diff --git a/.claude/skills/openstack-cloud-ops/references/platform-traps.md b/.claude/skills/openstack-cloud-ops/references/platform-traps.md index 95cd868..e9b0cba 100644 --- a/.claude/skills/openstack-cloud-ops/references/platform-traps.md +++ b/.claude/skills/openstack-cloud-ops/references/platform-traps.md @@ -16,7 +16,7 @@ | Thing | Pin | Why the pin exists | |---|---|---| | `dmacvicar/libvirt` provider | `0.9.8` | 0.9.0 was a compatibility-BREAKING rewrite; anything remembered from 0.8-era examples is wrong (see below) | -| OpenTofu | `v1.12.3` (as-run) | the binary that actually executed Stage 1 | +| OpenTofu | live pin: CURRENT-STATE.md section 7 | Stage-1 as-run value is historical (git history) | | LXD | **`5.21` LTS track** | MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) | | MAAS | 3.7.2 (VR0) | the LXD ceiling above is a property of MAAS 3.6/3.7 | | OPNsense | live pin: CURRENT-STATE.md section 7 (26.7 as of 2026-07-18) | ISC-DHCP left core AT 26.1 -- Kea/dnsmasq only on every later release (see below) | diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index c872d6e..f5dac9a 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -202,7 +202,7 @@ |---|------|----------------|-------|---------------------------| | G1 | Audit Phase 3: fresh-agent grounding test | [V] 3 clean-context probes score the 7-question set against this doc; holes map made | session | CLOSED 2026-07-18: 3 probes, 21/21 PASS, holes H1 (amended into G9) + H2 (no action) -- `docs/audit/phase3-grounding-test-20260718.md` | | G2 | Audit Phase 4: GA-R1..R7 structural rulings + the stage-status vocabulary A/B | [R] ruling-type gate (GA-R6 rule 6): closes when every item carries a GA-R5 Status block | operator | CLOSED 2026-07-18: all seven GA-R + vocabulary (Option A + H1) RATIFIED, utterances quoted (`docs/audit/ga-rulings.md`, through commit `fe4f1c4` + this one) | -| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | [R] operator-gated fix batches, each commit naming its GA-F | operator + session | Batch 0 OPENED by operator 2026-07-19; items 0.1 (repo-lint L10, GA-R1/C1), 0.2 (SEC repoint, GA-R4/F3), 0.3 (counter hardening, GA-F15), 0.4 (extractor vocab scan, GA-F10/H1) landed; Batch 0 CLOSED (verification passed 2026-07-19); Batch 1 all items landed + close verification passed (G4/G5/G6/G7 CLOSED; triple 6/0/6 recorded); Batch 2 OPEN (record fixes landing per-GA-F); Batches 2-6 await gates; FREEZE holds for un-gated surfaces | +| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | [R] operator-gated fix batches, each commit naming its GA-F | operator + session | Batch 0 OPENED by operator 2026-07-19; items 0.1 (repo-lint L10, GA-R1/C1), 0.2 (SEC repoint, GA-R4/F3), 0.3 (counter hardening, GA-F15), 0.4 (extractor vocab scan, GA-F10/H1) landed; Batch 0 CLOSED (verification passed 2026-07-19); Batches 0-2 CLOSED 2026-07-19 (Batch 2: items 2.1-2.10 landed per-GA-F incl. two operator rulings -- D-tags + R3-F disposition; live-surface vocab flags 0; residual extractor groups are history-class or mechanical, adjudication in the session changelog); Batches 3-6 await gates; Batches 2-6 await gates; FREEZE holds for un-gated surfaces | | G4 | The two D-130 verifications | [V] run them, capture output | session | CLOSED 2026-07-19: v8 suppression CONFIRMED (7/2/7 -> 6/2/6, zero forces-replacement; `docs/audit/outer-plan-20260719-v8-ignorechanges.txt` + `-baseline.txt`); v7 no-bounce under running domain, zero residue (`docs/audit/throwaway-v7-20260719.txt`) | | G5 | D-130 mechanism ruling (seed-volume durable fix) | [R] operator rules in Phase 5, quoting G4's captured output | operator | CLOSED 2026-07-19: D-130 ADOPTED (a) ignore_changes (`docs/design-decisions.md` D-130, GA-R5 utterance quoted); implemented in `modules/cloudinit-vm` + `tests/cloudinit-vm` | | G6 | State reconcile of autostart + seed WITHOUT bouncing guests | [R] gated mechanism, operator-ruled (S3) | operator | CLOSED 2026-07-19: ruled (ii) state surgery (GA-R5); pull -> inject autostart:true on both domains -> push (serial 22->23, backup `terraform.tfstate.pre-G6-20260719`); guests never touched (ids 1/2 unchanged, running) | @@ -231,12 +231,10 @@ | NetBox (Office1 apex) | 4.6.4 per as-built `docs/vr1-office1-as-built.md:44`; service UP verified (HTTP 302) this session | `ssh office1-netbox 'curl ... localhost:8000'` | office1-netbox | | Juju | NOT part of VR1 substrate yet (arrives Stage 5). Last recorded VR0 value 3.6.25 -- historical, unverified here | n/a | n/a | -Known-stale pins that this table supersedes (do NOT trust them; Phase-5 -fixes them): OpenTofu 1.12.3 at `opentofu/README.md:41` (historical Stage-1 -prose), `docs/dc-dc-deployment-workflow.md:47,360,875`, -`.claude/skills/.../platform-traps.md:19` (GA-F03); OPNsense 26.1 across -the skill references (GA-F04); jumphost name `vopenstack-jesse` in -`CLAUDE.md:4` and the skill -- the host is `vcloud`, measured (GA-F05). +The known-stale pin sites this table used to enumerate (GA-F03/F04/F05: +tofu 1.12.3, OPNsense 26.1, hostname vopenstack-jesse) were ALL fixed or +demoted to pointers in sweep Batch 2, 2026-07-19 (session changelog); the +one remaining copy is the memory file, Batch 3. ## 8. Open decision queue (the exact questions the operator must answer) diff --git a/docs/changelog-20260719-phase5-sweep.md b/docs/changelog-20260719-phase5-sweep.md index 38d63c3..8d89b6e 100644 --- a/docs/changelog-20260719-phase5-sweep.md +++ b/docs/changelog-20260719-phase5-sweep.md @@ -124,3 +124,66 @@ hit -- the settings edit itself now prompts instead of denying. - REVERT: `git revert` this commit, or `cp .claude/settings.json.bak` per the operator backup if the bak is refreshed first. + +## Batch 2 -- record fixes (OPENED by operator 2026-07-19; commits per-GA-F) + +1. **2.4 GA-F05 hostname** (`02af860`): vcloud on CLAUDE.md + SKILL.md + a + discovered fourth surface (environment.md:43). Memory copy = Batch 3. +2. **2.2 GA-F03 tofu pins** (`b5981a9`): four sites demoted to the + CURRENT-STATE section-7 pointer; the one LIVE false claim (workflow :360) + corrected. A fifth site (platform-traps:19) fixed at batch close. +3. **2.3 GA-F04 OPNsense rows** (`6232dd3`): skill pin row -> pointer; trap + sections requalified as entered-at-26.1-persisting; env.md's stale tofu + pin (GA-F03 class) caught on the same surface. +4. **2.1 GA-F02 readiness doc** (`360e8d6`): three contradictory plan-count + forms -> section-5 pointers; falsified deploy-ready blockquote reframed + as history; fresh-session banner -> one-line pointer at the G9 canonical + entry doc (operator scope addition, probe hole H1). +5. **2.5+2.6 H1 migration + GA-R1 demotions** (`47423c6`): mapping record + docs/audit/h1-token-map-20260719.md (no token unmapped); workflow doc 26 + flags -> 0 (8 State lines demoted, tracker model dropped from the + header); runbooks 18 -> 0 with close-out instructions RETARGETED at + CURRENT-STATE; CURRENT-STATE 6 -> 0 (G9 STOPPED -> BLOCKED w/ named + blocker; stale "GA-R1 NOT yet ratified" header fixed per C2); gate rows + gained GA-R6/E1 [V]/[R] type tags; CLAUDE.md expectation line demoted + (S5b). History classes deliberately untouched (Batch 4 / GA-R3). +6. **2.8 GA-F14 banner** on the D-127 changelog (content preserved). +7. **2.9 