D-068 Q2 RULED: Roosevelt baselines on 1.8 + funded remediation track (structure only) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 Q1 RULED: rehearsal-scoped EOL Vault acceptance, posture 1b (utterance quoted) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 item 1: re-scoped Vault migration plan drafted (options paper; nothing adopted) ...

Q1 interim posture / Q2 Roosevelt path (4 options incl. OpenBao-payload fork,
shrink-the-job) / Q3 review triggers; verify list V1-V5 before any Q2 ruling.
Amendment on D-068; CURRENT-STATE section 8 + G15 updated same commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session permissions: allow ledger-scan + opentofu-validate (read-only; gates untouched) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Queue pass: vr1-dc0-maas cache residue deleted (association-checked, operator-approved) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G13 CLOSED: office1 edge bundle -- qga channel live, 26.7.1, os-iperf in (operator-approved) ...

Saved-plan 0/1/0 channel apply (bounce = the ruled restart; guest-ping proven),
REST update 26.7->26.7.1 (no reboot), vr1-edge profile complete (both plugins
installed=1 by read-back), outer plan re-converged zero diff. Close capture
docs/audit/g13-close-20260723.txt; G13 row + section 5/7 + as-built updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G13 plugin leg PARTIAL: qga installed, os-iperf refused pending 26.7.1 (measured) ...

Operator-approved vr1-edge apply on office1-opnsense: os-qemu-guest-agent 1.3
verified installed; os-iperf refused by the edge (upgradestatus: "update to
opnsense-26.7.1 is required") -- new gated maintenance decision, nothing
further mutated. G13 row updated in the same commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

L10 repair: CURRENT-STATE carries the SEC-010 re-assert status (GA-R1/C1) ...

The 627cfc8 capture commit should have updated CURRENT-STATE in the SAME
commit; lint's exit code was masked by a pipe and the FAIL was missed
before push -- owned. Status line added (section 2.2); lint now 0-fail.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

SEC-010 live re-assert: idempotent nft file on voffice1 + both DC racks (operator-approved) ...

Declare-then-delete preamble inserted in place on all three hosts; sec010-fw
double-restart converged (4/2/2 drops, no duplication). Pre/post capture
docs/audit/sec010-reassert-20260723.txt; logged window ops-sec010-reassert;
per-host revert = restore .pre-reassert-20260723 backup + restart.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Queue pass: post-G12 queued findings delivered (5 script/harness fixes + DOCFIX-198/-199) ...

- opnsense-prep-image.sh: survives bash -s (BASH_SOURCE unbound fix; T3b)
- site-headend-install.sh: version/site-neutral hints; nftables-sec010
  idempotent reload preamble; serial-log staging dir in --host-nodes (+check)
- opnsense-bootstrap-apikey.sh: sshd readiness wait + first-scp retry +
  ssh -n stdin guard + minter-beside-script usage note (T9/T10)
- DOCFIX-198: phase2 runbook Steps 9-10 SUPERSEDED banners (pod route refuted,
  D-103/D-123 amendments) + DC standup definition-of-done section (lands the
  staging-dir + SEC-016 snap-refresh re-assert DoD obligations)
- DOCFIX-199: D-112(c) console-bootstrap payload requirements (util.inc et al)

Gauntlet ALL GREEN (76); repo-lint 0 fail. Per-item reverts in
docs/changelog-20260723-queue-pass.md. No cloud mutation this session;
queued: gated live re-assert of the nftables-sec010 files on all three hosts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend: G12 dc1 CLOSED + merged (edge->commission->close in one session) ...

Bounded GA-R4 close summary + machine-derived reseed (SEC 10->12: SEC-015/-016);
G14 SEC-row count reconciled to 12. dc1 substrate built + commissioned 9/9,
merged to main (a5c0a49), branch retired. Full body in the archived changelog.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1 close-out: consolidation + skill sweep + CURRENT-STATE (G12 CLOSED) ...

- GA-R2 consolidation: 3 dc1 session changelogs (07-21 authoring, 07-22 build,
  07-23 edge) archived to docs/archive/changelogs/; Stage 3 record gains a
  "G12 CLOSED 2026-07-23" section + table rows
- CURRENT-STATE: G12 gate CLOSED, section-1 stage narrative updated
- skill sweep: per-DC dedicated MAAS->libvirt power key (SEC-012/SEC-016)
  added as a standing DC-standup invariant
- GA-R7 memory review: clean (no changes)

Close-out set complete; ready for operator-gated merge to main.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: SEC-016 power key wired + commissioning 9/9 READY -- [V] leg complete ...

