| 2026-07-21 |
D-129 sub (iii) RULED: per-site Tailscale = dedicated node on metal-admin, edge excluded (GA-R5)
...
Operator clarification recorded verbatim (per-site metal-admin tailscale
planned for this deployment + Roosevelt); D-107 shape becomes the
standing per-site pattern; D-131 sub-2 revisit clause never triggers.
Couplings same-commit (C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV
|
D-129 sub (ii) RULED: os-frr pinned to Roosevelt design time (GA-R5, utterance quoted)
...
VR1 stays static per D-124/D-125; rules alongside D-100 link spec +
D-132 topology at Roosevelt network design. Couplings same-commit (C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV
|
D-129 sub (i) RULED: COS scrapes the edge, in-scope per-DC (GA-R5, utterance quoted)
...
Status line updated (ruling authority); Step-10 exporter pin ungated at
its deployment step. CURRENT-STATE + ledger coupled same-commit (C1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV
|
D-131 sub-3 RESOLVED (no dhcpd option-6 defect); pin DNS arch review; file D-132 (Roosevelt MAAS topology)
...
Sub-3: source read (snap 41649) + operator-run rendered-config capture
(docs/audit/d131-sub3-dhcpd-option6-20260721.txt) -- option 6 carries the
forwarder alone; morning prepend observation was a stale pre-re-render
read. No second LP. Pinned architectural DNS review recorded in D-131
(feeds sub-4). D-132 PROPOSED filed on operator directive (verbatim
quoted): HA regions per DC, rack-top racks, cross-site backup custody.
CURRENT-STATE + ledger coupled same-commit (GA-R1 C1); next-free D=133.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV
|
D-131 sub-2 RULED: forwarder scope = metal-admin only (GA-R5, utterance quoted)
...
Status block updated in design-decisions.md (the ruling authority);
CURRENT-STATE + ledger D-131 lines coupled in the same commit (GA-R1 C1).
No live change -- codifies the running dc0-node-dns shape.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV
|
Pin tenant-onboarding review items to deployment-close consideration review (operator-directed)
...
Committee verdict on Chat's three inserts recovered from the disconnected
session's transcript; operator deferred all four corrected items to an
end-of-deployment review (posture/end-goals shifting). Self-contained pin
in session-ledger retained blocks; nothing landed in appendix-A, the
contract, or dc-dc-phase6.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV
|
Session bookend: Stage 3 closed + merged; ledger re-seeded (DOCFIX=198, D-131 surfaced)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XRtm5sDQgUsZyTJk3k7dz
|
Disconnect collapse: predecessor bookend landed; netem-tc install VERIFIED (step E unblocked)
...
- docs/audit/netem-sudo-install-20260721.txt: read-only verification of the
operator-run install (0440 root:root, byte-identical, sudo -n -l exit 0)
- CURRENT-STATE step-E paragraph: install PENDING -> INSTALLED+VERIFIED,
remaining path stated (GA-R1 C1/C2, same commit)
- session-ledger: bounded SESSION CLOSE for the close-and-delivery session
- changelog-20260721-netem-install-verify.md: session changelog w/ reverts;
ledger-scan D-131 status-phrasing blind spot flagged as queued finding
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XRtm5sDQgUsZyTJk3k7dz
|
Session close 2026-07-21: commissioning RESOLVED 9/9 Ready; D-131 proposed; SEC-014 opened
...
Lands the ops-commissioning-diag session's deliverable, whose close
bookend was lost to a session disconnect. Landed same-day by the
successor session after read-only re-verification (9/9 Ready, forwarder
active+enabled, dhcpd on both controllers, Phase-7 tag cleanup done).
- CURRENT-STATE: commissioning resolved (two stacked faults: MAC drift
from the in-place apply; MAAS 3.7 rack-only agent resolver SERVFAIL);
G10 remainder = netem step E only.
- design-decisions: D-131 PROPOSED (rack-only node DNS strategy).
- security-ledger: SEC-014 OPENED (rack cluster secret exposure).
- committee doc: closed by addendum.
- changelog + adjudication capture + as-executed index row.
