Pass 3 -- ADMINISTRATOR REPORT: tests review (container-layer elimination)

Author: the Phase-3 administrator (multi-agent pass, SCOPE-AND-EXECUTION-PLAN.md Section 4). Date: 2026-08-09. Inputs: pass3-w1-harnesses-gauntlet.md, pass3-w2-gates.md, pass3-w3-new-tests.md -- read in full, adversarially cross-checked against repo ground truth (checks logged in Section 1). Baseline consumed: pass0-admin-report.md incl. Section 7a (Option 1 CONFIRMED; cross-DC handling (a) CONFIRMED; MAAS region stays on vr1-dcN-maas-01), pass1-admin-report.md (planning change-set; the (a)-control consolidated spec, Section 3), pass2-admin-report.md (tools change-set; the THREE isolation concerns, Section 2; the 13 owed artifacts, Section 5). READ-ONLY synthesis; no mutation; findings are LOGGED, not executed. All dispositions are proposals feeding Phase 4 (GA-R5); contingent items are marked with their blocking ruling, never pre-picked.

Repo discipline governing every row: an assertion must be provably able to FAIL (GA-R6, SKILL.md:321-333); assert on CONTENT not existence; REFUSE on unrecognised input, never pass silently; a fix that makes an assertion stale gets REPLACED with the new invariant, never deleted to go green.

1. Reconciliation / adversarial-check results (run against repo ground truth this session)

1. The two harness universes UNIFY cleanly -- with two count corrections, no contradictions.

   • W3.1's "13 of 103 affected" needs granularity: its own verdict line ("2 clean RETIRE, 2 contingent RETIRE, 6 CHANGE, 1 contingent CHANGE") sums to 11 verdict-blocks; the survey table names 14 harnesses (one, netem-link, a declared grep false-positive). Reconciled: 13 harnesses carried a survey hit; 8 of them carry CHANGE/RETIRE verdicts; 5 are graded STAY. The unified table (Section 2) is presented at verdict-block granularity so the counts fall out of it.
   • W3.3's summary line "6 new + 5 extend-existing + 2 ride" does not decompose against its own rows -- CORRECTED. By its own per-artifact dispositions: 7 new-build (#12 dc-site, #2 (a) control, #1 teardown primitive, #11 power-key mitigation, #13 D-131 evidence, #4 R7 checklist, #5 MAAS record release/delete), 3 extend-existing (#3 SEC-010 successor -> tests/site-headend-install (conditional: new harness if the extraction becomes its own script), #7 FIT extension -> tests/dc-dc-whole-host-budget, #9 NetBox migration -> tests/dc-rack-mgmt-import), 3 ride (#6 rides #1's harness, #8 rides dc-site's MAC invariant, #10 rides geneve-encap-assert unchanged). 7+3+3 = 13; all owed artifacts accounted for. (The phase prompt inherited the 6/5/2 figure from W3.3's own summary line -- this is a worker-count correction.)
   • Overlap check (the load-bearing one): of the 3 extend-existing, #3 and #9 map INTO W3.1's affected set (site-headend-install Section-8 SEC-010 sub-case; dc-rack-mgmt-import vvr1 pins) -- the same edit seen from two sides, MERGED in Section 2, not double-counted. #7 crosses the universe boundary knowingly: dc-dc-whole-host-budget sits OUTSIDE W3.1's 13 (its Sec 3.4 supplementary note routes it to W3.2/W3.3 explicitly), and W3.3 #7 picks it up -- the one clean boundary crossing, now inside the unified set (Section 2 row C8). No worker contradicts another anywhere in the two universes.

2. The power-key (#11) critical-path dependency is CONSISTENT across all three workers -- W3.1 (edit-list item 4: dc-selector + maas-region-power-key edited ONLY together with #11's ship, from the ruled URI/key shape), W3.2 (P4's power-address assertion and P5's new register row BLOCKED on #11's mechanism; Sec 4 risk 1), W3.3 (Sec 2.4: the harness + artifact are a stated PRECONDITION for the lib-hosts.sh re-derivation and every call-site literal). Stated plainly as the sequencing constraint in Section 4: owed artifact #11 blocks a six-item cluster of test edits, and the interim RED those harnesses will show once lib-hosts.sh changes is the DESIRED fail-loud state, not a defect to green out.

3. Gate homes are COHERENT and each assertion is failable (Section 3 verified row-by-row against W3.2 Sec 1-3 and W3.3 Sec 2): (i) Stage-1 gate + cloud-assert A11a -- enumerates the live bridge set and REFUSES if fewer than the full plane count resolves (SEC-010's fail-open lesson generalized), plus W3.3's no-host-address-on-bridge and does-not-globalize failing fixtures; (ii) preflight P10 (P10 confirmed the next free slot; P6 is the reserved non-executing reminder block) -- host-bound --check on the P7 model, REFUSE off-host, REFUSE on an absent transit interface; (iii) P4-dependency + A11b -- the pass verdict is tied to a NEGATIVE test (the key CANNOT reach the wrong domains) plus W3.3's positive-coverage diff against the DC's own roster and a must-not-over-restrict control. None is an existence-only check; none is a checker-that-cannot-fail. One administrator spec amendment (recommendation grade): P8's root enumeration must come from a DECLARED root list, not a filesystem glob -- a glob loop is a checker-that-cannot-fail for a missing/renamed root (it silently drops out of coverage instead of FAIL/WARN). Section 3 carries it.

4. Two coverage gaps the workers left dangling -- CLOSED BY MEASUREMENT this session:

   • scripts/pre-flight-checks.sh body sweep (W3.2 Sec 4 risk 3 flagged it read by neither worker): grep for W3.1's exact term set (vvr1|qemu+ssh|172.31|host-nodes|expose_nested|inner root|bootstrap gate|Model B| node_host) returned zero hits (rc=1). Its container-layer exposure is entirely INDIRECT via sourced lib-hosts.sh (pre-flight-checks.sh:44-45) -- the dc-selector-covered surface. No direct edit owed to its body; the NEW post-#11 content assertion (Section 3) is net-new, homed in tests/pre-flight-checks (harness exists, verified ls tests/).
   • lib-identity.sh harness status (pass2 Section 6's unclosed worker handoff): ANSWERED by W3.1's no-hit list -- tests/lib-validate exercises the lib-hosts/lib-net/lib-identity plumbing generically. Closed.

5. One pass2 Phase-3 handoff was addressed by NO worker -- carried OPEN, not dropped: the maas-fabric-prune.sh/maas_fabric_classify.py harness gap (pre-existing; pass2 Section 6 routed "build vs accept-as-named-exception" to this phase). Verified this session: tests/maas-fabric-prune does not exist. None of W3.1/W3.2/W3.3 mentions it. Routed to Phase 4 as a named decision exactly as pass2 framed it (Section 7 open item 8). It is container-elim-ADJACENT only (a pre-existing gap), so parking it there loses nothing from this change-set.

6. Next-free SEC number: SEC-034 CONFIRMED -- with the verification shape stated honestly. ledger-scan.sh computes next-free for D/DOCFIX/BUNDLEFIX only (run this session: D next-free=144, DOCFIX=214, BUNDLEFIX=059), NOT for SEC rows; the SEC confirmation rests on the direct ledger grep: highest row in docs/security-ledger.md = SEC-033, and the sole repo-wide SEC-034 mention is W3.2's own doc. 2-or-3 new SEC rows are owed ((a) control; #11 mitigation; and concern (ii)'s row, which pass2 deliberately left as a "SEC-row disposition" -- it may land as a SEC-010 amendment rather than a new number). Nothing assigned here; delivery greps next-free at mint time per repo numbering discipline.

7. Denominator + doc-currency: tests/HARNESS-MANIFEST lists 103 harnesses (tests/ holds 104 entries including the manifest itself) -- W3.1's denominator confirmed. CLAUDE.md's "98 harnesses" line is stale vs 103 -- logged as a doc-currency nit OUTSIDE this pass's change-set (rides the next CLAUDE.md touch; no action here).

8. No inferred-value violations found in the three worker docs. Spot-checked load-bearing cites (preflight.sh P8 root literal :284,298; cloud-assert.sh A0-A10 shape; site-headend-install.sh SEC-010 writer/check line ranges; node-vm/variables.tf:38-62 MAC validation; security-ledger.md:21 fail-open hardening note; the changelog cites for D-131 asymmetry) resolved to the cited lines. Every unknown (root naming, #11 mechanism, (a) rule set, P10's body, D-127's client-VM autostart value) is marked OWED in the source docs rather than guessed.

2. THE UNIFIED TESTS CHANGE-SET (one table, three dispositions, no double-counting)

Blocker legend: ready = editable/buildable at delivery with no ruling owed; #11 = blocked on the power-key mitigation design (Section 4); root-naming, rack-ret (rack-controller retirement + owed live re-measure), D-131 (retirement ratification + owed live re-measure), netbox (NetBox migration design, owed #9), mechanism (the artifact's own Phase-4 mechanism choice), root-fork (root-topology ratification).

A. EXISTING -- CHANGE (9 verdict-blocks across 9 harnesses)

B. EXISTING -- RETIRE (5 verdict-blocks across 3 harnesses)

STAY, named so they are not re-litigated: opentofu-validate T8-T10 (S3 module-body cases); node-vm T1-T7/T12-T15; site-headend-install Sections 1-5,7; maas-node-power (URI fixture is an opaque pass-through arg -- cosmetic refresh optional); preflight pending-change fixture; geneve-encap-assert (all cases -- its post-build live re-run is a new INVOCATION, owed #10, not a harness edit); site-baseleg (guard already forward-compatible; comment re-cite is doc-currency); cloudinit-vm; d124-transit-seed; netem-link (declared grep false-positive); the 90 no-hit harnesses.

C. NEW-BUILD (7 harnesses, one per owed artifact; specs in pass3-w3-new-tests.md Sec 2-3)

Rides (no build): #6 -> C3's fixture library; #8 MAC re-measure -> C1's MAC invariant;

#10 geneve/jumbo -> existing geneve-encap-assert verbatim, new invocation point in the runbook only.

3. GATE-HOME MAP -- the three isolation controls + preflight/cloud-assert changes

SEC rows: next-free SEC-034 (check 6); 2-or-3 rows owed ((a) control, #11, and concern (ii)'s disposition -- possibly a SEC-010 amendment); minted at delivery, next-free re-grepped then.

4. THE CRITICAL-PATH SEQUENCING CONSTRAINT (stated plainly)

Owed artifact #11 (the power-key blast-radius mitigation) is a BLOCKER for a six-item cluster of test work. Until its mechanism is chosen (Phase 4) and its artifact

• C4 harness ship, NONE of the following may be written -- a guessed URI/key value here is the false-green mint this repo's inferred-value rule exists to prevent:

• lib-hosts.sh VIRSH_POWER_ADDRESS_FROM_OFFICE1/_FROM_DCREGION re-derivation (the tools-side edit the tests then pin);

• dc-selector power-address rows (A4);
• maas-region-power-key URI assertions (A5) -- A4/A5 edited TOGETHER, same session, same ruled shape;
• the new tests/pre-flight-checks P4 content case (A9);
• cloud-assert A11b's concrete body;
• the P5 register row for the mitigation's key material.

Order: Phase-4 mechanism choice -> #11 artifact + C4 harness -> then the cluster, as one delivery unit. Interim state is deliberate: A4/A5 go honestly RED the moment lib-hosts.sh changes -- that fail-loud RED is wanted; do not "fix" it early. Independent of this cluster (may proceed in parallel once their own blockers clear): A1/A2 (root-naming), A7 (rack-ret), B1/B2 (ready), C1/C5/C6/C7 (ready/spec-ready).

5. HARNESS-EDIT HAZARDS (delivery-time warnings, consolidated from W3.1 Sec 3)

• H1 -- the plausible-URI swap (sharpest risk in the survey): swapping a plausible-looking new power URI into A4/A5 ("just point it at vcloud") before #11's mechanism exists produces a harness GREEN against a value nothing enforces -- worse than the current honest RED. Only the ruled shape, only both harnesses together.
• H2 -- the rc=2 coincidence: if --host-nodes is REMOVED as a flag, a stale case like --host-nodes without --role rack -> 2 can keep passing on the unrecognized-flag exit code, silently changing what the assertion proves. Re-derive every expected rc from the NEW arg-parse contract; never assume rc=2 still means what it meant.
• H3 -- delete-to-go-green: a stale hardcoded path in A1/A2 fails LOUD (safe); the hazard is a sloppy fix that deletes the case instead of re-pointing it, quietly dropping D-127 autostart-drift / MAC-count regression coverage (this class has gone red twice before, tests/node-vm/run-tests.sh:68-81). Replace, never delete to go green.
• H4 -- the harness that stays green against a dead topology: dc-dc-whole-host-budget's Model-A/B math keeps passing indefinitely after the topology it models is gone; nothing forces a re-run until #7 ships. A8's extension must land WITH the redeploy, and the old cases must not remain the sole coverage.
• H5 -- the retirement residual gap: retiring T13 leaves a stray vvr1 autostart re-add uncaught unless B1's negative-assertion case is added (recommended over accept-and-declare).
• H6 -- glob-based gate enumeration (administrator addition): P8's root loop -- and any future multi-root/multi-host gate -- must iterate a declared list; a glob cannot fail on an absent member.

