D-137 PROPOSED: credential mint-and-consolidate pipeline -- make consolidation structural [ARCH] ...

Operator ask: a better method for minting/saving credentials, plus "a durable
rule to make sure when accounts are created there is a consolidation that
happens every time so credentials aren't misplaced or lost."

PROPOSED only -- no tooling built, no enforcement wired, no SEC-009 demotion.
Three forks are presented for ruling, one exchange each (GA-R5).

Measured diagnosis: the existing SEC-009 control CANNOT DETECT THE FAILURE
CLASS IT WAS BUILT FOR, because creds-audit is DECLARATION-based -- the
manifest IS the declaration, so an undeclared secret is structurally
invisible and a green CLEAN is not evidence nothing was missed.
- creds-audit vr1-office1 read CLEAN on 2026-07-15 while four secrets minted
  on the region VM on 2026-07-13 (site-headend-install.sh:416-455) sat
  undeclared; admin.pass surfaced only 2026-07-25 (SEC-020), 12 days later,
  and only because a task went looking.
- No --all (creds-audit.sh:25 takes one mandatory site).
- Enforcement is PROSE in exactly one place (phase-3 runbook:498), absent from
  preflight/cloud-assert/repo-lint/gauntlet -- and it did not fire at EITHER
  DC standup (dc0 3 + dc1 1 undeclared at this session's open).
- No D governs credential mint/custody generally (D-069 = Vault unseal keys,
  D-126 = per-env key isolation), so the rule lives only in the security
  ledger -- a register of exposures, which no gate can cite as authority.

Proposal: mint-and-consolidate as ONE operation (creds-mint.sh), plus the
DISCOVERY inversion (creds-audit --all/--remote against declared VM secret
locations -- the only piece that would have caught admin.pass), plus gate
wiring, plus a site-headend-install.sh amendment at the source.

The SEC-020 identity-conflation question stays SEPARATE (not batched, GA-R5)
and remains D-unassigned.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

DOCFIX-203: mark D-134's superseded original band table in place ...

The 2026-07-23 AMENDMENT header says it supersedes the original D-134 band table,
but the original carried no in-place marker -- a reader grepping D-134 hits the
original first and gets the REJECTED bands (control .10-.19 / compute .20-.49 /
storage .201-.254). The Chat seat did exactly this 2026-07-25. Added a SUPERSEDED
marker immediately above the original, pointing at the authoritative contiguous
table; original kept as history. Single text addition, no behavioural effect.
repo-lint 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-136 PROPOSED (NetBox-coupled render pipeline) + Ruling 3 + DOCFIX-201 ...

Register append + CURRENT-STATE same commit (GA-R1/C1); DOCFIX-201's docs/audit
edits ride the same CURRENT-STATE touch (L10).

- D-136 PROPOSED [ARCH]: NetBox-coupled per-DC render pipeline; option (C)
  recommended (values-file back half now for both DCs, NetBox front half for
  Roosevelt); non-gating for dc1; prerequisite = extend sandbox-fidelity-check.py.
- Ruling 3 (GA-R5) recorded INLINE in D-136 with the verbatim question + utterance
  ("Your question about 1 or 2, go with 1. Base bundle and everything else is
  applied via overlay") -- committee BLOCKER-1 fix (durable home, not the
  delete-after-use pack file).
- CURRENT-STATE Stage-4: bullet (a) vault-VIP D-020 fix + per-DC widen, bullet (c)
  artifact-shape RULED, coupling bullet -> PROPOSED as D-136, FOLLOW-UP gate
  blockers (pre-flight-checks CHECK 1, provider-bundle-check vault VIP, VIP_OCTET_MAX).
- DOCFIX-201: dual-VIP decision is D-020 not D-036, SEVEN sites (7th caught by the
  pack-review committee; verify -> 0 VIP-context D-036 remain).
- Chat correction (2026-07-25): D-136 open Q5 rewritten -- Jenkins IS the runner
  (gap void); real requirements webhooks + status-back; placement OPEN.

repo-lint 0 fail. No cloud state mutated. D-136 PROPOSED -- operator rules the
mechanism (GA-R5).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

fix(lint): reword D-101 ruling-note header to clear L5 collision ...