- session-ledger: bounded close entry + machine-derived block re-seeded
from the 2026-07-21 scan (D next-free 132, DOCFIX 197, BUNDLEFIX 052,
10 open SEC rows).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01STHXiHfoxHqq8fGRVvb66G
|
| 2026-07-19 |
Deploy paused at A/B boundary; fresh-session handoff note (step B facts measured)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
DC0 deploy STEP A EXECUTED: outer apply 6/0/6 exact; G8+G9 CLOSED; convergence zero
...
Logged window dc0-deploy (as-executed log + index convention). G8 passed
in the apply session (six planes 0 leases, 0 attachments); validate
PASS; pre-apply capture equaled the recorded triple; the SAVED plan was
applied: 6 added / 0 changed / 6 destroyed. vvr1-dc0 RUNNING (108 vCPU,
416 GiB, autostart disable per D-127); vr1-dc0-uplink active; six vcloud
planes destroyed (Model B relocation); voffice1 + edge untouched (ids
1/2). Convergence re-plan: no differences (captured). CURRENT-STATE:
section 1 position, section 5 expected plan = ZERO DIFF (any diff is a
STOP), G8 + G9 rows CLOSED; active gate G10. Captures committed same
commit (C1/C2).
Revert: infra revert = runbooks/dc-dc-teardown-rollback.md decision tree
(NOT a blind destroy); docs revert = git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
AUDIT EXIT: operator re-signed CURRENT-STATE; G3+G11 CLOSED, G9 OPEN; session close (GA-R4)
...
Batch 6 item 6: signature utterance "Reviewed, approved, continue."
recorded into section 11 (replaces 2026-07-18 per GA-R1 rule 7). All six
exit runs PASS. G3 CLOSED (all six batches); G9 OPEN (audit criteria
MET; remaining closer = the operator-gated logged apply with G8 first);
FREEZE LIFTED. Session GA-R4 close: bounded 14-line summary in the
ledger, full body rotated to docs/archive/session-20260719-phase5-sweep.md.
Repo HEAD at signing = this commit's parent (437d9d1).
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 6 item 3: exit probe trio 21/21 -- 7/7 on ALL THREE (bar exceeded)
...
Three independent clean-context probes (repo + verbatim charter question
set only, read-only, no shared state; fresh contexts satisfy GA-R7/G2)
scored against CURRENT-STATE with citations spot-verified against the
tree. Unanimous on every question; third-trap picks varied (all real);
zero orientation divergence (all landed CURRENT-STATE-first via the
swept skill); probe hole H1 did not recur. Full scorecard in the exit
record. Remaining before audit exit: item 6 only (operator re-read +
re-signature). G3 cell updated same commit.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 6: exit runs 1/2/4/5 -- archive exclusion (operator-ruled), adjudication, plan==triple, S2
...
6.1: docs/archive/ joins docs/audit/ as inventoried-not-counted (ruling
quoted in the exit record); record-audit + harness 35/35; per-group
adjudication = ZERO contradictory status-claim pairs on counted surfaces
(the charter's criterion as stated); group floor 9 recorded as re-run
baseline; missed patch file archived; CURRENT-STATE stale-note made
token-free. 6.2: 16 top-level docs (<25). 6.4: fresh capture
outer-plan-20260719-phase6-exit.txt = 6/0/6 == section-5 triple. 6.5:
G9 row names SEC-010's step-B dependency (S2). Exit record:
docs/audit/phase6-exit-runs-20260719.md. Items 3+6 pend operator
execution. G3 cell updated same commit.
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 5: skill sweep -- GA-R1..R7 implemented in openstack-cloud-ops (single commit)
...
New GA-rulings section reconciled against the RATIFIED text (draft
skill-additions cross-checked; the one draft-only item, the
reconciliation circuit-breaker, kept and marked as discipline). Stale
facts demoted to CURRENT-STATE delegation: the header's "current phase =
VR0 testcloud" and the deploy loop's "opentofu UNVALIDATED / no tofu
binary has ever run" (false since 2026-07-13). Session bookends + stage
close rewritten per GA-R4/GA-R6; change-delivery per GA-R2/D1; routing
rows re-pointed. Read-through checklist committed:
docs/audit/skill-sweep-checklist-20260719.md (every ratified rule ->
disposition). G3 cell updated same commit. repo-lint 0 fail.
