diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index bccc1c8..fb7d419 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -56,15 +56,25 @@ .100-.119, compute .120-.149, storage .150-.200), dynamic MOVES to .201-.254 -- the carve's first gated mutation per DC. VR1 nodes: control .100-.102, compute .120-.121, storage .150-.153, keyed by - tofu name / pinned boot MAC). OPEN - decision points before their steps: deploy OS series (bundle is - ubuntu@22.04/jammy; region default_distro_series=noble and ONLY - noble images are synced -- capture, ibid.), per-DC artifact mirror - (gap #5, D-107 -- blocks the exit gate honestly), deploy-placement - tag shape (single region serves BOTH DCs; VR0's shared `openstack` - tag cannot disambiguate). Carve is UNBLOCKED (D-133 shape + D-134 - addresses). No cloud mutation has occurred this stage; the logged - window opens before the first one. + tofu name / pinned boot MAC). **CARVE EXECUTED 2026-07-23, BOTH DCs + (logged window stage4-carve; capture + `docs/audit/stage4-carve-verify-20260723.txt`):** dynamic ranges + .201-.254 in place (office1 untouched); 10 named plane fabrics; 90 + NIC re-homes (18 nodes, read-back each, pinned MACs matched); 2 + provider subnets moved off fabric-5 (+ ruled .1 gateways) + 8 plane + subnets created; 6 spaces (bundle binding names) with 12 VLANs + assigned; 18 nodes' statics + br-ex OVS (D-133 flat, D-100 + provider-raw). ALL 18 nodes still Ready. Flagged residue (cleanup + gated at stage close): 192.168.1.0/24 + emptied fabric-5, ~90 empty + auto-created fabrics. OPEN decision points before their steps: + deploy OS series (bundle is ubuntu@22.04/jammy; region + default_distro_series=noble and ONLY noble images are synced -- + capture, ibid.), per-DC artifact mirror (gap #5, D-107 -- blocks + the exit gate honestly), deploy-placement tag shape (single region + serves BOTH DCs; VR0's shared `openstack` tag cannot disambiguate). + NEXT: deploy-series ruling -> Step 8 topology check -> tag ruling -> + gated per-node deploys -> Step 6/7 verifies -> lib-hosts.sh per-DC + population (delivery item). - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6 exact; convergence zero -- `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B diff --git a/docs/audit/stage4-carve-verify-20260723.txt b/docs/audit/stage4-carve-verify-20260723.txt new file mode 100644 index 0000000..b464c16 --- /dev/null +++ b/docs/audit/stage4-carve-verify-20260723.txt @@ -0,0 +1,182 @@ +# Stage 4 carve verification -- 2026-07-23 (read-only; Plane 2 via voffice1) +# D-133 flat carve + D-134-amended bands; commands shown inline + +== ipranges read (dynamic moved to .201-.254 both DCs; office1 untouched): +1 dynamic 10.10.1.100 10.10.1.200 10.10.1.0/24 +2 dynamic 10.12.8.201 10.12.8.254 10.12.8.0/22 +3 dynamic 10.12.68.201 10.12.68.254 10.12.68.0/22 + +== spaces read (six plane spaces, two DC subnets each): +provider-public 10.12.4.0/22, 10.12.64.0/22 +metal-admin 10.12.68.0/22, 10.12.8.0/22 +metal-internal 10.12.12.0/22, 10.12.72.0/22 +data-tenant 10.12.16.0/22, 10.12.76.0/22 +storage 10.12.32.0/22, 10.12.80.0/22 +replication 10.12.36.0/22, 10.12.84.0/22 +undefined 10.10.0.0/24, 10.10.1.0/24, 172.31.0.0/30, 172.31.0.4/30, 192.168.1.0/24, 192.168.122.0/24, 2602:f3e2:f01:100::/64 + +== per-node interface trees (18 nodes; name/type/fabric/links): +-- nhg3nf (wired-thrush): +enp1s0 physical fabric-4 static:10.12.8.100 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.100 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.100 +enp5s0 physical vr1-dc0-storage static:10.12.32.100 +enp6s0 physical vr1-dc0-replication static:10.12.36.100 +br-ex bridge vr1-dc0-provider-public static:10.12.4.100 +-- ssyexn (ace-robin): +enp1s0 physical fabric-4 static:10.12.8.101 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.101 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.101 +enp5s0 physical vr1-dc0-storage static:10.12.32.101 +enp6s0 physical vr1-dc0-replication static:10.12.36.101 +br-ex bridge vr1-dc0-provider-public static:10.12.4.101 +-- sk8c4d (real-filly): +enp1s0 physical fabric-4 static:10.12.8.102 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.102 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.102 +enp5s0 physical vr1-dc0-storage static:10.12.32.102 +enp6s0 physical vr1-dc0-replication static:10.12.36.102 +br-ex bridge vr1-dc0-provider-public static:10.12.4.102 +-- dbcq8h (keen-dove): +enp1s0 physical fabric-4 static:10.12.8.120 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.120 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.120 +enp5s0 physical vr1-dc0-storage static:10.12.32.120 +enp6s0 physical vr1-dc0-replication static:10.12.36.120 +br-ex bridge vr1-dc0-provider-public static:10.12.4.120 +-- sgwfnb (superb-piglet): +enp1s0 physical fabric-4 static:10.12.8.121 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.121 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.121 +enp5s0 physical vr1-dc0-storage static:10.12.32.121 +enp6s0 physical vr1-dc0-replication static:10.12.36.121 +br-ex bridge vr1-dc0-provider-public static:10.12.4.121 +-- kghggm (first-oryx): +enp1s0 physical fabric-4 static:10.12.8.150 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.150 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.150 +enp5s0 physical vr1-dc0-storage static:10.12.32.150 +enp6s0 physical vr1-dc0-replication static:10.12.36.150 +br-ex bridge vr1-dc0-provider-public static:10.12.4.150 +-- 8mtpxq (wise-stud): +enp1s0 physical fabric-4 static:10.12.8.151 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.151 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.151 +enp5s0 physical vr1-dc0-storage static:10.12.32.151 +enp6s0 physical vr1-dc0-replication static:10.12.36.151 +br-ex bridge vr1-dc0-provider-public static:10.12.4.151 +-- sn6qda (alert-cub): +enp1s0 physical fabric-4 static:10.12.8.152 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.152 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.152 +enp5s0 physical vr1-dc0-storage static:10.12.32.152 +enp6s0 physical vr1-dc0-replication static:10.12.36.152 +br-ex bridge vr1-dc0-provider-public static:10.12.4.152 +-- xqqwdq (moral-salmon): +enp1s0 physical fabric-4 static:10.12.8.153 +enp2s0 physical vr1-dc0-provider-public +enp3s0 physical vr1-dc0-metal-internal static:10.12.12.153 +enp4s0 physical vr1-dc0-data-tenant static:10.12.16.153 +enp5s0 physical vr1-dc0-storage static:10.12.32.153 +enp6s0 physical vr1-dc0-replication static:10.12.36.153 +br-ex bridge vr1-dc0-provider-public static:10.12.4.153 +-- x8t386 (big-trout): +enp1s0 physical fabric-142 static:10.12.68.100 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.100 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.100 +enp5s0 physical vr1-dc1-storage static:10.12.80.100 +enp6s0 physical vr1-dc1-replication static:10.12.84.100 +br-ex bridge vr1-dc1-provider-public static:10.12.64.100 +-- 6xhcnf (real-wasp): +enp1s0 physical fabric-142 static:10.12.68.101 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.101 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.101 +enp5s0 physical vr1-dc1-storage static:10.12.80.101 +enp6s0 physical vr1-dc1-replication static:10.12.84.101 +br-ex bridge vr1-dc1-provider-public static:10.12.64.101 +-- qc3sem (apt-ocelot): +enp1s0 physical fabric-142 static:10.12.68.102 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.102 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.102 +enp5s0 physical vr1-dc1-storage static:10.12.80.102 +enp6s0 physical vr1-dc1-replication static:10.12.84.102 +br-ex bridge vr1-dc1-provider-public static:10.12.64.102 +-- m8y6kr (ample-buck): +enp1s0 physical fabric-142 static:10.12.68.120 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.120 