Stage 4 carve EXECUTED both DCs: D-133 flat statics + D-134 bands live in MAAS ...

Logged window stage4-carve (index entry added). Sets 0-5: dynamic ranges
moved .201-.254, 10 plane fabrics, 90 NIC re-homes (pinned MACs matched),
2 provider subnets moved off fabric-5 + 8 created, 6 spaces + 12 VLANs,
18 nodes' statics + br-ex OVS (provider raw, D-100). All 18 nodes Ready.
Verification capture docs/audit/stage4-carve-verify-20260723.txt.
Changelog items 5-6 (incl. session permission-rule change + flagged
residue: 192.168.1.0/24, emptied fabric-5, empty auto-fabrics).
CURRENT-STATE same-commit (GA-R1 C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-134 AMENDED: contiguous band table (Option B swap), utterances quoted ...

Operator rejected interleaved bands; ruled Option B: nodes contiguous at
.100-.200 (control .100-.119 / compute .120-.149 / storage .150-.200),
dynamic range moves to .201-.254 (first gated carve mutation per DC),
utility .4-.49, VIP .50-.99. VR1 assignments: control .100-.102, compute
.120-.121, storage .150-.153. CURRENT-STATE + changelog same-commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-134 ADOPTED: per-role octet bands for VR1 DC node statics ...

Rejected-then-ruled sequence recorded (GA-R5): .40-.48 flat band rejected;
operator directed per-role bands with headroom; recommendation adopted.
Bands: .10-.19 control / .20-.49 compute / .201-.254 storage; .4-.9
utility-reserved; .50-.99 formal VIP band (measured .50-.60 today);
.100-.200 dynamic untouched. Stable octet per node across all six planes,
both DCs, keyed by tofu name via pinned boot MAC. CURRENT-STATE updated
same-commit (GA-R1 C1); changelog item 3.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Stage 4 OPEN + D-133 ADOPTED: flat per-NIC carve (VR1), hw-faithful NICs next deployment ...

Stage 4 (Phase 3, MAAS deploy per DC) opened on this branch: precondition
PASS, discovery captured read-only (docs/audit/stage4-discovery-20260723.txt),
runbook-vs-reality deltas + open decision points recorded in CURRENT-STATE
(same commit, GA-R1 C1). D-133 records the operator ruling (utterance quoted,
GA-R5): VR1 planes carve flat on dedicated NICs -- no VLAN-103 stack; next
deployment builds node VMs with target-hardware-exact NIC topology
(bonds/trunks). Affected stale surfaces queued in the entry, not edited.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend: queue-pass CLOSED (ledger summary, changelog archived, scan fix) ...

Bounded GA-R4 close entry; changelog-20260723-queue-pass.md -> docs/archive/
changelogs/; as-executed index row broadened to the window's full scope.
AT CLOSE: ledger-scan false-close defect (detached-amendment status hijack,
D-132 dropped) found by the close reconciliation itself -- fixed number-keyed
with regression cases (48/48; gauntlet 76 ALL GREEN), machine block re-seeded,
scan re-verified truthful. GA-R7 memory review: no changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 Q3 RULED + delivered: monthly-review checks in ops-update-procedure 0c ...

Two standing read-only checks (Vault 1.8.x CVE scan, migration-signal probes);
design-time V1-V5 re-verify trigger recorded. Same-vehicle stale claims fixed
(bundle-pins-1.16 CAUTION, D-071 PROPOSED tail). D-068 item 1 remainder is now
only the Q2 path selection at Roosevelt Vault design time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 Q2 RULED: Roosevelt baselines on 1.8 + funded remediation track (structure only) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 Q1 RULED: rehearsal-scoped EOL Vault acceptance, posture 1b (utterance quoted) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-068 item 1: re-scoped Vault migration plan drafted (options paper; nothing adopted) ...