Revert: git revert this commit (restores the pre-sweep skill).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C6: docs disposition -- 24 history docs archived, 16 retained, refs rewritten
...
DISPOSITION MANIFEST (archive, one-line justifications): clientdocs-
workflow-review (v1 tenant-docs era) / D-057-DECIDED-append +
D-057-REVIEW-ITEMS + README-D057-PACK + D-058-renumber (executed v1
decision packs) / D-068-openbao-assessment-DRAFT (supplementary; the
cited analysis retained) / DOCFIX-064-phase08-changelist + docfix-draft-
20260702 (executed/draft) / handoff-20260703 + handoff-20260705
(superseded handoffs) / incident-20260712-triplefault (trap routed to
platform-traps 1b/1c long ago) / netbox-vip-queue + phase-00-maas-
standup-notes + script-quality-findings + session-findings-2026-07-02 +
tenant-cidr-overlap-PLAN + v1-pre-deploy-fixes (v1-era executed/dated) /
repo-lint-nextfree-bug-FINDING (absorbed DOCFIX-105/107; repo_lint.py
pointer updated) / upstream-bug-draft-dashboard-tls (draft, dated) /
model-a-fallback-plan (D-123 Model B adopted; fallback preserved in
archive) / stage3-adversarial-review-20260716 (R3-F register,
dispositioned in 2.10) / dc-dc-replication-DR-seed (absorbed per
workflow) / dc-dc-ipv6-charm-research + dc-dc-netem-and-ula-gua-proposal
(stage 4+ research, refs updated). RETAINED 16 top-level, justified in
the session changelog. Live-surface refs to all moved files rewritten to
archive paths (18 files). G3 cell + ledger + changelog updated same
commit (the L10 fire on a Status-line path rewrite is satisfied by the
CURRENT-STATE touch -- the check worked as designed).
Revert: git revert this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 4 C1: GA-R4 rule-6 ledger rotation -- 1187 -> 131 lines (GA-F13)
...
Bodies rotated VERBATIM to docs/archive/session-ledger-rotated-20260719.md
(Live state 2026-07-13, OPEN WORK VR1+VR0, NetBox write-path bugs, PINNED
rulings, standing lessons, state facts, project-completion, NetBox import
narrative). Routed-before-rotating (durable homes): juju format=line 3.6
trap -> appendix-A; guards-are-load-bearing -> operating-discipline; VR0
operational facts + admin/controller -> maas-as-built-reference.md
(lessons 1-6 verified already covered by platform-traps/L8). Live ledger
keeps header + machine-derived fence + two compact still-live blocks
(NetBox write-path bugs pointer, project-completion) + the bounded session
summaries. 131 < 300: the F1 cap is now ENFORCEABLE. Fences OK; ledger-
scan counters unchanged; repo-lint 0 fail.
Revert: git revert this commit (restores the 1187-line ledger).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 3 CLOSE: memory hygiene (GA-F05..F08 memory surfaces) + G1 review; GA-F16 registered
...
Per the recorded provenance rulings: review-after-each-step.md REMOVED
(GA-F06 -- one-time instruction, never standing) and project-posture-
closed-test.md REMOVED (GA-F07 -- "ruling" never ruled; posture NEUTRAL);
hostname -> vcloud in the Remote Control memory (GA-F05 last surface);
MEMORY.md index rebuilt (GA-F08). GA-R7 rule-6 skill line added to
SKILL.md bootstrap. First full G1 review (rules 1-4) found + fixed one
further violation: creds-folder-convention.md duplicated a repo-carried
convention and linked both removed files -- registered as GA-F16, reduced
to a pointer entry. Post-review: 3 memory files, zero violations, zero
stale refs (grep-verified). Pre-edit copies: docs/archive/memory-20260718/
(index copy ASCII-normalized, noted in the changelog). G3 cell updated
same commit (L10 satisfied).
Revert: restore files from docs/archive/memory-20260718/ (memory side);
git revert this commit (repo side).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 2 CLOSE: verification + adjudication recorded; last GA-F03 site fixed
...
