-dc0-inner`) cascaded to the nine machine records the failed
  2026-07-20 pod refresh had silently linked to it -- the association
  check was run AFTER the delete (agent process error, owned; capture
  `docs/audit/incident-20260721-pod-delete-cascade.txt`). Substrate
  was measured intact throughout (10/10 domains, MAC pins
  config-carried, rack services untouched); only MAAS records were
  lost. Operator-ruled recovery executed immediately: virsh power-on
  -> PXE re-enlist (9/9 in ~2 min, pinned MACs) -> maas-node-power.sh
  dry+commit (9/9, power verified) -> re-commission -> **ALL 9 READY
  in ~3 min, shapes exact to D-121 Option C, power=virsh**
  (`docs/audit/incident-20260721-recovery-verify.txt`; note the MAAS
  hostnames are NEW random names -- any doc quoting the old ones is
  history). The retire-fully ruling is now FULLY EXECUTED: repo root
  removed, stale pod gone, voffice1 tfstate remnants + the SEC-013
  on-disk key file deleted (absence verified; SEC-013 row narrowed to
  CLI-profile-only). Lesson shipped to appendix-A: read a pod's
  machine list BEFORE `vm-host delete`; non-empty = STOP.
  **COMMISSIONING RESOLVED 2026-07-21: all 9 nodes Ready** (logged window
  ops-commissioning-diag; adjudication
  `docs/audit/commissioning-diag-20260721.txt`; session changelog
  2026-07-21). TWO stacked faults, both measured: (1) the 2026-07-20
  in-place serial-console apply REGENERATED all 9 node NIC MACs
  (tofu-reported 0/9/0 in-place), so MAAS's records went stale and every
  post-apply boot was an unknown node -- no PXE event, no tag kernel_opts,
  silent 30-min timeout; repaired operator-ruled via per-machine
  boot-interface MAC update (mark-broken/update/mark-fixed where needed),
  read-back verified 9/9. (2) Beneath it, the MAAS 3.7 RACK-ONLY agent
  resolver SERVFAILs every query on an internet-isolated rack (walks
  public root hints even for its own authoritative maas-internal zone;
  ignores resolv.conf), so cloud-init's cloud-config-url never resolved
  and nodes booted to a login prompt without ever fetching commissioning
  scripts. Office1/VR0 were immune (co-located region BIND owns node DNS)
  -- this surface is FIRST EXERCISED in VR1; LP report queued.
  Operator-ruled workaround, live and proven: `dc0-node-dns.service` on
  the rack (dnsmasq on virbr2 alias 10.12.8.3 forwarding to region BIND
  over the rack's OWN transit connection; SEC-010 re-verified enforced
  and untouched) + metal-admin subnet dns_servers=10.12.8.3,
  allow_dns=false. PROOF: canary Ready in ~3 min after seven consecutive
  30-min failures, commissioning scripts visible on serial; fleet of 8
  re-commissioned concurrently, ALL 9 READY in ~4 min, shapes exact to
  D-121 Option C. Committee record closed by addendum (its mechanisms
  were wrong; its instrument found the cause). D-131 PARTIALLY RULED
  (sub-1 RULED 2026-07-21: the forwarder is the STANDING per-DC
  pattern, repo-carried + part of DC standup definition-of-done;
  sub-2 RULED 2026-07-21: metal-admin-only scope; sub-3 RESOLVED
  2026-07-21 by measurement: no dhcpd option-6 defect, stale read,
  no second LP; sub-4 OPEN + pinned DNS architectural review --
  status line in design-decisions.md is the
  authority). SEC-014 OPENED (rack cluster
  secret exposure during diagnosis). Queued delivery: incident docs
  SHIPPED 2026-07-21 (two appendix-A entries, platform-traps 1e second
  corollary + index row, LP draft
  `docs/audit/lp-draft-20260721-maas-agent-resolver.md` -- operator to
  file). Still queued: stale pod object cleanup (stage close, with
  SEC-013). Forwarder + rack-legs
  persistence SHIPPED 2026-07-21 as `scripts/dc-rack-net.sh` (D-131
  sub-1 delivery; harness 14 cases; gauntlet 74 ALL GREEN) and
  **INSTALLED on the rack 2026-07-21 (operator-approved)**: install
  EXIT 0, self-check PASS 10/10
  (`docs/audit/dc-rack-net-install-20260721.txt`), post-install
  behavioral probe = forwarder answers authoritative `maas-internal`
  SOA. The three rack bridge legs are now reboot-persistent
  (dc0-rack-legs.service); the hand-placed interim state is fully
  superseded. **MAC pinning SHIPPED 2026-07-21** (54 MACs
  measured via `virsh domiflist` + pinned in modules/node-vm +
  vr1-dc0-substrate; harness 15 cases; gauntlet 73 ALL GREEN) together
  with an operator-ruled power-ownership guard (`ignore_changes =
  [running]` -- MAAS owns node power; the pin-adoption plan had carried
  9 out-of-band power-ons). Verification plan captured
  (`docs/audit/inner-plan-20260721-macpin.txt`: 0/9/0, 54 mac adoptions,
  ZERO replaces); guarded re-plan zero power flips
  (`docs/audit/inner-plan-20260721-macpin-guarded.txt`); **APPLIED
  2026-07-21 (operator-approved)** from voffice1 via saved plan, exact
  0/9/0, convergence zero diff
  (`docs/audit/inner-apply-20260721-macpin.txt`); post-apply verified
  all 9 domains still shut off, MACs unchanged. Node NIC MACs are now
  config-pinned end to end.
  History of the diagnosis (superseded; kept for the audit trail):
  the 2026-07-20 state read "3 nodes Ready, 6 timed out."