Q1 interim posture / Q2 Roosevelt path (4 options incl. OpenBao-payload fork,
shrink-the-job) / Q3 review triggers; verify list V1-V5 before any Q2 ruling.
Amendment on D-068; CURRENT-STATE section 8 + G15 updated same commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G13 CLOSED: office1 edge bundle -- qga channel live, 26.7.1, os-iperf in (operator-approved) ...

Saved-plan 0/1/0 channel apply (bounce = the ruled restart; guest-ping proven),
REST update 26.7->26.7.1 (no reboot), vr1-edge profile complete (both plugins
installed=1 by read-back), outer plan re-converged zero diff. Close capture
docs/audit/g13-close-20260723.txt; G13 row + section 5/7 + as-built updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G13 plugin leg PARTIAL: qga installed, os-iperf refused pending 26.7.1 (measured) ...

Operator-approved vr1-edge apply on office1-opnsense: os-qemu-guest-agent 1.3
verified installed; os-iperf refused by the edge (upgradestatus: "update to
opnsense-26.7.1 is required") -- new gated maintenance decision, nothing
further mutated. G13 row updated in the same commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

L10 repair: CURRENT-STATE carries the SEC-010 re-assert status (GA-R1/C1) ...

The 627cfc8 capture commit should have updated CURRENT-STATE in the SAME
commit; lint's exit code was masked by a pipe and the FAIL was missed
before push -- owned. Status line added (section 2.2); lint now 0-fail.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend: G12 dc1 CLOSED + merged (edge->commission->close in one session) ...

Bounded GA-R4 close summary + machine-derived reseed (SEC 10->12: SEC-015/-016);
G14 SEC-row count reconciled to 12. dc1 substrate built + commissioned 9/9,
merged to main (a5c0a49), branch retired. Full body in the archived changelog.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1 close-out: consolidation + skill sweep + CURRENT-STATE (G12 CLOSED) ...

- GA-R2 consolidation: 3 dc1 session changelogs (07-21 authoring, 07-22 build,
  07-23 edge) archived to docs/archive/changelogs/; Stage 3 record gains a
  "G12 CLOSED 2026-07-23" section + table rows
- CURRENT-STATE: G12 gate CLOSED, section-1 stage narrative updated
- skill sweep: per-DC dedicated MAAS->libvirt power key (SEC-012/SEC-016)
  added as a standing DC-standup invariant
- GA-R7 memory review: clean (no changes)

Close-out set complete; ready for operator-gated merge to main.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: SEC-016 power key wired + commissioning 9/9 READY -- [V] leg complete ...

- SEC-016 dedicated dc1 MAAS->libvirt power key minted, authorized on the
  rack, installed in the region MAAS snap (per-host ssh config; dc0 SEC-012
  key untouched -- true per-DC isolation); manifest updated (creds-audit CLEAN)
- maas-node-power.sh --commit: power_type=virsh on all 9, each verified by a
  real query-power-state (proves the SEC-016 region->rack path)
- commissioned all 9 -> ALL 9 READY in ~3.5 min (no timeout, no SERVFAIL),
  shapes EXACT to D-121 Option C; dc0's two stacked faults pre-empted by
  pinned MACs + the dc-rack-net forwarder
- G12 [V] leg (dc1 build) COMPLETE; NEXT is close-out + operator-gated merge

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: rack-net install + region MAAS config + SEC-016 power-key ruling ...

- dc-rack-net install dc1 on the rack: check 10/10, forwarder answers
  authoritative maas-internal SOA (D-131 fix; audit capture committed)
- region MAAS: D-120 range 10.12.68.100-.200, D-131 dns_servers=10.12.68.3
  allow_dns=false, DHCP dhcp_on=true primary_rack=nmpcq4; dhcpd verified
  RUNNING on virbr6 (behavioral, no Temporal incident)
- dc1 enlistment PROVEN via canary (machines 11->12 in ~2 min)
- SEC-016: operator-ruled "Mint a dedicated dc1 power key" (per-DC
  isolation, not SEC-012 reuse) -- recorded before dependent wiring (GA-R5)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: edge bootstrap + v4 addressing COMPLETE (D-112c + D-113a2 proven on 26.7) ...

