d139-carve-dryrun-20260801.txt
===============================
READ-ONLY dry run of netbox/d139-gua-carve.py against the VR1 WORKING apex
(office1-netbox http://10.10.1.10:8000, DOCFIX-195 -- NOT baldurkeep). Host:
vcloud. Date: 2026-08-01T00:08:57Z. NO write of any kind was made: the apex prefix
count was 139 before and 139 after, and none of the 22 CREATE rows exists.
Governing decision: D-139 ruling B. Retirement is REPORTED, never executed.
TOTALS ACROSS BOTH DCs: CREATE 22 | EXISTS 6 (untouched) | RETIRE-REPORT 18
ULA rows, holding 52 dependent ip-addresses that a later delete would orphan.
STANDING NOTE: commit 633da1c (same day, concurrent session) REFUTED D-139
ruling B's stated deciding reason (glibc 2.35 does not implement RFC 6724's
precedence table) and FLAGGED the ruling for operator reconsideration. D-139's
text is UNCHANGED, so this dry run reflects the ruling as it stands -- but the
--commit push is gated on that reconsideration, not merely on operator approval.
MEASURED STRUCTURAL ASYMMETRY, reported not acted on (outside D-139 table):
VR0 DC0 and Willamette -- the two sites D-139 cites as the org standard --
each carry a role=Cloud /56 (e02::/56, 102::/56), a :e0::/60 VPN and a
:f0::/60+/64 OOB. VR1 DC0/DC1 carry NONE of these; they hold only the /48
container. D-139 does not rule them, so this tool does not create them.
=======================================================================
== d139-gua-carve vr1-dc0 (DRY RUN) ==
apex: http://10.10.1.10:8000 site: VR1 DC0 (id=8)
apex prefixes scoped to vr1-dc0: 21 (read this run)
CREATE 11 | EXISTS 3 | RETIRE-REPORT 9
CREATE:
2602:f3e2:f02:20::/60 role=metal-admin VR1 DC0 metal-admin (GUA /60; D-139)
2602:f3e2:f02:20::/64 role=metal-admin VR1 DC0 metal-admin (GUA /64; D-139)
2602:f3e2:f02:21::/64 role=metal-internal VR1 DC0 metal-internal (GUA /64; D-139)
2602:f3e2:f02:30::/60 role=data-tenant VR1 DC0 data-tenant (GUA /60; D-139)
2602:f3e2:f02:30::/64 role=data-tenant VR1 DC0 data-tenant (GUA /64; D-139)
2602:f3e2:f02:40::/60 role=storage VR1 DC0 storage (GUA /60; D-139)
2602:f3e2:f02:40::/64 role=storage VR1 DC0 storage (GUA /64; D-139)
2602:f3e2:f02:50::/60 role=replication VR1 DC0 replication (GUA /60; D-139)
2602:f3e2:f02:50::/64 role=replication VR1 DC0 replication (GUA /64; D-139)
2602:f3e2:f02:80::/60 role=lbaas-mgmt VR1 DC0 lb-mgmt (GUA /60; D-139)
2602:f3e2:f02:80::/64 role=lbaas-mgmt VR1 DC0 lb-mgmt (GUA /64; D-139)
EXISTS (idempotent -- left untouched):
2602:f3e2:f02:10::/60 role=provider-public provider-public
2602:f3e2:f02:10::/64 role=provider-public provider-public
2602:f3e2:f02:11::/64 role=provider-public provider-public VIP
RETIRE -- REPORTED ONLY, this tool never deletes:
fd50:840e:74e2:220::/60 role=metal-admin VR1 DC0 metal-admin (ULA metal /60 (admin+internal); D-101/D-111)
fd50:840e:74e2:220::/64 role=metal-admin VR1 DC0 metal-admin (ULA /64 active; D-101/D-111)
fd50:840e:74e2:221::/64 role=metal-internal VR1 DC0 metal-internal (ULA /64 active (in metal /60); D-101/D-111)
fd50:840e:74e2:230::/60 role=data-tenant VR1 DC0 data-tenant (ULA /60; D-101/D-111)
fd50:840e:74e2:230::/64 role=data-tenant VR1 DC0 data-tenant (ULA /64 active; D-101/D-111)
fd50:840e:74e2:240::/60 role=storage VR1 DC0 storage (ULA /60; D-101/D-111)
fd50:840e:74e2:240::/64 role=storage VR1 DC0 storage (ULA /64 active; D-101/D-111)
fd50:840e:74e2:250::/60 role=replication VR1 DC0 replication (ULA /60; D-101/D-111)
fd50:840e:74e2:250::/64 role=replication VR1 DC0 replication (ULA /64 active; D-101/D-111)
dependent objects inside those prefixes: 26 ip-address(es), 0 ip-range(s)
DRY RUN -- nothing was written. Re-run with --commit to apply.
== d139-gua-carve vr1-dc1 (DRY RUN) ==
apex: http://10.10.1.10:8000 site: VR1 DC1 (id=9)
apex prefixes scoped to vr1-dc1: 21 (read this run)
CREATE 11 | EXISTS 3 | RETIRE-REPORT 9
CREATE:
2602:f3e2:f03:20::/60 role=metal-admin VR1 DC1 metal-admin (GUA /60; D-139)
2602:f3e2:f03:20::/64 role=metal-admin VR1 DC1 metal-admin (GUA /64; D-139)
2602:f3e2:f03:21::/64 role=metal-internal VR1 DC1 metal-internal (GUA /64; D-139)
2602:f3e2:f03:30::/60 role=data-tenant VR1 DC1 data-tenant (GUA /60; D-139)
2602:f3e2:f03:30::/64 role=data-tenant VR1 DC1 data-tenant (GUA /64; D-139)
2602:f3e2:f03:40::/60 role=storage VR1 DC1 storage (GUA /60; D-139)
2602:f3e2:f03:40::/64 role=storage VR1 DC1 storage (GUA /64; D-139)
2602:f3e2:f03:50::/60 role=replication VR1 DC1 replication (GUA /60; D-139)
2602:f3e2:f03:50::/64 role=replication VR1 DC1 replication (GUA /64; D-139)
2602:f3e2:f03:80::/60 role=lbaas-mgmt VR1 DC1 lb-mgmt (GUA /60; D-139)
2602:f3e2:f03:80::/64 role=lbaas-mgmt VR1 DC1 lb-mgmt (GUA /64; D-139)
EXISTS (idempotent -- left untouched):
2602:f3e2:f03:10::/60 role=provider-public provider-public
2602:f3e2:f03:10::/64 role=provider-public provider-public
2602:f3e2:f03:11::/64 role=provider-public provider-public VIP
RETIRE -- REPORTED ONLY, this tool never deletes:
fd50:840e:74e2:320::/60 role=metal-admin VR1 DC1 metal-admin (ULA metal /60 (admin+internal); D-101/D-111)
fd50:840e:74e2:320::/64 role=metal-admin VR1 DC1 metal-admin (ULA /64 active; D-101/D-111)
fd50:840e:74e2:321::/64 role=metal-internal VR1 DC1 metal-internal (ULA /64 active (in metal /60); D-101/D-111)
fd50:840e:74e2:330::/60 role=data-tenant VR1 DC1 data-tenant (ULA /60; D-101/D-111)
fd50:840e:74e2:330::/64 role=data-tenant VR1 DC1 data-tenant (ULA /64 active; D-101/D-111)
fd50:840e:74e2:340::/60 role=storage VR1 DC1 storage (ULA /60; D-101/D-111)
fd50:840e:74e2:340::/64 role=storage VR1 DC1 storage (ULA /64 active; D-101/D-111)
fd50:840e:74e2:350::/60 role=replication VR1 DC1 replication (ULA /60; D-101/D-111)
fd50:840e:74e2:350::/64 role=replication VR1 DC1 replication (ULA /64 active; D-101/D-111)
dependent objects inside those prefixes: 26 ip-address(es), 0 ip-range(s)
DRY RUN -- nothing was written. Re-run with --commit to apply.
