OpenStack/openstack-caracal-dc-dc

Fork: 0

OpenStack / openstack-caracal-dc-dc

History for openstack-caracal-dc-dc / netbox / sandbox-fidelity-check.py

2026-07-14	497ede6 Browse files » D-118 ADOPTED (org ULA fd50:840e:74e2::/48); VR1 DC0 + DC1 IMPORTED; roles importer bug fixed ... D-118: ORG_ULA_48 = fd50:840e:74e2::/48. RFC 4193 valid (fd -> L=1, 40-bit Global ID 0x50840e74e2, /48 -> 256 x /56 for D-101's per-DC /56). The load-bearing check is NOT the RFC conformance -- it is that it does NOT collide with Tailscale's fd7a:115c:a1e0::/48: office1-tailscale runs --accept-routes, so an overlap would have been a LIVE tailnet routing conflict, not a paper one. Provenance stated honestly: the 'CSPRNG-generated' claim cannot be re-verified. It does not change the ruling (RFC 4193's SHA1 construction is a SHOULD; the requirement is a pseudo-random 40-bit Global ID). Regenerating would only swap in a different random number at the cost of re-editing 7 places. Corrects a FALSE claim: changelog-20260711 called this value 'ratified' when no D-number ever assigned it. That phantom ratification is why it read as settled for two days. Same failure mode as D-117: a document asserting authority it lacked. IMPORTED into the sandbox: six-plane roles + 2 RIRs + 5 aggregates, then VR1 DC0 (18 prefixes) and VR1 DC1 (18). The D-117 fix is now LIVE-PROVEN, not just green offline: --dc dc0 -> apex site VR1 DC0 (id=8), --dc dc1 -> VR1 DC1 (id=9). ULA reads DC.NN in the 4th hextet per D-111 (fd50:840e:74e2:220:: .. :350::). A REAL BUG, found by running roles-aggregates-import.py for the first time for real: it checked existence by SLUG only, but NetBox also enforces UNIQUE NAMES. The draft's legacy role 'Replication' (slug repl) blocks the six-plane role (slug replication, name Replication) -- so it created 4 roles, 400'd on the 5th, and DIED, leaving the apex HALF-POPULATED with no RIRs, no aggregates, no rollback. It had never met a NetBox holding the real draft (only empty ones) and it SHIPPED WITH NO HARNESS. That is why it survived. - six-plane role renamed 'Replication Plane' (slug unchanged -- lib-net.sh SPACES6 and the prefix importer look up 'replication') - the script now PREFLIGHTS every name/slug and writes NOTHING unless the whole plan is viable. An IPAM importer that can die partway corrupts what it populates. - tests/roles-aggregates-import/ CREATED: 16/16 PASS. Final state PROVEN by sandbox-fidelity-check (now carrying the full planned delta): the sandbox is the upstream draft + EXACTLY D-115 + D-117 + D-118 -- every shared object field-identical, nothing lost, nothing stray. 90 -> 134 prefixes. repo-lint 0 fail. run-tests-all: ALL GREEN (56 harnesses). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ZBxzAbmqwLW7jEmMG23Xw JANeumatrix committed 6 hours ago
ece2db3 Browse files » Prove the sandbox is a FAITHFUL replica, not just a count-matching one ... netbox/sandbox-fidelity-check.py (+4 assertions in tests/sandbox-seed, 22/22 PASS) Counts and idempotency CANNOT prove a faithful seed. The region-scope bug proved it: 17 of 90 prefixes silently lost their scope, every count still matched, and re-runs were still perfectly idempotent. It was caught by LUCK on a spot-check that happened to print 'site None'. This is that catch, made deliberate. Method needs no new plumbing: prod-draft-dump.py is READ-ONLY, so point it at the sandbox and diff the two JSON dumps FIELD BY FIELD. RESULT: every shared object is field-level IDENTICAL to upstream, and the delta is EXACTLY the expected D-115 additions (+edge role, +vr1-off1 site, +8 prefixes). Nothing missing, nothing unexpected. The sandbox is a PROVEN baseline -- which is what the later feed-back diff to production depends on. Also de-misdirects docs/dc-dc-netbox-buildout-scope.md, which still told the next person to run '--dc dc2' with DC2_V4_SUPERNET -- both of which the new guards now REJECT by name. Its G5 recommendation (rename the APEX to vr1-dc1/vr1-dc2) is marked SUPERSEDED: D-117 ruled the opposite. ORG_ULA_48 is now listed there as UNASSIGNED and BLOCKING, not as a settled literal. Disclosure: D-117 Option B is PARTIALLY executed -- the import path and the scope doc are done; the $DC shell selector and the runbook DC prose are NOT. Recorded in the ledger so 'D-117 ADOPTED' is not misread as 'fully renamed'. repo-lint 0 fail. run-tests-all: ALL GREEN (55 harnesses). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ZBxzAbmqwLW7jEmMG23Xw JANeumatrix committed 7 hours ago

2026-07-14

497ede6
Browse files »

D-118 ADOPTED (org ULA fd50:840e:74e2::/48); VR1 DC0 + DC1 IMPORTED; roles importer bug fixed ...

