diff --git a/docs/archive/session-ledger-rotated-20260805.md b/docs/archive/session-ledger-rotated-20260805.md new file mode 100644 index 0000000..c232898 --- /dev/null +++ b/docs/archive/session-ledger-rotated-20260805.md @@ -0,0 +1,36 @@ +# Rotated session-ledger summaries -- moved 2026-08-05 (GA-R4 rule 3 / F1) + +Moved VERBATIM from `docs/session-ledger.md` at the 2026-08-05 (part 2) close to keep the +live ledger under the 300-line cap. Also folds forward the 2026-08-01 rotation pointer +(`docs/archive/session-ledger-rotated-20260801.md`, unchanged). + +--- + +## SESSION CLOSE 2026-07-31 -- Stage 5 dc0: prefer-ipv6 ruled, deploy succeeded then torn down for a clean rebuild (bounded, GA-R4) + +- Branch `dc-dc-stage5-preconditions`, **45 commits** pushed. NO stage opened/closed. Scan: 3 decisions, **SEC 26**, D 139 / DOCFIX 207 / BUNDLEFIX 053. +- **8 RULINGS (GA-R5, all utterances quoted):** prefer-ipv6 dropped from the six, then from ALL thirteen; P5's five new findings accepted; **option D** (explicit base on 56 apps AND a clean model); jammy-backports synced; UCA points in-DC; snaps get an in-DC forward proxy; and the MAAS proxy declined in favour of the owned one. +- **THE RESEARCH INVERTED ITS OWN PREMISE.** Read from the charm ARTIFACTS: `prefer-ipv6` is NOT what makes HAProxy bind `:::port` -- that is gated on the kernel `disable_ipv6` sysctl, and pacemaker picks IPv6addr by family detection. Neither consults the option. vault ships no haproxy at all (`[::]:8200` hardcoded). +- **>>> THE BUNDLE DEPLOYED (attempt 3, `Deploy of bundle completed.`) <<<** after three failures each one layer deeper: unknown option; a missing `policies/overrides.zip` on the client host; and a bundle relying on `default-base` being deployable exactly ONCE. +- **FOUR ARTIFACT DEFECTS, each masked by the one before it** (`apt-get update --error-on=any` fails on the first bad source): backports 404, upstream UCA unreachable, `prefer-ipv6` fatal on containers with only link-local v6, and snaps with no path. Units tracked 22 -> 17 -> 4 -> 7-in-one-class. +- **THE v6 HALF IS CARVED AS ADDRESSES BUT NEVER MADE OPERATIONAL** -- all six v6 plane subnets carry ZERO allocatable ranges, the rack has NO global v6 at all, the mirror does not answer on v6, and nodes have no v6 default route. Operator: dual-stack was "only a safety net". DC1 carries the IPv6 build; DC0 folds it back. +- **TEARDOWN STALLED AND WAS FORCED.** All 26 agents were `stopped`, so no hook could run -- a fixed point, not backoff. `--force` cleared it; NOTHING was stranded. All nine nodes renamed to their ruled `vr1-dc0--NN` by pinned boot MAC and back to `Ready`. +- **SNAP PROXY BUILT AND INDEPENDENTLY REVIEWED, NOT APPLIED.** squid at the utility `.4:3129`, allowlisted, 53/53 mutations killed; review says the ruled design is HONOURED on all four counts and logs FOUR real bugs. Nothing proven end to end. +- **OWNED:** a red-lint push (`| tail` masked the exit code); a `git add -A` that swept an agent's files into an unrelated commit; two instrument misreads (a `juju models` summary read as progress, and stale unit logs read as current); and a wrong "immutable system_id" claim the operator corrected. +- **NEXT:** apply the review cuts, re-run the mutation pass (S8 invalidates it), confirm BUG-3's deny shape once, install the proxy, then `add-model` + spaces + `deploy`. Sweep: `docs/audit/queued-findings-20260731-stage5-deploy.txt` (11 FIRST SURFACE). Bodies: `docs/changelog-20260731-prefer-ipv6-research.md`. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-08-01 -- snap proxy LIVE, D-139 adopted, IPv6 PROVEN on the node planes (bounded, GA-R4) + +- Branch `dc-dc-stage5-preconditions`, **8 commits** pushed (`d555b90..844b2e4`). NO stage opened or closed. Scan: 3 open decisions, SEC **26** (none opened this session), D **140** / DOCFIX 207 / BUNDLEFIX 053. +- **THE dc0 SNAP PROXY IS LIVE.