| 2026-07-20 |
Deploy step B COMPLETE: rack bootstrapped + enrolled, SEC-010 CLOSED both ends (operator-ruled), OPNsense 26.7 base staged (operator-ruled); ledger-scan fail-open hardening
...
Bootstrap runs 1+2 (stale-lists 404 fixed by proxied apt update):
maas 3.7/stable, rack enrolled, libvirt+nested KVM, SEC-010 loaded
+ persistent on enp1s0; final --check EXIT 0 ALL items
(docs/audit/stepB-check-20260720-final.txt). voffice1-side SEC-010
pin applied per the row's follow-on clause. 26.7 nano prepped on the
rack (measured leaseweb mirror via region proxy); inner-root base
default -> 26.7. ledger-scan: FAIL-OPEN no longer counts as OPEN
(harness 45/45). CURRENT-STATE position/G10/G14 + section-5 updated
in this commit (GA-R1/C1). Open SEC count 8 -> 7.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Step B transit reach ESTABLISHED: voffice1 .1/30 applied (Kea re-key incident fixed); vvr1-dc0 netplan set-name root cause fixed; zero-diff converged
...
voffice1 transit NIC applied 1/1/1 exact; MAC-regen broke the Kea
reservation (measured .108) -- re-keyed via edge API, .20 restored.
vvr1-dc0 both-NICs-silent root cause: netplan match.name+set-name
(one-boot rename lag, measured offline via libguestfs); fix drops
set-name, keeps measured enp1s0/enp2s0, instance-id bump, seed
-replace 2/0/2 exact. Verified: ssh -J voffice1 w/ dc0 key,
rack->region 0% loss. Outer plan ZERO DIFF converged.
CURRENT-STATE sections 3+5 updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
| 2026-07-19 |
Step B prereq: voffice1 transit NIC authored (172.31.0.1/30 region end, D-124); ruling recorded; expected plan 1/1/1
...
Measured: transit net isolated, only vvr1-dc0 attached; nothing held .1.
Operator-ruled mechanism 2026-07-19: voffice1 via IaC + restart.
Capture: docs/audit/outer-plan-20260719-voffice1-transit.txt (1/1/1).
CURRENT-STATE sections 3+5 updated in this commit (GA-R1/C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr
|
Deploy paused at A/B boundary; fresh-session handoff note (step B facts measured)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
DC0 deploy STEP A EXECUTED: outer apply 6/0/6 exact; G8+G9 CLOSED; convergence zero
...
Logged window dc0-deploy (as-executed log + index convention). G8 passed
in the apply session (six planes 0 leases, 0 attachments); validate
PASS; pre-apply capture equaled the recorded triple; the SAVED plan was
applied: 6 added / 0 changed / 6 destroyed. vvr1-dc0 RUNNING (108 vCPU,
416 GiB, autostart disable per D-127); vr1-dc0-uplink active; six vcloud
planes destroyed (Model B relocation); voffice1 + edge untouched (ids
1/2). Convergence re-plan: no differences (captured). CURRENT-STATE:
section 1 position, section 5 expected plan = ZERO DIFF (any diff is a
STOP), G8 + G9 rows CLOSED; active gate G10. Captures committed same
commit (C1/C2).
Revert: infra revert = runbooks/dc-dc-teardown-rollback.md decision tree
(NOT a blind destroy); docs revert = git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
AUDIT EXIT: operator re-signed CURRENT-STATE; G3+G11 CLOSED, G9 OPEN; session close (GA-R4)
...
Batch 6 item 6: signature utterance "Reviewed, approved, continue."
recorded into section 11 (replaces 2026-07-18 per GA-R1 rule 7). All six
exit runs PASS. G3 CLOSED (all six batches); G9 OPEN (audit criteria
MET; remaining closer = the operator-gated logged apply with G8 first);
FREEZE LIFTED. Session GA-R4 close: bounded 14-line summary in the
ledger, full body rotated to docs/archive/session-20260719-phase5-sweep.md.
