D-136 step 6: the chain audit -- R9's drift gate built, three refusals, two dead cases ...

Three read-only lenses over data source -> renderer -> deployment mechanism,
the ruled final step of D-136 option (D). Lens 3 was adversarial and made
the chain produce wrong-but-green THREE times, all executed.

All three converged on one root cause: dc1's overlay was byte-gated and
dc0's was gated by nothing. render/values/ was referenced by zero scripts
and zero harnesses, while preflight P2 feeds the deploy gate dc0's overlay.
R9's render-drift check had been RULED and never built.

Executed wrong-but-green:
- transposing two apps' octets in the dc0 overlay (consistent, in-band,
  correct prefixes) -> PASS
- changing ONE WORD, family: dual -> v4, silently reverting dc0 to IPv4-only
  against R2's ruling -> PASS, because dropping prefer-ipv6 and the v6 legs
  together satisfies invariant 9, and vip_dual is printed but never asserted

tests/render-drift/ is R9's gate, built. It iterates render/values/*.yaml,
reads each file's own output: field (inert until now), renders and
byte-compares. A new per-DC values file is gated the moment it is committed.
Non-zero floor plus a proof-of-teeth case that mutates a copy and requires
red.

Three refusals where the chain took the last writer silently:
- duplicate (role, kind) in the apex, in BOTH readers. Appending one spare
  prefix -- routine IPAM work -- re-homed every dc0 VIP into a different /64
  and went green, because the gate checks overlay-vs-apex agreement and both
  sides read the same wrong value. The winner depended on JSON array order.
- duplicate app name / duplicate octet / out-of-band octet in APP_OCTET. A
  duplicate name emitted two YAML blocks, safe_load kept the last, and one
  app's ruled octet vanished with nothing red.

Two harness cases that could not fail:
- T3b's byte-compare was CIRCULAR -- header derived --from-overlay $LIVE
  then compared --against $LIVE, so a third of the bytes were self-copied.
  Proven by rewriting a header line to a false claim and still matching.
- T29's own fixture was inert; its assertion held from the overlay alone.

OWNED: my first T29 re-point asserted a --show-legs flag THAT DOES NOT
EXIST. I invented an interface instead of reading one. The harness caught it
immediately; replaced with real behaviour and recorded rather than quietly
fixed.

Gauntlet ALL GREEN (86) on vcloud; repo-lint 0 fail / 612 files. The larger
deploy-path half is logged not actioned -- see the changelog, items 16-25.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

VIP arity gap CLOSED + R11's three ruled gate changes executed ...

provider-bundle-check.py could not express what R2 and R11 already ruled:
:137 required exactly 3 addresses per vip (a dual-family VIP is 6, so it
would have failed EVERY application) and :149's octet extraction returned
the whole string on a v6 literal, leaving every v6 leg trivially unique
and unchecked. The apex now holds the dual-family set a renderer will
emit, so the only gate that validates overlays could not validate what is
about to be produced.

Arity: a vip is now a v4 triple OR a dual-family sextet. The v6 legs are
validated against the per-DC v6 /64s READ FROM THE APEX RECORD (D-136
option (D)), reusing dc-plane-ipam.sh's (role, kind) keying -- the
provider leg takes the dedicated GUA VIP /64, admin/internal their plane
/64s. The v6 host part must MIRROR the v4 octet textually. prefer-ipv6
and the v6 legs are COUPLED in both directions: the measured L3-9 finding
is that the merge order which keeps prefer-ipv6 while dropping the v6
legs is the one that exits 0. An unreadable apex REFUSES at exit 2; a
v4-only bundle needs no apex.

R11 (D-020 amendment, ruled 2026-07-27), same pass: band 50-60 -> 50-99
in both separately-named sites; VIP_COUNT_EXPECT 11 -> 13;
EXPECT_PUBLIC_VIP deliberately stays 11 (measured -- neither vault nor
designate has a public binding); and an hacluster principal with no vip
now FAILS, since cluster_count is asserted nowhere and a 3->1 rewrite of
all 20 values produces a byte-identical PASS.

Measured consequence, not glossed: two sub-checks flip PASS -> FAIL
(designate's missing VIP; CHECK 1 at OK=11 want 13). preflight was
ALREADY exit 1 before this change and is still exit 1 after -- no deploy
path that was open is closed. Both reds are the ruled gate reporting real
work owed; per R6 the .61/.62 VIPs land before the HA overlay.