** `check dc0` PASS exit 0, 16 assertions, re-verified independently of the agent that installed it -- and **a real snap payload fetched through it** (HTTP 206, first bytes `hsqs`). No longer fixture-green. BUG-3 confirmed by measurement (no assertion changed); BUG-4 fixed at BOTH sites where the review had named one. +- **D-139 ADOPTED** -- two rulings taken in separate exchanges: IPv6-only on the east-west planes, and the whole plane carve moved to GUA on the octet map VR0 and Willamette already use. +- **THEN ITS DECIDING REASON WAS REFUTED BY MY OWN VERIFICATION** -- glibc 2.35 implements RFC **3484**, not 6724, so ULA and GUA are EQUAL at precedence 40. Put back to the operator rather than quietly kept; ruling CONFIRMED on its other grounds and the dead rationale STRUCK IN PLACE, not deleted. +- **RULING A IS NOT ACHIEVABLE at current charm revisions** -- `ceph-osd` fails a v6-only plane in BOTH directions, `hacluster` still ships `ip_version: ipv4`, OVN documents encap as IPv4-only. Narrowed by ruling ("B plus C") to a storage+replication experiment plus the upstream fix; LP draft written, operator files it. +- **>>> IPv6 IS PROVEN ON THE dc0 NODE PLANES <<<** 6/6 addresses live on the NICs, 0% loss node-to-node on all six planes, ND resolving from a COLD neighbour table. Gate **G19** built AND run live. **IPv6 is also already load-bearing: node time sync runs over `fd50:840e:74e2:220::6`, stratum 3.** +- **THE RECORDED ROOT CAUSE OF THE v4-ONLY CONTAINERS WAS WRONG.** MAAS has 100% of every v6 `/64` available; the real limit is juju taking `addrs[0]` from an unsorted query, family-blind, with no knob (LP #1723240, open since 2017). Corrected per GA-R1 C2. +- **THE "JUJU CLIENT BLOCKER" WAS NOT ONE** -- the client is live and registered on the rack, exactly where D-138 puts it. Corrects this repo's own 2026-07-31 finding 9d. +- **D-139's OWN EXECUTION LIST WAS DEFECTIVE AND IS REPLACED.** `dc-node-v6-carve.py` pivots on IPv4 existing, so run after v4 removal it would carve four fewer planes per node **and exit clean**. +- **OWNED:** my BUG-1 fix was wrong (a secondary alias is never the kernel's chosen source); I scoped the v6 experiment wrong (ceph couples storage+replication); I stated an agent's input source wrongly; I scoped a research agent with no repo path, so 355 lines landed in `/tmp` and needed rescuing; and one commit went red on ASCII-only em-dashes. +- Gauntlet **ALL GREEN (96)**, repo-lint 0 fail, `d139-gua-carve` 71/71, `dc-node-v6-verify` 55/55. **voffice1's clone is 36 commits BEHIND** -- no loss, but a live hazard on the Plane-2 host. +- **AMENDED AFTER THE BOOKEND (2026-08-01):** both DC containment VMs resized **416 -> 480 GiB** through tofu (operator: *"Option 2 look sgood me"*), **128 GiB swap** added (operator-run), and preflight gained **gate P8, substrate drift** (harness 33 -> 38, proven live at zero diff). Host used **809 -> 63 GiB**. Found: dc0's MAAS region and juju controller have `autostart=disable`. Bodies: changelog items 21-22. +- **NEXT:** apex CREATE-only push (tool built, independently reviewed, dry-run byte-identical), then the bundle deploy -- its blockers are cleared. `network-get` on a v6-only bound space is still unmeasured and gates the v4-removal experiment. Sweep: `docs/audit/queued-findings-20260801-stage5-ipv6-d139.txt` (**6 FIRST SURFACE**). Body: `docs/changelog-20260731-snap-proxy-apply-ipv6.md`. Status ONLY in CURRENT-STATE.md. diff --git a/docs/audit/queued-findings-20260805-d121-ha-vault.txt b/docs/audit/queued-findings-20260805-d121-ha-vault.txt new file mode 100644 index 0000000..9699847 --- /dev/null +++ b/docs/audit/queued-findings-20260805-d121-ha-vault.txt @@ -0,0 +1,98 @@ +SWEEP -- 2026-08-05 session: D-121 HA