- SEC-016 dedicated dc1 MAAS->libvirt power key minted, authorized on the
  rack, installed in the region MAAS snap (per-host ssh config; dc0 SEC-012
  key untouched -- true per-DC isolation); manifest updated (creds-audit CLEAN)
- maas-node-power.sh --commit: power_type=virsh on all 9, each verified by a
  real query-power-state (proves the SEC-016 region->rack path)
- commissioned all 9 -> ALL 9 READY in ~3.5 min (no timeout, no SERVFAIL),
  shapes EXACT to D-121 Option C; dc0's two stacked faults pre-empted by
  pinned MACs + the dc-rack-net forwarder
- G12 [V] leg (dc1 build) COMPLETE; NEXT is close-out + operator-gated merge

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: rack-net install + region MAAS config + SEC-016 power-key ruling ...

- dc-rack-net install dc1 on the rack: check 10/10, forwarder answers
  authoritative maas-internal SOA (D-131 fix; audit capture committed)
- region MAAS: D-120 range 10.12.68.100-.200, D-131 dns_servers=10.12.68.3
  allow_dns=false, DHCP dhcp_on=true primary_rack=nmpcq4; dhcpd verified
  RUNNING on virbr6 (behavioral, no Temporal incident)
- dc1 enlistment PROVEN via canary (machines 11->12 in ~2 min)
- SEC-016: operator-ruled "Mint a dedicated dc1 power key" (per-DC
  isolation, not SEC-012 reuse) -- recorded before dependent wiring (GA-R5)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: dc-rack-net.sh dc1 site-table arm + harness (D-131 sub-1) ...

Adds the dc1 arm to the standing per-DC rack-legs + node-DNS forwarder
pattern. MEASURED/apex-committed values, network-name keyed (no virbrN):
- vr1-dc1-metal-admin 10.12.68.2/22 (rack MAAS/DHCP; apex-committed rack IP)
- vr1-dc1-metal-admin 10.12.68.3/22 (forwarder listen alias; D-120 static)
- vr1-dc1-provider-public 10.12.64.2/22 (edge-LAN; measured live 2026-07-23)
- upstream region BIND 10.10.0.20 over transit

Harness T15-T18 added; dc-rack-net 18/18, gauntlet ALL GREEN (76),
repo-lint 0-fail. The forwarder pre-empts dc0's commissioning SERVFAIL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: edge bootstrap + v4 addressing COMPLETE (D-112c + D-113a2 proven on 26.7) ...

Edge phase for vr1-dc1, resuming the 2026-07-22 close handoff:
- D-112(c) console bootstrap: SSH + dc1 edge key materialized (payload
  needed util.inc/shell_safe() -- dc0 lesson iv the .b64 artifact lacked)
- key-only SSH verified (15.1-RELEASE-p1)
- D-113(a2) API key minted via vendor model; GET core/firmware/status
  exit 0, product_abi 26.7
- edge addressed: WAN 172.30.3.2/24 gw 172.30.3.1 (egress 0% loss),
  LAN -> 10.12.64.1/22 (ruled provider-public gw), API at new LAN
- interim reach leg removed; rack provider-public leg 10.12.64.2/22 live
- creds consolidated to ~/vr1-dc1-creds/ (creds-audit CLEAN); rack edge-key
  copy shredded -> SEC-015 (transient, remediated)

Two queued findings: bootstrap .b64 missing util.inc; opnsense-bootstrap-apikey.sh
scp transient post-restart-sshd failure (readiness-wait/retry candidate).

CURRENT-STATE G12 row + security-ledger SEC-015 + manifest updated (GA-R1/C1).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend: G12 dc1 build session closed (steps A-C + D-125 gate delivered) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: D-125 egress gate PASS (two identical runs, isolation confirmed) ...

dc0's procedure of record recovered from the dc0 rack, adapted per-DC,
prereqs proxied in, noble.img streamed dc0->dc1. Both runs: gw 0%, net 0%,
1.1.1.1=301, archive=200, region LAN-TCP=000, zero leftovers. dc0's
one-time ICMP anomaly did not recur. Bridge-in egress proven for dc1;
double-NAT fallback not needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1 step C COMPLETE: 28/28 inner resources, 10/10 domains running ...

Inner apply from voffice1 (D-128 Plane 2): staging set mirrored from dc0
(branch switch preserving dc0 tfstate, dc1 key piped, known_hosts, 26.7
base local to the provider host, tfvars all-sourced). Plan 28/0/0 exact
with 54 pinned MACs verified. One fix-forward: serial-log staging dir
absent inside vvr1-dc1 (dc0 had it hand-made 07-20; queued to standup
DoD) -- dir created, resume 10/0/0, exit 0. Convergence zero diff; edge
at the 26.7 login prompt (D-112 datapoint #2). Captures:
docs/audit/inner-{plan,converge}-20260722-dc1-stepC.txt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1 step B COMPLETE: transit live, rack enrolled, SEC-010 both ends, 26.7 staged ...

cloudinit-vm gains interface_macs (node-vm port; harness 10/10) -- voffice1
NIC3 + full MAC pins, vvr1-dc1 pin-adoption, 0/2/0 exact, post-bounce
battery ALL PASS, converged zero diff. Transit .5<->.6 proven with the dc1
key. Rack bootstrap dc1-parameterized via existing flags (dry-run caught the
dc0-flavored defaults); first run exit 4 on stale apt index, re-run exit 0;
region lists vvr1-dc1 (nmpcq4). SEC-010 region end extended to enp3s0.
OPNsense 26.7 base = hash-verified copy of dc0's proven artifact. Named
gate EXIT 0 (docs/audit/dc1-stepB-check-20260722-final.txt). Three queued
findings logged (changelog item 7).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: remove spent binary saved plan (lint L1 fix) ...

tfplan-dc1-20260722 deviated from the *.tfplan gitignore naming and was
committed by mistake with a pipeline-masked lint failure; removed, lint
0-fail. Captures remain the applied-plan record. Changelog CORRECTION
appended.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: apex --commit executed + substrate step A applied (5/0/0 exact, converged) ...

Operator-gated session (as-executed: dc1-deploy, per-command wrap):
apex write CREATED 172.31.0.4/30 + 10.12.68.2/22 (preflight re-run +
idempotent read-back captured); dc1 svc keypair minted per manifest
(creds-audit CLEAN); tfvars authored (local, D-124 amendment verbatim);
outer saved-plan apply 5 added / 0 changed / 0 destroyed -- vvr1-dc1
RUNNING (108 vCPU / 416 GiB, measured host headroom ~140 GiB), prior
guests untouched; convergence ZERO DIFF
(docs/audit/outer-plan-20260722-postdc1-converged.txt).
Next gated step: dc1 step B bootstrap (CURRENT-STATE G12 row).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: item-3 substrate landed + harness reconcile (gauntlet 76 ALL GREEN) ...

Lands the disconnected session's authored tree (vr1_dc1 vars, vvr1-dc1 +
uplink modules, inner root vr1-dc1-substrate/ with 54 pre-pinned MACs,
lib-net dc1 arm + one-selection guard) and delivers changelog item 4:
six harnesses reconciled to the ratified dc1 selector arm, phase-00
PLANES/lib-net parity guard (exit 2, refuses cross-DC planning),
rbd-mirror + radosgw parent-shell selection (dc1 reminder now shows
10.12.84.0/22, not dc0's). Gauntlet ALL GREEN 76
(docs/audit/gauntlet-20260722-g12-reconcile.txt); repo-lint 0-fail.
G12 next gated step unchanged: operator-gated apex --commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend (successor-landed): G12 dc1-authoring session disconnected mid-item-3 ...

Drop-state recorded, not delivered: dc1 vars + substrate root + lib-net dc1
arm authored UNCOMMITTED in tree; gauntlet 6/76 FAILED (six harnesses still
assert the retired vr1-dc1 fail-loud arm -- capture in docs/audit/). G12 row
updated same-commit (GA-R1/C1). Working-tree authoring intentionally left
uncommitted pending harness reconcile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GksWgeVyXqhrojhKTiS8J5

G12 dc1: apex confirm-free captured; dc-rack-mgmt-import gains per-site (--site) dc1 support ...

Confirm-free vs live apex (read-only): dc1 planes already assigned+consistent,
transit 172.31.0.4/30 + rack 10.12.68.2 free, uplink 172.30.3.0/24 registered.
Importer harness 117/117; live dc1 dry-run preflight PASS (captures committed).
The apex --commit remains an operator-gated step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VifVpH3XQQxQz8NQ1VxNau

Session bookend: queue-pass session closed (9 rulings, A9 delivery, dc1 addressing ratified) ...

Bounded GA-R4 summary appended; both same-day changelogs archived in
this close commit; netem changelog pointer updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

G12 [R] leg CLOSED: vr1-dc1 addressing RATIFIED (D-124 amendment 2026-07-21, GA-R5) ...

Pattern-derived from D-115/D-101/D-124/D-120/D-131/D-125/D-126; contiguous
/22 carve divergence documented; apex confirm-free at authoring. G12 row
HELD -> OPEN with the [V] remainder named. Couplings same-commit (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

cloud-assert A9: vault-kv consumer AppRole auth probe (D-068 item 3 delivery) ...

Delegates to vault-kv-health.sh; skips gracefully pre-Stage-5 (no vault
app). Harness +3 cases (15/15); gauntlet 76 ALL GREEN.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-100 gap #11: netem placeholder CONFIRMED STANDING until Roosevelt link spec (GA-R5) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-068 item 3 RULED: AppRole lifecycle adopted for Roosevelt + probe ships on VR1 now (GA-R5) ...

Operator chose the wider scope over the recommendation; cloud-assert
probe delivery queued this session.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV