diff --git a/docs/archive/session-ledger-rotated-20260726.md b/docs/archive/session-ledger-rotated-20260726.md new file mode 100644 index 0000000..f3ded8f --- /dev/null +++ b/docs/archive/session-ledger-rotated-20260726.md @@ -0,0 +1,152 @@ +# session-ledger rotation 2026-07-26 (GA-R4 rule 3, amendment F1) + +The live ledger had grown to 413 lines against GA-R4's 300-line cap; the 2026-07-25 close +recorded the rotation as OWED and it was not performed. F1's rule is OLDEST-FIRST: "after +writing the close summary, rotate oldest closed-session summaries until under cap." + +Moved here VERBATIM, oldest first: the eight closed-session summaries from 2026-07-18 +through the fifth 2026-07-21 session. Nothing is lost -- each summary already points at +its own archived full body, and this file preserves the summaries themselves. + +Precedent: `docs/archive/session-ledger-rotated-20260719.md` (the one-time rule-6 +rotation). This is the first routine F1 rotation. + +NOTE ON TIMING: F1 binds the cap AT SESSION CLOSE. This rotation was performed mid-session +at operator direction ("rotate the session ledger") rather than at a close bookend. That is +early, not late; no open session's in-flight section was moved (this session has none in +the ledger), so the rule-3 protection is not implicated. + +--- + +## SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary + +- Audit Phases 1-4 COMPLETE, each externally reviewed; FULL FREEZE upheld (zero pre-audit surfaces edited). +- Phase 1: record-audit extractor + inventory (12 contradiction groups); outer plan CAPTURED 7/2/7; GA-F01..F15. +- Phase 2: docs/CURRENT-STATE.md authored -- the single status authority; operator SIGNED (G11, section 11). +- Phase 3: fresh-agent grounding test, 3 probes 21/21 PASS; hole H1 amended into the G9 row. +- Phase 4: GA-R1..R7 + stage-status vocabulary (Option A + H1) ALL RATIFIED, utterances quoted (docs/audit/ga-rulings.md). +- Phase 5 NOT opened: sweep plan DRAFTED (docs/audit/phase5-sweep-plan.md, commit 687dfa8) awaiting external review. +- DC0 apply remains STOPPED (G9); D-130 unruled; expected plan triple UNRESOLVED (CURRENT-STATE section 5). +- Next session: FRESH operator session, auto-memory ON (GA-R7 rule 8); read sweep plan + CURRENT-STATE.md first. +- Status lives ONLY in CURRENT-STATE.md (GA-R1); this entry is narrative + pointers, not status. +- Full session body: docs/archive/session-20260718-grounding-audit.md (GA-R4 rules 1-2, first live compliance run). +- GA-R4 F1 cap (<300 lines) not yet enforceable: the one-time rotation is Phase-5 Batch 4 (rule 6) -- noted, not skipped. +- POST-CLOSE ADDENDUM (2026-07-19): sweep plan externally reviewed PASS; amendments S1-S5 applied in + a single commit (15ccfbd). Batch 0 was PRESENTED and HELD -- operator routed execution to the fresh + session. Fresh session: read docs/audit/phase5-sweep-plan.md + docs/CURRENT-STATE.md, then gate Batch 0. + +## SESSION CLOSE 2026-07-19 -- GA Phase-5 sweep (Batches 0-6) + AUDIT EXIT (bounded, GA-R4) + +- All six sweep batches executed + closed in ONE session under per-batch operator gates. +- Tooling: L10 status-coupling lint (WARN->FAIL), SEC pointer+count scan, wrap-aware counters, + vocab-keyed extractor + archive exclusion (operator-ruled). Gauntlet grew 69 -> 70 harnesses. +- D-130 ADOPTED (a) + implemented + v7/v8-verified; G6 state surgery (operator-ruled); expected + triple 6/0/6 recorded and re-verified twice (postG6 + phase6-exit captures). +- Record fixes GA-F02..F05/F10..F12/F14..F16; H1 token migration; E1 gate-type tags; ARCH/OPS + D-tags + D-129 split (operator-ruled); R3-F register fully dispositioned (S1). +- Memory hygiene per provenance rulings (2 files removed, GA-F16 found+fixed); ledger rotated + 1187->131; 96 changelogs + 25 docs consolidated to archive; top-level docs/ = 16. +- Skill swept against ratified GA-R1..R7 (checklist committed). Exit runs 1-6 ALL PASS incl. + fresh probe trio 21/21 (7/7 on all three); operator RE-SIGNED CURRENT-STATE 2026-07-19. +- AUDIT EXITED: G3 + G11 CLOSED, FREEZE lifted, G9 