Edge phase for vr1-dc1, resuming the 2026-07-22 close handoff:
- D-112(c) console bootstrap: SSH + dc1 edge key materialized (payload
  needed util.inc/shell_safe() -- dc0 lesson iv the .b64 artifact lacked)
- key-only SSH verified (15.1-RELEASE-p1)
- D-113(a2) API key minted via vendor model; GET core/firmware/status
  exit 0, product_abi 26.7
- edge addressed: WAN 172.30.3.2/24 gw 172.30.3.1 (egress 0% loss),
  LAN -> 10.12.64.1/22 (ruled provider-public gw), API at new LAN
- interim reach leg removed; rack provider-public leg 10.12.64.2/22 live
- creds consolidated to ~/vr1-dc1-creds/ (creds-audit CLEAN); rack edge-key
  copy shredded -> SEC-015 (transient, remediated)

Two queued findings: bootstrap .b64 missing util.inc; opnsense-bootstrap-apikey.sh
scp transient post-restart-sshd failure (readiness-wait/retry candidate).

CURRENT-STATE G12 row + security-ledger SEC-015 + manifest updated (GA-R1/C1).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: D-125 egress gate PASS (two identical runs, isolation confirmed) ...

dc0's procedure of record recovered from the dc0 rack, adapted per-DC,
prereqs proxied in, noble.img streamed dc0->dc1. Both runs: gw 0%, net 0%,
1.1.1.1=301, archive=200, region LAN-TCP=000, zero leftovers. dc0's
one-time ICMP anomaly did not recur. Bridge-in egress proven for dc1;
double-NAT fallback not needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1 step C COMPLETE: 28/28 inner resources, 10/10 domains running ...

Inner apply from voffice1 (D-128 Plane 2): staging set mirrored from dc0
(branch switch preserving dc0 tfstate, dc1 key piped, known_hosts, 26.7
base local to the provider host, tfvars all-sourced). Plan 28/0/0 exact
with 54 pinned MACs verified. One fix-forward: serial-log staging dir
absent inside vvr1-dc1 (dc0 had it hand-made 07-20; queued to standup
DoD) -- dir created, resume 10/0/0, exit 0. Convergence zero diff; edge
at the 26.7 login prompt (D-112 datapoint #2). Captures:
docs/audit/inner-{plan,converge}-20260722-dc1-stepC.txt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1 step B COMPLETE: transit live, rack enrolled, SEC-010 both ends, 26.7 staged ...

cloudinit-vm gains interface_macs (node-vm port; harness 10/10) -- voffice1
NIC3 + full MAC pins, vvr1-dc1 pin-adoption, 0/2/0 exact, post-bounce
battery ALL PASS, converged zero diff. Transit .5<->.6 proven with the dc1
key. Rack bootstrap dc1-parameterized via existing flags (dry-run caught the
dc0-flavored defaults); first run exit 4 on stale apt index, re-run exit 0;
region lists vvr1-dc1 (nmpcq4). SEC-010 region end extended to enp3s0.
OPNsense 26.7 base = hash-verified copy of dc0's proven artifact. Named
gate EXIT 0 (docs/audit/dc1-stepB-check-20260722-final.txt). Three queued
findings logged (changelog item 7).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: apex --commit executed + substrate step A applied (5/0/0 exact, converged) ...