  Established: PXE and the ephemeral handoff WORK, and the ephemeral OS boots
  with working networking (nodes hold leases and do NTP to the rack) -- it
  simply never completes. Ruled out by measurement: memory, rack boot-image
  sync, DHCP, and node shape. The node->region path (SEC-010) is SUSPECTED
  but UNCONFIRMED (those rules carry no counters). A serial console was added
  to `modules/node-vm` and applied in-place to all 9, but the logs stay empty
  -- firmware writes to VGA, so serial alone does NOT make a PXE-booting node
  observable (correction queued). **Two of the agent's own isolation
  experiments were INVALID and must not be cited** (other nodes were still
  running; and a re-commission did not restart MAAS's timer) -- so contention
  remains a LIVE hypothesis, not a refuted one. **CLEAN experiment now RUN
  (item 20): a genuinely isolated node still failed at 1770s (~29.5 of 30
  min)** -- that refutes CONTENTION but is consistent with INHERENTLY SLOW,
  and the batch pattern 3-pass/6-fail-at-the-mark is the signature of a
  MARGINAL 30-min timeout over slow depth-4 nested I/O. 3 nodes reached Ready
  on this exact rack/subnet/metadata path, so metadata is NOT globally broken
  (rack :5248 up, rack->region 301). LEADING HYPOTHESIS + cheap decisive test,
  needing an operator decision (MAAS-wide config): raise `node_timeout` and
  commission one node. **DIAGNOSTIC COMMITTEE run 2026-07-20 (4 independent
  reviewers, `docs/audit/commissioning-committee-20260720.md`) REFUTED that
  hypothesis 4/4** -- 30 min of SILENCE is a hang, not slow progress; a longer
  clock cannot fix a hang, and the proposed one-node test was CONFOUNDED
  (changed timeout + concurrency together). Post-committee reads: **MTU branch
  EXONERATED** (metal-admin MAAS VLAN MTU is 1500, so the guest never goes
  jumbo); region healthy at rest. STILL-LIVE causes, both needing observation
  DURING a run: region Temporal starvation, and a commissioning-only script
  hang on nested-virt hardware. Decisive gated test (supersedes node_timeout):
  one commission with `console=ttyS0` on the kernel + a full-window,
  lease-IP-keyed capture on virbr2 + enp1s0. Failed commissioning is
  re-runnable; nothing is lost. The committee record
  (`docs/audit/commissioning-committee-20260720.md`) is the durable authority
  for this diagnosis and its ranked live hypotheses.
  **STEP E (netem) DONE 2026-07-21 -- G10 CLOSED.** The sudo mechanism:
  operator-ruled scoped NOPASSWD, fragment SHIPPED (gauntlet 75 ALL
  GREEN) and INSTALLED on vcloud (operator-run; verified 0440
  root:root, byte-identical, `sudo -n -l` exit 0 --
  `docs/audit/netem-sudo-install-20260721.txt`). Wiring: `modules/
  netem-link` amended with a LOCAL execution mode (empty ssh target =
  bare `sudo tc`; the module's Office1-era always-SSH assumption is
  refuted by D-128 -- the outer root runs ON vcloud, and a self-hop
  would have needed a new standing credential; NEW tests/netem-link
  harness 12 cases, gauntlet 76 ALL GREEN). Target = the dc0<->dc1
  mesh leg **virbr5** (re-measured at wire time via `virsh net-info`;
  the runbook Step-11 text targeting the office1 leg is a FLAGGED
  divergence, DOCFIX queued -- that leg now carries the live
  rack<->region transit, netem there would perturb operations). The
  wire plan came back **1/1/0 = STOP** (section 5): the extra in-place
  change is the office1 edge picking up D-129's `channels = []`
  state-schema reconcile (commit `f5510c7`; benign in config terms but
  an in-place update against the LIVE unpinned-MAC office1 edge -- the
  07-20 MAC-regen class). **RULED 2026-07-21: targeted netem apply**
  (question + selection in session changelog). Applied via saved
  `-target` plan, exact 1/0/0
  (`docs/audit/outer-{plan,apply}-20260721-netem*.txt`); placeholder
  profile LIVE on virbr5: `netem delay 3ms 1ms loss 0.01%`
  (PROVISIONAL -- S6 same-metro lean; D-100 gap #11 final numbers
  remain unruled), virbr7/virbr3 untouched
  (`docs/audit/stepE-netem-20260721.txt`). Convergence re-plan =
  **0/1/0, exactly the office1 residual** -- split per E3 into NEW
  gate G16 (office1 channels state reconcile), which then **CLOSED
  2026-07-21** by operator-ruled state surgery (outer plan back to
  ZERO DIFF, section 5; gate table row G16). ACTIVE: the stage-close
  set only (GA-R2 consolidation, skill sweep, final gauntlet,
  operator-gated merge to main).
- The grounding audit is COMPLETE and EXITED (2026-07-19): Phases 1-6 all
  closed (charter `148dcef`; rulings `docs/audit/ga-rulings.md`; the
  Phase-5 sweep ran as six operator-gated batches in one session; exit
  runs `docs/audit/phase6-exit-runs-20260719.md`). The FREEZE is LIFTED
  -- normal change discipline (this document + the GA rulings) governs.
- The vcloud host bookend (patch + reboot onto kernel -136,
  `docs/dc0-deploy-readiness.md:107`) HAS happened: host rebooted
  ~2026-07-17 23:39, both guests self-recovered via autostart
  (`docs/audit/env-snapshot-20260718.md:10-16`; re-measured this session,
  section 2.2 below).