OPEN (gated logged apply, G8 first). +- Full body: docs/archive/session-20260719-phase5-sweep.md. Status lives ONLY in CURRENT-STATE.md. + +## SESSION 2026-07-19 (continued) -- DC0 deploy, step A (logged: dc0-deploy) + +- Same session continued past the audit close at operator direction (skill re-invoked; fresh-session + hygiene noted and waived by the operator's go). +- G8 passed in-session; validate PASS; pre-apply capture == 6/0/6; saved plan applied: 6/0/6 exact. +- vvr1-dc0 RUNNING (108 vCPU / 416 GiB / autostart off); guests untouched; convergence = no diff. +- Next: step B (bootstrap vvr1-dc0: site-headend-install --role rack --host-nodes + SEC-010 check, + OPNsense base prep ON the VM) -- needs transit reachability + the dc0 key (D-126 DC rows). +- PAUSED at the A/B boundary (2026-07-19): operator moving to a fresh session. Step B's measured + starting facts: vvr1-dc0 NICs = mesh-vr1-dc0-office1 + vr1-dc0-uplink (NO transit NIC yet -- + measure how reach works before wiring ssh; D-124 tfvars local+present; dc0 key minted). + Fresh session: CURRENT-STATE first, then resume at runbook step B in the dc0-deploy logged window + (same-day log appends). + +## SESSION CLOSE 2026-07-21 -- commissioning diagnosis + repair (logged: ops-commissioning-diag; bounded, GA-R4) + +- Session DISCONNECTED before its bookend; entry landed same-day by the successor session after + read-only re-verification (9/9 Ready, forwarder active+enabled, dhcpd both controllers). +- G10 commissioning RESOLVED: ALL 9 DC0 nodes Ready, shapes exact to D-121 Option C. +- Two stacked faults, both measured: (1) the 2026-07-20 in-place apply regenerated all 9 node NIC + MACs -- MAAS records repaired in place (operator-ruled), read-back 9/9; (2) MAAS 3.7 rack-only + agent resolver SERVFAILs everything on an internet-isolated rack -- dc0-node-dns dnsmasq + forwarder workaround (operator-ruled), live and proven (canary Ready ~3 min). LP report queued. +- D-131 PROPOSED (rack-only node DNS, Roosevelt-relevant); SEC-014 OPENED (rack cluster secret + exposure); committee record closed by addendum. Phase-7 tag cleanup verified done. +- QUEUED delivery: node-vm MAC pinning + harness; forwarder + rack-legs repo persistence; + platform-traps + appendix-A entries; stale-pod cleanup at stage close (with SEC-013). +- REMAINING in G10: netem step E only (netem-link passwordless-sudo blocker). +- Details: docs/changelog-20260721-commissioning-diag.md + docs/audit/commissioning-diag-20260721.txt. + Status lives ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-21 -- close-and-delivery session (bounded, GA-R4) + +- Session DISCONNECTED before its bookend (second same-day disconnect); all seven deliverable + commits were already pushed (8b3adb3..8a9c04c), so only this entry + the netem-install record + were outstanding. Landed by the successor session after read-only re-verification. +- Delivered: predecessor (ops-commissioning-diag) close landed; node-vm MAC pinning (54 measured + pins) + power-ownership guard ruled and APPLIED on voffice1 (0/9/0 exact, converged zero diff); + D-131 sub-1 RULED + dc-rack-net.sh shipped AND installed on the rack (check 10/10, SOA probe); + incident docs (appendix-A x2, platform-traps 1e corollary, LP draft -- operator to file); + step-E netem sudo RULED (scoped NOPASSWD) + fragment shipped (gauntlet 75 ALL GREEN). +- Post-disconnect: operator ran the netem-tc install interactively; successor VERIFIED read-only + (0440 root:root, byte-identical, sudo -n -l grant checks exit 0 -- + docs/audit/netem-sudo-install-20260721.txt). Step E is now UNBLOCKED (gated run pending). +- Details: docs/archive/changelogs/changelog-20260721-close-and-delivery.md. Status lives ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-21 -- STAGE 3 CLOSED + MERGED (third session; bounded, GA-R4) + +- Bookend landed at stage close while the session may continue (two same-day disconnects argued + for durable-early); any further work appends a POST-CLOSE ADDENDUM (07-18 precedent). +- Step E netem DONE (targeted apply at an operator-ruled 1/1/0 STOP; placeholder live on virbr5) + -> G10 CLOSED. G16 opened for the office1 channels residual, then CLOSED same-day + (operator-ruled state surgery; outer plan back to ZERO DIFF). +- Ruling 1 retire-fully EXECUTED: vr1-dc0-maas removed, stale pod + SEC-013 key file + tfstate + deleted. INCIDENT: the pod delete cascaded to the 9 machine records (association check ran + post-delete -- owned); recovered same-hour via re-enlist/power/commission, 9/9 Ready, shapes + exact, NEW MAAS hostnames. Appendix-A entry shipped (check pod machine list BEFORE delete). +- Also: ledger-scan PARTIAL fix, DOCFIX-197, D-103/D-123 amendments, GA-R7 memory review. +- STAGE 3 CLOSED (operator-ruled): consolidation + skill sweep + gauntlet 76 ALL GREEN; merge + commit 8d0d155 on main; branch retired local+remote. Next stage branches off main. +- Open queue unchanged: D-131 sub-2..4, SEC-014 rotation, D-068/D-071/D-129, G12 (dc1), G15. +- Details: docs/archive/changelogs/changelog-20260721-netem-install-verify.md (archived at the + successor's bookend). Status lives ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-21 -- queue-pass session (fourth same-day; bounded, GA-R4) + +- Recovered the predecessor's undelivered committee verdict from its transcript; the + tenant-onboarding items are PINNED to a deployment-close consideration review (operator-directed; + self-contained block in the retained section above). +- Queue pass, one GA-R5 ruling per exchange, each committed+pushed: D-131 sub-2 ruled + (metal-admin-only) + sub-3 RESOLVED by measurement (no dhcpd option-6 defect; stale read; + operator-run capture); D-129 subs (i)-(iv) ALL RULED -- decision-complete, G13 execution-only; + D-071 ADOPTED (all four points); D-068 items 2-3 RULED; D-100 netem placeholder CONFIRMED. +- Filed/pinned: D-132 PROPOSED (per-DC MAAS topology, operator verbatim); DNS architectural + review pinned to D-131 sub-4. Delivered: cloud-assert A9 vault-kv AppRole probe + (harness 15/15; gauntlet 76 ALL GREEN). +- G12 [R] leg CLOSED: vr1-dc1 addressing RATIFIED (D-124 amendment; apex confirm-free at + authoring). Remaining [V]: vars + substrate root + build. +- Open after this session: D-068 item 1 (draft), D-131 sub-4 (LP + pinned review), D-132 + (pinned), G12 [V], G13 execution, 10 SEC rows, LP filing (operator). +- Details: docs/archive/changelogs/changelog-20260721-tenant-review-pin.md. Status lives ONLY + in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-21 -- G12 dc1-authoring session (fifth same-day; bounded, GA-R4) + +- Session DISCONNECTED before its bookend; entry landed by the successor session 2026-07-22 + after read-only re-verification (tree, branch, harnesses). No cloud state was touched. +- Delivered pre-drop (commit cbc1104 on branch dc-dc-g12-dc1-substrate -- branch UNPUSHED at + the drop): dc1 apex confirm-free capture (transit /30 + rack 10.12.68.2 FREE, planes already + consistent) + dc-rack-mgmt-import per-site --site support (117/117; live dry-run PASS). +- INTERRUPTED mid-item-3, authored UNCOMMITTED in tree: vr1_dc1 vars + vvr1-dc1 module + + vr1-dc1-uplink, inner root opentofu/vr1-dc1-substrate/ (54 MACs pre-pinned 52:54:01:d1), + lib-net.sh dc1 arm + selection guard, dc-selector 40/40. Drop point: BEFORE the gauntlet -- + successor run = 6/76 FAILED, six harnesses still assert the retired vr1-dc1 fail-loud arm + (docs/audit/gauntlet-20260722-g12-dropstate.txt). Owed: reconcile -> ALL GREEN -> delivery + entry -> commit+push; THEN the operator-gated apex --commit stays G12's next gated step. +- Details: docs/changelog-20260721-g12-dc1-authoring.md (item 3 = drop-state record). Status + lives ONLY in CURRENT-STATE.md. + diff --git a/docs/changelog-20260726-d137-tier1.md b/docs/changelog-20260726-d137-tier1.md index 4773341..2e8d014 100644 --- a/docs/changelog-20260726-d137-tier1.md +++ b/docs/changelog-20260726-d137-tier1.md @@ -600,3 +600,40 @@ unverified, as does grant/scope drift. **Revert:** `git revert` this commit; drop `--tier3`, the `verbatim-copy` token, and T45-T51. + +## Item 19 -- session-ledger rotated (GA-R4 rule 3 / amendment F1) + +The live ledger was **413 lines against GA-R4's 300-line cap** -- a breach the 2026-07-25 +close recorded as OWED and did not perform. + +**Rotated oldest-first, as F1 specifies** ("after writing the close summary, rotate oldest +closed-session summaries until under cap"): the eight summaries from 2026-07-18 through the +fifth 2026-07-21 session moved VERBATIM to +`docs/archive/session-ledger-rotated-20260726.md`. Sessions from 2026-07-22 onward stay +live. **413 -> 280 lines.** Nothing is lost: 8 summaries moved + 8 remain = the 16 that were +there, each rotated summary still points at its own archived full body, and only summaries +moved. Precedent `docs/archive/session-ledger-rotated-20260719.md` was the one-time rule-6 +rotation; this is the first routine F1 one. + +**Timing, stated plainly:** F1 binds the cap AT SESSION CLOSE. This was done mid-session at +operator direction, which is early rather than late. Rule 3's protection -- an open +session's in-flight section is never rotated -- is not implicated: this session has no +in-flight section in the ledger. + +**Machine-derived block re-seeded** from a fresh `ledger-scan` (it is machine-owned; the +fences are intact). It had gone stale: open SEC rows **19 -> 20** (SEC-024), next-free D +**137 -> 138**. + +**A status CLAIM corrected to narrative.** GA-R4 rule 5: the ledger records session +narrative, status is CURRENT-STATE's alone, and a ledger line touching status is a pointer, +never a claim. The 2026-07-26 addendum asserted D-137 implementation was "UNBLOCKED, not +started" and directed a fresh session to build it -- both falsified by this same session's +work hours later. Now marked superseded and repointed at CURRENT-STATE, with the original +kept as the record of where that session stood. + +The 07-25 close's "rotation OWED" line is marked DISCHARGED in place. + +Gauntlet ALL GREEN (80), repo-lint 0-fail, `ledger-scan` exit 0. + +**Revert:** `git revert` this commit; the eight summaries return inline and the cap is +breached again. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 40e0cfb..57b225b 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -30,37 +30,27 @@ ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit) -_Re-seeded from a 2026-07-25 scan (SEC-020 session; the prior seeding was the 2026-07-23 close and -had gone stale on every line -- counts and next-free both). Re-run `bash scripts/ledger-scan.sh` to refresh._ +_Re-seeded from a 2026-07-26 scan (D-137 build session), at the GA-R4/F1 rotation. +Re-run `bash scripts/ledger-scan.sh` to refresh._ -- **PROPOSED / OPEN decisions (4):** D-068 (Vault substrate hardening, Roosevelt -- sole remainder - is Q2 path selection at Roosevelt Vault design time), D-131 (node-facing DNS strategy for - rack-only controllers [ARCH] -- PARTIALLY RULED: sub-1 ruled + delivered 2026-07-21, sub-2 ruled - 2026-07-21 (metal-admin only), sub-3 resolved 2026-07-21 (no defect), sub-4 open + pinned DNS - architectural review), D-132 (Roosevelt per-DC MAAS topology [ARCH] -- PROPOSED 2026-07-21, - operator-pinned to the next deployment), D-136 (NetBox-coupled per-DC render pipeline for bundle - overlays and tfvars [ARCH] -- PROPOSED 2026-07-25 in Chat, non-gating for the dc1 deploy). - D-071, D-129 and now D-137 (ADOPTED 2026-07-26, all five sub-rulings ruled) are - ADOPTED/RESOLVED and correctly drop off the scan. - Status lines in `docs/design-decisions.md` are the only ruling authority. -- **OPEN security rows:** 19 open per `bash scripts/ledger-scan.sh` (re-seeded 2026-07-25). Since the - last seeding this went 12 -> 19: SEC-017 (caveman plugin supply-chain re-verify), SEC-018/-019 - (per-DC MAAS API keys for the Juju cloud credentials), SEC-020 (MAAS region superuser passwords -- - the `admin` un-consolidation + the new `operator` human GUI identity), and SEC-021/-022/-023 - (2026-07-25 D-137 credential research: dc0 custody defects, unaudited shadow `*-creds/` stores on - voffice1, sprawl-glob blind spots + a predicted Stage-5 `~/admin-openrc` exposure). The SEC register of record - is `docs/security-ledger.md`; row-level dispositions live THERE only (GA-R4 amendment F3) -- - this block carries pointer + count, never rows. The CURRENT-STATE G14 evidence cell was - RECONCILED to 19 in the same commit as SEC-021/-023 (its title text keeps the 07-23 figure). -- **Next-free numbers:** D = **137**, DOCFIX = **204**, BUNDLEFIX = 053. +- **PROPOSED / OPEN decisions (4):** D-068 (Vault substrate hardening, Roosevelt -- sole + remainder is Q2 path selection at Roosevelt Vault design time), D-131 (node-facing DNS for + rack-only controllers [ARCH] -- sub-4 open + the pinned DNS architectural review), D-132 + (Roosevelt per-DC MAAS topology [ARCH], operator-pinned to the next deployment), D-136 + (NetBox-coupled per-DC render pipeline [ARCH], non-gating). D-137 is ADOPTED and correctly + drops off the scan. Status lines in `docs/design-decisions.md` are the only ruling authority. +- **OPEN security rows:** **20** per `bash scripts/ledger-scan.sh` (was 19). SEC-024 opened + 2026-07-26 -- `opentofu/terraform.tfstate.backup` at mode 0664 carrying the MAAS API key in + plaintext, found by the D-137 matrix on its first run after the committee fixes. The SEC + register of record is `docs/security-ledger.md`; row-level dispositions live THERE only + (GA-R4/F3) -- this block carries pointer + count, never rows. +- **Next-free numbers:** D = **138**, DOCFIX = **204**, BUNDLEFIX = **053**. - **Standing numbering rule:** never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN) - ABOVE the real high-water mark anywhere in `docs/` or `runbooks/` prose -- historically a decoy - token in prose inflated the next-free counter (hardened in DOCFIX-174); the authoring discipline - stands regardless. -- **`ledger-scan` D-115 false-positive: RESOLVED.** The scan now keys on the LAST `**Status:**` - line per `## D-NNN:` block (see `scripts/ledger-scan.sh` awk), not arbitrary body prose, so D-115 - (ADOPTED) no longer shows as PROPOSED/OPEN. The general hygiene -- trust the Status line over body - text -- still holds. + ABOVE the real high-water mark anywhere in `docs/` or `runbooks/` prose -- historically a + decoy token in prose inflated the next-free counter (hardened in DOCFIX-174). +- **`ledger-scan` D-115 false-positive: RESOLVED.** The scan keys on the LAST `**Status:**` + line per `## D-NNN:` block, not arbitrary body prose. The general hygiene -- trust the + Status line over body text -- still holds. @@ -111,137 +101,13 @@ 2026-07-21 disconnected-session transcript, not in a repo surface. -## SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary +## ROTATED 2026-07-26 (GA-R4 rule 3 / F1 -- oldest-first, cap restored) -- Audit Phases 1-4 COMPLETE, each externally reviewed; FULL FREEZE upheld (zero pre-audit surfaces edited). -- Phase 1: record-audit extractor + inventory (12 contradiction groups); outer plan CAPTURED 7/2/7; GA-F01..F15. -- Phase 2: docs/CURRENT-STATE.md authored -- the single status authority; operator SIGNED (G11, section 11). -- Phase 3: fresh-agent grounding test, 3 probes 21/21 PASS; hole H1 amended into the G9 row. -- Phase 4: GA-R1..R7 + stage-status vocabulary (Option A + H1) ALL RATIFIED, utterances quoted (docs/audit/ga-rulings.md). -- Phase 5 NOT opened: sweep plan DRAFTED (docs/audit/phase5-sweep-plan.md, commit 687dfa8) awaiting external review. -- DC0 apply remains STOPPED (G9); D-130 unruled; expected plan triple UNRESOLVED (CURRENT-STATE section 5). -- Next session: FRESH operator session, auto-memory ON (GA-R7 rule 8); read sweep plan + CURRENT-STATE.md first. -- Status lives ONLY in CURRENT-STATE.md (GA-R1); this entry is narrative + pointers, not status. -- Full session body: docs/archive/session-20260718-grounding-audit.md (GA-R4 rules 1-2, first live compliance run). -- GA-R4 F1 cap (<300 lines) not yet enforceable: the one-time rotation is Phase-5 Batch 4 (rule 6) -- noted, not skipped. -- POST-CLOSE ADDENDUM (2026-07-19): sweep plan externally reviewed PASS; amendments S1-S5 