Repo HEAD at signing = this commit's parent (437d9d1).
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 6 item 3: exit probe trio 21/21 -- 7/7 on ALL THREE (bar exceeded)
...
Three independent clean-context probes (repo + verbatim charter question
set only, read-only, no shared state; fresh contexts satisfy GA-R7/G2)
scored against CURRENT-STATE with citations spot-verified against the
tree. Unanimous on every question; third-trap picks varied (all real);
zero orientation divergence (all landed CURRENT-STATE-first via the
swept skill); probe hole H1 did not recur. Full scorecard in the exit
record. Remaining before audit exit: item 6 only (operator re-read +
re-signature). G3 cell updated same commit.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 6: exit runs 1/2/4/5 -- archive exclusion (operator-ruled), adjudication, plan==triple, S2
...
6.1: docs/archive/ joins docs/audit/ as inventoried-not-counted (ruling
quoted in the exit record); record-audit + harness 35/35; per-group
adjudication = ZERO contradictory status-claim pairs on counted surfaces
(the charter's criterion as stated); group floor 9 recorded as re-run
baseline; missed patch file archived; CURRENT-STATE stale-note made
token-free. 6.2: 16 top-level docs (<25). 6.4: fresh capture
outer-plan-20260719-phase6-exit.txt = 6/0/6 == section-5 triple. 6.5:
G9 row names SEC-010's step-B dependency (S2). Exit record:
docs/audit/phase6-exit-runs-20260719.md. Items 3+6 pend operator
execution. G3 cell updated same commit.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 5: skill sweep -- GA-R1..R7 implemented in openstack-cloud-ops (single commit)
...
New GA-rulings section reconciled against the RATIFIED text (draft
skill-additions cross-checked; the one draft-only item, the
reconciliation circuit-breaker, kept and marked as discipline). Stale
facts demoted to CURRENT-STATE delegation: the header's "current phase =
VR0 testcloud" and the deploy loop's "opentofu UNVALIDATED / no tofu
binary has ever run" (false since 2026-07-13). Session bookends + stage
close rewritten per GA-R4/GA-R6; change-delivery per GA-R2/D1; routing
rows re-pointed. Read-through checklist committed:
docs/audit/skill-sweep-checklist-20260719.md (every ratified rule ->
disposition). G3 cell updated same commit. repo-lint 0 fail.
Revert: git revert this commit (restores the pre-sweep skill).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C6: docs disposition -- 24 history docs archived, 16 retained, refs rewritten
...
DISPOSITION MANIFEST (archive, one-line justifications): clientdocs-
workflow-review (v1 tenant-docs era) / D-057-DECIDED-append +
D-057-REVIEW-ITEMS + README-D057-PACK + D-058-renumber (executed v1
decision packs) / D-068-openbao-assessment-DRAFT (supplementary; the
cited analysis retained) / DOCFIX-064-phase08-changelist + docfix-draft-
20260702 (executed/draft) / handoff-20260703 + handoff-20260705
(superseded handoffs) / incident-20260712-triplefault (trap routed to
platform-traps 1b/1c long ago) / netbox-vip-queue + phase-00-maas-
standup-notes + script-quality-findings + session-findings-2026-07-02 +
tenant-cidr-overlap-PLAN + v1-pre-deploy-fixes (v1-era executed/dated) /
repo-lint-nextfree-bug-FINDING (absorbed DOCFIX-105/107; repo_lint.py
pointer updated) / upstream-bug-draft-dashboard-tls (draft, dated) /
model-a-fallback-plan (D-123 Model B adopted; fallback preserved in
archive) / stage3-adversarial-review-20260716 (R3-F register,
dispositioned in 2.10) / dc-dc-replication-DR-seed (absorbed per
workflow) / dc-dc-ipv6-charm-research + dc-dc-netem-and-ula-gua-proposal
(stage 4+ research, refs updated). RETAINED 16 top-level, justified in
the session changelog. Live-surface refs to all moved files rewritten to
archive paths (18 files). G3 cell + ledger + changelog updated same
commit (the L10 fire on a Status-line path rewrite is satisfied by the
CURRENT-STATE touch -- the check worked as designed).
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C5: Stage 3 changelogs through 2026-07-18 -- 11 files (partial; stage OPEN)
...
Live session changelog (20260719) stays top-level until session close.
Consolidated record: docs/archive/stage-records/vr1-stage3-partial-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
changelog-20260716-d124-addressing-pin.md
changelog-20260716-d124-rack-addressing.md
changelog-20260716-d126-durable-forward.md
changelog-20260716-review-sweep-phaseAB.md
changelog-20260716-review-sweep-phaseC.md
changelog-20260716-review-sweep-phaseC2-D125.md
changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md
changelog-20260717-d127-iac-autostart-and-guest-updates.md
changelog-20260717-netbox-apex-recovery-edge-wan-import.md
changelog-20260718-opnsense-plugins-installer.md
changelog-20260718-permission-posture-ask-preempts-classifier.md
Revert: git revert this commit (restores top-level paths).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C4: VR1 Stage 2 (Office1) changelog consolidation -- 38 files (GA-R2, GA-F09)
...
Durable content routed contemporaneously (as-built/decisions/traps);
record notes the routing map. Stage 2 merged main PR #1 e468d2e.
Consolidated record: docs/archive/stage-records/vr1-stage2-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
changelog-20260711-d111-subcarve-nn-alignment.md
changelog-20260711-ula-gen-command-fix.md
changelog-20260712-docfix189-max-context-session-audit.md
changelog-20260712-libvirt-acpi-kernel-panic.md
changelog-20260712-libvirt-memory-unit-rootcause.md
changelog-20260712-office1-opnsense-edge-build.md
changelog-20260712-opnsense-edge-boot-fixes.md
changelog-20260712-opnsense-edge-real-isp-router.md
changelog-20260712-opnsense-prep-bz2-fallback.md
changelog-20260713-apparmor-libvirt-prereq.md
changelog-20260713-config-xml-danger-sweep.md
changelog-20260713-config-xml-path-deleted.md
changelog-20260713-d114-voffice1-nested-virt.md
changelog-20260713-docfix194-opentofu-module-validation.md
changelog-20260713-git-credential-store.md
changelog-20260713-office1-dhcp-apply.md
changelog-20260713-office1-headend-maas-lxd.md
changelog-20260713-office1-netbox-deployed.md
changelog-20260713-opnsense-api-client.md
changelog-20260713-opnsense-api-proven.md
changelog-20260713-opnsense-api-write-proven.md
changelog-20260713-opnsense-apikey-bootstrap.md
changelog-20260713-workflow-doc-status-correction.md
changelog-20260714-c4-sandbox-loop-and-upstream-guard.md
changelog-20260714-d119-region-qualified-dc-namespace.md
changelog-20260714-d119-tofu-apply.md
changelog-20260714-netbox-importers-waf-useragent.md
changelog-20260714-netbox-write-path-hardening.md
changelog-20260714-office1-lan-ipv6-executed.md
changelog-20260714-opnsense-set-interface-v6.md
changelog-20260715-creds-audit.md
changelog-20260715-creds-consolidation.md
changelog-20260715-d120-load-and-iprange-tooling.md
changelog-20260715-d120-office1-service-reip.md
changelog-20260715-d121-d122-stage3-ha-nodelayout.md
changelog-20260715-docfix195-c2-netbox-of-record.md
changelog-20260715-fidelity-check-scope-correctness.md
changelog-20260715-stage3-prereqs-prep.md
Revert: git revert this commit (restores top-level paths).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C3: VR1 Stage 0-1 changelog consolidation -- 45 files (GA-R2, GA-F09)
...
The 2026-07-09 authoring wave (31 in one day) + Stage-1 execution.