D-118: ORG_ULA_48 = fd50:840e:74e2::/48. RFC 4193 valid (fd -> L=1, 40-bit Global
ID 0x50840e74e2, /48 -> 256 x /56 for D-101's per-DC /56). The load-bearing check
is NOT the RFC conformance -- it is that it does NOT collide with Tailscale's
fd7a:115c:a1e0::/48: office1-tailscale runs --accept-routes, so an overlap would
have been a LIVE tailnet routing conflict, not a paper one.

Provenance stated honestly: the 'CSPRNG-generated' claim cannot be re-verified.
It does not change the ruling (RFC 4193's SHA1 construction is a SHOULD; the
requirement is a pseudo-random 40-bit Global ID). Regenerating would only swap in
a different random number at the cost of re-editing 7 places.

Corrects a FALSE claim: changelog-20260711 called this value 'ratified' when no
D-number ever assigned it. That phantom ratification is why it read as settled for
two days. Same failure mode as D-117: a document asserting authority it lacked.

IMPORTED into the sandbox: six-plane roles + 2 RIRs + 5 aggregates, then VR1 DC0
(18 prefixes) and VR1 DC1 (18). The D-117 fix is now LIVE-PROVEN, not just green
offline: --dc dc0 -> apex site VR1 DC0 (id=8), --dc dc1 -> VR1 DC1 (id=9). ULA
reads DC.NN in the 4th hextet per D-111 (fd50:840e:74e2:220:: .. :350::).

A REAL BUG, found by running roles-aggregates-import.py for the first time for
real: it checked existence by SLUG only, but NetBox also enforces UNIQUE NAMES.
The draft's legacy role 'Replication' (slug repl) blocks the six-plane role (slug
replication, name Replication) -- so it created 4 roles, 400'd on the 5th, and
DIED, leaving the apex HALF-POPULATED with no RIRs, no aggregates, no rollback.
It had never met a NetBox holding the real draft (only empty ones) and it SHIPPED
WITH NO HARNESS. That is why it survived.
  - six-plane role renamed 'Replication Plane' (slug unchanged -- lib-net.sh
    SPACES6 and the prefix importer look up 'replication')
  - the script now PREFLIGHTS every name/slug and writes NOTHING unless the whole
    plan is viable. An IPAM importer that can die partway corrupts what it
    populates.
  - tests/roles-aggregates-import/ CREATED: 16/16 PASS.

Final state PROVEN by sandbox-fidelity-check (now carrying the full planned
delta): the sandbox is the upstream draft + EXACTLY D-115 + D-117 + D-118 --
every shared object field-identical, nothing lost, nothing stray. 90 -> 134
prefixes.

repo-lint 0 fail. run-tests-all: ALL GREEN (56 harnesses).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013ZBxzAbmqwLW7jEmMG23Xw

JANeumatrix committed 6 hours ago

ece2db3
Browse files »

Prove the sandbox is a FAITHFUL replica, not just a count-matching one ...

netbox/sandbox-fidelity-check.py (+4 assertions in tests/sandbox-seed, 22/22 PASS)

Counts and idempotency CANNOT prove a faithful seed. The region-scope bug proved
it: 17 of 90 prefixes silently lost their scope, every count still matched, and
re-runs were still perfectly idempotent. It was caught by LUCK on a spot-check
that happened to print 'site None'. This is that catch, made deliberate.

Method needs no new plumbing: prod-draft-dump.py is READ-ONLY, so point it at the
sandbox and diff the two JSON dumps FIELD BY FIELD.

RESULT: every shared object is field-level IDENTICAL to upstream, and the delta is
EXACTLY the expected D-115 additions (+edge role, +vr1-off1 site, +8 prefixes).
Nothing missing, nothing unexpected. The sandbox is a PROVEN baseline -- which is
what the later feed-back diff to production depends on.

Also de-misdirects docs/dc-dc-netbox-buildout-scope.md, which still told the next
person to run '--dc dc2' with DC2_V4_SUPERNET -- both of which the new guards now
REJECT by name. Its G5 recommendation (rename the APEX to vr1-dc1/vr1-dc2) is
marked SUPERSEDED: D-117 ruled the opposite. ORG_ULA_48 is now listed there as
UNASSIGNED and BLOCKING, not as a settled literal.

Disclosure: D-117 Option B is PARTIALLY executed -- the import path and the scope
doc are done; the $DC shell selector and the runbook DC prose are NOT. Recorded
in the ledger so 'D-117 ADOPTED' is not misread as 'fully renamed'.

repo-lint 0 fail. run-tests-all: ALL GREEN (55 harnesses).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013ZBxzAbmqwLW7jEmMG23Xw

JANeumatrix committed 7 hours ago