Pass 4 / W4.1 -- MASTER CHANGE INVENTORY (container-layer elimination)

Author: Worker W4.1 (Phase 4 -- change synthesis), multi-agent container-elim pass (SCOPE-AND-EXECUTION-PLAN.md Section 4). Date: 2026-08-09. Inputs: pass0-admin-report.md (baseline + confirmed target topology), pass1-admin-report.md (planning change-set), pass2-admin-report.md (tools change-set), pass3-admin-report.md (tests change-set) -- all four read in full. READ-ONLY synthesis; no mutation; nothing here is executed. This document MERGES the planning + tools + tests change-sets into one indexed table an execution session can work from directly.

Baseline carried in (do not re-derive): Option 1 CONFIRMED (flat node VMs on vcloud libvirt + one small non-hypervisor vr1-dcN-client VM per DC); cross-DC handling (a) CONFIRMED (new vcloud-level host isolation control); MAAS region stays on vr1-dcN-maas-01; root topology (B) shared-outer + per-DC-flat RECOMMENDED (Phase-4 ratifies); THREE isolation controls confirmed distinct -- (i) the (a) cross-DC host control, (ii) the SEC-010 transit-leg successor, (iii) the MAAS power-key blast-radius mitigation; everything rides D-143 (10.12->10.13 re-IP); 13 owed artifacts (numbered #1-#13 below); tests change-set = 9 existing-change verdict-blocks / 5 existing-retire verdict-blocks / 7 new-build harnesses / 3 rides.

ID scheme: DEC- decision (not a change; an open ruling) -- TF- tofu-module -- LB- lib (lib-hosts.sh/lib-net.sh) -- SC- script/procedure -- DC- doc (deployment-workflow.md / CURRENT-STATE.md prose, non-gate) -- RB- runbook -- GT- gate (preflight/cloud-assert/G-series) -- HN- harness (A#/B#/C# tags preserved from pass3-w3-new-tests.md for cross-reference) -- SEC- security-ledger row. Axis: [CE] container-elim only, [D-143] re-IP only, [both] dual-labeled (per pass1 check 5's four confirmed dual items + this pass's extensions). Owed-artifact# refers to the 13-item list in pass2-admin-report.md Section 5 (also restated below).

0. The 13 owed artifacts (for cross-reference; full spec in pass2-admin-report.md #5)

1. Teardown primitive (root-scoped tofu destroy + emergency lever) -- 6. rides as the emergency virsh destroy loop (distinct row, same fixture library)
2. The (a) cross-DC host isolation control (concern i)
3. SEC-010 transit-leg successor (concern ii)
4. R7 credential-revocation checklist
5. MAAS machine-record release/delete step (+ rack-controller decommission)
6. FIT-calculator extension + capacity measure (+ artifact-service sizing)
7. MAC re-measurement pass (post-apply)
8. NetBox DCIM migration
9. Post-build live asserts (geneve/jumbo)
10. Power-key blast-radius mitigation (concern iii) -- critical path
11. modules/dc-site
12. D-131 retirement-evidence step

1. MASTER CHANGE-INVENTORY TABLE

1.1 Decisions (open rulings -- not changes; gate the change rows below)

1.2 OpenTofu roots/modules

Note: modules/office1-network, mesh-link (x3), netem-link are CONFIRMED UNCHANGED (pass2 check 3/4.5) -- not itemized as rows. modules/maas-vm-host is dead/orthogonal, never instantiated -- see DEC-18, not itemized as a change row.

1.3 lib-hosts.sh / lib-net.sh

Note: CARVE_AUX_HOSTS, NIC_PLANE_ORDER, BREX_PARENT_NIC, HOST_OCTET maps/suffixes, HOST_TAG, resolver fns -- UNCHANGED under container-elim (octet maps change under D-143 only). The client VM does NOT get a lib-hosts.sh row (resolved: it is L1 cloudinit-vm, not MAAS/virsh-power-managed; identity lives in tofu + NetBox).

1.4 Scripts

Note: dc-node-carve.sh, dc-node-v6-carve.py, carve-host-interfaces.sh, maas-role-tags.sh, maas-profile-assert.sh, maas-role-tags.sh, dc-egress-check.sh logic bodies -- NO CODE CHANGE (grep-verified zero containment hits; pure MAAS-API, <site>-parameterized); only invocation-host currency (D-128-amendment territory) and doc comments naming vvr1-dcN need updating -- LOW priority, not itemized as separate rows.

1.5 Doc (workflow doc + gate-table prose, non-runbook)

Note: Stages 1, 6, 7 and the dc-dc-office1-service-reip.md / dc-dc-phase0-vcloud-prep.md / dc-dc-phase1-office1-standup.md runbooks are CONFIRMED NO CHANGE / OUT OF SCOPE (D-114, zero containment hits) -- not itemized.

1.6 Runbooks

Note: dc-dc-phase5-dr-failover-drill.md has NO DIRECT CHANGE -- it inherits RB-04's table; not itemized as its own row.

1.7 Gates (preflight / cloud-assert / G-series)

Note: G12 is CLOSED/historical, read as "the shape being replaced," not touched further. G18, G1-G8, G11, G13, G15, G16 and cloud-assert A0-A10 -- CONFIRMED no container-layer dependency (verified per-gate by W1.2/W3.2); not itemized.