applied in - a single commit (15ccfbd). Batch 0 was PRESENTED and HELD -- operator routed execution to the fresh - session. Fresh session: read docs/audit/phase5-sweep-plan.md + docs/CURRENT-STATE.md, then gate Batch 0. - -## SESSION CLOSE 2026-07-19 -- GA Phase-5 sweep (Batches 0-6) + AUDIT EXIT (bounded, GA-R4) - -- All six sweep batches executed + closed in ONE session under per-batch operator gates. -- Tooling: L10 status-coupling lint (WARN->FAIL), SEC pointer+count scan, wrap-aware counters, - vocab-keyed extractor + archive exclusion (operator-ruled). Gauntlet grew 69 -> 70 harnesses. -- D-130 ADOPTED (a) + implemented + v7/v8-verified; G6 state surgery (operator-ruled); expected - triple 6/0/6 recorded and re-verified twice (postG6 + phase6-exit captures). -- Record fixes GA-F02..F05/F10..F12/F14..F16; H1 token migration; E1 gate-type tags; ARCH/OPS - D-tags + D-129 split (operator-ruled); R3-F register fully dispositioned (S1). -- Memory hygiene per provenance rulings (2 files removed, GA-F16 found+fixed); ledger rotated - 1187->131; 96 changelogs + 25 docs consolidated to archive; top-level docs/ = 16. -- Skill swept against ratified GA-R1..R7 (checklist committed). Exit runs 1-6 ALL PASS incl. - fresh probe trio 21/21 (7/7 on all three); operator RE-SIGNED CURRENT-STATE 2026-07-19. -- AUDIT EXITED: G3 + G11 CLOSED, FREEZE lifted, G9 OPEN (gated logged apply, G8 first). -- Full body: docs/archive/session-20260719-phase5-sweep.md. Status lives ONLY in CURRENT-STATE.md. - -## SESSION 2026-07-19 (continued) -- DC0 deploy, step A (logged: dc0-deploy) - -- Same session continued past the audit close at operator direction (skill re-invoked; fresh-session - hygiene noted and waived by the operator's go). -- G8 passed in-session; validate PASS; pre-apply capture == 6/0/6; saved plan applied: 6/0/6 exact. -- vvr1-dc0 RUNNING (108 vCPU / 416 GiB / autostart off); guests untouched; convergence = no diff. -- Next: step B (bootstrap vvr1-dc0: site-headend-install --role rack --host-nodes + SEC-010 check, - OPNsense base prep ON the VM) -- needs transit reachability + the dc0 key (D-126 DC rows). -- PAUSED at the A/B boundary (2026-07-19): operator moving to a fresh session. Step B's measured - starting facts: vvr1-dc0 NICs = mesh-vr1-dc0-office1 + vr1-dc0-uplink (NO transit NIC yet -- - measure how reach works before wiring ssh; D-124 tfvars local+present; dc0 key minted). - Fresh session: CURRENT-STATE first, then resume at runbook step B in the dc0-deploy logged window - (same-day log appends). - -## SESSION CLOSE 2026-07-21 -- commissioning diagnosis + repair (logged: ops-commissioning-diag; bounded, GA-R4) - -- Session DISCONNECTED before its bookend; entry landed same-day by the successor session after - read-only re-verification (9/9 Ready, forwarder active+enabled, dhcpd both controllers). -- G10 commissioning RESOLVED: ALL 9 DC0 nodes Ready, shapes exact to D-121 Option C. -- Two stacked faults, both measured: (1) the 2026-07-20 in-place apply regenerated all 9 node NIC - MACs -- MAAS records repaired in place (operator-ruled), read-back 9/9; (2) MAAS 3.7 rack-only - agent resolver SERVFAILs everything on an internet-isolated rack -- dc0-node-dns dnsmasq - forwarder workaround (operator-ruled), live and proven (canary Ready ~3 min). LP report queued. -- D-131 PROPOSED (rack-only node DNS, Roosevelt-relevant); SEC-014 OPENED (rack cluster secret - exposure); committee record closed by addendum. Phase-7 tag cleanup verified done. -- QUEUED delivery: node-vm MAC pinning + harness; forwarder + rack-legs repo persistence; - platform-traps + appendix-A entries; stale-pod cleanup at stage close (with SEC-013). -- REMAINING in G10: netem step E only (netem-link passwordless-sudo blocker). -- Details: docs/changelog-20260721-commissioning-diag.md + docs/audit/commissioning-diag-20260721.txt. - Status lives ONLY in CURRENT-STATE.md. - -## SESSION CLOSE 2026-07-21 -- close-and-delivery session (bounded, GA-R4) - -- Session DISCONNECTED before its bookend (second same-day disconnect); all