Consolidated record: docs/archive/stage-records/vr1-stage0-1-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
changelog-20260709-adversarial-review-fixes.md
changelog-20260709-ceph-replication-tooling.md
changelog-20260709-dc-dc-design.md
changelog-20260709-dc-dc-phase0-runbook.md
changelog-20260709-dc-dc-phase1-runbook.md
changelog-20260709-dc-dc-phase2-runbook.md
changelog-20260709-dc-dc-phase3-runbook.md
changelog-20260709-dc-dc-phase4-runbook.md
changelog-20260709-dc-dc-phase5-runbook.md
changelog-20260709-dc-dc-phase6-runbook.md
changelog-20260709-dc-dc-repo-rename-sweep.md
changelog-20260709-dc-selector-convention.md
changelog-20260709-designate-cinderbackup-rbdmirror.md
changelog-20260709-final-consolidation.md
changelog-20260709-ipv6-family-matrix-overlay.md
changelog-20260709-maas-scripts-dc-param.md
changelog-20260709-mtu-ceph-budget-calculators.md
changelog-20260709-netbox-dc-dc-pipeline.md
changelog-20260709-netem-ula-gua-proposal.md
changelog-20260709-office1-network-edge.md
changelog-20260709-opentofu-audit.md
changelog-20260709-opentofu-cloudinit-vm.md
changelog-20260709-opentofu-maas-netem.md
changelog-20260709-opentofu-node-vm.md
changelog-20260709-opentofu-scaffold.md
changelog-20260709-opnsense-config-design.md
changelog-20260709-opnsense-edge-module.md
changelog-20260709-opnsense-research.md
changelog-20260709-repo-agnostic-sweep.md
changelog-20260709-repo-lint-crlf-fix.md
changelog-20260709-stage0-ratification.md
changelog-20260710-carve-gua-hang-fix.md
changelog-20260710-ledger-scan-self-inflicted-falsepositive-fix.md
changelog-20260710-netbox-roles-aggregates.md
changelog-20260710-opentofu-scaffold-first-validation.md
changelog-20260710-opentofu-state-file-security.md
changelog-20260710-phase0-runbook-as-executed.md
changelog-20260710-phase01-bundle-staleness-fix.md
changelog-20260710-prereq-install-scripts.md
changelog-20260710-skill-vr1-awareness.md
changelog-20260710-sweep-bundle-fixes.md
changelog-20260710-sweep-dcdc-runbook-fixes.md
changelog-20260710-sweep-script-fixes.md
changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md
changelog-20260710-vr1-teardown-rollback-runbook.md
Revert: git revert this commit (restores top-level paths).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C2: v1/VR0-era changelog consolidation (GA-R2, GA-F09)
...
v1-redeploy-changelog.md was the era's own running record; its
"completion consolidation" TODO stays open in the ledger block.
Consolidated record: docs/archive/stage-records/v1-era-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
changelog-20260703-process-hardening.md
v1-redeploy-changelog.md
Revert: git revert this commit (restores top-level paths).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C1: GA-R4 rule-6 ledger rotation -- 1187 -> 131 lines (GA-F13)
...
Bodies rotated VERBATIM to docs/archive/session-ledger-rotated-20260719.md
(Live state 2026-07-13, OPEN WORK VR1+VR0, NetBox write-path bugs, PINNED
rulings, standing lessons, state facts, project-completion, NetBox import
narrative). Routed-before-rotating (durable homes): juju format=line 3.6
trap -> appendix-A; guards-are-load-bearing -> operating-discipline; VR0
operational facts + admin/controller -> maas-as-built-reference.md
(lessons 1-6 verified already covered by platform-traps/L8). Live ledger
keeps header + machine-derived fence + two compact still-live blocks
(NetBox write-path bugs pointer, project-completion) + the bounded session
summaries. 131 < 300: the F1 cap is now ENFORCEABLE. Fences OK; ledger-
scan counters unchanged; repo-lint 0 fail.
Revert: git revert this commit (restores the 1187-line ledger).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 3 CLOSE: memory hygiene (GA-F05..F08 memory surfaces) + G1 review; GA-F16 registered
...
Per the recorded provenance rulings: review-after-each-step.md REMOVED
(GA-F06 -- one-time instruction, never standing) and project-posture-
closed-test.md REMOVED (GA-F07 -- "ruling" never ruled; posture NEUTRAL);
hostname -> vcloud in the Remote Control memory (GA-F05 last surface);
MEMORY.md index rebuilt (GA-F08). GA-R7 rule-6 skill line added to
SKILL.md bootstrap. First full G1 review (rules 1-4) found + fixed one
further violation: creds-folder-convention.md duplicated a repo-carried
convention and linked both removed files -- registered as GA-F16, reduced
to a pointer entry. Post-review: 3 memory files, zero violations, zero
stale refs (grep-verified). Pre-edit copies: docs/archive/memory-20260718/
(index copy ASCII-normalized, noted in the changelog). G3 cell updated
same commit (L10 satisfied).
Revert: restore files from docs/archive/memory-20260718/ (memory side);
git revert this commit (repo side).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 2 CLOSE: verification + adjudication recorded; last GA-F03 site fixed
...
Gauntlet ALL GREEN (70); repo-lint 0 fail / 1 legacy WARN (L10 at FAIL).
platform-traps:19 tofu pin (the fifth GA-F03 site) demoted; CURRENT-
STATE's known-stale-pins paragraph rotated (all sites fixed, memory copy
= Batch 3). G3 cell: Batches 0-2 CLOSED. Extractor adjudication + the
criterion-mechanics FINDING recorded in the session changelog (live-
surface vocab flags 0; residual groups history-class or mechanical;
literal ZERO-on-counted lands with Batch 4 + Batch 6.1 by construction).
Revert: git revert this commit (docs + one skill row).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
GA-R3: class tags D-121..D-130 + register template + D-129 ARCH split (2.7, operator-ruled)
...
One-time review ruled 2026-07-19 (utterance: "Tags as proposed + D-122
amendment"): D-121..D-125 [ARCH], D-126..D-129 [OPS], D-130 [ARCH] (new
entries ARCH by construction). Register head gains the GA-R3 class-tag
convention block. D-129's ARCH fragment (Roosevelt metal-edge plugin
transfer profile) split per A1 into a dated AMENDMENT on D-122, the
governing site/edge-shape decision -- governing copy there, D-129 text
retained as history; its four OPEN sub-decisions unaffected. ledger-scan
re-verified: statuses + next-free counters unchanged (D next-free 131).
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
S1/2.10: R3-F residual disposition -- none unaccounted
...
Full register accounting (13 items): F01 CLOSED (R-1/R-2 rulings +
re-attributions, Phase A 2026-07-16); F02 CLOSED (SEC-010 artifact
committed + G10 gate names the pre-apply check; the SEC row itself stays
open on apply); F03/F04/F05 CLOSED (D-107/D-122 amendments, Phase A);
F06/F07 CLOSED (whole-host-budget.py committed + re-validation 838/1024
FIT); F09 CLOSED (D-115 status line, scan-verified); F10 CLOSED (SEC-011
operator ruling). Residuals dispositioned NOW: F08 CLOSED-SUPERSEDED --
the 3-OSD-host premise fell when R-3 added the 4th storage node/DC (one
host of rebuild headroom exists in the ruled 3+2+4); F11 FIXED -- the
workflow authoring cell's "D-101 supernet unassigned" clause dropped
(10.12.64.0/19 assigned by D-115; vr1-dc1 stays HELD on transit/rack
addressing, G12); F12 CLOSED -- the observation's blocker (uncommitted
model) resolved by the committed calculator; transient N+1 amphora churn
sits well inside the measured 186 GiB headroom, and the Stage-6 drill
exercises the real failover; F13 CLOSED as recorded observation (wording
cosmetic; D-122's bullet already amended). Also: readiness C5 queue was
STALE (queued amendments that landed 2026-07-16) -- corrected. Batch 2
item 2.10 (amendment S1).
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
GA-F14: stale-claim banner on the D-127 changelog (content preserved as history)
...
The falsified plan-outcome prediction is banner-marked, pointing at
GA-F14 and the GA-R2 rule (changelogs never citable as status). Batch 2
item 2.8. Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
GA-F10/H1 + GA-R1/R6: token migration, State-line demotions, E1 type tags (2.5+2.6)
...
Mapping record: docs/audit/h1-token-map-20260719.md -- all distinct
tokens dispositioned, none unmapped. Live-surface migration: workflow
doc (26 flags -> 0; header drops the tracker model, 8 State lines demote
to identity + CURRENT-STATE pointers), runbooks (18 -> 0; close-out
instructions RETARGETED to record status in CURRENT-STATE, not the
workflow tracker), readiness doc (5 -> 0), CURRENT-STATE itself (6 -> 0:
G9 STOPPED -> BLOCKED with named blocker; stale "GA-R1 NOT yet ratified"
header + pre-D-130 divergence rows corrected per C2). Gate rows gain
GA-R6/E1 type tags ([V]/[R]) with legend. CLAUDE.md expectation line
demoted per S5b. History classes (ledger, changelogs, design-decisions)
deliberately untouched -- their disposition is Batch 4/GA-R3 structural.
Extractor re-run: zero flagged occurrences on live non-history surfaces.
Batch 2 items 2.5 + 2.6.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
GA-F02: readiness doc demoted -- plan counts point at CURRENT-STATE, banner points at G9 entry
...
All three contradictory plan-count forms (5/2/6, 5/0/6, 5-add/(0-or-2)-
change/6-destroy) replaced with pointers at CURRENT-STATE.md section 5;
the falsified DEPLOY-READY status blockquote reframed as an explicitly
historical prep record; the "A FRESH session starts the deployment from
here" banner demoted to a one-line pointer at the G9 canonical entry doc
(runbooks/dc-dc-phase2-tofu-dc-substrate.md) per the operator's
post-Phase-3 scope addition (probe hole H1). Batch 2 item 2.1.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
GA-F03: stale tofu 1.12.3 pins demoted to CURRENT-STATE pointers
...
opentofu/README.md:41 (historical prose keeps its date, drops the pin)
and docs/dc-dc-deployment-workflow.md:47/:360/:875 (the :360 live claim
"binary EXISTS: v1.12.3" was FALSE -- measured 1.12.4) now point at
docs/CURRENT-STATE.md section 7, the only pin authority (GA-R1 rule 3).
The :47 edit also drops a "DONE" status token (vocab overlap with 2.5).
Batch 2 item 2.2.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 1 CLOSE: gauntlet ALL GREEN (70); changelog + ledger entries
...
Post-batch verification per the sweep plan: the G7 capture equals the
section-5 recorded triple exactly (6/0/6, committed in 5a4f5eb).
Gauntlet ALL GREEN -- now 70 harnesses (tests/cloudinit-vm joined the
set); repo-lint 0 fail, 1 legacy WARN, L10 running at FAIL severity.
Session changelog carries Batch 1 items with per-item reverts; ledger
entry appended (fences OK).
Revert: git revert this commit (docs-only).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
G6 reconcile EXECUTED (state surgery, operator-ruled) + G7 triple 6/0/6 recorded
...
Batch 1 items 5-7. Operator ruled (ii) state surgery per S3/GA-R5:
state pull -> autostart:true injected on voffice1 + office1-opnsense
(both were None, matching the measured absence) -> push, serial 22->23,
backup opentofu/terraform.tfstate.pre-G6-20260719 (gitignored). Guests
never touched: ids 1/2 unchanged, both running, autostart enable.
Re-plan captured to docs/audit/outer-plan-20260719-postG6.txt:
Plan: 6 to add, 0 to change, 6 to destroy -- zero in-place changes,
zero replacements. Section 5 records 6/0/6 as THE expected triple with
decomposition (C2: capture + doc same commit); G6 + G7 rows CLOSED;
divergence 2.3-ii marked resolved.
