| 2026-07-20 |
Pod path chased to root cause: MAAS virsh pods incompatible with node-vm volume-ref disks; per-machine power PROVEN working
...
Dedicated MAAS->libvirt key minted+wired (operator-ruled). Two further
measured findings: (1) MAAS dials the pod from the REGION, not the rack, so
the credential belongs where MAAS dials from; (2) each 503 created a broken
pod server-side outside tofu state (both deleted). Final blocker: domblkinfo
fails on pool+volume disk refs -- reproduced LOCALLY on the rack with an
active pool, so it is libvirtd, not snap/SSH. Making pods work would mean
converting node-vm to file-path disks + re-applying 9 domains. Not needed:
the pod's job was discovery, which PXE already did, and per-machine
power_type=virsh query-power-state returns state=off on the canary. Per
machine power is also the Roosevelt shape (IPMI per node). Awaiting ruling.
CURRENT-STATE untouched pending the ruling.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Step D part 2: MAAS root shipped; apply refutes D-123's local qemu:///system pod mechanism
...
New opentofu/vr1-dc0-maas root (isolates MAAS creds from substrate roots
per DOCFIX-179's lesson); plan clean, apply failed 'Failed to login to
virsh console'. MEASURED root cause: confined MAAS snap gets Permission
denied on libvirt-sock and ships NO libvirt interface to connect -- a local
qemu:///system pod is architecturally impossible with snap MAAS. D-123
Model B and modules/maas-vm-host both state that mechanism; intent (no
cross-fiber dial) survives, mechanism does not. Amendment pending a ruling.
qemu+ssh replacement measured feasible (snap ships ssh; rack user in
libvirt group). Nothing was created by the failed apply.
CURRENT-STATE updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
INCIDENT RESOLVED + G10 depth-4 boot gate PASS: all 9 DC0 nodes enlisted in MAAS
...
Region restart recovered Temporal; dhcpd verified by PROCESS on both
controllers (0->1 each), not by service_set. One restart fixed both sites,
confirming the single wedged-Temporal root cause. The identical canary that
had failed then enlisted immediately -- proof it was the real blocker.
All 9 nodes enlisted with shapes exactly matching D-121 Option C
(3x16/64, 2x12/48, 4x8/24): node VMs inside vvr1-dc0 PXE-booted from the
Office1 region across the transit and run the ephemeral kernel = real
nested KVM at depth 4, proven behaviorally. Appendix-A entry queued for
this new incident class.
CURRENT-STATE updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Step D part 1 done (metal-admin DHCP configured); INCIDENT: MAAS DHCP down region-wide (Temporal wedged)
...
Rack registered + ruled dynamic range 10.12.8.100-.200 + VLAN 5005
dhcp_on/primary_rack verified by read-back. Canary node did NOT enlist:
measured dhcpd off, no process, no generated config on the rack while the
API reports dhcp_on=True -- config and running state disagree. Region
journal shows Temporal wedged ('Not enough hosts to serve the request',
2807 retries), and MAAS 3.7 drives DHCP through Temporal workflows.
Scope is wider than this deploy: voffice1 has NO dhcpd process either, so
Office1's own DHCP has been down since ~the 2026-07-17 reboot, masked by
both service VMs already being Deployed. Remedy proposed, NOT run (gated).
Detection gap queued: cloud-assert trusts MAAS's self-report.
CURRENT-STATE updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
D-129 edge profile APPLIED on 26.7: qga channel shipped, plugins installed, agent ANSWERS guest-ping
...
expose_qga_channel (opt-in, default OFF; dc0 true) applied as an in-place
domain update -- disk with the console/API bootstrap never at risk. Real
install (status ok + msg_uuid, not dry-run echoes); service started via the
plugin's own API; gate met to the runbook's bar: guest-ping -> {'return':{}}
and domifaddr --source agent reports both legs. Prior capture of the same
name recorded the false dry-run and is replaced. Security finding queued:
the plugin can disable guest-exec RPCs (remote command execution) -- propose
at the 26.7 hardening review.
CURRENT-STATE updated in this commit (GA-R1/C1, L10 satisfied).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
FIX false-success: opnsense-plugins.sh apply ALWAYS dry-ran (DRY_RUN:+ expands on 0)
...