Gauntlet ALL GREEN (70); repo-lint 0 fail / 1 legacy WARN (L10 at FAIL).
platform-traps:19 tofu pin (the fifth GA-F03 site) demoted; CURRENT-
STATE's known-stale-pins paragraph rotated (all sites fixed, memory copy
= Batch 3). G3 cell: Batches 0-2 CLOSED. Extractor adjudication + the
criterion-mechanics FINDING recorded in the session changelog (live-
surface vocab flags 0; residual groups history-class or mechanical;
literal ZERO-on-counted lands with Batch 4 + Batch 6.1 by construction).
Revert: git revert this commit (docs + one skill row).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 1 CLOSE: gauntlet ALL GREEN (70); changelog + ledger entries
...
Post-batch verification per the sweep plan: the G7 capture equals the
section-5 recorded triple exactly (6/0/6, committed in 5a4f5eb).
Gauntlet ALL GREEN -- now 70 harnesses (tests/cloudinit-vm joined the
set); repo-lint 0 fail, 1 legacy WARN, L10 running at FAIL severity.
Session changelog carries Batch 1 items with per-item reverts; ledger
entry appended (fences OK).
Revert: git revert this commit (docs-only).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 0 CLOSE: verification green; session changelog + ledger entry
...
Post-batch verification per the sweep plan: touched harnesses 42/42 +
44/44 + 33/33; full gauntlet ALL GREEN (69 harnesses); repo-lint 0 fail
1 legacy WARN, now running WITH the L10/C1 check active. Session
changelog opened (one for the whole sweep session, GA-R2/D1) with
per-item reverts; ledger gains the Batch 0 in-flight entry incl. the
L10 WARN->FAIL flip reminder due at Batch 1 open. G3 evidence cell
updated same commit (GA-R1 rule 8).
Revert: git revert this commit (docs-only).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Batch 0.2: ledger-scan SEC reporting repointed at security-ledger.md (GA-R4/F3)
...
Scan output now emits open COUNT + ID list + register-of-record pointer;
row-level dispositions dropped (they live in docs/security-ledger.md
ONLY). Session ledger's machine-derived SEC bullet re-seeded to pointer
+ count form. G14 evidence cell repointed at security-ledger.md same
commit, and its count corrected 9 -> 8 per GA-R1/C2 (measurement wins:
the cell's own enumeration and the scan both measure 8; divergence noted
in the cell, not silently harmonized).
Harness: tests/ledger-scan +4 checks (count+IDs surfaced, pointer
present, disposition text absent), 41/41 PASS; repo-lint 0 fail.
Revert: git revert this commit (restores per-row scan output, prior
ledger bullet, and the 2026-07-18 G14 cell incl. its count error).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi
|
Ledger: post-close addendum -- plan reviewed + S1-S5 applied; Batch 0 presented, HELD for fresh session
...
Keeps the GA-R4 close summary truthful about the post-close continuation
(review verdict arrived after the bookend). No other work remains in this
session.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ZV3uqyU9oWoFTcwiE4a21
|
| 2026-07-18 |
SESSION CLOSE per GA-R4: bounded 14-line summary + full body to docs/archive/ (first live compliance run)
...
Grounding-audit session closed: Phases 1-4 complete and externally
reviewed, sweep plan drafted (687dfa8), Phase 5 deferred to a fresh
session. Fences OK post-append. F1 cap noted as not yet enforceable
pending the Batch-4 one-time rotation (GA-R4 rule 6). Revert: git revert
of this commit restores the pre-close ledger.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ZV3uqyU9oWoFTcwiE4a21
|
Ledger: session-close bookend -- DC0 apply STOPPED, superseded by grounding audit charter
...
Bookend for the 2026-07-18 session. Records what was established (source-verified
autostart bounce path, the /tmp cloudinit root cause, the corrected 3-VM blast
radius), what remains open (D-130 mechanism ruling, verifications 7 and 8, the
doc-integrity list), and points at the full record in
docs/finding-20260718-voffice1-cloudinit-seed-replace.md (43b29d7).