seven deliverable - commits were already pushed (8b3adb3..8a9c04c), so only this entry + the netem-install record - were outstanding. Landed by the successor session after read-only re-verification. -- Delivered: predecessor (ops-commissioning-diag) close landed; node-vm MAC pinning (54 measured - pins) + power-ownership guard ruled and APPLIED on voffice1 (0/9/0 exact, converged zero diff); - D-131 sub-1 RULED + dc-rack-net.sh shipped AND installed on the rack (check 10/10, SOA probe); - incident docs (appendix-A x2, platform-traps 1e corollary, LP draft -- operator to file); - step-E netem sudo RULED (scoped NOPASSWD) + fragment shipped (gauntlet 75 ALL GREEN). -- Post-disconnect: operator ran the netem-tc install interactively; successor VERIFIED read-only - (0440 root:root, byte-identical, sudo -n -l grant checks exit 0 -- - docs/audit/netem-sudo-install-20260721.txt). Step E is now UNBLOCKED (gated run pending). -- Details: docs/archive/changelogs/changelog-20260721-close-and-delivery.md. Status lives ONLY in CURRENT-STATE.md. - -## SESSION CLOSE 2026-07-21 -- STAGE 3 CLOSED + MERGED (third session; bounded, GA-R4) - -- Bookend landed at stage close while the session may continue (two same-day disconnects argued - for durable-early); any further work appends a POST-CLOSE ADDENDUM (07-18 precedent). -- Step E netem DONE (targeted apply at an operator-ruled 1/1/0 STOP; placeholder live on virbr5) - -> G10 CLOSED. G16 opened for the office1 channels residual, then CLOSED same-day - (operator-ruled state surgery; outer plan back to ZERO DIFF). -- Ruling 1 retire-fully EXECUTED: vr1-dc0-maas removed, stale pod + SEC-013 key file + tfstate - deleted. INCIDENT: the pod delete cascaded to the 9 machine records (association check ran - post-delete -- owned); recovered same-hour via re-enlist/power/commission, 9/9 Ready, shapes - exact, NEW MAAS hostnames. Appendix-A entry shipped (check pod machine list BEFORE delete). -- Also: ledger-scan PARTIAL fix, DOCFIX-197, D-103/D-123 amendments, GA-R7 memory review. -- STAGE 3 CLOSED (operator-ruled): consolidation + skill sweep + gauntlet 76 ALL GREEN; merge - commit 8d0d155 on main; branch retired local+remote. Next stage branches off main. -- Open queue unchanged: D-131 sub-2..4, SEC-014 rotation, D-068/D-071/D-129, G12 (dc1), G15. -- Details: docs/archive/changelogs/changelog-20260721-netem-install-verify.md (archived at the - successor's bookend). Status lives ONLY in CURRENT-STATE.md. - -## SESSION CLOSE 2026-07-21 -- queue-pass session (fourth same-day; bounded, GA-R4) - -- Recovered the predecessor's undelivered committee verdict from its transcript; the - tenant-onboarding items are PINNED to a deployment-close consideration review (operator-directed; - self-contained block in the retained section above). -- Queue pass, one GA-R5 ruling per exchange, each committed+pushed: D-131 sub-2 ruled - (metal-admin-only) + sub-3 RESOLVED by measurement (no dhcpd option-6 defect; stale read; - operator-run capture); D-129 subs (i)-(iv) ALL RULED -- decision-complete, G13 execution-only; - D-071 ADOPTED (all four points); D-068 items 2-3 RULED; D-100 netem placeholder CONFIRMED. -- Filed/pinned: D-132 PROPOSED (per-DC MAAS topology, operator verbatim); DNS architectural - review pinned to D-131 sub-4. Delivered: cloud-assert A9 vault-kv AppRole probe - (harness 15/15; gauntlet 76 ALL GREEN). -- G12 [R] leg CLOSED: vr1-dc1 addressing RATIFIED (D-124 amendment; apex confirm-free at - authoring). Remaining [V]: vars + substrate root + build. -- Open after this session: D-068 item 1 (draft), D-131 sub-4 (LP + pinned review), D-132 - (pinned), G12 [V], G13 execution, 10 SEC rows, LP filing (operator). -- Details: docs/archive/changelogs/changelog-20260721-tenant-review-pin.md. Status lives ONLY - in CURRENT-STATE.md. - -## SESSION CLOSE 2026-07-21 -- G12 dc1-authoring session (fifth same-day; bounded, GA-R4) - -- Session DISCONNECTED before its bookend; entry landed by the successor session 2026-07-22 - after read-only re-verification (tree, branch, harnesses). No