Harness 15 -> 28. Three cases RE-POINTED rather than deleted: the fixture
base splits into a pristine repo bundle and one carrying designate's
ruled .62, with new case T16 asserting the pristine bundle DOES trip the
new invariant. When .62 lands, T16 gets re-pointed, not deleted. Proven
able to both fail and pass on the same check (T16 red / T18 green).

Gauntlet ALL GREEN (84) on vcloud; repo-lint 0 fail / 604 files scanned.

Scope was operator-gated: "Fix the arity gap first, then start the
renderer", with the arity-alone vs arity-plus-R11 fork put separately and
answered "Arity gap + R11's three ruled changes (Recommended)". OPS under
GA-R3, no D-number.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

vr1-dc1 bundle render (9-node role-separated) + expansion review record ...

Render (committee Fork-2 hand-render), validated by the extended checker:
- bundle.yaml: machines "8"-"11" (tags=openstack) -> "0"-"8" role+DC tags (block
  style); every `to:` re-homed (quorum trio -> control 0/1/2; nova-compute 3->2 on
  compute 3/4; ceph-osd -> storage 5-8; scaled apps + utilities -> control);
  ovn-chassis -> the 2 dc1 compute provider MACs (52:54:01:d1:04:02/05:02).
- overlays/vr1-dc1-machines.yaml (NEW): per-DC retag (machines-overlay merge is
  VERIFY-LIVE at `juju deploy --dry-run`).
- overlays/dc-ha-scaleup.yaml: tokens rendered to logical control ids 0/1/2
  (DC-neutral); header updated; stale ceph-osd-3 comment -> 4.
- provider-bundle-check.py: ovn-chassis MAC check skips the VR0 Pattern-A set on a
  role-separated bundle (the validator CAUGHT a real YAML flow-comma render bug).

Validated: base + FULL dc1 deploy input (3 overlays, --dc vr1-dc1) PASS; harness
15/15; gauntlet ALL GREEN (78); repo-lint 0-fail.

Expansion review (3 read-only reviewers) recorded in
docs/audit/stage5-expansion-review-20260724.md: relations/bindings/subordinates
HOLD under role-sep (uniform 6-NIC, SEC-011); no channel/pin change; open
resolve-before-deploy items (vault VIP, v4-vs-dual-stack phasing) + deploy-gate
script gaps + VERIFY-LIVE gates. NetBox->deploy coupling routed to Chat as a new
PROPOSED D-number (Fork-2 escalation). No cloud state mutated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

provider-bundle-check: overlay merge + per-DC VIP bands + placement invariants ...

The committee's non-negotiable placement "spine" so the vr1-dc1 render is
machine-checked, not eyeballed. The checker was placement-blind (D-052 bindings
+ mysql=3 only), so any render could silently ship decorative HA.

- --overlay FILE: juju-like merge -> validates the EFFECTIVE deploy input
- --dc vr1-dc0|vr1-dc1: per-DC VIP bands (default dc0 = base; un-param run
  byte-identical to before). Closes the dc1-VIP-outside-the-check gap.
- placement invariants (fire only on a role-separated machines block, self-skip
  on the base bundle): no dangling to:; LXD->control, ceph-osd->storage,
  nova-compute->compute; num_units>=2 spread across that many DISTINCT machines
  (anti-affinity); ceph-osd==storage count, nova-compute==compute count.

Harness 15/15 (7 new behavioral cases); gauntlet ALL GREEN (78); repo-lint 0 fail.
Machines-block overlay merge is confirmed at `juju deploy --dry-run` (VERIFY-LIVE).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Patches

D-060: revert to Pattern A; supersede D-057/D-058 ...

Revert provider NIC to Pattern A (MAAS-built OVS br-ex) on the existing D-052/D-053 scheme. bundle.yaml clean bf7de5a checkout (provider-public x11, VIP triple .4/.8/.12, all 4 br-ex MACs); lib-net.sh + carve back to D-052/D-053; NEW provider-bundle-check.py gate; standup retargeted; teardown.sh + teardown runbook updated. Retire: phase-00-maas-recidr.sh, provider-vip-standup.sh, d057-bundle-check.py, and the 3 provider-vip/reconfigure runbooks.