diff --git a/docs/archive/session-ledger-rotated-20260727.md b/docs/archive/session-ledger-rotated-20260727.md new file mode 100644 index 0000000..fbb5b41 --- /dev/null +++ b/docs/archive/session-ledger-rotated-20260727.md @@ -0,0 +1,70 @@ +# session-ledger summaries rotated 2026-07-27 (GA-R4 rule 3 / F1 -- oldest-first) + +Moved VERBATIM from `docs/session-ledger.md` at the Stage 4 close, to restore the 300-line +cap (the live ledger was 317). These are the three 2026-07-23 closed-session summaries -- +the oldest still-live ones. Each still points at its own archived full body; only the +summaries moved. Status is in `docs/CURRENT-STATE.md` ONLY; this file is history. + +## SESSION CLOSE 2026-07-23 -- G12 dc1 edge->commission + CLOSE + MERGE (bounded, GA-R4) + +- Resumed from the 07-22 handoff (edge at login prompt); drove dc1 to a commissioned fleet, + every mutation operator-gated in `manual` permission mode (auto-mode classifier blocks + remote sudo shapes instead of prompting -- manual mode is the fix; noted). +- Edge: D-112(c) console bootstrap (payload needed util.inc/shell_safe -- dc0 lesson iv the + .b64 lacked) + key auth + D-113(a2) API mint (transient post-restart-sshd scp, ssh-pipe + workaround) + v4 addressing WAN 172.30.3.2 / LAN 10.12.64.1 (egress 0%). +- dc-rack-net dc1 arm (harness 18/18) + install (forwarder answers maas-internal); region MAAS + D-120 range + D-131 dns + DHCP primary_rack=nmpcq4 (dhcpd verified running). +- SEC-016 RULED "Mint a dedicated dc1 power key" (per-DC isolation) + wired (script=svc key, + MAAS snap=dedicated key). Commissioning ALL 9 READY ~3.5 min, shapes exact D-121 Option C -- + dc0's two stacked faults pre-empted by pinned MACs + forwarder. +- G12 CLOSED: gauntlet 76 GREEN, repo-lint 0-fail, consolidation + skill sweep (per-DC power + key invariant) + GA-R7 memory review; MERGED to main (merge commit a5c0a49), branch retired. +- Open after: SEC 12 rows (incl. SEC-015/-016); 3 findings (util.inc, scp readiness, snap-key + refresh fragility); D-068 item1, D-131 sub-4, D-132 pinned. Next stage branches off main. +- Full body: docs/archive/changelogs/changelog-20260723-g12-dc1-edge.md. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-23 -- Stage 4 OPEN + carve + mirrors (bounded, GA-R4) + +- Stage 4 OPENED (branch dc-dc-stage4-phase3-maas-deploy); discovery captured; D-133 + (flat per-NIC carve; hw-faithful NICs next deployment) + D-134 (+amendment: contiguous + bands, Option B swap) ADOPTED, utterances quoted. +- CARVE EXECUTED both DCs (logged stage4-carve): ranges .201-.254, 10 fabrics, 90 NIC + re-homes, subnets+spaces, 18 nodes statics + br-ex; all Ready; capture committed. +- Deploy model RULED: Ready handoff (DOCFIX-200 -- runbook Step 4 would have broken + Stage 5); jammy images synced; per-DC tags applied 9+9. +- Mirror: exception REJECTED -> D-135 ADOPTED; dc-mirror.sh shipped (19/19, gauntlet 77); + INSTALLED both racks; initial syncs RUNNING at last check (hours; verify + last-sync.status before citing). INCIDENT: dc1 edge pf never regenerated post- + addressing -- filter reload fixed; appendix-A + DoD + script amendment QUEUED. +- OWNED: pipe-masked L10 lint FAIL (repaired); dc0-only egress probe wrongly assumed + symmetric (item 9). +- Delivery batch LANDED before close (item 11): lib-hosts VR1 arms populated (tofu-name + keys, pinned MACs, D-134 octets, host_sysid_by_bootmac) + D-133 guards in the two VR0 + flow scripts + appendix-A pf entry + DoD items 8-9 + item-4 range fix; dc-selector 48, + gauntlet 77 GREEN. At close: both syncs RUNNING (dc0 13G / dc1 15G pulled). +- OPEN in-stage for the NEXT session: verify last-sync.status OK both racks (this + session's watcher dies with it -- check at open); mirror node-side reachability gate; + set-interface-v4 reload amendment (queued OPTION, unruled); local permission-rules + prune (`Bash(ssh *)` flag); then the stage close-out set (consolidation, skill sweep, + GA-R7 memory review, final gauntlet, operator-gated merge). +- Details: docs/archive/changelogs/changelog-20260723-stage4-open.md. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-23 -- queue pass + D-068 rulings (bounded, GA-R4) + +- Queue fully processed. Repo: 5 script/harness fixes (prep-image bash -s; headend hints + + idempotent sec010 nft + staging dir; apikey readiness/retry) + DOCFIX-198 (Steps 9-10 + superseded; DC standup DoD) + DOCFIX-199 (D-112(c) payload spec). Gauntlet 76 ALL GREEN. +- Live (logged ops-sec010-reassert, all operator-approved): SEC-010 files idempotent on all + 3 hosts (double-restart proof); G13 CLOSED -- office1 qga channel 0/1/0 saved-plan apply + (guest-ping proven), edge 26.7 -> 26.7.1, os-iperf in after a measured refusal; outer plan + re-converged zero diff. vr1-dc0-maas cache residue deleted (association-checked FIRST). +- D-068 item 1: plan DRAFTED then Q1 (rehearsal EOL acceptance, 1b), Q2 STRUCTURE (Roosevelt + on 1.8 + funded remediation track), Q3 (monthly checks -> ops-update-procedure 0c) ALL + RULED -- individually confirmed after a volunteered batch answer (GA-R5 kept). Remainder: + Q2 path at Roosevelt design time. NetBox residue -> docs/netbox-write-path-findings.md. +- Owned: one capture commit pushed with a pipe-masked L10 lint FAIL; repaired same-hour. +- GA-R7 memory review: no changes. AT CLOSE: ledger-scan FALSE-CLOSE defect found (tail-appended + detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED + number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded. +- Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index c894f53..fd72f41 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -30,8 +30,8 @@ ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit) -_Re-seeded from a 2026-07-26 scan (D-137 build session), at the GA-R4/F1 rotation. -Re-run `bash scripts/ledger-scan.sh` to refresh._ +_Re-seeded from a 2026-07-27 scan at the STAGE 4 CLOSE (values verified against +`bash scripts/ledger-scan.sh` in that session). Re-run the scan to refresh._ - **PROPOSED / OPEN decisions (4):** D-068 (Vault substrate hardening, Roosevelt -- sole remainder is Q2 path selection at Roosevelt Vault design time), D-131 (node-facing DNS for @@ -114,69 +114,12 @@ OWED. Each rotated summary still points at its own archived full body; only the summaries moved. Sessions from 2026-07-22 onward remain live below. -## SESSION CLOSE 2026-07-23 -- G12 dc1 edge->commission + CLOSE + MERGE (bounded, GA-R4) +## ROTATED 2026-07-27 (GA-R4 rule 3 / F1 -- oldest-first, cap restored at the Stage 4 close) -- Resumed from the 07-22 handoff (edge at login prompt); drove dc1 to a commissioned fleet, - every mutation operator-gated in `manual` permission mode (auto-mode classifier blocks - remote sudo shapes instead of prompting -- manual mode is the fix; noted). -- Edge: D-112(c) console bootstrap (payload needed util.inc/shell_safe -- dc0 lesson iv the - .b64 lacked) + key auth + D-113(a2) API mint (transient post-restart-sshd scp, ssh-pipe - workaround) + v4 addressing WAN 172.30.3.2 / LAN 10.12.64.1 (egress 0%). -- dc-rack-net dc1 arm (harness 18/18) + install (forwarder answers maas-internal); region MAAS - D-120 range + D-131 dns + DHCP primary_rack=nmpcq4 (dhcpd verified running). -- SEC-016 RULED "Mint a dedicated dc1 power key" (per-DC isolation) + wired (script=svc key, - MAAS snap=dedicated key). Commissioning ALL 9 READY ~3.5 min, shapes exact D-121 Option C -- - dc0's two stacked faults pre-empted by pinned MACs + forwarder. -- G12 CLOSED: gauntlet 76 GREEN, repo-lint 0-fail, consolidation + skill sweep (per-DC power - key invariant) + GA-R7 memory review; MERGED to main (merge commit a5c0a49), branch retired. -- Open after: SEC 12 rows (incl. SEC-015/-016); 3 findings (util.inc, scp readiness, snap-key - refresh fragility); D-068 item1, D-131 sub-4, D-132 pinned. Next