5cf15b3 pushed with a repo-lint L5 FAIL (owned -- lint was not gated before the
commit). L5 counts `^##+ D-NNN` headers unless they contain AMENDMENT/RESOLVED;
the ruling note led with `### D-101 --` (a confirmation, not an amendment), so it
collided with the `## D-101:` definition. Reworded to `### RULING NOTE 2026-07-25
-- D-101 ...` so it no longer leads with the identifier. Content unchanged;
repo-lint 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Ruling 1 recorded (GA-R5): address-family policy (D-101 confirmed, no amendment) ...

Operator ruling 2026-07-25. Question: v4-only vs dual-stack for dc1 phase-4.
Utterance (verbatim): "Dual stack to be used where IPv4 is required, IPv6 where
IPv6 only makes sense." Clarifying: "Dual stack deployment for DC0 and DC1. This
is the deployment when the dual-stack is added".

- docs/design-decisions.md: dated RULING NOTE under ## D-101 with the verbatim
  question + utterance (confirms D-101's matrix; changes nothing).
- docs/CURRENT-STATE.md: resolve-before-deploy bullet (b) RESOLVED -- v4-only
  phasing CLOSED for both DCs; VIP-overlay reconciliation now non-deferrable.
- changelog item 12.

The verbatim is transcribed into durable committed homes (D-101 note + changelog),
NOT left in the delete-after-use _handoff-not-committed/ pack (committee BLOCKER-1).
GA-R5: this ruling lands before the dependent VIP-reconciliation / deploy work.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Stage-5 dc1: committee review + Fork-1 ruling (D-104 amendment) + BUNDLEFIX-052 ...

Track-2 bundle-render blocker, committee-adjudicated (4 read-only lenses:
Roosevelt-delta / HA-DR / operational-risk / Juju-MAAS-mechanism). Every
load-bearing claim re-verified against the repo before adoption.

- Committee record: docs/audit/committee-20260724-track2-bundle-render.md
- Fork 1 RULED (operator, GA-R5): dedicated 10th per-DC controller VM ->
  D-104 amendment. Capacity gate PASS (measured): 10-node x 2-DC =
  854/1024 GiB (83%, FIT, 170 GiB headroom);
  docs/audit/stage5-controller-capacity-20260724.txt
- BUNDLEFIX-052: removed an orphaned `bindings:` block absorbed into
  ceph-rbd-mirror (clobbered its D-108 replication bindings + injected a
  phantom `dashboard` endpoint -> juju deploy reject). provider-bundle-check PASS.
- CURRENT-STATE Stage-4 bullet updated same change set (GA-R1/C1).

No cloud state mutated. Fork 2/3 = OPS committee-unanimous, executed under gating.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-135 amendment: DC1 interim apt caching proxy (dc-cache-proxy.sh) ...

Operator-ruled 2026-07-24 (GA-R5, utterance quoted in D-135): DC1 gets an
interim apt caching proxy (apt-cacher-ng) to unblock its build without waiting
on the full ~950 GiB debmirror; DC0 stays the full-mirror deployment under test;
DC1 proxy is replaced by a full mirror afterward. Both artifact-delivery models
thus get exercised this rehearsal (Roosevelt input, D-132/D-133).

- scripts/dc-cache-proxy.sh: site-keyed check/install; apt-cacher-ng proxy mode
  at the D-134 utility .4:3142; reuses the <site>-mirror-net layer (fails loud if
  absent); caches archive/security/UCA, consumed via juju apt-http-proxy.
- tests/dc-cache-proxy/run-tests.sh: 15 static cases, 15/15 PASS.
- D-135 AMENDED (design-decisions.md) + CURRENT-STATE Stage-4 DC0/DC1 split.
- DC1 debmirror PAUSED at ~330 GiB (kept dormant as fallback); measured that the
  vcloud uplink was NOT the shared bottleneck (pausing dc1 did not speed dc0).

