IPv6-unlock design note (pass5, read-only) -> recorded under D-144 owed items ...

Focused 3-worker read-only pass enumerating the address-family surfaces of the
flat Option-1 topology (D-144) and which the collapse unlocks for IPv6.

Honest headline: the collapse unlocks LITTLE new IPv6. Of a 19-surface family
matrix, only the MAAS power-dial reach path is a clean collapse-caused v6 unlock
-- and it is UNVERIFIED, gated on DEC-15. No proposed v6 flip conflicts with a
standing ruling.

Genuine unlocks (design inputs folded into D-144's owed DECs):
- DEC-15: power-dial reach CAN go v6 (qemu+ssh to vcloud sshd off any plane
  bridge) -- prefer v6, verify the address.
- DEC-14/16: the (a) control + SEC-010 successor are v6-native by construction
  (nftables `inet`); and the UNRULED D-124 transit-overlay family (v6 candidate
  f00::/40 reserved in the apex) should be decided on the same leg they govern.
- DEC-24: cross-DC replication carrier + its still-open D-139 v6-route are the
  SAME leg -- resolve together.

NOT unlocked by the collapse (different layers, do NOT credit D-144): D-139's
plane family matrix, the geneve-over-v6 fix, and the LXD-container/juju LP#1723240
gap (D-141). metal-admin PXE stays v4 by ruling; v6-only MAAS commissioning is
UNVERIFIED (not asserted impossible). Uplink NAT stays v4 (simulated ISP).

Deliverables: pass5-w1/w2/w3 + ipv6-unlock-design-note-20260810.md. D-144 owed
section + CURRENT-STATE updated (GA-R1 C1). Read-only; nothing ruled or built.
repo-lint 0-fail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

container-elim planning pass RAN (phases 0-4 + advisor): FINAL-PLAN + operator-report + D-144 framing (READ-ONLY) ...

Multi-agent read-only planning pass for the dc0/dc1 container-layer elimination
in the 10.13 redeploy. Phases 0-4 (4 sonnet workers + 1 administrator/phase) +
a final advisor review; agents recorded as "the administrator"/"the advisor"
(no model name asserted, operator instruction). NOTHING built or executed
against the cloud -- produced a plan; every owed artifact is LOGGED, not built.

Phase-0 operator gate: confirmed Option 1 (flat node VMs on vcloud libvirt + a
small per-DC vr1-dcN-client VM) + cross-DC handling (a) -- directional, not the
GA-R5 [ARCH] ruling.

Deliverables (docs/audit/container-elim-pass/):
- operator-report.md          -- the single consolidated report
- FINAL-PLAN.md               -- 104-row change-set + L0-L5 module design +
                                 Part-A/B sequencing + D-144 decision package
- FINAL-advisor-review.md     -- verdict SOUND + 2 verified follow-ups
                                 (DEC-15 reach; DEC-24 dc0<->dc1 mesh/Ceph path)
- pass0..4 worker + admin docs (20)

Key findings: the container layer is the one violation of the repo's
IaC->procedure boundary (inner root's qemu+ssh provider); root topology (B)
shared-outer + per-DC-flat recommended; three isolation controls owed incl. the
MAAS power-key blast radius (flattening makes SEC-012/016 per-DC separation
vacuous absent a mitigation); 13 owed artifacts; 9 owed live measurements.

OWED (operator, GA-R5): the Tier-1 package -- DEC-01 adopt as new D-144
(supersedes D-123 Model B; D-143 precedent) + amendments D-128/D-134/D-131 +
DEC-15/14/16/11/08/24. Model B stays the LIVE shape until D-144 is ruled.

CURRENT-STATE.md updated in the same commit (GA-R1 C1): the container-elim block
flips SCOPED/NOT-YET-RUN -> RAN + owed-ruling pointer. repo-lint 0-fail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

Scope + prep the container-layer-elimination pass (multi-agent, phases 0-4) as a cold-start handoff for a NEW session ...

Operator directed: scope this pass now, defer EXECUTION to a fresh session (this
session is large). Read-only planning pass -- produces a plan/change-set/module
design; no teardown, no mutation.

New folder docs/audit/container-elim-pass/:
- SCOPE-AND-EXECUTION-PLAN.md: self-contained handoff -- bootstrap, grounded
  current-state (Model-B container layer = vvr1-dcN containment VM + inner libvirt
  + 6 plane bridges + transit; opentofu/main.tf:26-33), the LOCKED decisions,
  phase 0-4 definitions, orchestration flow, context discipline, deliverables,
  governing constraints.
- phase-prompts.md: draft sonnet-worker + fable-administrator prompts per phase,
  ready to adapt & spawn.

LOCKED from the 2026-08-09 scoping exchange: phases 0-4 (adopted); module =
layered system (IaC OpenTofu modules + procedure/runbook modules); target topology
= Phase 0 proposes -> operator confirms before Phase 1 (HARD GATE); fleet = standard
3-5 sonnet workers + 1 fable administrator/phase; final fable advisor review;
read-only; agents write durable docs + return bounded summaries (context
discipline); operator gets ONE report at the end.

Goal/framing: plan the dc0/dc1 container-layer elimination for the 10.13 redeploy
AND turn the redeploy steps into a repeatable layered module workflow feeding the
pre-Roosevelt bare-metal test. The container-elim itself remains an OWED [ARCH]
decision (D-123 amendment or new D-number) that Phase 4 frames and the operator rules.

CURRENT-STATE pointer added (GA-R1 C1). NOT YET RUN.

REVERT: git rm -r docs/audit/container-elim-pass/ and revert the CURRENT-STATE pointer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728