GA-F11/F12 adjudication**: one real live version row fixed + (env.md:29 -> pin authorities); 192 non-history broken-ref rows + adjudicated ALL false-positive (provider-repo doc paths, glob/range + forms, slash-phrases, wraps) or VR0-era history docs routed to Batch 4. + Spot-checks: as-built:59 "netbox/tailscale" = slash-phrase; workflow:473 + retired-script mention = history; env.md:86 "phase-00..08" = range glob. +8. **2.10 S1 R3-F disposition**: all 13 items accounted -- F01-F07/F09/F10 + closed by the 2026-07-16 Phase A/B + rulings + SEC-010 artifact; + F08 CLOSED-SUPERSEDED (R-3's 4th storage node restored rebuild + headroom); F11 FIXED (supernet-unassigned clause dropped; vr1-dc1 stays + HELD on transit addressing, G12); F12 CLOSED (committed budget model, + 186 GiB headroom covers transient N+1 amphora; Stage-6 drill exercises + the real path); F13 CLOSED as recorded observation. Stale readiness C5 + queue corrected (it queued amendments that landed 2026-07-16). +9. **2.7 GA-R3 D-tags (operator-ruled)**: D-121..125 [ARCH], D-126..129 + [OPS], D-130 [ARCH]; register template gains the class-tag convention; + D-129's ARCH fragment (Roosevelt metal-edge profile) split to a dated + D-122 AMENDMENT per A1 (utterance: "Tags as proposed + D-122 + amendment"). + +**Batch-2 verification + the criterion-mechanics finding.** Extractor +re-run: live-surface vocab flags = 0; the remaining flagged occurrences +(110) and contradiction groups (12) sit ENTIRELY on history-class surfaces +(session ledger, changelogs, the append-only register, VR0-era docs -- +Batch 4's rotation/consolidation) or are extractor MECHANICS: the global +plan key conflates different roots' plans (Stage-1's 13-object plan vs the +DC0 triple), charm channels/step numbers read as juju versions, the +provider (2.7.2) vs MAAS-server (3.7.2) attribution, compatibility +thresholds (LXD >= 6.7), and prose like "Stage-4 concerns" keying a stage +status. FINDING (logged, not silently absorbed): the sweep plan's Batch-2 +exit criterion "contradiction groups on counted non-changelog surfaces +reach ZERO" is not literally computable by the extractor's changelog-only +exclusion -- ledger/register/finding classes are counted non-changelog but +their ruled disposition is Batch 4/GA-R3 retention, and the status +authority itself must narrate history (7/2/7 -> 6/2/6 -> 6/0/6) to comply +with GA-R1 rule 2. The achieved, verifiable state: zero contradiction +among LIVE-surface status claims (mechanical classification script in the +session record); final ZERO-on-counted comes with Batch 4's rotation + +Batch 6.1 as the plan already sequences. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 8dd7840..b1ff13e 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -1172,3 +1172,10 @@ (dac10e0); G6 state surgery executed per operator ruling (ii), backup terraform.tfstate.pre-G6-20260719; G7 re-plan = 6/0/6 == recorded triple (5a4f5eb). Gate status lives in CURRENT-STATE.md. - Next gate: operator opens Batch 2 (record fixes, GA-F backlog, repo-only). + +- BATCH 2 COMPLETE (2026-07-19, same session): items 2.1-2.10 landed per-GA-F (9 commits), two + operator rulings recorded GA-R5-style (D-tags: "Tags as proposed + D-122 amendment"; R3-F + disposition none-unaccounted). Live-surface vocab flags 0; residual extractor groups adjudicated + history-class/mechanical -- see the session changelog's Batch-2 verification note, incl. the + criterion-mechanics FINDING (Batch-2 literal ZERO is Batch-4-dependent by construction). +- Next gate: operator opens Batch 3 (memory hygiene; edits shown per-file, memory is outside the repo).