2026-07-16 -- D-124 addressing pinned: transit supernet 172.31.0.0/24 + ratified rack values

Context

The operator resolved the three scoping flags netbox/dc-rack-mgmt-import.py had surfaced (seed the transit role; carve a dedicated transit supernet; prefix scope) and ratified the transit /30 + rack IP. This pins the importer's CONTAINER and records the values. NO apex mutation happened here -- office1-netbox (10.10.1.10) is UNREACHABLE from the vcloud jumphost (measured: ping/TCP:8000/HTTP all fail, no SSH/tunnel), and the apex token lives on that host. The --commit is an on-host operator step.

Operator rulings (2026-07-16)

Seed a NEW dedicated transit role (not the shared infra role).
Carve a dedicated transit supernet, NOT under Cloud 10.12.0.0/16. Ratified 172.31.0.0/24 (mirrors the Edge role's dedicated 172.30.0.0/16; /24 = 64 /30s, ample for ptp transit links).
Transit prefix scope = dcim.site:vr1-dc0 ("mirror the edge").
Ratified values: transit /30 172.31.0.0/30 (region/peer .1, rack .2); rack IP 10.12.8.2.

What changed (repo-side; pushable)

netbox/dc-rack-mgmt-import.py: CONTAINER = "10.12.0.0/16" -> "172.31.0.0/24" (+ header note: dedicated transit supernet, operator-pinned; scope-flag comment updated to RULED). Usage example updated to the ratified values. The importer STILL takes --transit-cidr/--rack-ip as required inputs (no invented literal) and still fail-loud on a missing/collision container.
tests/dc-rack-mgmt-import/ (harness + test_logic.py): the CONTAINER assertion + every transit fixture rebased Cloud->172.31.0.x (preserving each /30,/31,/29,host-bit shape so the shape/host-bit rejections still die for the RIGHT reason, inside the new container). 10.12.8.x rack fixtures unchanged (metal-admin is unchanged). 96/96 PASS.
docs/design-decisions.md: D-124 AMENDMENT recording the carve + ratified addressing.

Still operator-gated (cannot run from the vcloud jumphost)

The apex is unreachable here + the token is a secret on office1-netbox, so the operator runs, on that host:

A. edge-WAN /24s (IPAM hygiene; the edge role/container must exist first):

# d115-office-carve.py --commit  (seeds Office + Edge roles/containers), THEN:
NETBOX_URL=http://10.10.1.10:8000 NETBOX_TOKEN="$(sudo cat /root/netbox-secrets/api.token)" \
  python3 netbox/dc-edge-wan-import.py            # dry-run; add --commit  (loads 172.30.2.0/24, .3.0/24)

B. D-124 transit + rack IP (unblocks tofu plan):

# 1. seed the `transit` role in office1-netbox
# 2. carve 172.31.0.0/24 (a container prefix, role transit) -- confirm free in the LIVE apex
NETBOX_URL=http://10.10.1.10:8000 NETBOX_TOKEN="$(sudo cat /root/netbox-secrets/api.token)" \
  python3 netbox/dc-rack-mgmt-import.py --transit-cidr 172.31.0.0/30 --rack-ip 10.12.8.2   # dry-run; add --commit

C. fill the four rack tfvars (a gitignored local opentofu/*.auto.tfvars on the host that runs tofu plan), matching the committed NetBox values: vr1_dc0_rack_metal_admin_ip = "10.12.8.2" vr1_dc0_rack_transit_ip = "172.31.0.2" vr1_dc0_rack_transit_prefix = 30 vr1_dc0_rack_transit_peer_ip = "172.31.0.1"

Only C unblocks tofu plan (D-125 needs no NetBox object). The importers' die-if-absent preconditions (role/container/site) are the safety net; run them in the order above.

Verification

bash tests/dc-rack-mgmt-import/run-tests.sh -> 96/96 PASS.
bash scripts/repo-lint.sh -> 0 fail (1 legacy WARN).

Revert

git checkout netbox/dc-rack-mgmt-import.py tests/dc-rack-mgmt-import/ (restores CONTAINER = Cloud + the old fixtures); delete the D-124 AMENDMENT (transit supernet) from docs/design-decisions.md. No cloud/apex state touched (nothing was committed to the apex).