Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / archive / session-ledger-rotated-20260727.md
@JANeumatrix JANeumatrix 2 hours ago 11 KB Session close: GA-R4 bookend, skill sweep, ledger rotation, permission block removed
Raw Blame History

session-ledger summaries rotated 2026-07-27 (GA-R4 rule 3 / F1 -- oldest-first)

Moved VERBATIM from docs/session-ledger.md at the Stage 4 close, to restore the 300-line cap (the live ledger was 317). These are the three 2026-07-23 closed-session summaries -- the oldest still-live ones. Each still points at its own archived full body; only the summaries moved. Status is in docs/CURRENT-STATE.md ONLY; this file is history.

SESSION CLOSE 2026-07-23 -- G12 dc1 edge->commission + CLOSE + MERGE (bounded, GA-R4)

  • Resumed from the 07-22 handoff (edge at login prompt); drove dc1 to a commissioned fleet, every mutation operator-gated in manual permission mode (auto-mode classifier blocks remote sudo shapes instead of prompting -- manual mode is the fix; noted).
  • Edge: D-112(c) console bootstrap (payload needed util.inc/shell_safe -- dc0 lesson iv the .b64 lacked) + key auth + D-113(a2) API mint (transient post-restart-sshd scp, ssh-pipe workaround) + v4 addressing WAN 172.30.3.2 / LAN 10.12.64.1 (egress 0%).
  • dc-rack-net dc1 arm (harness 18/18) + install (forwarder answers maas-internal); region MAAS D-120 range + D-131 dns + DHCP primary_rack=nmpcq4 (dhcpd verified running).
  • SEC-016 RULED "Mint a dedicated dc1 power key" (per-DC isolation) + wired (script=svc key, MAAS snap=dedicated key). Commissioning ALL 9 READY ~3.5 min, shapes exact D-121 Option C -- dc0's two stacked faults pre-empted by pinned MACs + forwarder.
  • G12 CLOSED: gauntlet 76 GREEN, repo-lint 0-fail, consolidation + skill sweep (per-DC power key invariant) + GA-R7 memory review; MERGED to main (merge commit a5c0a49), branch retired.
  • Open after: SEC 12 rows (incl. SEC-015/-016); 3 findings (util.inc, scp readiness, snap-key refresh fragility); D-068 item1, D-131 sub-4, D-132 pinned. Next stage branches off main.
  • Full body: docs/archive/changelogs/changelog-20260723-g12-dc1-edge.md. Status ONLY in CURRENT-STATE.md.

SESSION CLOSE 2026-07-23 -- Stage 4 OPEN + carve + mirrors (bounded, GA-R4)

  • Stage 4 OPENED (branch dc-dc-stage4-phase3-maas-deploy); discovery captured; D-133 (flat per-NIC carve; hw-faithful NICs next deployment) + D-134 (+amendment: contiguous bands, Option B swap) ADOPTED, utterances quoted.
  • CARVE EXECUTED both DCs (logged stage4-carve): ranges .201-.254, 10 fabrics, 90 NIC re-homes, subnets+spaces, 18 nodes statics + br-ex; all Ready; capture committed.
  • Deploy model RULED: Ready handoff (DOCFIX-200 -- runbook Step 4 would have broken Stage 5); jammy images synced; per-DC tags applied 9+9.
  • Mirror: exception REJECTED -> D-135 ADOPTED; dc-mirror.sh shipped (19/19, gauntlet 77); INSTALLED both racks; initial syncs RUNNING at last check (hours; verify last-sync.status before citing). INCIDENT: dc1 edge pf never regenerated post- addressing -- filter reload fixed; appendix-A + DoD + script amendment QUEUED.
  • OWNED: pipe-masked L10 lint FAIL (repaired); dc0-only egress probe wrongly assumed symmetric (item 9).
  • Delivery batch LANDED before close (item 11): lib-hosts VR1 arms populated (tofu-name keys, pinned MACs, D-134 octets, host_sysid_by_bootmac) + D-133 guards in the two VR0 flow scripts + appendix-A pf entry + DoD items 8-9 + item-4 range fix; dc-selector 48, gauntlet 77 GREEN. At close: both syncs RUNNING (dc0 13G / dc1 15G pulled).
  • OPEN in-stage for the NEXT session: verify last-sync.status OK both racks (this session's watcher dies with it -- check at open); mirror node-side reachability gate; set-interface-v4 reload amendment (queued OPTION, unruled); local permission-rules prune (Bash(ssh *) flag); then the stage close-out set (consolidation, skill sweep, GA-R7 memory review, final gauntlet, operator-gated merge).
  • Details: docs/archive/changelogs/changelog-20260723-stage4-open.md. Status ONLY in CURRENT-STATE.md.