Notes that this session is superseded by a grounding audit charter arriving via
git, to be read first by whoever picks this up.
Nothing applied, no module touched, no state written. Gate before any apply
stands: plan must read EXACTLY 5 add / 0 change / 6 destroy.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YArUfQQe6VasfTvzzb9D6P
|
Findings: post-reboot outer plan would BOUNCE Office1 headend + edge -- DC0 apply STOPPED
...
Read-only orientation + pre-apply re-verification. NOTHING applied, no module
touched, no state written. Records findings only, before any fix work.
WHAT WAS FOUND
Outer `tofu plan` post-reboot = 7 add / 2 change / 7 destroy, NOT the committed
5 add / 2 in-place / 6 destroy in docs/dc0-deploy-readiness.md. The entire delta
is `voffice1` (the live headend), not DC0 scope.
1. DOMINANT RISK -- the 2 "in-place" changes bounce both guests. VERIFIED FROM
PRIMARY SOURCE (dmacvicar/libvirt v0.9.8 internal/provider/domain_resource.go):
Update's only no-bounce path (L1090) requires
`domainConfigUnchanged && runningChanged && autostartUnchanged`. An
autostart-only diff has runningChanged=FALSE, so it falls through to
stopDomainIfRunning -> DomainUndefine -> DomainDefineXML -> DomainSetAutostart.
The guest is STOPPED. Applies to voffice1 AND office1-opnsense.
2. `-refresh-only` CANNOT fix it. Read is self-gating (L938):
`if isImport || (!state.Autostart.IsNull() && ...)`. State's Autostart is NULL,
so autostart is never read back. Matches empirical `grep -c autostart` = 0 on
both domains. (isImport DOES read it -- `tofu import` is a candidate
bounce-free reconcile path.)
3. Seed-volume replacement is STRUCTURAL, not drift. modules/cloudinit-vm chains
libvirt_cloudinit_disk.seed (stages the ISO in /tmp) -> libvirt_volume.seed
(create.content.url = that /tmp path). The 2026-07-17 host reboot cleared /tmp,
so the disk re-creates with a NEW random filename, so the url changes, so the
volume force-replaces -- while attached to the RUNNING domain as sda. The real
ISO is intact. Recurs after every host reboot. Warrants D-130 (next-free
confirmed 2026-07-18).
ALSO RECONCILED
- Bookend item (a) CLOSED (measured): vcloud host patched to 6.8.0-136 and rebooted
2026-07-17; apt clean; no reboot-required. D-127 autostart chain PROVEN by a real
unattended reboot -- both VMs + all 3 SSH targets recovered with zero manual
intervention; base-leg ok, NetBox 302, edge 0% loss. Item (b) STAYS OPEN (edge
guest still on 14.3-RELEASE-p16; a host reboot does not patch it).
- Stage-3 "HELD NetBox addressing" blocker in dc-dc-deployment-workflow.md is STALE.
Measured live against the apex: 172.31.0.0/30 (Transit, scope VR1 DC0), the
172.31.0.0/24 container, and 10.12.8.2/22 all PRESENT. Needs DOCFIX-196.
- Version drift: OpenTofu on the jumphost is v1.12.4; README.md:41 says v1.12.3.
Coincidental to the above -- the cause is /tmp, not the version bump.
TWO OF MY OWN CLAIMS CORRECTED IN-FLIGHT (both were inferences, per hard rule 2)
- Cited platform-traps.md 1e as the warrant for the autostart bounce. 1e was
measured on a MEMORY change and does NOT transfer to an autostart-only diff. The
conclusion held but the reasoning was wrong; replaced with the source evidence
above. 1e's operational rule ("0 to change is the only assurance") stands.
- Claimed the /tmp trap hits "all 9 DC0 node VMs and every containment VM". WRONG,
retracted. libvirt_cloudinit_disk appears in exactly ONE module (cloudinit-vm),
instantiated TWICE (main.tf:181 voffice1, main.tf:361 vvr1_dc0). The 9 nodes use
modules/node-vm = blank-disk PXE, NO cloud-init; edges use REST config (D-113(a2)).
Real exposure = voffice1 + vvr1-dc0 (+vvr1-dc1) = 3.
