diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 0666199..a01a126 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2481,6 +2481,18 @@ `office1_svc` pubkey; (d) REBUILD the 9 nodes+juju+.7 FRESH into it -- delete each from Office1 `admin`, then power/enlist/commission/deploy/carve into `vr1-dc1-region`, naming each `vr1-dc1--NN` (D-134 amdt); the aux-carve + lib-hosts octet/MAC map already cover every host.** + **^ STEPS (a)-(b) DONE 2026-08-07 (part 2), region STANDUP substantially complete + (`changelog-20260807-dc1-region-sequence.md` Items 2-4).** (a) topology apply `check` 40/0; + (b) `maas-region-power-key.sh install` 9/9 (SEC-016, virsh proven), `dc-plane-ipam.sh` carve-v6 + 6/6 + reserve 13/13 (`check` 24/0), DHCP CUTOVER off-Office1-admin -> on-region (`.6` sole + metal-admin dhcpd, no dual-serve; region subnet 3 `dns_servers=10.12.68.3 allow_dns=false` + dynamic `10.12.68.201-.254` -- MEASURED, not the `.100-.200` in G12 prose), jammy image sync + TRIGGERED + downloading (blocked-then-UNBLOCKED by the SEC-031 edge rebuild that restored `.6` + egress). Captures `docs/audit/dc1-region-topology-20260807.txt`, `dc1-dhcp-handover-20260807.txt`. + **REMAINING: verify jammy `.complete`; (c) import the office1_svc pubkey; (d) the 9-node+juju+.7 + FRESH rebuild** -- destructive, batches of three, profile re-asserted before each delete, PLUS + the isolation-critical in-region `juju-vr1-dc1` mint (SEC-028 pattern -- the Office1-region key + does NOT authenticate against the separate DB) and the SEC-026 single-credential residency check. **NEXT (NetBox, do not miss -- operator-flagged 2026-08-07): record this session's new IPAM objects into `office1-netbox` (the live VR1 apex, DOCFIX-195) -- the dc0 `.7` (10.12.8.7/10.12.4.7), dc1 `.6` region VM (10.12.68.6/10.12.64.6) + the new `vr1-dc1-region`, dc1 `.7` when live diff --git a/docs/archive/session-ledger-rotated-20260807.md b/docs/archive/session-ledger-rotated-20260807.md index 2737e17..39d7e0b 100644 --- a/docs/archive/session-ledger-rotated-20260807.md +++ b/docs/archive/session-ledger-rotated-20260807.md @@ -30,3 +30,29 @@ - Gauntlet **ALL GREEN (99)**, repo-lint 0 fail. voffice1 PULLED to sync (`9b49b84`); dc0 rack `~/repo-stage` lacks the new script (redeploy prereq -- sweep F3). Live tests were reversible; model at its captured before-state (residue: certificates:145, /0 holds its proof cert -- sweep F2). - **OWNED:** called the root cause wrong THREE times before right; explained away a null resolvectl result (advisor caught it); two false-negative binding tests (didn't re-fire the relation); nearly wired the fix without confirming a server cert issues (advisor made that test blocking). - **NEXT:** we are at **STEP 3** -- Path M model teardown -> preflight -> phase-01 (with Step 1.2b) -> phase-02 vault init -> converge. Sweep: `docs/audit/queued-findings-20260804-ovn-cert-fix.txt` (4 FIRST SURFACE). Body: `docs/changelog-20260804-ovn-central-cert-fix.md`. Status ONLY in CURRENT-STATE.md. +# Rotated session-ledger summaries -- moved 2026-08-07 (GA-R4 rule 3, <300 cap) + +## SESSION CLOSE 2026-08-05 -- vault init DONE + ovn-central RESOLVED; D-142 vault-init QoL saved (bounded, GA-R4) + +- Branch `dc-dc-stage5-preconditions`, pushed `d6975fb..ca3c0d3`. NO stage opened/closed; Stage 5 remains OPEN. Scan: **4** PROPOSED/OPEN decisions (D-142 added), **SEC 29**, next-free **D-143 / DOCFIX-209 / BUNDLEFIX-053**. +- **>>> VAULT INIT COMPLETE (operator-run one-shot) + ovn-central RESOLVED end-to-end. <<<** Fresh `phase-02-vault-preflight vr1-dc0` -> PROCEED; operator ran phase-02-vault-bringup 2.1-2.3 VERBATIM on the dc0 rack (`-m vr1-dc0`): init (5 shares + TOKEN_OK, `2>&1|tee`), unseal 3/3, authorize + generate-root-ca -> vault active/idle. Root CA (public): valid 2026-08-05 02:05:57 -> 2036-08-02 01:06:27 UTC. +- **ovn-central/3,4,5 ALL active** (/4 leader ovnnb_db+ovnsb_db, /5 northd) -- OVN NB/SB cluster FORMED. Closes the multi-session saga via BOTH cycle fixes: dc-node-etchosts Step 1.2b (CN delivery) + D-052 re-amendment `''`->metal-admin (reachability). Census 40->47 active, 0 error. +- **D-142 PROPOSED -- vault-init workflow QoL sweep SAVED (approved-in-principle, IMPL DEFERRED per operator "run current commands now, test QoL next opportunity"; R2 off-host transport UNRESOLVED).** Full R1-R5 + hidden-prompt safety analysis + tee-write residual + pre-init writability probe + R3 harness constraints: `docs/audit/vault-init-qol-proposal-20260805.md`. Fold-register **F13** (D-138 `-m openstack`->`-m vr1-dc0`, scope-stretch stated). Distinct from D-068 (substrate) / D-011.6 (unseal bar). +- **Hung-apps directive (fulfilled):** the "hung" set was mostly correctly-waiting (ovn certs, designate/octavia/rbd-mirror). GENUINELY stuck: **ceph-mon/2 + ceph-radosgw/0** `allocating` (apt-wedge class) -> cascade to ceph-osd/glance/nova-compute. Logged, not fixed (hard rule 1). +- **Security hygiene:** child token printed in the operator's paste (init keys + root token WERE redacted) was ttl=10m/unset/expired -> benign, not stored/echoed/committed. Lesson: redact token-create output too. +- **Durability:** vcloud 0 uncommitted / 0 unpushed at close; repo-lint 0 fail / 1 legacy warn; **voffice1 PULLED to sync** (was at `3321c57`, 4 behind -> `8305ceb`); dc0 rack `~/repo-stage` UNAFFECTED (docs-only session, no staged script touched; `phase-02-vault-preflight.sh` sha `90910dfb` verified == repo today). Gauntlet not owed (docs-only, no script/harness change). Root CA + vault init recorded no-secrets (root CA openssl-verified on the rack) in `docs/audit/stage5-dc0-redeploy-asexec-20260804.txt`. +- **NEXT:** triage the ceph-mon/2 + ceph-radosgw/0 apt-wedge (appendix-A) -> ceph/storage-backend convergence -> continue Stage 5 (phase-03 core verify). Sweep: `docs/audit/queued-findings-20260805-vault-init-close.txt` (3 items). **Body: `docs/changelog-20260805-vault-init-ovn-resolved.md`.** Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-08-05 (part 2) -- D-121 HA scale-up 14/14 LIVE + vault METAL-ONLY (D-020 amdt); harness + amendment UNCOMMITTED (Task #2) (bounded, GA-R4) + +- Branch dc-dc-stage5-preconditions; 5 commits pushed today (33f9158 71c5b97 c1111a3 ae06c72 4392118). Scan: 4 open decisions, SEC 29, next-free D-143 / DOCFIX-210 / BUNDLEFIX-054. +- **CEPH:** ceph-mon/2 + ceph-radosgw/0 "allocating" ROOT-CAUSED to apt-cacher-ng CLOSE-WAIT (NOT proxy-down; proxies PASS), remediated (remove-unit -> remove-machine --force -> re-add); appendix-A entry added. Body: `changelog-20260805-stage5-dc0-ceph-remediation.md`. +- **D-121 EXECUTED LIVE -- all 14 control-plane apps scaled 1->3 HA** (8 Wave-1 + placement pilot + nova-cc + rabbitmq + barbican + keystone + vault). barbican-vault RESOLVED. Findings: apt-concurrency forces 1-app/2-container batches; PROACTIVE cluster_count=3 avoids the keystone VIP auth-blip (F5). +- **BUNDLE:** BUNDLEFIX-053 -- num_units/cluster_count 1->3, vault-hacluster + vault:ha, rabbitmq min-cluster-size; every change charm-doc-verified; provider-bundle-check PASS. Body: `changelog-20260805-d121-ha-scaleup.md`. +- **VAULT:** 3-unit HA on MySQL backend (operator unsealed vault/1,2). D-020 AMENDMENT ratified 2026-08-05 -> vault METAL-ONLY (PKI/CA root not tenant-facing; provider VIP unhostable -- no provider leg, findif). Live metal-only DONE, vault-hacluster UNBLOCKED. +- **SKILL:** DOCFIX-209 (session-close bookend text). Body: `changelog-20260805-skill-close-convention-docfix.md`. +- **OWNED:** shipped BUNDLEFIX-053 (ae06c72) WITHOUT running its harness -> harness now RED (Task #2, F1); twice mis-framed vault init-state before measuring the settling mysql-router; nearly concluded MySQL backend un-shared during a relation-settle. +- **RED AT CLOSE (both = Task #2):** repo-lint L10 (held amendment) + provider-bundle-check harness 6/? FAIL. Amendment + dc0 overlay + check-exception are UNCOMMITTED (on disk). +- **DURABILITY:** vcloud 0 unpushed; **3 files UNCOMMITTED** (Task #2, held); voffice1 PULLED to 4392118; dc0 rack `~/repo-stage/bundle.yaml` may be STALE post-BUNDLEFIX-053 (F9). +- **NEXT:** Task #2 (harness reconcile + amendment/overlay/check commit + CURRENT-STATE 14/14); Task #1 (post-wave bundle/overlay review); verify vault `ha_enabled`/(v-a) (F4) + ceph-radosgw radosgw-service (F8). Sweep: `docs/audit/queued-findings-20260805-d121-ha-vault.txt`. Status ONLY in CURRENT-STATE.md. + diff --git a/docs/audit/queued-findings-20260807-dc1-region-sequence.txt b/docs/audit/queued-findings-20260807-dc1-region-sequence.txt new file mode 100644 index 0000000..bbb26dc --- /dev/null +++ b/docs/audit/queued-findings-20260807-dc1-region-sequence.txt @@ -0,0 +1,84 @@ +QUEUED FINDINGS -- session 2026-08-07 "dc1-region sequence" (F + Stage-5 dc1 standup B/C + SEC-031 edge rebuild) +Method: read the whole session, grep each candidate. FIRST SURFACE = existed only in the transcript. +Body: docs/changelog-20260807-dc1-region-sequence.md. Status ONLY in docs/CURRENT-STATE.md. + +================================================================================ +FIRST SURFACE (existed only in the transcript -- would have been lost on /clear) +================================================================================ + +F1. scripts/opnsense-console-rebuild.py SHIPPED WITHOUT A HARNESS. + Committed in 2b476e4. The change-delivery loop says no script ships without its + tests//run-tests.sh. It is a pexpect serial-console driver (hard to test fully + offline), but a MINIMAL harness is feasible and owed: parse check, --help exit 0, + structure asserts (no hardcoded domain/pubkey; PHP payload carries require_once util.inc + + local_user_set + write_config; base64 <=160-char chunking present; PUB read from file). + Prove-it-can-fail per the 2026-07-30 mutation lesson. OWED next session. + +F2. run-logged.sh NOT opened this session -- as-executed log GAP for a heavy-mutation window. + This session executed many live mutations (dc1 topology apply, IPAM carve/reserve, the + DHCP cutover, power-key install, the full edge REBUILD incl. tofu