SESSION CLOSE 2026-07-23 -- queue pass + D-068 rulings (bounded, GA-R4)

  • Queue fully processed. Repo: 5 script/harness fixes (prep-image bash -s; headend hints + idempotent sec010 nft + staging dir; apikey readiness/retry) + DOCFIX-198 (Steps 9-10 superseded; DC standup DoD) + DOCFIX-199 (D-112(c) payload spec). Gauntlet 76 ALL GREEN.
  • Live (logged ops-sec010-reassert, all operator-approved): SEC-010 files idempotent on all 3 hosts (double-restart proof); G13 CLOSED -- office1 qga channel 0/1/0 saved-plan apply (guest-ping proven), edge 26.7 -> 26.7.1, os-iperf in after a measured refusal; outer plan re-converged zero diff. vr1-dc0-maas cache residue deleted (association-checked FIRST).
  • D-068 item 1: plan DRAFTED then Q1 (rehearsal EOL acceptance, 1b), Q2 STRUCTURE (Roosevelt on 1.8 + funded remediation track), Q3 (monthly checks -> ops-update-procedure 0c) ALL RULED -- individually confirmed after a volunteered batch answer (GA-R5 kept). Remainder: Q2 path at Roosevelt design time. NetBox residue -> docs/netbox-write-path-findings.md.
  • Owned: one capture commit pushed with a pipe-masked L10 lint FAIL; repaired same-hour.
  • GA-R7 memory review: no changes. AT CLOSE: ledger-scan FALSE-CLOSE defect found (tail-appended detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded.
  • Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md.

SECOND ROTATION PASS 2026-07-27 (at the Stage-5 grounding audit close)

The live ledger reached 305 lines against the 300-line cap after that session's bookend landed. The oldest remaining live summary moved here VERBATIM, oldest-first per GA-R4 rule 3 / F1. It still points at its own archived full body.

SESSION CLOSE 2026-07-24 -- caveman guardrails + DC1 proxy-build start (bounded, GA-R4)

  • caveman plugin DISABLED (enabled:false both scopes) + SEC-017 + guardrails (repo-lint L11 *.original.md detector; deny compress; CLAUDE.md norm). commits up to 338c919..d0db020.
  • DC-mirror: DC0 full mirror still syncing; DC1 debmirror PAUSED ~330G (bandwidth NOT the bottleneck, measured) + switched to an INTERIM apt caching proxy (D-135 AMENDED 2026-07-24): scripts/dc-cache-proxy.sh shipped + INSTALLED on dc1 (serves archive+UCA 200). Two per-DC Stage-5 test methods (dc0 full-mirror / dc1 proxy) = gates on ONE branch, not sub-branches.
  • DC1 Stage-5 deploy STARTED: per-DC MAAS creds (SEC-018/-019); Juju 3.6.25 on voffice1 (headend, D-128); add-cloud vr1-maas + add-credential both DCs; VIP overlay overlays/vr1-dc1-vips.yaml; phase-4 Step 2.0 (MAAS-cred task) added. commits ..116e9b2.
  • BLOCKED before bootstrap (committee-reviewed): committed bundle.yaml is still VR0 4-node HYPERCONVERGED; VR1 dc1 is 9 ROLE-SEPARATED (D-121 Option C). Architecture DECIDED, deploy ARTIFACTS not rendered (dc-ha-scaleup.yaml partial/unrendered/dc0-named/stale/unwired; tag/ placement/num_units unhandled; phase-4 runbook stale). DNS confirmed GREEN for bootstrap (D-131 forwarder resolves external; hang can't recur) -- but bootstrap needs edge egress OPEN (juju agents/snaps unmirrored); do NOT narrow egress until after bootstrap.
  • OWNED: I fabricated a "D-193" reference in analysis (cardinal sin) -- corrected to D-121; verified NOT persisted to repo. NEXT SESSION: render vr1-dc1 role-separated HA bundle + wire overlays + de-stale phase-4, THEN bootstrap. Full detail: CURRENT-STATE Stage-4 bullet.
  • Status ONLY in CURRENT-STATE.md. Changelog: docs/archive/changelogs/changelog-20260724-caveman-disable.md.

THIRD ROTATION PASS 2026-07-27 (at the Stage-5 grounding-audit close)

The live ledger reached 321 lines against the 300-line cap after the audit's addendum landed. The oldest remaining live summary moved here VERBATIM, oldest-first per GA-R4 rule 3 / F1. It still points at its own archived full body.