Feasibility recon'd read-only first (apt-cacher-ng installable, upstreams 200 via
edge, port free). Live install on the DC1 rack is the separately-gated mutation.
repo-lint 0 fail; gauntlet ALL GREEN (78).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-135 ADOPTED: per-DC artifact mirror realization (D-107 build-out, staged) ...

Mirror-gate exception REJECTED (utterance quoted); staged plan adopted:
rack-host placement at the D-134 utility .4 per DC; item 1 (apt+UCA,
debmirror+nginx) builds now; items 2-3 pinned to Stage 5 (charmhub/snaps
measure-then-rule); egress narrowing is the closing mutation; D-129(iv)
supersedes the D-107 NTP line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-134 AMENDED: contiguous band table (Option B swap), utterances quoted ...

Operator rejected interleaved bands; ruled Option B: nodes contiguous at
.100-.200 (control .100-.119 / compute .120-.149 / storage .150-.200),
dynamic range moves to .201-.254 (first gated carve mutation per DC),
utility .4-.49, VIP .50-.99. VR1 assignments: control .100-.102, compute
.120-.121, storage .150-.153. CURRENT-STATE + changelog same-commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-134 ADOPTED: per-role octet bands for VR1 DC node statics ...

Rejected-then-ruled sequence recorded (GA-R5): .40-.48 flat band rejected;
operator directed per-role bands with headroom; recommendation adopted.
Bands: .10-.19 control / .20-.49 compute / .201-.254 storage; .4-.9
utility-reserved; .50-.99 formal VIP band (measured .50-.60 today);
.100-.200 dynamic untouched. Stable octet per node across all six planes,
both DCs, keyed by tofu name via pinned boot MAC. CURRENT-STATE updated
same-commit (GA-R1 C1); changelog item 3.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Stage 4 OPEN + D-133 ADOPTED: flat per-NIC carve (VR1), hw-faithful NICs next deployment ...

Stage 4 (Phase 3, MAAS deploy per DC) opened on this branch: precondition
PASS, discovery captured read-only (docs/audit/stage4-discovery-20260723.txt),
runbook-vs-reality deltas + open decision points recorded in CURRENT-STATE
(same commit, GA-R1 C1). D-133 records the operator ruling (utterance quoted,
GA-R5): VR1 planes carve flat on dedicated NICs -- no VLAN-103 stack; next
deployment builds node VMs with target-hardware-exact NIC topology
(bonds/trunks). Affected stale surfaces queued in the entry, not edited.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend: queue-pass CLOSED (ledger summary, changelog archived, scan fix) ...

Bounded GA-R4 close entry; changelog-20260723-queue-pass.md -> docs/archive/
changelogs/; as-executed index row broadened to the window's full scope.
AT CLOSE: ledger-scan false-close defect (detached-amendment status hijack,
D-132 dropped) found by the close reconciliation itself -- fixed number-keyed
with regression cases (48/48; gauntlet 76 ALL GREEN), machine block re-seeded,
scan re-verified truthful. GA-R7 memory review: no changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 Q3 RULED + delivered: monthly-review checks in ops-update-procedure 0c ...

Two standing read-only checks (Vault 1.8.x CVE scan, migration-signal probes);
design-time V1-V5 re-verify trigger recorded. Same-vehicle stale claims fixed
(bundle-pins-1.16 CAUTION, D-071 PROPOSED tail). D-068 item 1 remainder is now
only the Q2 path selection at Roosevelt Vault design time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 Q2 RULED: Roosevelt baselines on 1.8 + funded remediation track (structure only) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 Q1 RULED: rehearsal-scoped EOL Vault acceptance, posture 1b (utterance quoted) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 item 1: re-scoped Vault migration plan drafted (options paper; nothing adopted) ...

Q1 interim posture / Q2 Roosevelt path (4 options incl. OpenBao-payload fork,
shrink-the-job) / Q3 review triggers; verify list V1-V5 before any Q2 ruling.
Amendment on D-068; CURRENT-STATE section 8 + G15 updated same commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 [R] leg CLOSED: vr1-dc1 addressing RATIFIED (D-124 amendment 2026-07-21, GA-R5) ...

Pattern-derived from D-115/D-101/D-124/D-120/D-131/D-125/D-126; contiguous
/22 carve divergence documented; apex confirm-free at authoring. G12 row
HELD -> OPEN with the [V] remainder named. Couplings same-commit (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-100 gap #11: netem placeholder CONFIRMED STANDING until Roosevelt link spec (GA-R5) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-068 item 3 RULED: AppRole lifecycle adopted for Roosevelt + probe ships on VR1 now (GA-R5) ...

Operator chose the wider scope over the recommendation; cloud-assert
probe delivery queued this session.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-068 item 2 RULED: Vault listener TLS required for Roosevelt (GA-R5, utterance quoted) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-071 point 4 RULED + D-071 ADOPTED closure: all four update-policy points ruled (GA-R5) ...

In-channel-only refreshes adopted; D-071 status ADOPTED; G15 row,
CURRENT-STATE queue item 4, ledger machine block coupled (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-071 point 3 RULED: standing update order adopted as proposed (GA-R5, utterance quoted) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-071 point 2 RULED: patch-only controller rule adopted as proposed (GA-R5, utterance quoted) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-071 point 1 RULED: monthly cadence trigger adopted as proposed (GA-R5, utterance quoted) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-129 sub (iv) RULED: MAAS NTP hierarchy stays -- all four D-129 subs now ruled (GA-R5) ...

Status flipped to RULED; office1 install + qga retrofit re-pointed at
G13 as execution items. G13 row + CURRENT-STATE + ledger coupled (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-129 sub (iii) RULED: per-site Tailscale = dedicated node on metal-admin, edge excluded (GA-R5) ...

Operator clarification recorded verbatim (per-site metal-admin tailscale
planned for this deployment + Roosevelt); D-107 shape becomes the
standing per-site pattern; D-131 sub-2 revisit clause never triggers.
Couplings same-commit (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-129 sub (ii) RULED: os-frr pinned to Roosevelt design time (GA-R5, utterance quoted) ...

VR1 stays static per D-124/D-125; rules alongside D-100 link spec +
D-132 topology at Roosevelt network design. Couplings same-commit (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-129 sub (i) RULED: COS scrapes the edge, in-scope per-DC (GA-R5, utterance quoted) ...

Status line updated (ruling authority); Step-10 exporter pin ungated at
its deployment step. CURRENT-STATE + ledger coupled same-commit (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-131 sub-3 RESOLVED (no dhcpd option-6 defect); pin DNS arch review; file D-132 (Roosevelt MAAS topology) ...

Sub-3: source read (snap 41649) + operator-run rendered-config capture
(docs/audit/d131-sub3-dhcpd-option6-20260721.txt) -- option 6 carries the
forwarder alone; morning prepend observation was a stale pre-re-render
read. No second LP. Pinned architectural DNS review recorded in D-131
(feeds sub-4). D-132 PROPOSED filed on operator directive (verbatim
quoted): HA regions per DC, rack-top racks, cross-site backup custody.
CURRENT-STATE + ledger coupled same-commit (GA-R1 C1); next-free D=133.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-131 sub-2 RULED: forwarder scope = metal-admin only (GA-R5, utterance quoted) ...

Status block updated in design-decisions.md (the ruling authority);
CURRENT-STATE + ledger D-131 lines coupled in the same commit (GA-R1 C1).
No live change -- codifies the running dc0-node-dns shape.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV