Multi-agent read-only planning pass for the dc0/dc1 container-layer elimination
in the 10.13 redeploy. Phases 0-4 (4 sonnet workers + 1 administrator/phase) +
a final advisor review; agents recorded as "the administrator"/"the advisor"
(no model name asserted, operator instruction). NOTHING built or executed
against the cloud -- produced a plan; every owed artifact is LOGGED, not built.

Phase-0 operator gate: confirmed Option 1 (flat node VMs on vcloud libvirt + a
small per-DC vr1-dcN-client VM) + cross-DC handling (a) -- directional, not the
GA-R5 [ARCH] ruling.

Deliverables (docs/audit/container-elim-pass/):
- operator-report.md          -- the single consolidated report
- FINAL-PLAN.md               -- 104-row change-set + L0-L5 module design +
                                 Part-A/B sequencing + D-144 decision package
- FINAL-advisor-review.md     -- verdict SOUND + 2 verified follow-ups
                                 (DEC-15 reach; DEC-24 dc0<->dc1 mesh/Ceph path)
- pass0..4 worker + admin docs (20)

Key findings: the container layer is the one violation of the repo's
IaC->procedure boundary (inner root's qemu+ssh provider); root topology (B)
shared-outer + per-DC-flat recommended; three isolation controls owed incl. the
MAAS power-key blast radius (flattening makes SEC-012/016 per-DC separation
vacuous absent a mitigation); 13 owed artifacts; 9 owed live measurements.

OWED (operator, GA-R5): the Tier-1 package -- DEC-01 adopt as new D-144
(supersedes D-123 Model B; D-143 precedent) + amendments D-128/D-134/D-131 +
DEC-15/14/16/11/08/24. Model B stays the LIVE shape until D-144 is ruled.

CURRENT-STATE.md updated in the same commit (GA-R1 C1): the container-elim block
flips SCOPED/NOT-YET-RUN -> RAN + owed-ruling pointer. repo-lint 0-fail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728