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.120 +enp5s0 physical vr1-dc1-storage static:10.12.80.120 +enp6s0 physical vr1-dc1-replication static:10.12.84.120 +br-ex bridge vr1-dc1-provider-public static:10.12.64.120 +-- sgqrcc (divine-heron): +enp1s0 physical fabric-142 static:10.12.68.121 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.121 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.121 +enp5s0 physical vr1-dc1-storage static:10.12.80.121 +enp6s0 physical vr1-dc1-replication static:10.12.84.121 +br-ex bridge vr1-dc1-provider-public static:10.12.64.121 +-- qp4krq (cute-satyr): +enp1s0 physical fabric-142 static:10.12.68.150 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.150 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.150 +enp5s0 physical vr1-dc1-storage static:10.12.80.150 +enp6s0 physical vr1-dc1-replication static:10.12.84.150 +br-ex bridge vr1-dc1-provider-public static:10.12.64.150 +-- 8dfwmh (tender-elk): +enp1s0 physical fabric-142 static:10.12.68.151 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.151 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.151 +enp5s0 physical vr1-dc1-storage static:10.12.80.151 +enp6s0 physical vr1-dc1-replication static:10.12.84.151 +br-ex bridge vr1-dc1-provider-public static:10.12.64.151 +-- pf47qm (big-eel): +enp1s0 physical fabric-142 static:10.12.68.152 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.152 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.152 +enp5s0 physical vr1-dc1-storage static:10.12.80.152 +enp6s0 physical vr1-dc1-replication static:10.12.84.152 +br-ex bridge vr1-dc1-provider-public static:10.12.64.152 +-- y3h4sw (right-spider): +enp1s0 physical fabric-142 static:10.12.68.153 +enp2s0 physical vr1-dc1-provider-public +enp3s0 physical vr1-dc1-metal-internal static:10.12.72.153 +enp4s0 physical vr1-dc1-data-tenant static:10.12.76.153 +enp5s0 physical vr1-dc1-storage static:10.12.80.153 +enp6s0 physical vr1-dc1-replication static:10.12.84.153 +br-ex bridge vr1-dc1-provider-public static:10.12.64.153 + +== machine statuses (expect all Ready): +superb-piglet sgwfnb Ready +wired-thrush nhg3nf Ready +alert-cub sn6qda Ready +first-oryx kghggm Ready +keen-dove dbcq8h Ready +ace-robin ssyexn Ready +real-filly sk8c4d Ready +wise-stud 8mtpxq Ready +moral-salmon xqqwdq Ready +big-trout x8t386 Ready +cute-satyr qp4krq Ready +ample-buck m8y6kr Ready +tender-elk 8dfwmh Ready +big-eel pf47qm Ready +right-spider y3h4sw Ready +divine-heron sgqrcc Ready +apt-ocelot qc3sem Ready +real-wasp 6xhcnf Ready diff --git a/docs/changelog-20260723-stage4-open.md b/docs/changelog-20260723-stage4-open.md index 748721a..0f0c60f 100644 --- a/docs/changelog-20260723-stage4-open.md +++ b/docs/changelog-20260723-stage4-open.md @@ -82,3 +82,58 @@ - CURRENT-STATE Stage-4 bullet updated same-commit. - **Revert:** remove the amendment block + CURRENT-STATE edit (`git revert `); no live state touched yet. + +## Item 5 -- Approvals workflow: session-log-keyed permission rules (operator-directed) + +- Operator directed session-length approvals mid-carve (manual mode was + prompting per command; the earlier auto-mode classifier BLOCKED the first + mutation outright -- the known dc1-session behavior, ledger 2026-07-23). +- `.claude/settings.local.json` (uncommitted, personal): ADDED allow + `Bash(script -aqe ~/as-executed/2026-07-23-stage4-carve.log -c *)` (the + logged-window wrapper -- inherently session-scoped, the rule names this + window's log file) + ask rule keeping `maas admin machine *` shapes + (commission/deploy) prompting inside that same wrapper. PRUNED seven dead + rules keyed to retired log files (2026-07-21-ops-commissioning-diag, + 2026-07-22-dc1-deploy). +- FLAGGED for stage close, not acted on: local allow list carries a broad + `Bash(ssh *)` from a prior session -- prune candidate. +- Review surface stays the as-executed log + this changelog (GA-R2 + blanket-approval precedent). +- **Revert:** remove the two added rules from settings.local.json (file is + local-only, not committed). + +## Item 6 -- Stage 4 carve EXECUTED, both DCs (logged window stage4-carve) + +- All mutations in ~/as-executed/2026-07-23-stage4-carve.log (per-command + wrap; helper scripts' full content logged verbatim before first use). + Verification capture: `docs/audit/stage4-carve-verify-20260723.txt`. +- Set 0: dc0+dc1 metal-admin dynamic ranges MOVED to .201-.254 in place + (iprange ids 2/3; office1 id 1 untouched) -- the D-134-amendment + consequence, done before statics. +- Set 1: 10 named plane fabrics created (vr1-dc0-* ids 188-192 / vlans + 5189-5193; vr1-dc1-* ids 193-197 / vlans 5194-5198). +- Set 2: 90 NIC re-homes, one node per approval-unit, read-back each: every + non-boot NIC moved from its private auto-fabric to its plane fabric; + boot NICs stay fabric-4 (dc0) / fabric-142 (dc1). MACs matched + config-of-record pins throughout. +- Set 3: provider subnets 10.12.4.0/22 + 10.12.64.0/22 MOVED off shared + fabric-5 to their per-DC provider fabrics (+ ruled gateways .1); 8 plane + subnets CREATED (dc0 12/16/32/36, dc1 72/76/80/84). +- Set 4: 6 spaces created (bundle binding names verified against + bundle.yaml first); 12 untagged VLANs assigned (metal-admin = the two + boot fabrics). Office1/transit subnets remain in `undefined` untouched. +- Set 5: 18 nodes' statics per D-134-amended assignments (control + .100-.102, compute .120-.121, storage .150-.153, same octet all six + planes) -- five raw-NIC statics + br-ex (OVS, Pattern A) carrying the + provider static, provider NIC left raw (D-100). All nodes remain Ready. +- Residue NOT touched (flagged): fabric-5 still holds 192.168.1.0/24 + (factory-LAN residue, both edges re-addressed) and the now-empty + ex-provider fabric-5 itself; the ~90 empty auto-created fabrics + (fabric-98..187 class) also remain -- cleanup candidates, gated + separately at stage close, zero functional impact. +- **Revert:** MAAS-record-level; reverse order: unlink statics + delete + br-ex per node, delete the 8 created subnets, move the 2 provider subnets + back to fabric-5, unassign spaces + delete the 6 spaces, re-home NICs to + auto-fabrics (or delete the 10 named fabrics after), move dynamic ranges + back to .100-.200. Nodes were powered off throughout; no OS-level state + exists to revert. diff --git a/logs/as-executed-index.md b/logs/as-executed-index.md index 03f62f6..dfbb420 100644 --- a/logs/as-executed-index.md +++ b/logs/as-executed-index.md @@ -16,3 +16,4 @@ | 2026-07-21 | ops-commissioning-diag | jesse.austin (Claude Code lane, per-command wrap) | G10 commissioning diagnosis: instrumented run per committee; MAC-drift fault (all 9) repaired in place (ruled); MAAS 3.7 rack-only agent resolver defect found, dc0-node-dns forwarder workaround (ruled); ALL 9 NODES READY; SEC-014 opened; D-131 proposed | | 2026-07-22 | dc1-deploy | jesse.austin (Claude Code lane, per-command wrap) | G12 dc1 build: apex --commit (transit /30 + rack IP, 2 objects), dc1 svc key minted, outer apply 5/0/0 exact (vvr1-dc1 + uplink), converged zero diff | | 2026-07-23 | ops-sec010-reassert | jesse.austin (Claude Code lane, per-command wrap) | queue-pass live window: SEC-010 nft re-assert all 3 hosts (4/2/2 converged); G13 close -- office1 qga channel 0/1/0 apply + 26.7.1 update + os-iperf; cache-residue delete; captures docs/audit/sec010-reassert-20260723.txt + g13-close-20260723.txt | +| 2026-07-23 | stage4-carve | jesse.austin (Claude Code lane, per-command wrap) | Stage 4 carve, both DCs: dynamic ranges moved .201-.254 (D-134 amendment), 10 plane fabrics created, 90 NIC re-homes (18 nodes), 8 subnets created + 2 moved off fabric-5, 6 spaces created + 12 VLANs assigned, 18 nodes' statics + br-ex (D-133 flat); capture docs/audit/stage4-carve-verify-20260723.txt |