## 2. What is APPLIED (from tofu state + live measurement, not from docs)

### 2.1 OpenTofu outer-root state (command: `tofu -chdir=opentofu state list`,
run 2026-07-18, 20 resources)

Office1 site (live, load-bearing):
- `module.voffice1.libvirt_domain.vm` + `.libvirt_volume.disk` +
  `.libvirt_volume.seed` + `.libvirt_cloudinit_disk.seed`
  (BUT see divergence 2.3-i: the cloudinit staging ISO no longer exists
  live)
- `module.office1_opnsense.libvirt_domain.vm` + `.libvirt_volume.disk`
- `module.office1_network.libvirt_network.office1_local`
- `module.office1_storage.libvirt_pool.dc`
- `module.ubuntu_noble_base.libvirt_volume.base`

Inter-site fabric and DC scaffolding:
- `module.mesh_vr1_dc0_vr1_dc1.libvirt_network.link`,
  `module.mesh_vr1_dc0_office1.libvirt_network.link`,
  `module.mesh_vr1_dc1_office1.libvirt_network.link` (the D-100 mesh
  triangle)
- `module.vr1_dc0_planes.libvirt_network.plane["data-tenant" | "metal-admin"
  | "metal-internal" | "provider-public" | "replication" | "storage"]`
  -- applied and live, but REMOVED from config (see 2.3-iii)
- `module.vr1_dc0_storage.libvirt_pool.dc`,
  `module.vr1_dc1_storage.libvirt_pool.dc`

### 2.2 Live environment (measured this session, 2026-07-18, read-only)

- `hostname` -> `vcloud`; `uname -r` -> `6.8.0-136-generic`.
- `virsh list --all` -> exactly two domains, both running:
  `voffice1` (Id 1), `office1-opnsense` (Id 2).
- `virsh dominfo` -> `Autostart: enable` on BOTH domains.
- `ssh voffice1 'snap list maas lxd; uname -r'` ->
  `maas 3.7.2-17972-g.35e297c4d` rev 41649 (3.7/stable),
  `lxd 5.21.5-f2a1a0e` rev 40074 (5.21/stable, held),
  guest kernel `6.8.0-136-generic`.
- `ssh office1-netbox 'curl -s -o /dev/null -w "netbox=%{http_code}"
  http://localhost:8000/'` -> `netbox=302` (service up, redirecting to
  login).
- `ssh office1-tailscale 'tailscale status | head -1'` ->
  `100.64.0.53 office1-tailscale ... linux -` (subnet-router VM up).
- D-126 base leg: `scripts/site-baseleg.sh check office1` passed at the
  Phase-1 snapshot (`docs/audit/env-snapshot-20260718.md:16-17`); not
  re-run this session.
- OPNsense edge version: 26.7 per confirmed as-built
  (`docs/vr1-office1-as-built.md:42`, updated 2026-07-18). NOT re-measured
  this session -- measuring requires the gated API credential path; see
  section 7.
- SEC-010 nft files (2026-07-23, operator-approved live re-assert, logged
  window ops-sec010-reassert): `/etc/nftables-sec010.nft` on voffice1 and
  BOTH DC racks now carries the idempotent declare-then-delete preamble --
  sec010-fw double-restart converged with no rule duplication (4/2/2
  drops; pre/post capture `docs/audit/sec010-reassert-20260723.txt`;
  per-host backup `.pre-reassert-20260723` on each host). Generator fixed
  the same day (queue-pass changelog items 3/8).

### 2.3 State vs live vs config disagreements (REPORTED, not harmonized)

i.  `module.voffice1.libvirt_cloudinit_disk.seed` is IN STATE but its
    staging ISO was deleted by the reboot -- it still plans as a benign
    re-create (1 of section 5's 6 adds). The FORCED REPLACEMENT it used
    to force on `libvirt_volume.seed` (the GA-F01 defect that stopped
    the apply) is FIXED: D-130 ADOPTED (a) + implemented 2026-07-19,
    verified by the v8/v7 captures (gate rows G4/G5). Mechanism history:
    `docs/finding-20260718-voffice1-cloudinit-seed-replace.md:186-228`.
ii. Autostart: RESOLVED 2026-07-19 by the G6 state surgery (operator-
    ruled (ii), gate row G6): state now records `autostart = true` on
    both domains (`state show | grep -c autostart` -> 1 each); the 2
    in-place changes are gone from the plan (section 5 capture). Guests
    were never touched.
iii. The six `vr1-dc0` plane networks exist live and in state but are
    REMOVED from config -- the INTENDED Model B relocation (planes get
    recreated inside `vvr1-dc0` by the inner root,
    `opentofu/vr1-dc0-substrate/main.tf:28`). Their emptiness (0 leases,
    0 attached domains) was verified in a PRIOR session
    (`docs/dc0-deploy-readiness.md:43-45`) and must be re-verified in the
    same session as any apply (finding doc:259-265).
iv. RESOLVED 2026-07-19 (Batch 2, GA-F02): the readiness doc's falsified
    deploy-ready banner and its three contradictory plan counts are
    demoted -- status and the expected triple point HERE; the fresh-
    session banner points at the G9 canonical entry doc.

## 3. What is AUTHORED-BUT-NOT-APPLIED (in the tree, not in state / live)

- (2026-07-20) The step-B transit-reach work is APPLIED and verified --
  voffice1 holds the region end `172.31.0.1/30` on enp2s0 (plus its
  in-guest drop-in `/etc/netplan/60-transit.yaml`); `vvr1-dc0` answers
  at `172.31.0.2` (netplan set-name root cause fixed, kernel names
  enp1s0/enp2s0 kept); ssh `-J voffice1` with the dc0 key works;
  rack->region ping 10.10.0.20 0% loss. Kea reservation re-keyed to the
  regenerated voffice1 MAC (incident, session changelog item 3).
  Consequence for the G10 bootstrap: call site-headend-install.sh with
  `--transit-if enp1s0 --uplink-if enp2s0`.