Found on the first-ever live run (vr1-dc0 edge, 2026-07-20): ${DRY_RUN:+--dry-run}
expands whenever the var is set and NON-EMPTY, and DRY_RUN=0 is non-empty -- so
every apply silently dry-ran while printing 'OK: profile applied'. Nothing was
ever installed by this script. The harness missed it because every test drove
--dry-run, leaving the live path with zero coverage. Fix tests the VALUE; harness
gains two live-path tests via a stub api client (verified to FAIL 2/2 against the
buggy version before restoring). 20/20.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
DC edge ADDRESSED: WAN 172.30.2.2/24 + default gw, LAN -> 10.12.4.1/22; edge egresses 0% loss
...
Applied via the new operator-ruled v4 setter pair, WAN first per its own
ordering warning. Kernel-verified both legs; 3 interfaces intact; API
answers at the new LAN address (CORE_ABI 26.7). The edge had shipped with
WAN on dhcp -- unworkable on a /24 with no DHCP server (same fact behind
the earlier probe artifact). Interim bootstrap address removed.
CURRENT-STATE position + G10 row updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
D-125 egress isolation gate: PASS / CLOSED -- bridge-in proven end to end (2 identical runs)
...
Measurement disproved the missing-rule hypothesis first: operator-run nft
dumps show virbr4 structurally identical to the working virbr11, with all
three masquerade rules present INCLUDING the generic one, already fired --
so the pre-staged net-destroy/net-start was correctly not run. Matrix
re-probe: gateway ping 0, internet ping 0, curl 1.1.1.1 301, curl
archive.ubuntu.com 200, twice. Run-2's one-off ICMP failure recorded
UNEXPLAINED rather than swept. Side observation kept: the WAN segment
cannot reach the Office1 LAN through the ISP NAT (D-122/SEC-010 intent
holding) -- queued as an explicit hardening assertion.
CURRENT-STATE position + G10 row updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
CORRECTION (GA-R1/C2): D-125 rack-bridge follow-up was CONFOUNDED, not evidence
...
The rack has no default route (transit-only netplan; WAN bridge IP-less),
so 172.30.2.51-sourced traffic to 1.1.1.1 fails in the rack's own routing
table before the NAT is consulted. Its ICMP/TCP failures say nothing about
virbr4; the only clean signal is the guest's ICMP failure, and a guest TCP
datapoint is still missing. Measurement request widened accordingly: FULL
nft AND iptables-save dumps (backend unmeasured), diffing virbr4 vs
virbr11 across BOTH rule families -- POSTROUTING masquerade (subnet-keyed)
and FORWARD accept (interface-keyed, which a subnet grep would miss).
Fix-forward pre-staged: net-destroy/net-start reinstalls libvirt's rules.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
D-125 egress gate executed (throwaway VM, as ruled): bridge-in PROVEN, upstream NAT egress fails -- gate OPEN pending one sudo measurement
...
Run 1 was a test artifact (probe used DHCP; uplink /24 has no <dhcp> by
design -- DOCFIX queued for the gate wording). Run 2 static: gateway
ping 3/3 across the nested bridge = the D-125 property PASSES; 1.1.1.1
fails for ICMP and TCP alike. Controls pass and net-dumpxml shows the
working/failing NATs are substantively identical, so the suspect is
vcloud's live virbr4 rules, not the design -- double-NAT fallback
deliberately NOT invoked. Probe guest + temp addresses removed.
CURRENT-STATE updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
DC edge bootstrap: D-112(c) console chain complete + API key minted; D-113(a2) PROVEN on 26.7
...
Key-only root SSH to vr1-dc0-opnsense; GET core/firmware/status 200
(CORE_ABI 26.7) -- first 26.7 revalidation datapoint for the API path.
Five measured console-bootstrap findings recorded (base64 chunking for
serial wrap; tcsh quoting; measured shell_safe include; local_user_set
required to materialize authorized_keys). Rack legs 10.12.4.2/10.12.8.2
added interim; script support queued as a finding.
CURRENT-STATE position updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Stage-close queue: operator-directed OPNsense 26.7 changelog/docs review (findings->proposals->rulings; D-129 anchor)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Deploy step C COMPLETE: inner apply 28/28 from voffice1, converged zero diff; 9 nodes + 26.7 edge RUNNING at depth-4; three first-real-apply fixes
...
voffice1 = Plane-2 executor (tofu 1.12.4, repo @29cf7bf, dc0 key,
keyscan'd known_hosts). Fixed forward, measured at first real use:
provider keyfile/sshauth URI params; wan-bridge illegal <mtu> in
bridge mode; base image uploads from the EXECUTING host (copied to
voffice1, description corrected); staging-dir literal created on
rack. Captures: inner-{plan,apply,converge}-20260720-stepC*.