6. THE PER-MODULE HARNESS CONTRACT (adopted from W3.3 Sec 4 -- the template every

Section-2 row follows)

Adopted unchanged as the Phase-4 backbone; every principle grounded in an existing repo precedent (cited in pass3-w3-new-tests.md Sec 4): prove-it-can-fail (every assertion ships a fixture engineered to redden it); assert the ARTIFACT, not the intent (the installed rule / rendered file / deployed value, never a comment or self-report); stage-assert-then-promote (mutating subjects write to staging, assert staged, then promote); join the workspace to the deploy input (byte/value equality between generator output and what the consumer actually reads); fail-closed on absent/empty/unreachable input (incl. the interface-name fail-open class); offline/fixture-driven by default (fakebin or captured text; a separately-named LIVE gate re-run proves the deployed state -- two tiers, never conflated); $SITE/$DC-parameterized (fixtures exercise both DCs or a synthetic site); standard exit contract (lib-validate.sh 0/1/2/3/4); delivery discipline (own tests/<name>/run-tests.sh, changelog with revert, repo-lint clean -- no new-module exception).

7. Settled vs OPEN

SETTLED at this phase (do not re-open): the unified change-set decomposition (9 existing-change / 5 existing-retire verdict-blocks / 7 new-build harnesses / 3 rides; count corrections in check 1); the gate-home map (Stage-1 for (i), P10 for (ii), P4+A11b split for (iii), P8 declared-list loop, rack-evidence as one-time); the #11 sequencing constraint (Section 4); SEC-034 next-free; the harness contract template; pre-flight-checks.sh measured clean of direct container-layer literals; the lib-identity handoff (covered by tests/lib-validate); geneve-encap-assert and cloud-assert A0-A10 confirmed topology-agnostic.

OPEN -- carried to Phase 4 (rulings; operator rules, GA-R5):

1. Root NAMING (blocks A1/A2 path re-points; pass2 Section 6 item 2).
2. Rack-controller retirement ratification + the owed live re-measure (blocks A7, B3; shapes A6's concept question).
3. D-131 retirement ratification + live re-measure (blocks B5; C5's dc1 case stands RED until the live retirement).
4. The #11 mechanism choice (restricted key / wrapper / polkit ACL) -- unblocks the Section-4 cluster; its SEC row minted with it.
5. The (a) control's concrete nftables rule set + SEC number (C2's fixtures are mechanism-agnostic until then).
6. A11's home: fold into cloud-assert vs a dedicated isolation-assert.sh (W3.2 Sec 4 risk 5 -- recommendation-grade either way).
7. NetBox-migration design (owed #9) -- rename-in-place vs concept retirement for A6.
8. maas-fabric-prune harness gap (pre-existing; no Phase-3 worker addressed it, check 5): build vs accept-as-named-exception -- a named Phase-4 decision.
9. D-127 client-VM autostart value (A1's new case needs the ruled value).
10. The teardown primitive's fixture shape rides the root-fork ratification (C3).

Doc-currency nits (ride other edits, no action here): CLAUDE.md "98 harnesses" vs 103; opentofu-validate header "416 GiB" comment; maas-node-power cosmetic URI fixture refresh.

8. Verification note

Author = "the administrator" (no model name asserted, operator instruction). Direct measurements this session: grep -oE 'SEC-[0-9]{3}' docs/security-ledger.md (highest = SEC-033) + repo-wide SEC-034 grep (sole hit = W3.2's own doc) + bash scripts/ledger-scan.sh (D/DOCFIX/BUNDLEFIX next-free; confirms it does not compute SEC); grep -nE '<W3.1 term set>' scripts/pre-flight-checks.sh -> zero hits (rc=1) + lib-hosts sourcing at :44-45; ls tests/ + wc -l tests/HARNESS-MANIFEST (103; 104 entries incl. the manifest); tests/maas-fabric-prune absent; tests/pre-flight-checks and tests/preflight both exist (distinct). The three worker docs and three prior admin reports were read in full; worker citations were spot-checked at their load-bearing points, not re-derived wholesale. READ-ONLY; findings LOGGED only; nothing executed.