diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index dc473a0..e793cd4 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -497,8 +497,27 @@ unreachable" is a MISDIAGNOSIS -- the `maas` binary is simply ABSENT on vcloud. With the absent `juju` and absent `openstack`, THREE separate preflight/deploy failures on this jumphost are all "the client is not installed" and each is reported as something else.** - Still-open gaps that are measurable and were NOT done are listed in the register's - section 3 rather than buried. + **SECOND SWEEP 2026-07-27 (operator: "Close the remaining gaps")** -- U15-U17 closed. + **U15 voffice1 transit addressing is REBOOT-DURABLE** (positive result): live + `enp2s0 172.31.0.1/30` + `enp3s0 172.31.0.5/30`, both netplan-persistent via + `/etc/netplan/60-transit.yaml` and `61-transit-dc1.yaml`; no leg row is owed. + **U16 `RETROFIT_WAIT=30m` has NO recorded provenance** -- traced to a single bulk + commit with no rationale, and NO constant anywhere in `scripts/` is documented as + nested-virt calibrated, so it is an inherited default that has never been validated + against the depth-4 nested I/O it will run on; separately, that script's preconditions + require BOTH the `openstack` and `juju` clients and NO host has both. + **U17 the DC data path carries NO IPv6 at any layer** -- on BOTH racks, zero global v6 + on any plane bridge, no v6 default route, `accept_ra=1` with nothing arriving. With the + MAAS and node measurements that is a THREE-LAYER confirmation, and it WIDENS the R2 + propagation task: the rack bridges need v6 too, not just MAAS. + **STILL OPEN, with cause:** the two DC edges' own interface-level v6 config -- dc0 is + blocked by SEC-021(a) (no `opnsense-api.txt` in `~/vr1-dc0-creds/`, visible on disk; the + re-mint is a live edge mutation deliberately excluded from the 07-27 batch) and dc1's + API is not reachable from vcloud (measured timeout; the path runs from the rack, where + the creds are correctly not staged per SEC-015). U17 already answers the substantive + question from the rack side. `repo-lint`/gauntlet ON voffice1 remain deliberately + deferred until precondition 0.1 advances that 105-commit-stale clone -- running them + today would measure a stale tree. - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6 exact; convergence zero -- `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B diff --git a/docs/audit/stage5-unmeasured-register-20260727.md b/docs/audit/stage5-unmeasured-register-20260727.md index b51c1a4..7788f58 100644 --- a/docs/audit/stage5-unmeasured-register-20260727.md +++ b/docs/audit/stage5-unmeasured-register-20260727.md @@ -83,17 +83,29 @@ fetch. **Moot for the decision** -- R1 ruled option (a), a real second disk -- but recorded as still-unmeasured rather than quietly dropped. -**Measurable, NOT yet done -- these are real remaining gaps, not excuses:** -- **IPv6 state on the two DC edges.** The OPNsense API GET path is available and - permitted. Not attempted. Lower value than the planes (which ARE measured empty in - MAAS), but it is part of "full state of the configuration" and should be closed. -- **`repo-lint` and the gauntlet ON voffice1** (L5 P2). Deliberately deferred: that - clone is 105 commits behind, so running them there today measures a stale tree. Owed - immediately AFTER the clone is advanced, which is precondition 0.1. -- **Reboot-durability of voffice1's dc0/dc1 transit addressing** (L6 #4). A netplan read. - Not attempted. -- **Provenance of `RETROFIT_WAIT=30m`** and any other nested-virt-calibrated constant - (L7 #1). Not attempted. +**Measurable gaps -- CLOSED on operator instruction, 2026-07-27 (second sweep):** + +| # | Item | Result | +|---|---|---| +| U15 | **Reboot-durability of voffice1's transit addressing** (L6 #4) | **DURABLE -- positive result.** Live: `enp2s0 172.31.0.1/30` (dc0 leg), `enp3s0 172.31.0.5/30` (dc1 leg). Both are netplan-persistent: `/etc/netplan/60-transit.yaml` and `/etc/netplan/61-transit-dc1.yaml` both contain the `172.31.` addressing. The Plane-2 path survives a headend reboot; no leg row is owed here | +| U16 | **Provenance of `RETROFIT_WAIT=30m`** (L7 #1) | **NO RECORDED PROVENANCE.** `scripts/phase-05-amphora-pipeline.sh:43` sets `RETROFIT_WAIT="${RETROFIT_WAIT:-30m}"`; `git log -S` traces it to a single bulk commit `63f5832 "New Phase Scripts"` with no rationale. A repo-wide grep finds **no constant anywhere in `scripts/` documented as nested-virt or depth-4 calibrated**. So the 30m figure is an INHERITED DEFAULT, not a measured one -- it has never been validated against depth-4 nested I/O, which is where it will actually run (Stage 5 Step 9). Log-only, but it should not be mistaken for a tuned value. **Bonus finding from reading it: that script's own preconditions require BOTH the `openstack` AND `juju` clients (`:47-48`), and NO host currently has both** -- vcloud has neither, voffice1 has juju only. It cannot run anywhere today (reinforces S-1) | +| U17 | **IPv6 state in the DC data path** (L2 #5, edges half) | **MEASURED, and it is a THREE-LAYER confirmation of L2-3.** On BOTH racks: **zero** global IPv6 addresses on any plane bridge; **no IPv6 default route** (`NONE` on both); `net.ipv6.conf.all.accept_ra = 1`, so the racks WOULD accept a router advertisement and none is arriving. Combined with the earlier measurements (no v6 subnet on any of the 12 MAAS plane fabrics; no v6 link on any of the 18 nodes), the DC data path carries no IPv6 at ANY layer measured -- apex excepted, where it is fully assigned. **This widens the R2 propagation task: it is not only "carve into MAAS", the rack bridges have no v6 either** | + +**Still open after the second sweep, with the honest reason:** +- **The two DC edges' own interface-level v6 configuration.** dc0 is blocked by a KNOWN + MISSING CREDENTIAL, not by a failure to look: `~/vr1-dc0-creds/` contains no + `opnsense-api.txt` while `~/vr1-dc1-creds/` does -- which is SEC-021(a) directly + visible on disk, the one residual credential item the 2026-07-27 consolidation batch + deliberately excluded because the re-mint is a live edge mutation. dc1's API is + credentialed but not reachable from vcloud (measured: `GET core/firmware/status` to + `10.12.64.1` times out; the API path runs FROM the rack, where the edge creds are not + staged -- correctly, per SEC-015). Closing this needs either the SEC-021 re-mint or a + gated rack-side run. **The substantive question it would answer is already answered by + U17 from the rack side.** +- **`repo-lint` and the gauntlet ON voffice1** (L5 P2). DELIBERATELY still deferred, and + this is a judgement not an omission: that clone is 105 commits behind, so running them + there today would measure a stale tree and produce a number that means nothing. Owed + immediately AFTER precondition 0.1 advances the clone. ---