Edge serial log at FreeBSD login prompt (26.7 D-112 first datapoint).
CURRENT-STATE position updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Deploy step B COMPLETE: rack bootstrapped + enrolled, SEC-010 CLOSED both ends (operator-ruled), OPNsense 26.7 base staged (operator-ruled); ledger-scan fail-open hardening
...
Bootstrap runs 1+2 (stale-lists 404 fixed by proxied apt update):
maas 3.7/stable, rack enrolled, libvirt+nested KVM, SEC-010 loaded
+ persistent on enp1s0; final --check EXIT 0 ALL items
(docs/audit/stepB-check-20260720-final.txt). voffice1-side SEC-010
pin applied per the row's follow-on clause. 26.7 nano prepped on the
rack (measured leaseweb mirror via region proxy); inner-root base
default -> 26.7. ledger-scan: FAIL-OPEN no longer counts as OPEN
(harness 45/45). CURRENT-STATE position/G10/G14 + section-5 updated
in this commit (GA-R1/C1). Open SEC count 8 -> 7.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Step B transit reach ESTABLISHED: voffice1 .1/30 applied (Kea re-key incident fixed); vvr1-dc0 netplan set-name root cause fixed; zero-diff converged
...
voffice1 transit NIC applied 1/1/1 exact; MAC-regen broke the Kea
reservation (measured .108) -- re-keyed via edge API, .20 restored.
vvr1-dc0 both-NICs-silent root cause: netplan match.name+set-name
(one-boot rename lag, measured offline via libguestfs); fix drops
set-name, keeps measured enp1s0/enp2s0, instance-id bump, seed
-replace 2/0/2 exact. Verified: ssh -J voffice1 w/ dc0 key,
rack->region 0% loss. Outer plan ZERO DIFF converged.
CURRENT-STATE sections 3+5 updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
| 2026-07-19 |
Step B prereq: voffice1 transit NIC authored (172.31.0.1/30 region end, D-124); ruling recorded; expected plan 1/1/1
...
Measured: transit net isolated, only vvr1-dc0 attached; nothing held .1.
Operator-ruled mechanism 2026-07-19: voffice1 via IaC + restart.
Capture: docs/audit/outer-plan-20260719-voffice1-transit.txt (1/1/1).
CURRENT-STATE sections 3+5 updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Deploy paused at A/B boundary; fresh-session handoff note (step B facts measured)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
DC0 deploy STEP A EXECUTED: outer apply 6/0/6 exact; G8+G9 CLOSED; convergence zero
...
Logged window dc0-deploy (as-executed log + index convention). G8 passed
in the apply session (six planes 0 leases, 0 attachments); validate
PASS; pre-apply capture equaled the recorded triple; the SAVED plan was
applied: 6 added / 0 changed / 6 destroyed. vvr1-dc0 RUNNING (108 vCPU,
416 GiB, autostart disable per D-127); vr1-dc0-uplink active; six vcloud
planes destroyed (Model B relocation); voffice1 + edge untouched (ids
1/2). Convergence re-plan: no differences (captured). CURRENT-STATE:
section 1 position, section 5 expected plan = ZERO DIFF (any diff is a
STOP), G8 + G9 rows CLOSED; active gate G10. Captures committed same
commit (C1/C2).
Revert: infra revert = runbooks/dc-dc-teardown-rollback.md decision tree
(NOT a blind destroy); docs revert = git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
AUDIT EXIT: operator re-signed CURRENT-STATE; G3+G11 CLOSED, G9 OPEN; session close (GA-R4)
...
Batch 6 item 6: signature utterance "Reviewed, approved, continue."
recorded into section 11 (replaces 2026-07-18 per GA-R1 rule 7). All six
exit runs PASS. G3 CLOSED (all six batches); G9 OPEN (audit criteria
MET; remaining closer = the operator-gated logged apply with G8 first);
FREEZE LIFTED. Session GA-R4 close: bounded 14-line summary in the
ledger, full body rotated to docs/archive/session-20260719-phase5-sweep.md.
Repo HEAD at signing = this commit's parent (437d9d1).
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 6 item 3: exit probe trio 21/21 -- 7/7 on ALL THREE (bar exceeded)
...
Three independent clean-context probes (repo + verbatim charter question
set only, read-only, no shared state; fresh contexts satisfy GA-R7/G2)
scored against CURRENT-STATE with citations spot-verified against the
tree. Unanimous on every question; third-trap picks varied (all real);
zero orientation divergence (all landed CURRENT-STATE-first via the
swept skill); probe hole H1 did not recur. Full scorecard in the exit
record. Remaining before audit exit: item 6 only (operator re-read +
re-signature). G3 cell updated same commit.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 6: exit runs 1/2/4/5 -- archive exclusion (operator-ruled), adjudication, plan==triple, S2
...
6.1: docs/archive/ joins docs/audit/ as inventoried-not-counted (ruling
quoted in the exit record); record-audit + harness 35/35; per-group
adjudication = ZERO contradictory status-claim pairs on counted surfaces
(the charter's criterion as stated); group floor 9 recorded as re-run
baseline; missed patch file archived; CURRENT-STATE stale-note made
token-free. 6.2: 16 top-level docs (<25). 6.4: fresh capture
outer-plan-20260719-phase6-exit.txt = 6/0/6 == section-5 triple. 6.5:
G9 row names SEC-010's step-B dependency (S2). Exit record:
docs/audit/phase6-exit-runs-20260719.md. Items 3+6 pend operator
execution. G3 cell updated same commit.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 5: skill sweep -- GA-R1..R7 implemented in openstack-cloud-ops (single commit)
...
New GA-rulings section reconciled against the RATIFIED text (draft
skill-additions cross-checked; the one draft-only item, the
reconciliation circuit-breaker, kept and marked as discipline). Stale
facts demoted to CURRENT-STATE delegation: the header's "current phase =
VR0 testcloud" and the deploy loop's "opentofu UNVALIDATED / no tofu
binary has ever run" (false since 2026-07-13). Session bookends + stage
close rewritten per GA-R4/GA-R6; change-delivery per GA-R2/D1; routing
rows re-pointed. Read-through checklist committed:
docs/audit/skill-sweep-checklist-20260719.md (every ratified rule ->
disposition). G3 cell updated same commit. repo-lint 0 fail.
Revert: git revert this commit (restores the pre-sweep skill).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C6: docs disposition -- 24 history docs archived, 16 retained, refs rewritten
...
DISPOSITION MANIFEST (archive, one-line justifications): clientdocs-
workflow-review (v1 tenant-docs era) / D-057-DECIDED-append +
D-057-REVIEW-ITEMS + README-D057-PACK + D-058-renumber (executed v1
decision packs) / D-068-openbao-assessment-DRAFT (supplementary; the
cited analysis retained) / DOCFIX-064-phase08-changelist + docfix-draft-
20260702 (executed/draft) / handoff-20260703 + handoff-20260705
(superseded handoffs) / incident-20260712-triplefault (trap routed to
platform-traps 1b/1c long ago) / netbox-vip-queue + phase-00-maas-
standup-notes + script-quality-findings + session-findings-2026-07-02 +
tenant-cidr-overlap-PLAN + v1-pre-deploy-fixes (v1-era executed/dated) /
repo-lint-nextfree-bug-FINDING (absorbed DOCFIX-105/107; repo_lint.py
pointer updated) / upstream-bug-draft-dashboard-tls (draft, dated) /
model-a-fallback-plan (D-123 Model B adopted; fallback preserved in
archive) / stage3-adversarial-review-20260716 (R3-F register,
dispositioned in 2.10) / dc-dc-replication-DR-seed (absorbed per
workflow) / dc-dc-ipv6-charm-research + dc-dc-netem-and-ula-gua-proposal
(stage 4+ research, refs updated). RETAINED 16 top-level, justified in
the session changelog. Live-surface refs to all moved files rewritten to
archive paths (18 files). G3 cell + ledger + changelog updated same
commit (the L10 fire on a Status-line path rewrite is satisfied by the
CURRENT-STATE touch -- the check worked as designed).
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C5: Stage 3 changelogs through 2026-07-18 -- 11 files (partial; stage OPEN)
...
Live session changelog (20260719) stays top-level until session close.
Consolidated record: docs/archive/stage-records/vr1-stage3-partial-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
changelog-20260716-d124-addressing-pin.md
changelog-20260716-d124-rack-addressing.md
changelog-20260716-d126-durable-forward.md
changelog-20260716-review-sweep-phaseAB.md
changelog-20260716-review-sweep-phaseC.md
changelog-20260716-review-sweep-phaseC2-D125.md
changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md
changelog-20260717-d127-iac-autostart-and-guest-updates.md
changelog-20260717-netbox-apex-recovery-edge-wan-import.md
changelog-20260718-opnsense-plugins-installer.md
changelog-20260718-permission-posture-ask-preempts-classifier.md
Revert: git revert this commit (restores top-level paths).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C4: VR1 Stage 2 (Office1) changelog consolidation -- 38 files (GA-R2, GA-F09)
...
Durable content routed contemporaneously (as-built/decisions/traps);
record notes the routing map. Stage 2 merged main PR #1 e468d2e.
Consolidated record: docs/archive/stage-records/vr1-stage2-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
changelog-20260711-d111-subcarve-nn-alignment.md
changelog-20260711-ula-gen-command-fix.md
changelog-20260712-docfix189-max-context-session-audit.md
changelog-20260712-libvirt-acpi-kernel-panic.md
changelog-20260712-libvirt-memory-unit-rootcause.md
changelog-20260712-office1-opnsense-edge-build.md
changelog-20260712-opnsense-edge-boot-fixes.md
changelog-20260712-opnsense-edge-real-isp-router.md
changelog-20260712-opnsense-prep-bz2-fallback.md
changelog-20260713-apparmor-libvirt-prereq.md
changelog-20260713-config-xml-danger-sweep.md
changelog-20260713-config-xml-path-deleted.md
changelog-20260713-d114-voffice1-nested-virt.md
changelog-20260713-docfix194-opentofu-module-validation.md
changelog-20260713-git-credential-store.md
changelog-20260713-office1-dhcp-apply.md
changelog-20260713-office1-headend-maas-lxd.md
changelog-20260713-office1-netbox-deployed.md
changelog-20260713-opnsense-api-client.md
changelog-20260713-opnsense-api-proven.md
changelog-20260713-opnsense-api-write-proven.md
changelog-20260713-opnsense-apikey-bootstrap.md
changelog-20260713-workflow-doc-status-correction.md
changelog-20260714-c4-sandbox-loop-and-upstream-guard.md
changelog-20260714-d119-region-qualified-dc-namespace.md
changelog-20260714-d119-tofu-apply.md
changelog-20260714-netbox-importers-waf-useragent.md
changelog-20260714-netbox-write-path-hardening.md
changelog-20260714-office1-lan-ipv6-executed.md
changelog-20260714-opnsense-set-interface-v6.md
changelog-20260715-creds-audit.md
changelog-20260715-creds-consolidation.md
changelog-20260715-d120-load-and-iprange-tooling.md
changelog-20260715-d120-office1-service-reip.md
changelog-20260715-d121-d122-stage3-ha-nodelayout.md
changelog-20260715-docfix195-c2-netbox-of-record.md
changelog-20260715-fidelity-check-scope-correctness.md
changelog-20260715-stage3-prereqs-prep.md
Revert: git revert this commit (restores top-level paths).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C3: VR1 Stage 0-1 changelog consolidation -- 45 files (GA-R2, GA-F09)
...
The 2026-07-09 authoring wave (31 in one day) + Stage-1 execution.
Consolidated record: docs/archive/stage-records/vr1-stage0-1-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
changelog-20260709-adversarial-review-fixes.md
changelog-20260709-ceph-replication-tooling.md
changelog-20260709-dc-dc-design.md
changelog-20260709-dc-dc-phase0-runbook.md
changelog-20260709-dc-dc-phase1-runbook.md
changelog-20260709-dc-dc-phase2-runbook.md
changelog-20260709-dc-dc-phase3-runbook.md
changelog-20260709-dc-dc-phase4-runbook.md
changelog-20260709-dc-dc-phase5-runbook.md
changelog-20260709-dc-dc-phase6-runbook.md
changelog-20260709-dc-dc-repo-rename-sweep.md
changelog-20260709-dc-selector-convention.md
changelog-20260709-designate-cinderbackup-rbdmirror.md
changelog-20260709-final-consolidation.md
changelog-20260709-ipv6-family-matrix-overlay.md
changelog-20260709-maas-scripts-dc-param.md
changelog-20260709-mtu-ceph-budget-calculators.md
changelog-20260709-netbox-dc-dc-pipeline.md
changelog-20260709-netem-ula-gua-proposal.md
changelog-20260709-office1-network-edge.md
changelog-20260709-opentofu-audit.md
changelog-20260709-opentofu-cloudinit-vm.md
changelog-20260709-opentofu-maas-netem.md
changelog-20260709-opentofu-node-vm.md
changelog-20260709-opentofu-scaffold.md
changelog-20260709-opnsense-config-design.md
changelog-20260709-opnsense-edge-module.md
changelog-20260709-opnsense-research.md
changelog-20260709-repo-agnostic-sweep.md
changelog-20260709-repo-lint-crlf-fix.md
changelog-20260709-stage0-ratification.md
changelog-20260710-carve-gua-hang-fix.md
changelog-20260710-ledger-scan-self-inflicted-falsepositive-fix.md
changelog-20260710-netbox-roles-aggregates.md
changelog-20260710-opentofu-scaffold-first-validation.md
changelog-20260710-opentofu-state-file-security.md
changelog-20260710-phase0-runbook-as-executed.md
changelog-20260710-phase01-bundle-staleness-fix.md
changelog-20260710-prereq-install-scripts.md
changelog-20260710-skill-vr1-awareness.md
changelog-20260710-sweep-bundle-fixes.md
changelog-20260710-sweep-dcdc-runbook-fixes.md
changelog-20260710-sweep-script-fixes.md
changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md
changelog-20260710-vr1-teardown-rollback-runbook.md
Revert: git revert this commit (restores top-level paths).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C2: v1/VR0-era changelog consolidation (GA-R2, GA-F09)
...
v1-redeploy-changelog.md was the era's own running record; its
"completion consolidation" TODO stays open in the ledger block.
Consolidated record: docs/archive/stage-records/v1-era-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
changelog-20260703-process-hardening.md
v1-redeploy-changelog.md
Revert: git revert this commit (restores top-level paths).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C1: GA-R4 rule-6 ledger rotation -- 1187 -> 131 lines (GA-F13)
...
Bodies rotated VERBATIM to docs/archive/session-ledger-rotated-20260719.md
(Live state 2026-07-13, OPEN WORK VR1+VR0, NetBox write-path bugs, PINNED
rulings, standing lessons, state facts, project-completion, NetBox import
narrative). Routed-before-rotating (durable homes): juju format=line 3.6
trap -> appendix-A; guards-are-load-bearing -> operating-discipline; VR0
operational facts + admin/controller -> maas-as-built-reference.md
(lessons 1-6 verified already covered by platform-traps/L8). Live ledger
keeps header + machine-derived fence + two compact still-live blocks
(NetBox write-path bugs pointer, project-completion) + the bounded session
summaries. 131 < 300: the F1 cap is now ENFORCEABLE. Fences OK; ledger-
scan counters unchanged; repo-lint 0 fail.
Revert: git revert this commit (restores the 1187-line ledger).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 3 CLOSE: memory hygiene (GA-F05..F08 memory surfaces) + G1 review; GA-F16 registered
...
Per the recorded provenance rulings: review-after-each-step.md REMOVED
(GA-F06 -- one-time instruction, never standing) and project-posture-
closed-test.md REMOVED (GA-F07 -- "ruling" never ruled; posture NEUTRAL);
hostname -> vcloud in the Remote Control memory (GA-F05 last surface);
MEMORY.md index rebuilt (GA-F08). GA-R7 rule-6 skill line added to
SKILL.md bootstrap. First full G1 review (rules 1-4) found + fixed one
further violation: creds-folder-convention.md duplicated a repo-carried
convention and linked both removed files -- registered as GA-F16, reduced
to a pointer entry. Post-review: 3 memory files, zero violations, zero
stale refs (grep-verified). Pre-edit copies: docs/archive/memory-20260718/
(index copy ASCII-normalized, noted in the changelog). G3 cell updated
same commit (L10 satisfied).
Revert: restore files from docs/archive/memory-20260718/ (memory side);
git revert this commit (repo side).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 2 CLOSE: verification + adjudication recorded; last GA-F03 site fixed
...
Gauntlet ALL GREEN (70); repo-lint 0 fail / 1 legacy WARN (L10 at FAIL).
platform-traps:19 tofu pin (the fifth GA-F03 site) demoted; CURRENT-
STATE's known-stale-pins paragraph rotated (all sites fixed, memory copy
= Batch 3). G3 cell: Batches 0-2 CLOSED. Extractor adjudication + the
criterion-mechanics FINDING recorded in the session changelog (live-
surface vocab flags 0; residual groups history-class or mechanical;
literal ZERO-on-counted lands with Batch 4 + Batch 6.1 by construction).
Revert: git revert this commit (docs + one skill row).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