SESSION CLOSE 2026-07-25 -- handoff-pack execution + recon + Chat D-136 coupling (bounded, GA-R4)

  • IMMEDIATE NEXT (do FIRST): MAAS WEB-GUI login does NOT exist -- SEC-018/019 are API/Juju-only keys; the juju-vr1-dc0/dc1 superusers have RANDOM UNSTORED passwords, so the operator is locked out of the MAAS webpage (never minted; no prior task did it). Fix, operator-run on voffice1: sudo maas createadmin --username=<you> --email=<you> (or maas changepassword <user>); +SEC row.-> FALSIFIED + RESOLVED 2026-07-25 (SEC-020). The premise was wrong: GUI login DID exist. The admin superuser's password was minted 2026-07-13 by site-headend-install.sh:452 and MEASURED working this session (login 204 with the stored value vs 400 wrong-password control) -- it was merely root-only on voffice1 and un-consolidated (the SEC-009 miss class, not a missing account). Only the two juju-* clause was correct. DONE under operator-ruled scope "New account + consolidate only": admin password consolidated byte-identical to ~/vr1-office1-creds/ (VM copy stays source-of-record, NOT rotated); NEW operator superuser minted for human GUI login (stdin, never argv); dc0/dc1 manifest backfill -> creds-audit CLEAN all three sites. The juju-vr1-dc0/dc1 passwords remain random+unstored BY RULING -- their API keys are load-bearing for the blocked Stage-5 bootstrap, and operator removes any need to log in as them.
  • RECORD PHASE DONE + pushed (thru 87cec53): Rulings 1/2/3 (GA-R5 verbatim), D-136 PROPOSED (NetBox render pipeline, opt C, non-gating), DOCFIX-201 (D-020 not D-036, 7 sites)/-202/-203; pack-review committee + Chat open-Q5 (Jenkins IS the runner) folded in. DC0 mirror COMPLETE (949G+342M). lint 0.
  • GATED EXECUTION pending (each gated): verify MAAS role tags LIVE (deploy-blocking) -> 10th controller VM -> dc0 VIP extract (2 commits) -> vault-VIP repair (BLOCKER-1/2 + VIP_OCTET_MAX) -> DC-aware gates -> bootstrap. KEEP _handoff-not-committed/ (item 60 vault values not yet consumed).
  • Open sub-rulings: octavia family, reserved-range registry, vault-vip-derivation file. Deferred: CURRENT-STATE s4 stale-HIGH, G14 SEC 12->15, phase-4 designate. Chat skill pkg: .claude/skills/openstack-cloud-ops-consolidated-20260725.md. Detail: changelog items 1-17.

FOURTH ROTATION PASS 2026-07-27 (same close; cap still breached after the third)

The third pass left the live ledger at 307 lines against the 300-line cap, so the next oldest live summary moved here VERBATIM as well.

SESSION CLOSE 2026-07-25 -- MAAS admin-account recovery (SEC-020; bounded, GA-R4)

  • PREMISE FALSIFIED before any mutation: MAAS GUI login DID exist -- admin pw minted 2026-07-13 by site-headend-install.sh:452, MEASURED working (204 vs 400 wrong-pw control). Defect was root-only + un-consolidated on voffice1 (SEC-009 class), NOT a missing account.
  • Scope RE-RULED by operator: "New account + consolidate only" -- no existing password rotated.
  • DONE: operator superuser minted (pw via stdin, never argv); admin pw consolidated byte-identical to ~/vr1-office1-creds/ (VM copy stays source-of-record); dc0/dc1 manifest backfill -> creds-audit CLEAN x3; README index lists both. juju-* UNTOUCHED by ruling (their SEC-018/019 keys gate the blocked Stage-5 bootstrap). SEC-020 opened (open rows 15->16); falsified IMMEDIATE NEXT struck; machine-derived block re-seeded.
  • OWNED: called a login probe read-only; it authenticated, writing last_login twice (benign).
  • LOGGED not executed: headend-install consolidate-at-mint; conflation proposable as next-free D [ARCH]; 3 /root secrets unmoved. GA-R4 F1: ledger 370 lines at OPEN vs 300 cap -- rotation OWED. (DISCHARGED 2026-07-26: rotated oldest-first to 280 lines; see the ROTATED block above.)
  • Gauntlet 79 GREEN, repo-lint 0-fail, b2b0c80 pushed. Bookend EARLY (07-21 precedent); further work appends a POST-CLOSE ADDENDUM. Details: docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md.