destroy+recreate) with + NO as-executed log. 4th+ consecutive session with this gap (O3 in prior sweeps). The + changelog + captures are the record; declare the log gap on a surface (this file). + +F3. MAAS image-sync TRAP: jammy is NOT selectable until the region's boot-source INDEX is + refreshed. On a fresh region, `boot-source-selections create ... release=jammy` returns + "OS ubuntu with release jammy has no available images for download" until a first + `boot-resources import` fetches the simplestreams index from images.maas.io. Sequence: + import (fetches index) -> add jammy selection -> import again (downloads jammy). Measured + 2026-08-07 on vr1-dc1-region. Worth a line in the dc1 region-standup NEXT / a runbook. + +================================================================================ +ALREADY ON SURFACE (recorded where noted) +================================================================================ + +S1. NetBox tool GAP closed: no importer recorded D-134 utility-HOST IPs (only band ranges + + VIPs). Built netbox/dc-util-hosts-import.py + harness 19/19. -> changelog Item 1, CURRENT-STATE. + +S2. office1-netbox dcim/regions are GEOGRAPHIC (US-West/VR0/VR1), not MAAS regions -- so + vr1-dc1-region needs no NetBox object (the .6 IP represents it). -> changelog Item 1, CURRENT-STATE. + +S3. NetBox findings DEFERRED for operator: (a) the .4 ARTIFACT host (dc0 mirror / dc1 cache, + metal-admin-only 10.12.8.4 / 10.12.68.4, per-DC divergent, NO repo name) needs a NAMING + ruling before it can be recorded; (b) dc1 .5 juju + .7 tailscale record WHEN LIVE. + -> changelog Item 1, CURRENT-STATE. + +S4. DHCP cutover FALSE ALARM: a bare `pgrep -c dhcpd` self-matched its own command shell and + read 1, looking like dual-serve. `ss :67` / `pgrep -af` are authoritative. No dual-serve. + -> changelog Item 2. + +S5. MEASURED-CORRECTS-MEMORY: the dc1 metal-admin DYNAMIC DHCP range is 10.12.68.201-.254, + NOT the .100-.200 recalled from G12 prose. -> changelog Item 2. + +S6. dc-plane-ipam reserve reported skipped=6 on v6 bands though carve-v6 had landed; the + read-only check 24/0 confirms the ruled state is fully present. GLANCE owed. -> changelog Item 2. + +S7. SEC-031 CLOSED: dc1 edge rebuilt (proven dc0 procedure), egress restored, dc-egress-check + dc1 8/8. Procedure now runbooks/dc-edge-rebuild.md + scripts/opnsense-console-rebuild.py. + -> changelog Item 4, CURRENT-STATE, security-ledger SEC-031. + +S8. dc-egress-check A2 is STRUCTURALLY BLIND to "edge answers but does not NAT" (pre-existing + finding, CURRENT-STATE ~4013). Still open as a gate-improvement candidate (positive + "edge TRANSLATES" assertion). NOT actioned. -> CURRENT-STATE. + +================================================================================ +OPERATOR RULINGS THIS SESSION (OPS-level directives; exact utterances) +================================================================================ +- "Sequence and continue"; "Land the Netbox then move on to the rest of the sequence" +- NetBox gap: "Build importer, then land" +- DHCP: "Full cutover first. It shouldn't have had DHCP from Office1 to begin with." +- Image egress: "Fix .6 own egress to match dc0" +- Step B: "I approve you running these commands" +- Edge: "I drive the SEC-031 edge repair now"; "look back at the steps that were successful with dc0" +- Documentation: "make sure the steps and procedures are logged accurately so when we do this + again we won't go down this path again when there is a proven method and tools documented" + -> actioned: runbooks/dc-edge-rebuild.md + scripts/opnsense-console-rebuild.py + SEC-031 close. +(None is a GA-R5 D-number ruling; all are OPS directives -> changelog/runbook, no D-number.) + +================================================================================ +DELIBERATELY NOT DONE (deferred, with reason) +================================================================================ +- D (import SSH keys into vr1-dc1-region), E (rebuild 9 nodes + juju + .7 -- destructive, + batches of 3, incl SEC-028 in-region juju mint + SEC-026 residency), G (consolidate dc1 .6 + creds SEC-020) -- deferred to next session (session length). +- jammy image sync: TRIGGERED + downloading at close; verify .complete=true next session. +- The 2 NetBox findings (S3) + the console-driver harness (F1). diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 6f35fe6..c6ad71c 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -214,30 +214,6 @@ VERBATIM to `docs/archive/session-ledger-rotated-20260807.md`. Rotated oldest-first across the 2026-08-07 closes to keep the live ledger under the 300-line cap (GA-R4 rule 3). -## SESSION CLOSE 2026-08-05 -- vault init DONE + ovn-central RESOLVED; D-142 vault-init QoL saved (bounded, GA-R4) - -- Branch `dc-dc-stage5-preconditions`, pushed `d6975fb..ca3c0d3`. NO stage opened/closed; Stage 5 remains OPEN. Scan: **4** PROPOSED/OPEN decisions (D-142 added), **SEC 29**, next-free **D-143 / DOCFIX-209 / BUNDLEFIX-053**. -- **>>> VAULT INIT COMPLETE (operator-run one-shot) + ovn-central RESOLVED end-to-end. <<<** Fresh `phase-02-vault-preflight vr1-dc0` -> PROCEED; operator ran phase-02-vault-bringup 2.1-2.3 VERBATIM on the dc0 rack (`-m vr1-dc0`): init (5 shares + TOKEN_OK, `2>&1|tee`), unseal 3/3, authorize + generate-root-ca -> vault active/idle. Root CA (public): valid 2026-08-05 02:05:57 -> 2036-08-02 01:06:27 UTC. -- **ovn-central/3,4,5 ALL active** (/4 leader ovnnb_db+ovnsb_db, /5 northd) -- OVN NB/SB cluster FORMED. Closes the multi-session saga via BOTH cycle fixes: dc-node-etchosts Step 1.2b (CN delivery) + D-052 re-amendment `''`->metal-admin (reachability). Census 40->47 active, 0 error. -- **D-142 PROPOSED -- vault-init workflow QoL sweep SAVED (approved-in-principle, IMPL DEFERRED per operator "run current commands now, test QoL next opportunity"; R2 off-host transport UNRESOLVED).** Full R1-R5 + hidden-prompt safety analysis + tee-write residual + pre-init writability probe + R3 harness constraints: `docs/audit/vault-init-qol-proposal-20260805.md`. Fold-register **F13** (D-138 `-m openstack`->`-m vr1-dc0`, scope-stretch stated). Distinct from D-068 (substrate) / D-011.6 (unseal bar). -- **Hung-apps directive (fulfilled):** the "hung" set was mostly correctly-waiting (ovn certs, designate/octavia/rbd-mirror). GENUINELY stuck: **ceph-mon/2 + ceph-radosgw/0** `allocating` (apt-wedge class) -> cascade to ceph-osd/glance/nova-compute. Logged, not fixed (hard rule 1). -- **Security hygiene:** child token printed in the operator's paste (init keys + root token WERE redacted) was ttl=10m/unset/expired -> benign, not stored/echoed/committed. Lesson: redact token-create output too. -- **Durability:** vcloud 0 uncommitted / 0 unpushed at close; repo-lint 0 fail / 1 legacy warn; **voffice1 PULLED to sync** (was at `3321c57`, 4 behind -> `8305ceb`); dc0 rack `~/repo-stage` UNAFFECTED (docs-only session, no staged script touched; `phase-02-vault-preflight.sh` sha `90910dfb` verified == repo today). Gauntlet not owed (docs-only, no script/harness change). Root CA + vault init recorded no-secrets (root CA openssl-verified on the rack) in `docs/audit/stage5-dc0-redeploy-asexec-20260804.txt`. -- **NEXT:** triage the ceph-mon/2 + ceph-radosgw/0 apt-wedge (appendix-A) -> ceph/storage-backend convergence -> continue Stage 5 (phase-03 core verify). Sweep: `docs/audit/queued-findings-20260805-vault-init-close.txt` (3 items). **Body: `docs/changelog-20260805-vault-init-ovn-resolved.md`.** Status ONLY in CURRENT-STATE.md. - -## SESSION CLOSE 2026-08-05 (part 2) -- D-121 HA scale-up 14/14 LIVE + vault METAL-ONLY (D-020 amdt); harness + amendment UNCOMMITTED (Task #2) (bounded, GA-R4) - -- Branch dc-dc-stage5-preconditions; 5 commits pushed today (33f9158 71c5b97 c1111a3 ae06c72 4392118). Scan: 4 open decisions, SEC 29, next-free D-143 / DOCFIX-210 / BUNDLEFIX-054. -- **CEPH:** ceph-mon/2 + ceph-radosgw/0 "allocating" ROOT-CAUSED to apt-cacher-ng CLOSE-WAIT (NOT proxy-down; proxies PASS), remediated (remove-unit -> remove-machine --force -> re-add); appendix-A entry added. Body: `changelog-20260805-stage5-dc0-ceph-remediation.md`. -- **D-121 EXECUTED LIVE -- all 14 control-plane apps scaled 1->3 HA** (8 Wave-1 + placement pilot + nova-cc + rabbitmq + barbican + keystone + vault). barbican-vault RESOLVED. Findings: apt-concurrency forces 1-app/2-container batches; PROACTIVE cluster_count=3 avoids the keystone VIP auth-blip (F5). -- **BUNDLE:** BUNDLEFIX-053 -- num_units/cluster_count 1->3, vault-hacluster + vault:ha, rabbitmq min-cluster-size; every change charm-doc-verified; provider-bundle-check PASS. Body: `changelog-20260805-d121-ha-scaleup.md`. -- **VAULT:** 3-unit HA on MySQL backend (operator unsealed vault/1,2). D-020 AMENDMENT ratified 2026-08-05 -> vault METAL-ONLY (PKI/CA root not tenant-facing; provider VIP unhostable -- no provider leg, findif). Live metal-only DONE, vault-hacluster UNBLOCKED. -- **SKILL:** DOCFIX-209 (session-close bookend text). Body: `changelog-20260805-skill-close-convention-docfix.md`. -- **OWNED:** shipped BUNDLEFIX-053 (ae06c72) WITHOUT running its harness -> harness now RED (Task #2, F1); twice mis-framed vault init-state before measuring the settling mysql-router; nearly concluded MySQL backend un-shared during a relation-settle. -- **RED AT CLOSE (both = Task #2):** repo-lint L10 (held amendment) + provider-bundle-check harness 6/? FAIL. Amendment + dc0 overlay + check-exception are UNCOMMITTED (on disk). -- **DURABILITY:** vcloud 0 unpushed; **3 files UNCOMMITTED** (Task #2, held); voffice1 PULLED to 4392118; dc0 rack `~/repo-stage/bundle.yaml` may be STALE post-BUNDLEFIX-053 (F9). -- **NEXT:** Task #2 (harness reconcile + amendment/overlay/check commit + CURRENT-STATE 14/14); Task #1 (post-wave bundle/overlay review); verify vault `ha_enabled`/(v-a) (F4) + ceph-radosgw radosgw-service (F8). Sweep: `docs/audit/queued-findings-20260805-d121-ha-vault.txt`. Status ONLY in CURRENT-STATE.md. - ## SESSION CLOSE 2026-08-06 -- Task #2 DONE: D-020 vault-metal-only COMMITTED + enforced across 4 gates; renderer taught (bounded, GA-R4) - Branch dc-dc-stage5-preconditions; 2 commits pushed (07e2d9d Task #2, a08783c awk hardening). voffice1 SYNCED to a08783c (ff-only). Scan: 4 open decisions, SEC 29, next-free D-143 / DOCFIX-211 / BUNDLEFIX-054. @@ -295,3 +271,13 @@ - OWED: consolidate the .6 MAAS creds to `~/vr1-dc1-creds/` (SEC-020); RE-OPEN the voffice1:5243 tunnel after any reboot before `maas vr1-dc1-region ...`. - NEXT (dc1, `--profile vr1-dc1-region --expect-rack vr1-dc1-maas-01`, tunnel up): `dc-region-topology.sh apply` (6-plane) -> `maas-region-power-key.sh` (.6 snap) + `dc-plane-ipam.sh` + DHCP + jammy image sync -> import office1_svc pubkey -> REBUILD 9 nodes+juju+.7 fresh in (delete from Office1 admin -> enlist/commission/deploy/carve, name vr1-dc1--NN). Separately dc0 Step 3.3 on a TAGGED key + Headscale. - NEXT (NetBox, operator-flagged -- do not miss): record this session's new IPAM objects into `office1-netbox` (live apex, DOCFIX-195) -- dc0 .7 + dc1 .6 region VM + new vr1-dc1-region + dc1 .7 (when live) + D-134 utility `.4-.9` assignments + dc0 renames. Enumerated: changelog-20260807 Item 11. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-08-07 (part 2) -- dc1 region STANDUP (topology/IPAM/DHCP cutover/power-key) + SEC-031 edge REBUILT + NetBox util-host importer (bounded, GA-R4) + +- Branch dc-dc-stage5-preconditions; 2 commits (b6798df, 2b476e4) pushed at close; voffice1 pulled to sync. Scan: 4 open decisions, **SEC 29->28 (SEC-031 CLOSED)**, next-free D-143 / DOCFIX-213 / BUNDLEFIX-059 (no new numbers assigned). +- **F:** built `netbox/dc-util-hosts-import.py` (+harness 19/19) closing the D-134 utility-HOST IP gap; landed 8 ip-addresses into office1-netbox (186->194, ids 187-194). `.4` artifact + dc1 `.5`/`.7` DEFERRED (S3). +- **dc1 region STANDUP** (`--profile vr1-dc1-region`): topology apply 40/0; IPAM carve-v6 6/6 + reserve 13/13 (check 24/0); DHCP CUTOVER off-admin->on-region, `.6` sole server (no dual-serve, false-alarm resolved); power-key install 9/9 (SEC-016). Captures `docs/audit/dc1-*-20260807`. +- **SEC-031 CLOSED:** dc1 edge REBUILT via the proven dc0 procedure (operator "look back at dc0"), `dc-egress-check dc1` 8/8, `.6` egress restored -> now a RUNBOOK (`runbooks/dc-edge-rebuild.md`) + tool (`scripts/opnsense-console-rebuild.py`) per operator "log accurately so we don't re-derive". jammy image sync TRIGGERED + downloading at close. +- **OWNED:** `pgrep -c dhcpd` self-match false-alarm (instrument #21); recalled DHCP range .100-.200, MEASURED .201-.254; shipped `opnsense-console-rebuild.py` WITHOUT a harness (F1 owed); reserve skipped=6 glance owed; run-logged NOT opened (F2, 4th+ consecutive). +- Gates: repo-lint 0 fail/1 legacy warn; gauntlet ALL GREEN (102); ledger-scan reconciled. Ledger rotated (2026-08-05 x2 -> archive/session-ledger-rotated-20260807.md). +- **NEXT:** verify jammy sync completes; **D** (import ssh keys into vr1-dc1-region) -> **E** (rebuild 9 nodes+juju+.7 FRESH, destructive batches of 3, SEC-028 in-region juju mint + SEC-026 residency) -> **G** (dc1 .6 creds SEC-020); the 2 NetBox findings (S3); the console-driver harness (F1). Sweep: `docs/audit/queued-findings-20260807-dc1-region-sequence.txt` (F1-F3 FIRST SURFACE). Body: `docs/changelog-20260807-dc1-region-sequence.md`. Status ONLY in CURRENT-STATE.md.