1.8 Harnesses (tests/) -- A/B/C tags preserved from pass3-w3-new-tests.md

A: existing -- change (9 verdict-blocks)

B: existing -- retire (5 verdict-blocks)

C: new-build (7 harnesses, one per owed artifact)

Rides (no separate build): #6 -> HN-C3's fixture library; #8 MAC re-measure -> HN-C1's MAC invariant; #10 geneve/jumbo -> geneve-encap-assert verbatim, new invocation point only (SC-19). tests/opentofu-validate T8-T10, node-vm T1-T7/T12-T15, site-headend-install Sections 1-5/7, maas-node-power (opaque pass-through arg), preflight pending-change fixture, geneve-encap-assert (all cases), site-baseleg, cloudinit-vm, d124-transit-seed, netem-link (declared grep false-positive), and the 90 no-hit harnesses are CONFIRMED STAY -- not itemized.

1.9 Security-ledger (SEC) rows

2. Critical-path dependency chains

Chain A -- Power-key blast-radius mitigation (owed #11; the single largest blocker)

DEC-15 (mechanism choice: restricted key / wrapper / polkit ACL) -> SEC-02 (mint the SEC row) -> SC-11 (build the #11 artifact) -> HN-C4 (harness -- itself a precondition, not just coverage) -> LB-01 (lib-hosts.sh power-address re-derivation) + SC-07 (maas-region-power-key.sh URI/key shape) -> SC-01 (maas-node-power.sh call-site literals) -> HN-A4 + HN-A5 (dc-selector / maas-region-power-key assertions, edited together, same session -- H1 hazard: a plausible-looking URI swapped in before the mechanism exists produces a false-green harness) -> HN-A9 (pre-flight-checks P4 case) + GT-04 (cloud-assert A11b) -> GT-06 (P5 register row for the new key material). Six downstream test/tool edits are frozen until DEC-15 rules (pass3 Section 4); the interim RED on HN-A4/HN-A5 once lib-hosts.sh changes is the DESIRED fail-loud state, never something to "fix" early.

Chain B -- The (a)-control-before-any-flat-apply invariant (owed #2)

DEC-14 (mechanism) -> SEC-01 (SEC row) -> SC-10 (#2 artifact) -> HN-C2 (harness) -> GT-01 (Stage-1 gate, installed + --check-verified) -> MUST PRECEDE -> TF-13 (first flat substrate apply of EITHER per-DC root, under whatever DEC-11 root shape lands -- fork-robust: a merged single root's FIRST apply can create both DCs' planes at once, so "before the second DC's apply" is not sufficient, only "before ANY flat apply" survives the fork) -> GT-02 (A11a re-verify at each apply's close) -> GT-08 (folds into the G9/G10 successor gate) -> re-verified again at Stage-5 live traffic (the first point the claim is actually tested).

Chain C -- R7 + MAAS-release before destroy (Part A of the teardown sequence)

SC-12 (#4 R7 credential-revocation checklist, enumerated from every vm-secret-locations row keyed to the rack host class) + HN-C6 (harness) -> run BEFORE any substrate destroy (revoking after the hosts are gone degrades to "assume it's moot") -> SC-13 (#5 MAAS machine-record release/delete + rack-controller decommission + region-side primary_rack/DHCP-reference cleanup) + HN-C7 (harness) -> TF-01/TF-02 destroy applies (inner roots first from voffice1, then outer from vcloud) -> RB-01 (teardown runbook rewrite encodes this exact order). This chain governs the CURRENT 10.12 checkpoint teardown and is largely independent of DEC-11's root-shape ruling for the NEW build.

Cross-cutting: the root-topology fork (DEC-11)

Gates TF-02, TF-12, TF-13, SC-09, SC-14, HN-C3, RB-01, GT-05, HN-A1, HN-A2, DEC-12, DEC-23 -- the sequence itself is invariant to the fork (per pass1 check 2), but the teardown primitive's exact wording, the state blast radius, and every root-naming literal are NOT. Ratify DEC-11 early; it unblocks the largest single cluster of "ready once ratified" rows.

3. Count summary by category

Cross-check against source counts: harness total (21) matches pass3 Section 2's 9-existing-change + 5-existing-retire + 7-new-build decomposition exactly; owed-artifact references (13 distinct #-tags) all appear at least once across TF/SC/GT/HN/SEC rows, with no double-counting (rack decommission folds into SC-13/#5; artifact-service sizing rides SC-16/#7; the SEC-010-writer extraction IS SC-04/#3's implementation shape -- all per pass2 Section 5's explicit "not double-counted" note, carried forward here).

4. Verification note

Author = W4.1 (no model name asserted). This document is a MERGE of pass1-admin-report.md Sections 2-6, pass2-admin-report.md Sections 3-6, and pass3-admin-report.md Sections 2-5 -- no new repo reads were performed beyond the four admin reports and their stated verification notes; every row's artifact path/line traces to a citation already verified in one of those four reports (see each report's own Section verifying "Verification note" / "Adversarial-check results" for the underlying grep/read evidence). READ-ONLY; nothing executed; findings LOGGED only.