cloud state was touched. -- Delivered pre-drop (commit cbc1104 on branch dc-dc-g12-dc1-substrate -- branch UNPUSHED at - the drop): dc1 apex confirm-free capture (transit /30 + rack 10.12.68.2 FREE, planes already - consistent) + dc-rack-mgmt-import per-site --site support (117/117; live dry-run PASS). -- INTERRUPTED mid-item-3, authored UNCOMMITTED in tree: vr1_dc1 vars + vvr1-dc1 module + - vr1-dc1-uplink, inner root opentofu/vr1-dc1-substrate/ (54 MACs pre-pinned 52:54:01:d1), - lib-net.sh dc1 arm + selection guard, dc-selector 40/40. Drop point: BEFORE the gauntlet -- - successor run = 6/76 FAILED, six harnesses still assert the retired vr1-dc1 fail-loud arm - (docs/audit/gauntlet-20260722-g12-dropstate.txt). Owed: reconcile -> ALL GREEN -> delivery - entry -> commit+push; THEN the operator-gated apex --commit stays G12's next gated step. -- Details: docs/changelog-20260721-g12-dc1-authoring.md (item 3 = drop-state record). Status - lives ONLY in CURRENT-STATE.md. +The eight oldest closed-session summaries (2026-07-18 through the fifth 2026-07-21 +session) moved VERBATIM to `docs/archive/session-ledger-rotated-20260726.md`. The live +ledger was 413 lines against the 300-line cap -- a breach the 2026-07-25 close recorded as +OWED. Each rotated summary still points at its own archived full body; only the summaries +moved. Sessions from 2026-07-22 onward remain live below. ## SESSION CLOSE 2026-07-22 -- G12 dc1 build session (bounded, GA-R4) @@ -384,7 +250,7 @@ falsified IMMEDIATE NEXT struck; machine-derived block re-seeded. - OWNED: called a login probe read-only; it authenticated, writing last_login twice (benign). - LOGGED not executed: headend-install consolidate-at-mint; conflation proposable as next-free D - [ARCH]; 3 /root secrets unmoved. **GA-R4 F1: ledger 370 lines at OPEN vs 300 cap -- rotation OWED.** + [ARCH]; 3 /root secrets unmoved. **GA-R4 F1: ledger 370 lines at OPEN vs 300 cap -- rotation OWED.** (DISCHARGED 2026-07-26: rotated oldest-first to 280 lines; see the ROTATED block above.) - Gauntlet 79 GREEN, repo-lint 0-fail, b2b0c80 pushed. Bookend EARLY (07-21 precedent); further work appends a POST-CLOSE ADDENDUM. Details: docs/changelog-20260725-maas-admin-recovery.md. @@ -399,15 +265,16 @@ before the next was asked): enforcement = blocking in preflight; manifests DERIVED from the matrix; --remote bounded to declared locations; D-137 is the policy authority (SEC-009 demotes to a pointer); identity conflation FOLDED IN as the one-identity-one- - principal invariant. Implementation UNBLOCKED, not started. + principal invariant. (SUPERSEDED SAME-DAY: implementation was built, committee-audited and + remediated later on 2026-07-26 -- see CURRENT-STATE, which is the status authority. This + line is kept as the narrative record of where the session stood at the time.) - Research: 3 read-only agents. Capture `docs/audit/creds-creation-points-20260725.md` -- 55 MINT sites, and **12 declared secrets have NO mint command anywhere** (`ssh-keygen` = ZERO hits repo-wide), plus three credential dirs outside the SEC-009 convention. - **SEC-021/-022/-023 OPENED** (rows 16 -> 19): a consolidated dc0 credential ABSENT from its recorded location; two UNAUDITED shadow *-creds/ stores on the headend; sprawl-glob blind spots incl. a PREDICTED Stage-5 admin-openrc exposure. All logged-not-actioned. -- NEXT (fresh session, operator-directed): build per **`docs/D-137-implementation-plan.md`** - (the repo-carried build spec -- the design originated in an out-of-repo plan file, which - this bookend path would not surface). First run expected RED BY DESIGN; going green is a - separate remediation project, do not scope-creep it into the build. +- NEXT as recorded at the time: build per `docs/D-137-implementation-plan.md`. THAT HAPPENED + in the same-day successor session (tiers 1-3 built, six-lens committee audit, remediation, + preflight P5 wired, SEC-009 demoted). Current status: CURRENT-STATE only. - Status ONLY in CURRENT-STATE.md. Detail: docs/changelog-20260725-maas-admin-recovery.md.