Revert: git revert this commit for the docs; state revert = tofu state
push of the pre-G6 backup (restores the 2-change plan).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
D-130 ADOPTED (a) + implemented: seed-volume ignore_changes guard (GA-F01, G4+G5 CLOSED)
...
Batch 1 items 1-4. G4 verifications captured: v8 = suppression CONFIRMED
(fresh baseline 7/2/7 identical to 2026-07-18, with-edit 6/2/6, zero
forces-replacement; DC0 creates unaffected); v7 = defect reproduced on
isolated throwaway-v7-* domain, replacement applied UNDER the running
domain with NO bounce (domid 3->3), teardown verified zero residue.
Operator ruled (a) per GA-R5 (utterance quoted in the D-130 entry).
Implemented: lifecycle { ignore_changes = [create] } on
libvirt_volume.seed in modules/cloudinit-vm + tests/cloudinit-vm
harness (6/6; guard placement, exact attribute, no leak onto data disk,
tofu validate). CURRENT-STATE: G4/G5 rows CLOSED + rotated, decision
queue item 1 rotated to the register, section 5 records post-fix 6/2/6
pending the G6 reconcile (C2: captures + doc same commit). 342/360 cap.
Revert: git revert this commit (restores the replace-pair behavior and
the pre-ruling CURRENT-STATE rows; captures remain in history).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 1 open: L10 status-coupling flipped WARN -> FAIL (GA-R1/C1)
...
One-constant flip (L10_FAIL = True) per the sweep plan's Batch 0 revert
note ("WARN for one batch before becoming FAIL"). Harness rc
expectations updated for the five firing cases; 42/42 PASS. G3 cell
updated same commit: Batch 0 CLOSED, Batch 1 OPENED by operator.
Revert: git revert this commit (restores WARN severity).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Permission posture: extend ask rules (Remote Control approve flow, no walls)
...
Operator-directed: git mutations (merge/revert/reset/rebase/branch -D),
script mutation verbs (bash scripts/* apply|install), ssh-sudo, and
Skill(*) added to ask so they PROMPT instead of classifier hard-deny.
Nothing auto-allowed; deny + guard hook unchanged. Skill(*) syntax
verified empirically (pre-change call hard-denied, post-change call
prompted + ran). Extends the 2026-07-18 ask-preempts-classifier posture.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 0 CLOSE: verification green; session changelog + ledger entry
...
Post-batch verification per the sweep plan: touched harnesses 42/42 +
44/44 + 33/33; full gauntlet ALL GREEN (69 harnesses); repo-lint 0 fail
1 legacy WARN, now running WITH the L10/C1 check active. Session
changelog opened (one for the whole sweep session, GA-R2/D1) with
per-item reverts; ledger gains the Batch 0 in-flight entry incl. the
L10 WARN->FAIL flip reminder due at Batch 1 open. G3 evidence cell
updated same commit (GA-R1 rule 8).
Revert: git revert this commit (docs-only).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 0.4: extractor status scan keyed to the legal token set (GA-F10 / vocab H1)
...
record-audit.py now knows the ratified Option A vocabulary: legal set
OPEN/BLOCKED/HELD/CLOSED (OPEN was previously unscanned -- a post-
migration blind spot where OPEN-vs-CLOSED stage contradictions would
have gone undetected); DONE/TO RUN/RUNNING added to the token scan.
New report section 6 classifies every distinct token (legal/illegal/
event) and flags illegal tokens plus event words (VOID/REOPENED/
SUPERSEDED) minted in status position (**Status: line or table row);
prose event words stay legitimate row-history vocabulary per H1.
Report-only: the 0/1/2 exit contract stays contradiction-driven, so
Batch 6.1 semantics are unchanged. Live sanity run (scratch --out, the
Phase-1 capture untouched): 12 distinct tokens, 163 flagged counted
occurrences -- Batch 2.5's migration work-list. G3 cell updated same
commit (GA-R1 rule 8).
Harness: tests/record-audit +9 checks, 33/33 PASS; repo-lint 0 fail.
Revert: git revert this commit (restores the 8-token scan and the
section-5-only report).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