- `module "vvr1_dc0"` (`opentofu/main.tf:360`) -- the DC0 containment VM
  (416 GiB / 108 vCPU, D-121/D-123 sizing) + its disk, seed volume, and
  cloudinit seed. 4 of the 5 committed DC0 creates in the plan capture.
- `module "vr1_dc0_uplink"` (`opentofu/main.tf:341`) -- the D-125 simulated
  ISP NAT network `172.30.2.0/24` (capture lines 226-247). The 5th create.
- The ENTIRE inner root `opentofu/vr1-dc0-substrate/` (main/variables/
  versions.tf; no state file exists in that directory) -- inner storage
  pool, the six relocated planes, bridge-in WAN, and the rest of the
  Model B step-C build.
- The removal of `module "vr1_dc0_planes"` from the outer config (the 6
  intended destroys; see 2.3-iii).
- `autostart = true` on voffice1/office1-opnsense in config (D-127) --
  live-true but state-absent (2.3-ii).
- `scripts/opnsense-plugins.sh` + `tests/opnsense-plugins/` (D-129
  profile-installer; commit `4cefa8b`). BUILT and green; the live `apply`
  against the edge is an operator-gated firmware mutation, NOT run
  (`docs/design-decisions.md:4050-4056`).
- SEC-010 enforcement artifact (`scripts/site-headend-install.sh
  --host-nodes` writing the transit FORWARD-drop) -- COMMITTED, applies on
  `vvr1-dc0` at deploy step B; ledger row stays OPEN until applied+verified
  (`bash scripts/ledger-scan.sh` output, SEC-010 row).
- Stage 4-7 runbooks (`runbooks/dc-dc-phase3..6-*.md`) -- written, not
  executed (`docs/dc-dc-deployment-workflow.md:873`).

## 4. What is RULED-BUT-NOT-BUILT (ADOPTED/RULED with no artifact yet)

- D-121/D-122/D-123/D-124/D-125 (all ADOPTED/RULED, status lines at
  `docs/design-decisions.md:3291,3474,3543,3635,3713`): the DC0 deploy
  sequence they rule (steps A-E, `docs/dc0-deploy-readiness.md:170-179`)
  exists only as config + runbook. Nothing DC0 is built.
- `vr1-dc1`: topology ruled (D-100/D-101) and addressing RATIFIED
  2026-07-21 (D-124 amendment: planes contiguous in 10.12.64.0/19,
  transit 172.31.0.4/30, uplink 172.30.3.0/24; apex confirm-free at
  authoring). Still UNBUILT: no `vr1_dc1_rack_*` variables, no dc1
  substrate root; only its storage pool and mesh legs exist (state
  list, 2.1). Gate row G12 carries the remaining [V] leg.
- D-100 netem: mechanism authored (`opentofu/modules/netem-link`) but HELD
  as a comment in the root (`opentofu/main.tf:309-319`); placeholder
  parameters ruled for the rehearsal (readiness doc:73-75); final
  parameters unruled (section 8).
- D-129 Roosevelt metal-edge plugin profile (`os-smart`, `os-nut` |
  `os-apcupsd`, microcode, `os-lldpd`) -- recorded, inert until the
  Roosevelt edge build (`docs/design-decisions.md:4030-4031`).
- D-129 qga enablement: designed (opt-in module variable, default OFF; the
  guest-agent virtio channel is MISSING from the live edge domain) but not
  written; retrofit deferred to the edge's next scheduled restart
  (`docs/design-decisions.md:4041-4047,4057-4063`).

## 5. The outer plan count (wording per operator direction, GA-F01)

The true EXPECTED outer plan count is currently NOBODY'S:

- expected count: UNRESOLVED pending D-130;
- last captured: 7/2/7 (`docs/audit/outer-plan-20260718.txt`, line 428:
  "Plan: 7 to add, 2 to change, 7 to destroy." -- the ONLY citable
  plan-count source);
- pre-reboot gate was 5/0/6 (recorded at `docs/dc0-deploy-readiness.md:59`,
  `docs/session-ledger.md:278`).

The EXPECTED outer plan is **ZERO DIFF** ("no differences"),
re-recorded 2026-07-22 with its evidencing capture
(`docs/audit/outer-plan-20260722-postdc1-converged.txt`) after the
G12 dc1 substrate step-A apply (saved plan 5/0/0 exact -- vvr1-dc1 +
vr1-dc1-uplink adds only, zero touches to live resources). A future
outer plan showing ANY diff is a STOP (investigate drift before
touching anything). History: 7/2/7
post-reboot symptom -> 6/2/6 post-D-130 -> 6/0/6 post-G6-reconcile ->
applied exact -> zero diff -> 1/1/1 (voffice1 transit, ruled+applied)
-> 2/0/2 (rack netplan fix, applied) -> zero diff converged 2026-07-20
-> 1/1/0 netem-wire STOP -> targeted netem apply 1/0/0 exact -> 0/1/0
office1 residual -> G16 state surgery -> zero diff converged 2026-07-21
-> 5/0/0 dc1 substrate adds (G12 step A, saved-plan applied exact
2026-07-22) -> zero diff converged -> 0/1/0 office1 qga channel (G13
bundle, saved-plan applied exact 2026-07-23) -> zero diff converged
(`docs/audit/outer-plan-20260723-postqga-converged.txt`, this entry).

## 6. Open gates

Owner legend: operator (human ruling/approval), session (agent work under
gating), external (outside this repo/track). Type legend (GA-R6/E1): [V] =
verification-type (closes on its named executable check); [R] = ruling-type
(closes per a GA-R5 recorded ruling).

| # | Gate | What closes it | Owner | Evidence of current state |
|---|------|----------------|-------|---------------------------|
| G1 | Audit Phase 3: fresh-agent grounding test | [V] 3 clean-context probes score the 7-question set against this doc; holes map made | session | CLOSED 2026-07-18: 3 probes, 21/21 PASS, holes H1 (amended into G9) + H2 (no action) -- `docs/audit/phase3-grounding-test-20260718.md` |
| G2 | Audit Phase 4: GA-R1..R7 structural rulings + the stage-status vocabulary A/B | [R] ruling-type gate (GA-R6 rule 6): closes when every item carries a GA-R5 Status block | operator | CLOSED 2026-07-18: all seven GA-R + vocabulary (Option A + H1) RATIFIED, utterances quoted (`docs/audit/ga-rulings.md`, through commit `fe4f1c4` + this one) |
| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | [R] operator-gated fix batches, each commit naming its GA-F | operator + session | Batch 0 OPENED by operator 2026-07-19; items 0.1 (repo-lint L10, GA-R1/C1), 0.2 (SEC repoint, GA-R4/F3), 0.3 (counter hardening, GA-F15), 0.4 (extractor vocab scan, GA-F10/H1) landed; Batch 0 CLOSED (verification passed 2026-07-19); Batches 0-4 CLOSED 2026-07-19 (Batch 4: GA-R4 ledger rotation 1187->131 lines, F1 cap now enforceable; 96 changelogs + 24 history docs consolidated to docs/archive/ with 4 stage records + per-stage manifest commits; top-level docs/ = 16 files < 25; live-surface refs rewritten); Batch 5 CLOSED 2026-07-19 (skill sweep: GA section added reconciled against ratified text, stale phase/UNVALIDATED claims demoted, bookends + stage-close rewritten; checklist docs/audit/skill-sweep-checklist-20260719.md); Batch 6 OPEN: exit runs 1/2/4/5 PASS (adjudication + captures: docs/audit/phase6-exit-runs-20260719.md); exit item 3 PASS 2026-07-19 (fresh trio 21/21, 7/7 all three -- exit record); PENDING only item 6 (operator re-read + re-sign, replaces section 11); Batches 2-6 await gates; FREEZE holds for un-gated surfaces |
| G4 | The two D-130 verifications | [V] run them, capture output | session | CLOSED 2026-07-19: v8 suppression CONFIRMED (7/2/7 -> 6/2/6, zero forces-replacement; `docs/audit/outer-plan-20260719-v8-ignorechanges.txt` + `-baseline.txt`); v7 no-bounce under running domain, zero residue (`docs/audit/throwaway-v7-20260719.txt`) |
| G5 | D-130 mechanism ruling (seed-volume durable fix) | [R] operator rules in Phase 5, quoting G4's captured output | operator | CLOSED 2026-07-19: D-130 ADOPTED (a) ignore_changes (`docs/design-decisions.md` D-130, GA-R5 utterance quoted); implemented in `modules/cloudinit-vm` + `tests/cloudinit-vm` |
| G6 | State reconcile of autostart + seed WITHOUT bouncing guests | [R] gated mechanism, operator-ruled (S3) | operator | CLOSED 2026-07-19: ruled (ii) state surgery (GA-R5); pull -> inject autostart:true on both domains -> push (serial 22->23, backup `terraform.tfstate.pre-G6-20260719`); guests never touched (ids 1/2 unchanged, running) |
| G7 | New captured plan == the expected triple recorded in section 5 | [V] re-plan to a capture file after G5+G6 | session | CLOSED 2026-07-19: capture `docs/audit/outer-plan-20260719-postG6.txt` = 6/0/6, equals section 5 exactly |
| G8 | Same-session pre-apply re-verify: 6 planes still empty | [V] run in the SAME session as the apply | session | CLOSED 2026-07-19: verified in the apply session itself (all six 0 leases; only office1 nets attached) immediately before step A |
| G9 | DC0 outer apply (deploy step A) | [V] operator-gated, logged (`run-logged.sh`), after G1-G8; audit exit criteria met (charter Phase 6). SEC pre-apply dependency (S2): SEC-010's transit FORWARD-drop is applied+verified at deploy step B via `site-headend-install.sh --host-nodes --check` on vvr1-dc0 (gate G10) -- the ONLY SEC row gated on this apply (register of record: security-ledger). CANONICAL ENTRY DOC (probe hole H1): `runbooks/dc-dc-phase2-tofu-dc-substrate.md`, with `docs/dc0-deploy-readiness.md` section E as the step table | operator | CLOSED 2026-07-19: G8 same-session planes check passed (6x 0 leases, 0 attachments); saved plan == 6/0/6 applied in the logged dc0-deploy window; convergence re-plan = no differences; vvr1-dc0 running, prior guests untouched |
| G10 | Deploy steps B-E in-sequence gates: SEC-010 `--host-nodes --check` on vvr1-dc0; depth-4 nested boot; D-125 foreign-MAC egress test; MAAS reachability + `TF_VAR_maas_api_key` before step D; netem placeholder step E | [V] exercised during the gated deploy | session (each mutation operator-approved) | Step B DONE 2026-07-20 (`--check` EXIT 0 incl. SEC-010, `docs/audit/stepB-check-20260720-final.txt`; interfaces enp1s0/enp2s0). Depth-4 nested boot DONE (10 domains running inside vvr1-dc0). D-125 egress isolation test PASS 2026-07-20 (`docs/audit/d125-egress-gate-20260720-matrix.txt`), and the edge itself now egresses 0% loss after the v4 addressing. Step D COMPLETE incl. commissioning: ALL 9 NODES READY 2026-07-21 (two stacked faults diagnosed + fixed -- `docs/audit/commissioning-diag-20260721.txt`; section 1). Step E (netem) DONE 2026-07-21: sudo fragment installed+verified, module local-mode amendment, targeted apply 1/0/0 exact (operator-ruled at the 1/1/0 STOP), placeholder profile live on virbr5, virbr7/virbr3 untouched (`docs/audit/stepE-netem-20260721.txt` + `outer-{plan,apply}-20260721-netem*.txt`). **G10 CLOSED 2026-07-21** |
| G11 | Operator signs THIS document | [R] read top-to-bottom; discrepancies resolved in the document | operator | CLOSED: RE-SIGNED 2026-07-19 at audit exit, section 11 (replaces the 2026-07-18 signature) |
| G12 | `vr1-dc1` build | [R] operator rules dc1 transit/rack addressing; then vars + substrate authored | operator + session | CLOSED 2026-07-23 (operator-ruled "Merge to main + full close"; commissioning 9/9 READY, merge commit on `main`, branch retired) -- [R] leg CLOSED 2026-07-21: addressing RATIFIED (D-124 amendment 2026-07-21, utterance quoted). [V] leg IN PROGRESS (branch `dc-dc-g12-dc1-substrate`): apex confirm-free DONE 2026-07-21 -- planes/uplink already assigned+consistent, transit 172.31.0.4/30 + rack 10.12.68.2 FREE (`docs/audit/dc1-apex-confirm-20260721.txt`); importer per-site dc1 support shipped (harness 117/117) with live dry-run preflight PASS (`docs/audit/dc1-rack-import-dryrun-20260721.txt`). vars + substrate root + lib-net dc1 arm COMMITTED 2026-07-22 (successor session landed the disconnected item 3 + the harness reconcile as changelog item 4): six harnesses reconciled to the ratified dc1 arm, phase-00 PLANES parity guard added, rbd-mirror/radosgw cross-DC reminder fixed; gauntlet **ALL GREEN (76)** (`docs/audit/gauntlet-20260722-g12-reconcile.txt`), repo-lint 0-fail. Apex `--commit` EXECUTED 2026-07-22 (operator-gated): 172.31.0.4/30 + 10.12.68.2/22 CREATED, post-commit read-back idempotent (`docs/audit/dc1-rack-import-commit-20260722.txt`). dc1 svc key minted (creds-audit CLEAN), tfvars authored (local), **outer step-A apply DONE 2026-07-22**: saved plan 5/0/0 exact, converged ZERO DIFF (section 5), vvr1-dc1 RUNNING, prior guests untouched (as-executed log dc1-deploy; changelog-20260722-g12-dc1-build.md). **Step B COMPLETE 2026-07-22**: cloudinit-vm interface_macs port + voffice1 dc1-transit NIC (0/2/0 exact, MACs pinned both domains, post-bounce battery ALL PASS, converged zero diff -- `docs/audit/outer-plan-20260722-voffice1-dc1nic.txt`), transit LIVE (voffice1 .5/30 <-> rack .6/30, dc1-key ssh proven), rack ENROLLED (region lists vvr1-dc1 `nmpcq4`), SEC-010 applied+verified BOTH ends, OPNsense 26.7 base staged via hash-verified copy of dc0's proven artifact; named gate EXIT 0 `docs/audit/dc1-stepB-check-20260722-final.txt` (changelog-20260722 items 5-8, three queued findings). **Step C COMPLETE 2026-07-22**: inner apply FROM voffice1 -- plan 28/0/0 exact (54 pinned MACs verified in-capture), one fix-forward (serial-log staging dir absent on dc1; queued to standup DoD), resume 10/0/0 exit 0; 28/28 in state, convergence ZERO DIFF (`docs/audit/inner-converge-20260722-dc1-stepC.txt`), **10/10 domains RUNNING inside vvr1-dc1**, edge at the 26.7 FreeBSD login prompt (D-112 datapoint #2); dc1 inner tfstate ON voffice1 (site backup set). **D-125 egress gate PASS 2026-07-22** (two identical runs, dc0 criteria exact, isolation confirmed -- `docs/audit/d125-egress-gate-20260722-dc1.txt`). **Edge bootstrap + v4 addressing COMPLETE 2026-07-23** (changelog-20260723-g12-dc1-edge.md): D-112(c) console bootstrap done (SSH + dc1 edge key materialized; payload needed `util.inc`/`shell_safe()` -- dc0 lesson iv the `.b64` artifact lacked), key-only SSH VERIFIED (`15.1-RELEASE-p1`); D-113(a2) API key MINTED via the vendor model + smoke test `GET core/firmware/status` exit 0 `product_abi 26.7` (second 26.7 datapoint); edge ADDRESSED -- WAN `172.30.3.2/24` gw `172.30.3.1` (egress 1.1.1.1 0% loss), LAN `192.168.1.1` -> `10.12.64.1/22` (ruled provider-public gw), API answers at the new LAN; interim reach leg removed, rack provider-public leg `10.12.64.2/22` LIVE on virbr4. Creds consolidated to `~/vr1-dc1-creds/opnsense-api.txt` (creds-audit CLEAN, 5 entries); rack edge-key copy shredded (**SEC-015** transient, remediated). Two queued findings: bootstrap `.b64` missing `util.inc`; `opnsense-bootstrap-apikey.sh` scp had a transient post-restart-sshd failure (readiness-wait/retry candidate). **Rack standup + region MAAS config DONE 2026-07-23** (changelog-20260723 items 7-11): dc-rack-net.sh dc1 arm shipped (harness 18/18, gauntlet 76 GREEN) + INSTALLED on the rack (check 10/10, forwarder answers authoritative maas-internal SOA -- D-131 fix; `docs/audit/dc1-rack-net-install-20260723.txt`); region MAAS on metal-admin subnet 11 -- D-120 range 10.12.68.100-.200, D-131 dns_servers=10.12.68.3 allow_dns=false, DHCP dhcp_on=true primary_rack=nmpcq4 (dhcpd verified RUNNING on virbr6, no Temporal incident); **dc1 enlistment PROVEN** via canary (machines 11->12 in ~2 min). **SEC-016 RULED + WIRED 2026-07-23** (operator: "Mint a dedicated dc1 power key" -- per-DC isolation; dedicated key authorized on the rack + installed in the region MAAS snap with per-host ssh config, dc0's SEC-012 key untouched). **COMMISSIONING 9/9 READY 2026-07-23** (`docs/audit/dc1-commissioning-verify-20260723.txt`): all 9 nodes PXE-enlisted by pinned 52:54:01:d1 MACs, `power_type=virsh` set + verified by real query-power-state (SEC-016 path proven), commissioned to **ALL 9 READY in ~3.5 min** (no timeout, no SERVFAIL), shapes EXACT to D-121 Option C (3x16cpu/64GiB + 2x12cpu/48GiB + 4x8cpu/24GiB). dc0's two stacked faults pre-empted by pinned MACs + the dc-rack-net forwarder. **G12 [V] leg (the dc1 build) is COMPLETE.** NEXT: G12 close-out only -- consolidate this session's changelogs (GA-R2), final gauntlet + repo-lint, GA-R7 memory review, skill sweep, **operator-gated merge of `dc-dc-g12-dc1-substrate` -> `main`** (merge commit), branch retirement; then G12 CLOSES. NOTE open SEC rows now include SEC-014/-015/-016 (G14 row count stale -- reconcile in the close). |
| G13 | D-129 residuals | [R] operator-gated live plugin install on office1-opnsense; qga channel retrofit at that edge's next scheduled restart. All 4 sub-decisions RULED 2026-07-21 (D-129 Status line) -- only the two execution items remain | operator | CLOSED 2026-07-23 (operator-approved full maintenance bundle, logged window ops-sec010-reassert): qga channel retrofitted via outer tofu saved-plan apply 0/1/0 exact (`docs/audit/outer-plan-20260723-office1-qga.txt`; the apply's edge bounce = the ruled "next scheduled restart"; MACs were pinned 07-22 so the in-place-update trap class was closed); edge updated 26.7 -> 26.7.1 via REST (no reboot required; os-iperf had been REFUSED on 26.7 pending exactly this update); both plugins installed=1 by firmware-info read-back, `guest-ping` -> `{"return":{}}`, agent reports both legs, egress 0% loss, outer plan re-converged ZERO DIFF (`docs/audit/outer-plan-20260723-postqga-converged.txt`). Named close capture: `docs/audit/g13-close-20260723.txt` |
| G14 | 12 OPEN SEC rows (SEC-001, -003..-008, SEC-012, -013, -014, plus SEC-015 + SEC-016 opened 2026-07-23 for dc1 credentials; SEC-010/-011 CLOSED) | [R] per-row: rotations/flips at v1 close (external to VR1 track); SEC-012/-016 carry the same libvirt-group SCOPE hardening question; SEC-016 also a snap-refresh re-assert (queued to DC standup DoD) | operator / external | `docs/security-ledger.md` (register of record, GA-R4/F3); count re-verified vs `bash scripts/ledger-scan.sh` 2026-07-23 (12 open) |
| G15 | D-068 / D-071 rulings | [R] operator rules (section 8); neither blocks the VR1 substrate | operator | D-071 ADOPTED 2026-07-21 (all four points); D-068 items 2-3 RULED 2026-07-21; item 1: plan DRAFTED + Q1/Q2-structure/Q3 ALL RULED 2026-07-23 (three amendments, utterances quoted; monthly-review lines delivered). Sole D-068 remainder: Q2 path selection at Roosevelt Vault design time -- G15 is otherwise decision-complete |
| G16 | office1 edge `channels = []` state reconcile (the D-129 module-schema residual) | [R] operator rules the mechanism; then [V] the converged re-plan capture | operator + session | CLOSED 2026-07-21: RULED "State surgery (Recommended)" (GA-R5, session changelog item 16); executed per G6 precedent -- channels null -> [] injected, serial 29 -> 30, backup kept, guests untouched (office1-opnsense Id 2 running throughout); convergence = ZERO DIFF (`docs/audit/outer-plan-20260721-postG16-converged.txt`); section 5 re-recorded |

## 7. Version pins (measured; the authority for every pin)

| Component | Measured value | Command (run 2026-07-18) | Where measured |
|---|---|---|---|
| OpenTofu | v1.12.4 | `tofu version` | vcloud (also `docs/audit/env-snapshot-20260718.md:26`) |
| libvirt provider | dmacvicar/libvirt 0.9.8 (pinned) | `grep -A2 'provider' opentofu/.terraform.lock.hcl` | repo lock file |
| MAAS provider | canonical/maas 2.7.2 (pinned) | same | repo lock file |
| MAAS | 3.7.2-17972-g.35e297c4d (3.7/stable) | `ssh voffice1 'snap list maas'` | voffice1 |
| LXD | 5.21.5-f2a1a0e (5.21/stable, held) | `ssh voffice1 'snap list lxd'` | voffice1 |
| Kernel (host) | 6.8.0-136-generic | `uname -r` | vcloud |
| Kernel (voffice1) | 6.8.0-136-generic | `ssh voffice1 'uname -r'` | voffice1 |
| OPNsense edge | 26.7.1 (FreeBSD base 15.1) | MEASURED 2026-07-23 via the gated API (`GET core/firmware/status` -> product_version 26.7.1, capture `docs/audit/g13-close-20260723.txt`); updated 26.7 -> 26.7.1 in the G13 bundle. DC edges (vr1-dc0/dc1) remain 26.7 | office1-opnsense |
| NetBox (Office1 apex) | 4.6.4 per as-built `docs/vr1-office1-as-built.md:44`; service UP verified (HTTP 302) this session | `ssh office1-netbox 'curl ... localhost:8000'` | office1-netbox |
| Juju | NOT part of VR1 substrate yet (arrives Stage 5). Last recorded VR0 value 3.6.25 -- historical, unverified here | n/a | n/a |

The known-stale pin sites this table used to enumerate (the GA-F03/F04/
F05 tofu, OPNsense, and jumphost-name values -- stated token-free here so
the scan does not count them) were ALL fixed or demoted to pointers in
sweep Batches 2-3, 2026-07-19 (session changelog).

## 8. Open decision queue (the exact questions the operator must answer)

1. D-130: RULED 2026-07-19, ADOPTED (a) ignore_changes -- rotated to
   `docs/design-decisions.md` D-130 (question + utterance + captures).
2. D-100 netem parameter sub-item (gap #11) -- placeholder CONFIRMED
   STANDING 2026-07-21 (operator, GA-R5; D-100 sub-items block). No
   open question remains; the item is AWAITING EXTERNAL INPUT (the
   Roosevelt inter-DC link spec), trigger defined: re-tune via a gated
   apply when the spec exists, not before.
3. D-068 -- Vault substrate hardening. Items 2-3 RULED 2026-07-21; item 1
   re-scoped plan DRAFTED 2026-07-23
   (`docs/D-068-vault-migration-plan-draft.md`). Q1 RULED 2026-07-23
   (rehearsal-scoped EOL risk-acceptance, posture 1b -- amendment in
   design-decisions.md is the authority). Q2 structural assumption RULED
   2026-07-23 (Roosevelt baselines on 1.8/stable + a FUNDED remediation
   track; path 2a/2b/2c + deadline stay OPEN to Roosevelt design time on
   re-verified V1-V5). Q3 RULED 2026-07-23 (monthly-review lines delivered
   into ops-update-procedure 0c; design-time re-verify trigger). SOLE
   remainder on item 1: Q2 path selection (2a/2b/2c) + deadline, at
   Roosevelt Vault design time (item 1 Status line: OPEN on exactly that
   remainder -- reworded at the 2026-07-23 close for scan attribution).
4. D-071 -- ADOPTED 2026-07-21: all four policy points ruled (monthly
   review trigger; patch-only controller jumps; standing order;
   in-channel-only refreshes), each its own GA-R5 exchange -- status
   line in design-decisions.md is the authority. No open question
   remains; ops-update-procedure is the policy vehicle.
5. D-129 -- ALL FOUR sub-decisions RULED 2026-07-21 ((i) COS scrapes
   the edge in-scope per-DC; (ii) os-frr pinned to Roosevelt design;
   (iii) per-site Tailscale = dedicated node on metal-admin, edge
   excluded; (iv) MAAS hierarchy stays the time authority -- status
   line in design-decisions.md is the authority). No open question
   remains; the operator-gated live install of the ruled VR1 profile
   on office1-opnsense (`scripts/opnsense-plugins.sh apply vr1-edge`)
   + the qga retrofit at that edge's next restart are EXECUTION items
   tracked at gate G13.
6. Audit Phase 4 rulings: GA-R1..GA-R6 individually, plus the legal
   stage-status vocabulary A/B (GA-F10 operator note) -- each gated, one
   ruling per exchange.
7. D-132 -- Roosevelt per-DC MAAS topology (PROPOSED 2026-07-21,
   operator-pinned to the next deployment; three question groups: HA
   regions per DC, rack-top rack controllers, cross-site backup
   custody). Present at Roosevelt MAAS design time, not before.
8. D-131 sub-4 + pinned DNS architectural review (operator-directed
   2026-07-21: stack best practices, forwarder security implications,
   vendor guidance on the "utility nodes" DC-to-DC configuration) --
   executes at next-deployment design time; feeds the sub-4 ruling
   with the LP outcome.

## 9. Additional defect found while authoring (FIXED in sweep Batch 0.3,
2026-07-19 -- wrap-aware exclusion, GA-F15; history below)

`ledger-scan.sh`'s mention-derived next-free counters (DOCFIX, BUNDLEFIX)
are SELF-INFLATED by any doc that quotes a "next-free" value and lets the
hyphenated token wrap onto a line without the words "next-free" -- the
per-line exclusion filter (`scripts/ledger-scan.sh:121-129`, the
`grep -viE 'next[- ]free'` at :124) then counts the quote as a real
assignment; the script's own CAUTION comment (:112-120) documents exactly
this failure class. It happened TWICE inside the audit itself on
2026-07-18: the Phase-1 env snapshot's wrapped next-free line inflated the
BUNDLEFIX counter (051 -> reported 052), and this document's own first
draft of this very section inflated the DOCFIX counter the same way while
asserting DOCFIX was unaffected. Both audit surfaces were reworded
token-free the same day and the counters re-verified at their true values
(D=130, DOCFIX=197, BUNDLEFIX=052 -- see GA-F15). The D counter is
header-authoritative and was never affected. Batch 0.3 hardened the
scanner: an excluded line now also suppresses the immediately following
line (the wrap case); counters re-verified unchanged post-fix. The
authoring discipline stands regardless: never write a hyphenated
register-token quote of a next-free value into any doc; state the numbers
token-free as this section does.

## 10. How to verify this document (cold-session re-derivation)

Run read-only, from the repo root:

- Repo identity: `git rev-parse HEAD; git status --short`
  (this doc was authored at `e999b03`, clean tree).
- Applied set: `tofu -chdir=opentofu state list` (expect the 20 resources
  in section 2.1); `virsh list --all`; `virsh dominfo voffice1 | grep -i
  autostart` (and office1-opnsense).
- Authored-not-applied: `grep -n '^module ' opentofu/main.tf` (12 blocks;
  `vvr1_dc0` + `vr1_dc0_uplink` absent from state list);
  `ls opentofu/vr1-dc0-substrate/` (no *.tfstate).
- Plan count: read `docs/audit/outer-plan-20260718.txt` line 428. Do NOT
  re-run `tofu plan` casually against live state; if a fresh capture is
  taken, it must be written to a new dated capture file and cited here.
- Versions: `tofu version`; `ssh voffice1 'snap list maas lxd; uname -r'
  </dev/null`; `uname -r`; `grep -A2 provider
  opentofu/.terraform.lock.hcl`.
- Open decisions + SEC + next-free: `bash scripts/ledger-scan.sh`
  (BUNDLEFIX caveat: section 9); decision status lines:
  `grep -n '^## D-' docs/design-decisions.md` then read each Status line
  -- a decision's Status line in that file is the ONLY ruling authority.
- Gates: sections 1a and 4-7 of `docs/audit/grounding-audit-charter.md`;
  `docs/audit/grounding-audit-20260718.md` for GA-F01..F14.
- Live service probes: `ssh office1-netbox 'curl -s -o /dev/null -w
  "%{http_code}" http://localhost:8000/' </dev/null` (expect 302);
  `ssh office1-tailscale 'tailscale status | head -1' </dev/null`.

What this document is NOT built from and you must not rebuild it from:
the prose of the 95 `docs/changelog-*.md` files, the
`docs/session-ledger.md` narrative, or auto-memory -- all proven to carry
false status (GA-F14, GA-F06..F08).

## 11. Operator signature (G11)

SIGNED 2026-07-19 (re-signature at audit exit; REPLACES the 2026-07-18
signature per GA-R1 rule 7 -- git history keeps it). Question as presented
(Batch 6 item 6, 2026-07-19): read this document top to bottom, then
provide the signature statement. Operator answer, exact utterance:
"Reviewed, approved, continue." This document is the signed status
authority; charter Phase 6 item 5 MET at this baseline (repo HEAD at
signing recorded in the close commit).