Operator-gated session (as-executed: dc1-deploy, per-command wrap):
apex write CREATED 172.31.0.4/30 + 10.12.68.2/22 (preflight re-run +
idempotent read-back captured); dc1 svc keypair minted per manifest
(creds-audit CLEAN); tfvars authored (local, D-124 amendment verbatim);
outer saved-plan apply 5 added / 0 changed / 0 destroyed -- vvr1-dc1
RUNNING (108 vCPU / 416 GiB, measured host headroom ~140 GiB), prior
guests untouched; convergence ZERO DIFF
(docs/audit/outer-plan-20260722-postdc1-converged.txt).
Next gated step: dc1 step B bootstrap (CURRENT-STATE G12 row).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1: item-3 substrate landed + harness reconcile (gauntlet 76 ALL GREEN) ...

Lands the disconnected session's authored tree (vr1_dc1 vars, vvr1-dc1 +
uplink modules, inner root vr1-dc1-substrate/ with 54 pre-pinned MACs,
lib-net dc1 arm + one-selection guard) and delivers changelog item 4:
six harnesses reconciled to the ratified dc1 selector arm, phase-00
PLANES/lib-net parity guard (exit 2, refuses cross-DC planning),
rbd-mirror + radosgw parent-shell selection (dc1 reminder now shows
10.12.84.0/22, not dc0's). Gauntlet ALL GREEN 76
(docs/audit/gauntlet-20260722-g12-reconcile.txt); repo-lint 0-fail.
G12 next gated step unchanged: operator-gated apex --commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend (successor-landed): G12 dc1-authoring session disconnected mid-item-3 ...

Drop-state recorded, not delivered: dc1 vars + substrate root + lib-net dc1
arm authored UNCOMMITTED in tree; gauntlet 6/76 FAILED (six harnesses still
assert the retired vr1-dc1 fail-loud arm -- capture in docs/audit/). G12 row
updated same-commit (GA-R1/C1). Working-tree authoring intentionally left
uncommitted pending harness reconcile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GksWgeVyXqhrojhKTiS8J5

G12 dc1: apex confirm-free captured; dc-rack-mgmt-import gains per-site (--site) dc1 support ...

Confirm-free vs live apex (read-only): dc1 planes already assigned+consistent,
transit 172.31.0.4/30 + rack 10.12.68.2 free, uplink 172.30.3.0/24 registered.
Importer harness 117/117; live dc1 dry-run preflight PASS (captures committed).
The apex --commit remains an operator-gated step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VifVpH3XQQxQz8NQ1VxNau

G12 [R] leg CLOSED: vr1-dc1 addressing RATIFIED (D-124 amendment 2026-07-21, GA-R5) ...

Pattern-derived from D-115/D-101/D-124/D-120/D-131/D-125/D-126; contiguous
/22 carve divergence documented; apex confirm-free at authoring. G12 row
HELD -> OPEN with the [V] remainder named. Couplings same-commit (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-100 gap #11: netem placeholder CONFIRMED STANDING until Roosevelt link spec (GA-R5) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-071 point 4 RULED + D-071 ADOPTED closure: all four update-policy points ruled (GA-R5) ...

In-channel-only refreshes adopted; D-071 status ADOPTED; G15 row,
CURRENT-STATE queue item 4, ledger machine block coupled (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-129 sub (iv) RULED: MAAS NTP hierarchy stays -- all four D-129 subs now ruled (GA-R5) ...

Status flipped to RULED; office1 install + qga retrofit re-pointed at
G13 as execution items. G13 row + CURRENT-STATE + ledger coupled (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-129 sub (iii) RULED: per-site Tailscale = dedicated node on metal-admin, edge excluded (GA-R5) ...

Operator clarification recorded verbatim (per-site metal-admin tailscale
planned for this deployment + Roosevelt); D-107 shape becomes the
standing per-site pattern; D-131 sub-2 revisit clause never triggers.
Couplings same-commit (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

D-129 sub (ii) RULED: os-frr pinned to Roosevelt design time (GA-R5, utterance quoted) ...

VR1 stays static per D-124/D-125; rules alongside D-100 link spec +
D-132 topology at Roosevelt network design. Couplings same-commit (C1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV