diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 3ac5862..b29ebfa 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -269,8 +269,11 @@ remain unruled), virbr7/virbr3 untouched (`docs/audit/stepE-netem-20260721.txt`). Convergence re-plan = **0/1/0, exactly the office1 residual** -- split per E3 into NEW - gate G16 (office1 channels state reconcile). ACTIVE: G16 + the - stage-close set. + gate G16 (office1 channels state reconcile), which then **CLOSED + 2026-07-21** by operator-ruled state surgery (outer plan back to + ZERO DIFF, section 5; gate table row G16). ACTIVE: the stage-close + set only (GA-R2 consolidation, skill sweep, final gauntlet, + operator-gated merge to main). - The grounding audit is COMPLETE and EXITED (2026-07-19): Phases 1-6 all closed (charter `148dcef`; rulings `docs/audit/ga-rulings.md`; the Phase-5 sweep ran as six operator-gated batches in one session; exit @@ -426,19 +429,20 @@ - pre-reboot gate was 5/0/6 (recorded at `docs/dc0-deploy-readiness.md:59`, `docs/session-ledger.md:278`). -The EXPECTED outer plan is **0/1/0** -- exactly ONE in-place change on -`module.office1_opnsense.libvirt_domain.vm` (`channels` absent -> `[]`, -the D-129 module-schema reconcile, gate G16), re-recorded 2026-07-21 -with its evidencing capture -(`docs/audit/outer-plan-20260721-postE-residual.txt`) after the ruled -targeted netem apply. Any OTHER diff is a STOP (investigate drift -before touching anything); when G16 closes, the expected plan returns -to ZERO DIFF and this section gets re-recorded with the closing -capture. History: 7/2/7 post-reboot symptom -> 6/2/6 post-D-130 -> -6/0/6 post-G6-reconcile -> applied exact -> zero diff -> 1/1/1 -(voffice1 transit, ruled+applied) -> 2/0/2 (rack netplan fix, applied) --> zero diff converged 2026-07-20 -> 1/1/0 netem-wire STOP -> targeted -netem apply 1/0/0 exact -> 0/1/0 office1 residual (this entry). +The EXPECTED outer plan is **ZERO DIFF** ("no differences"), +re-recorded 2026-07-21 with its evidencing capture +(`docs/audit/outer-plan-20260721-postG16-converged.txt`) after the +operator-ruled G16 state surgery (channels null -> [] injected on the +office1 edge's state entry, serial 29 -> 30, backup +`terraform.tfstate.pre-G16-20260721`; guests never touched -- G6 +precedent). A future outer plan showing ANY diff is a STOP +(investigate drift before touching anything). History: 7/2/7 +post-reboot symptom -> 6/2/6 post-D-130 -> 6/0/6 post-G6-reconcile -> +applied exact -> zero diff -> 1/1/1 (voffice1 transit, ruled+applied) +-> 2/0/2 (rack netplan fix, applied) -> zero diff converged 2026-07-20 +-> 1/1/0 netem-wire STOP -> targeted netem apply 1/0/0 exact -> 0/1/0 +office1 residual -> G16 state surgery -> zero diff converged (this +entry). ## 6. Open gates @@ -464,7 +468,7 @@ | G13 | D-129 residuals | [R] operator-gated live plugin install on the edge; qga channel retrofit at next scheduled edge restart; 4 sub-decisions (section 8) | operator | OPEN / PARTIALLY RULED (`docs/design-decisions.md:4017`) | | G14 | 9 OPEN SEC rows (SEC-001, -003..-008, plus SEC-012 + SEC-013 opened 2026-07-20 for credentials this deploy created; SEC-010 CLOSED 2026-07-20, operator-ruled, applied+verified both transit ends) | [R] per-row: rotations/flips at v1 close (external to VR1 track); SEC-012 also carries a SCOPE question (libvirt-group grant is broader than the power verbs MAAS needs), SEC-013 is tied to whether `opentofu/vr1-dc0-maas` is retired | operator / external | `docs/security-ledger.md` (register of record, GA-R4/F3); count re-verified vs `bash scripts/ledger-scan.sh` 2026-07-20 | | G15 | D-068 / D-071 rulings | [R] operator rules (section 8); neither blocks the VR1 substrate | operator | PROPOSED/OPEN (status lines, section 8) | -| G16 | office1 edge `channels = []` state reconcile (the D-129 module-schema residual; expected outer plan 0/1/0 until closed, section 5) | [R] operator rules the mechanism: state-only surgery (G6 precedent) vs ride the in-place apply into the edge's next scheduled restart (where D-129 already defers the office1 qga retrofit) -- an in-place apply against the unpinned-MAC live edge is the 07-20 MAC-regen class, so it is NOT applied casually | operator | OPEN 2026-07-21: residual measured (`docs/audit/outer-plan-20260721-postE-residual.txt`, 0/1/0); ruled targeted-apply STOP handling recorded in session changelog | +| G16 | office1 edge `channels = []` state reconcile (the D-129 module-schema residual) | [R] operator rules the mechanism; then [V] the converged re-plan capture | operator + session | CLOSED 2026-07-21: RULED "State surgery (Recommended)" (GA-R5, session changelog item 16); executed per G6 precedent -- channels null -> [] injected, serial 29 -> 30, backup kept, guests untouched (office1-opnsense Id 2 running throughout); convergence = ZERO DIFF (`docs/audit/outer-plan-20260721-postG16-converged.txt`); section 5 re-recorded | ## 7. Version pins (measured; the authority for every pin) diff --git a/docs/audit/outer-plan-20260721-postG16-converged.txt b/docs/audit/outer-plan-20260721-postG16-converged.txt new file mode 100644 index 0000000..329314d --- /dev/null +++ b/docs/audit/outer-plan-20260721-postG16-converged.txt @@ -0,0 +1,25 @@ +module.netem_vr1_dc0_vr1_dc1.terraform_data.netem: Refreshing state... [id=1ea36d3f-e7af-984c-8157-152724a0b85a] +module.voffice1.libvirt_cloudinit_disk.seed: Refreshing state... [id=a4694210c663c9ce] +module.vvr1_dc0.libvirt_cloudinit_disk.seed: Refreshing state... [id=ff281478c6083cc3] +module.office1_storage.libvirt_pool.dc: Refreshing state... [id=5f94194c-69c1-4b04-a85f-c18d87303a03] +module.vr1_dc0_storage.libvirt_pool.dc: Refreshing state... [id=7ce1101c-a89e-40ca-9263-5f572bee40a9] +module.mesh_vr1_dc0_office1.libvirt_network.link: Refreshing state... [id=8318548f-c3d6-4e06-bef4-fe3f11d68125] +module.office1_network.libvirt_network.office1_local: Refreshing state... [id=8fdd2a97-417c-44d4-89e4-ae8d65594135] +module.mesh_vr1_dc0_vr1_dc1.libvirt_network.link: Refreshing state... [id=9cbc8589-9f40-48e6-872e-ef3abfe29a93] +module.vr1_dc1_storage.libvirt_pool.dc: Refreshing state... [id=4a1df114-ee04-4c80-9233-cc0c140c8556] +module.mesh_vr1_dc1_office1.libvirt_network.link: Refreshing state... [id=38a20d2d-cd91-4604-a5f4-8e2a6609633c] +module.vr1_dc0_uplink.libvirt_network.site_wan: Refreshing state... [id=f3500153-e4de-45f1-8854-9c92974a6094] +module.vvr1_dc0.libvirt_volume.seed: Refreshing state... [id=/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-cloudinit.iso] +module.voffice1.libvirt_volume.seed: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso] +module.office1_opnsense.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/office1-opnsense-disk.qcow2] +module.ubuntu_noble_base.libvirt_volume.base: Refreshing state... [id=/var/lib/libvirt/vr1/office1/ubuntu-24.04-base.qcow2] +module.voffice1.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-disk.qcow2] +module.vvr1_dc0.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-disk.qcow2] +module.office1_opnsense.libvirt_domain.vm: Refreshing state... [name=office1-opnsense] +module.vvr1_dc0.libvirt_domain.vm: Refreshing state... [name=vvr1-dc0] +module.voffice1.libvirt_domain.vm: Refreshing state... [name=voffice1] + +No changes. Your infrastructure matches the configuration. + +OpenTofu has compared your real infrastructure against your configuration and +found no differences, so no changes are needed. diff --git a/docs/changelog-20260721-netem-install-verify.md b/docs/changelog-20260721-netem-install-verify.md index 0b9f15f..709963b 100644 --- a/docs/changelog-20260721-netem-install-verify.md +++ b/docs/changelog-20260721-netem-install-verify.md @@ -246,3 +246,21 @@ - **Revert:** n/a for the live repairs; docs via git revert. The deleted key file is not restorable from the repo (by design) -- the operator re-mints from MAAS if a maas-provider root ever returns. + +## 16. G16 CLOSED: office1 channels residual reconciled by state surgery (stage-close ruling 2) + +- RULING (GA-R5). Question as presented: "Stage-close ruling 2: G16 + mechanism -- how does the office1 edge's `channels = []` + state-schema residual get reconciled?" Operator selection, exact: + "State surgery (Recommended)". +- Executed per the G6 precedent: `tofu state pull` -> verified the + attribute is `"channels": null` on exactly ONE resource + (module.office1_opnsense libvirt_domain.vm) -> injected `[]` -> + serial 29 -> 30 -> `tofu state push`. Backup: + `opentofu/terraform.tfstate.pre-G16-20260721` (gitignored, + verified). Convergence re-plan: **no differences** + (docs/audit/outer-plan-20260721-postG16-converged.txt). Guests never + touched (office1-opnsense Id 2 running throughout). CURRENT-STATE + section 5 re-recorded to ZERO DIFF + G16 row CLOSED, same commit. +- **Revert:** `tofu state push opentofu/terraform.tfstate.pre-G16-20260721` + (returns serial-29 state; the 0/1/0 residual and gate reopen).