PRIOR-SESSION ROOT CAUSE
docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md asserts "the 2
in-place collapse to 0 once the bookend sets those two autostart live" and "no
forces-replacement on any existing". Both are FALSE. The collapse prediction was
wrong WHEN WRITTEN, not made wrong by the reboot -- it inferred that `virsh
autostart` would be picked up by refresh, without reading the provider's Read path.
Correcting those assertions is queued as Class 1 doc-integrity work.
OPERATOR RULING (2026-07-18): do NOT proceed to DC0 leaving these behind. Fix
scripts/data/settings to 100% correct first; the post-teardown redeploy must be
error-free from these deliverables.
repo-lint: 0 fail (1 legacy WARN).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YArUfQQe6VasfTvzzb9D6P
|
Permission posture: ask-list mutation surfaces so they PROMPT (not classifier-deny)
...
Root cause (claude-code-guide, doc-cited): in auto mode, unmatched mutations
fall to the classifier and get HARD-DENIED (no approval prompt). ask/deny rules
are evaluated BEFORE the classifier, so ask-listing the mutation surfaces forces
an approve/deny/adjust prompt -- the intended gating.
.claude/settings.json (operator-applied; editing the permission file is itself
gated): + ask for *opnsense-api.sh POST, *opnsense-plugins.sh apply, *tofu
apply/destroy/import/state rm, *--commit, Edit(.claude/settings*.json); + allow
for the edge GET + opnsense-plugins.sh list. deny + guard hook unchanged.
Changelog + ledger note + carry-forward (verify prompts post-reload) added.
Revert: git revert this commit, or cp .claude/settings.json.bak over it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz
|
D-129: build the OPNsense edge plugin profile-installer + sharpen pins
...
Autonomous processing of D-129 items that need no operator keyboard. Repo-only;
NOTHING applied to the cloud (live plugin install stays classifier-gated).
- NEW scripts/opnsense-plugins.sh + tests/opnsense-plugins/ (17/17): named-profile
installer over the D-113 firmware API. Installs ONE plugin at a time + polls
upgradestatus (the firmware-lock lesson), delegates auth to opnsense-api.sh,
warns os-qemu-guest-agent != a working agent, offline --dry-run. Closes the
"build the reusable installer" pin.
- D-129 + dc-dc-phase2 pin: installer recorded as BUILT (use it, not build it);
qga channel logged as an OPT-IN-var design (default OFF -> no office1/DC0-plan
side-effect; dmacvicar 0.9.8 mechanism-to-verify); os-git-backup operator ask.
- Gauntlet ALL GREEN (68), repo-lint 0-fail.
Revert: git rm the script+harness; revert the doc/runbook edits.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz
|
Ledger: RETIRE boot-race carry-forward -- D-126 base-leg PROVEN 2026-07-18
...
Operator-forced test reboot (host boot 2026-07-17 23:38:41) exercised the
After=libvirtd+poll race. All four checks PASS; the unit journal logs
"added leg" (leg absent at boot -> unit created it), the strong proof. The
D-126 base-leg oneshot self-heals office1-local's dropped L3 leg unattended.
jessea123 added to systemd-journal group + relog so future sessions read
unit journals without sudo.
Revert: restore the prior carry-forward wording (informational only).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz
|
D-129 verify: qga installed-but-non-functional; iperf lost to firmware lock
...
Reconcile records to the measured 2026-07-18 install verification (operator ran
the firmware POSTs via `!`; agent verified read-only). No cloud mutation here.
- os-qemu-guest-agent: package installed, NON-FUNCTIONAL -- daemon off + the
opnsense-edge module defines no org.qemu.guest_agent.0 libvirt channel
(guest-ping fails). Functional enablement = channel-in-module + service-enable
+ edge restart -> DEFERRED; new DC edges born with the channel.
- os-iperf: did NOT install -- back-to-back firmware POSTs collided on the
OPNsense firmware lock. Re-run pending; profile-installer must be 1-at-a-time
+ poll upgradestatus.
- D-129 Verification note + phase2 pin + as-built row + ledger reconciled.
Revert: git revert; nothing installed/applied by this commit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz
|