stage branches off main. -- Full body: docs/archive/changelogs/changelog-20260723-g12-dc1-edge.md. Status ONLY in CURRENT-STATE.md. - -## SESSION CLOSE 2026-07-23 -- Stage 4 OPEN + carve + mirrors (bounded, GA-R4) - -- Stage 4 OPENED (branch dc-dc-stage4-phase3-maas-deploy); discovery captured; D-133 - (flat per-NIC carve; hw-faithful NICs next deployment) + D-134 (+amendment: contiguous - bands, Option B swap) ADOPTED, utterances quoted. -- CARVE EXECUTED both DCs (logged stage4-carve): ranges .201-.254, 10 fabrics, 90 NIC - re-homes, subnets+spaces, 18 nodes statics + br-ex; all Ready; capture committed. -- Deploy model RULED: Ready handoff (DOCFIX-200 -- runbook Step 4 would have broken - Stage 5); jammy images synced; per-DC tags applied 9+9. -- Mirror: exception REJECTED -> D-135 ADOPTED; dc-mirror.sh shipped (19/19, gauntlet 77); - INSTALLED both racks; initial syncs RUNNING at last check (hours; verify - last-sync.status before citing). INCIDENT: dc1 edge pf never regenerated post- - addressing -- filter reload fixed; appendix-A + DoD + script amendment QUEUED. -- OWNED: pipe-masked L10 lint FAIL (repaired); dc0-only egress probe wrongly assumed - symmetric (item 9). -- Delivery batch LANDED before close (item 11): lib-hosts VR1 arms populated (tofu-name - keys, pinned MACs, D-134 octets, host_sysid_by_bootmac) + D-133 guards in the two VR0 - flow scripts + appendix-A pf entry + DoD items 8-9 + item-4 range fix; dc-selector 48, - gauntlet 77 GREEN. At close: both syncs RUNNING (dc0 13G / dc1 15G pulled). -- OPEN in-stage for the NEXT session: verify last-sync.status OK both racks (this - session's watcher dies with it -- check at open); mirror node-side reachability gate; - set-interface-v4 reload amendment (queued OPTION, unruled); local permission-rules - prune (`Bash(ssh *)` flag); then the stage close-out set (consolidation, skill sweep, - GA-R7 memory review, final gauntlet, operator-gated merge). -- Details: docs/archive/changelogs/changelog-20260723-stage4-open.md. Status ONLY in CURRENT-STATE.md. - -## SESSION CLOSE 2026-07-23 -- queue pass + D-068 rulings (bounded, GA-R4) - -- Queue fully processed. Repo: 5 script/harness fixes (prep-image bash -s; headend hints + - idempotent sec010 nft + staging dir; apikey readiness/retry) + DOCFIX-198 (Steps 9-10 - superseded; DC standup DoD) + DOCFIX-199 (D-112(c) payload spec). Gauntlet 76 ALL GREEN. -- Live (logged ops-sec010-reassert, all operator-approved): SEC-010 files idempotent on all - 3 hosts (double-restart proof); G13 CLOSED -- office1 qga channel 0/1/0 saved-plan apply - (guest-ping proven), edge 26.7 -> 26.7.1, os-iperf in after a measured refusal; outer plan - re-converged zero diff. vr1-dc0-maas cache residue deleted (association-checked FIRST). -- D-068 item 1: plan DRAFTED then Q1 (rehearsal EOL acceptance, 1b), Q2 STRUCTURE (Roosevelt - on 1.8 + funded remediation track), Q3 (monthly checks -> ops-update-procedure 0c) ALL - RULED -- individually confirmed after a volunteered batch answer (GA-R5 kept). Remainder: - Q2 path at Roosevelt design time. NetBox residue -> docs/netbox-write-path-findings.md. -- Owned: one capture commit pushed with a pipe-masked L10 lint FAIL; repaired same-hour. -- GA-R7 memory review: no changes. AT CLOSE: ledger-scan FALSE-CLOSE defect found (tail-appended - detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED - number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded. -- Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md. +The three oldest live summaries (all 2026-07-23: G12 dc1 edge->commission+merge, Stage 4 +OPEN+carve+mirrors, queue pass + D-068 rulings) moved VERBATIM to +`docs/archive/session-ledger-rotated-20260727.md`. The live ledger was 317 lines against +the 300-line cap. Sessions from 2026-07-24 onward remain live below. ## SESSION CLOSE 2026-07-24 -- caveman guardrails + DC1 proxy-build start (bounded, GA-R4)