scale-up (14/14) + vault metal-only (D-020 amendment) +========================================================================================== +Method (ruled 2026-07-31): enumerate every finding from the session, then grep each against +the repo. FIRST SURFACE = exists only in this transcript and would be lost on a clear. +This was a very large session; the committed changelogs capture the bulk -- this file leads +with what they do NOT. + +== FIRST SURFACE (transcript-only until this file) ========================================= + +F1. OWN-MISTAKE: BUNDLEFIX-053 (bundle.yaml num_units 1->3, committed ae06c72) was SHIPPED + WITHOUT RUNNING ITS HARNESS. I ran `provider-bundle-check.py` directly (PASS) but not + `tests/provider-bundle-check/run-tests.sh`. The num_units:3 change broke the harness's + rolesep fixture builder (lines ~157-163 set to:[lxd:0] single-placement while base now + has num_units:3 -> placement/anti-affinity FAIL: T9). Latent until 2026-08-05's vault work + re-ran the harness. Remediation = Task #2. Lesson: a BUNDLE change breaks the CHECK's + harness even when the check script is untouched -- run the harness on any bundle edit. + +F2. provider-bundle-check HARNESS IS RED (6 cases: T9,T14,T16,T19,T21,T45) as of session close. + Two causes: (a) F1 above; (b) the D-020 vault-metal-only amendment -- dc1 overlay still has + vault as a triple (T14), and the VIP-count assertions expect 13 provider/admin/internal + triples, now 12 (T16/T19/T21/T45). Reconciliation + commit = Task #2. repo-lint also FAILS + (L10) while the amendment sits uncommitted in the working tree. + +F3. D-020 AMENDMENT (2026-08-05, vault METAL-ONLY) is RATIFIED but UNCOMMITTED. Operator + utterances (GA-R5 fidelity): "(a) draft the amendment" then "Ratify as written". The + amendment TEXT is written in docs/design-decisions.md (working tree, on disk, uncommitted); + overlays/vr1-dc0-vips.yaml (vault -> "10.12.8.61 10.12.12.61") and + scripts/provider-bundle-check.py (vault metal-only exception) are the applied edits, also + uncommitted. LIVE change DONE: `juju config vault vip="10.12.8.61 10.12.12.61"` -> the dead + provider VIP dropped, vault-hacluster UNBLOCKED (active, 2 metal VIPs Started). This is NOT + durable until Task #2 commits + pushes it. + +F4. vault `ha_enabled` / the D-121 (v-a) NATIVE leader-election question is UNVERIFIED at close. + Measured earlier: all 3 vault units `HA Enabled=false`, vault.hcl had NO ha_enabled. The + hacluster was blocked then (on the provider VIP); it is now unblocked. Whether the charm + now sets ha_enabled (true MySQL leader-election) vs. only VIP-level redundancy is NOT + re-checked. The (v-a) gate says: if no MySQL leader-election, evaluate Raft/route to D-068. + OWED: re-measure `vault status | grep 'HA Enabled'` on the 3 units now that hacluster is up. + +F5. keystone SCALE-UP CAUSED NO AUTH OUTAGE -- and the reason is a runbook-worthy sequencing + fact: setting hacluster `cluster_count=3` PROACTIVELY (as the new subs join), rather than + reactively after they cluster, avoided the transient VIP-stop that hit Wave 1. Measured: + keystone VIP 10.12.12.50:5000 held HTTP 200 across the reform. Belongs in the D-121 + execution runbook (owed). + +F6. vault API is PLAINTEXT (`tls_disable = 1` on the [::]:8200 and 127.0.0.1:8220 listeners). + There is NO vault API TLS cert -- so the VIP flip had no SAN-mismatch risk (the cert-SAN + prerequisite advisor flagged was moot). vault's consumers reach it over HTTP on the + internal plane; the certificates relation passes data via the juju databag. + +F7. Multi-unit vault-on-MySQL bring-up shape (for the runbook): new units come up + `Initialized=false` UNTIL their vault-mysql-router finishes "Waiting for proxied DB creation + from cluster" -- then flip to `Initialized=true, Sealed=true` (shared `database="vault"`). + They need UNSEAL (same 3-of-5 shares as vault/0), NEVER init. Operator unsealed vault/1,2 + (Sealed=false confirmed). Deploying vault-hacluster is a FRESH `juju deploy hacluster + vault-hacluster` + `juju integrate` (juju 3.x -- NOT `add-relation`). + +F8. ceph-radosgw reports workload "Services not running: radosgw" after its 3-unit scale-up + (HA structure IS formed: crm 3 nodes, VIPs Started). Likely the new-unit stale-status class + (single-unit radosgw showed the same and self-cleared earlier). OWED a verify. + +F9. dc0 rack ~/repo-stage/bundle.yaml MAY BE STALE relative to BUNDLEFIX-053 (num_units:3 + + vault-hacluster). Not re-staged this session (no rack redeploy needed -- the scale-up was + live `juju add-unit`). Re-stage + sha256-verify before any rack-side redeploy. + +== ALREADY ON SURFACE (grep-verified) ===================================================== + +- Ceph apt CLOSE-WAIT remediation + capture -> committed 71c5b97, + docs/changelog-20260805-stage5-dc0-ceph-remediation.md, appendix-A entry, CURRENT-STATE. +- Bundle 3-unit HA (BUNDLEFIX-053) + charm-doc verification -> committed ae06c72, + docs/changelog-20260805-d121-ha-scaleup.md, CURRENT-STATE. +- Skill close-convention DOCFIX-209 -> committed 33f9158, + docs/changelog-20260805-skill-close-convention-docfix.md. +- D-121 14/14 live status + apt-concurrency + transient-VIP findings -> CURRENT-STATE (4392118 + says 12/14; the 14/14 update rides with Task #2's amendment commit -- status LAG noted). +- vault-is-internal-only / magnum:certificates-is-service-cert / tenant-path-is-Barbican -> + recorded in the D-020 amendment text (F3, uncommitted). + +== ALWAYS-SWEEP FIVE ======================================================================= + +1. Gitignored state: none created this session. .claude/settings.local.json unchanged. +2. Dangling refs: the two committed changelogs + appendix-A cite paths that resolve. The + UNCOMMITTED amendment cites the overlay/check edits (present, uncommitted). +3. Ruling fidelity: D-020 amendment 2026-08-05 utterances quoted verbatim (F3). D-121 execution + authorised by the 2026-08-05 "stand up all remaining HA apps" + "testing as if Roosevelt" + directives (recorded in CURRENT-STATE's D-121 block). +4. As-executed log: NO run-logged.sh window opened this session (live shell). Every mutation is + in this transcript + the committed changelogs/CURRENT-STATE; the vault unseals were + operator-run (secret custody). This file + the changelogs are the record; there is no + script(1) capture. +5. Contradiction detector: CURRENT-STATE (committed) says 12/14; live is 14/14 -- corrected by + Task #2. bundle.yaml (committed) says vault vip triple via overlay; the overlay is now + metal-only (uncommitted). provider-bundle-check "13 clustered VIPs" is now 12. + +== TASKS OPEN AT CLOSE ===================================================================== +#1 Post-wave bundle/overlay review vs live HA installs (should also fold the vault metal-only + reconciliation). +#2 Reconcile provider-bundle-check harness + commit the D-020 amendment (F1/F2/F3) + CURRENT-STATE. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 3228f63..14bd911 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -193,40 +193,13 @@ `docs/archive/session-ledger-rotated-20260731.md`. The live ledger stood at 295 lines and this close's summary would have breached the 300-line cap. -## SESSION CLOSE 2026-07-31 -- Stage 5 dc0: prefer-ipv6 ruled, deploy succeeded then torn down for a clean rebuild (bounded, GA-R4) +## ROTATED 2026-08-05 (GA-R4 rule 3 / F1 -- oldest-first, cap restored at this close) -- Branch `dc-dc-stage5-preconditions`, **45 commits** pushed. NO stage opened/closed. Scan: 3 decisions, **SEC 26**, D 139 / DOCFIX 207 / BUNDLEFIX 053. -- **8 RULINGS (GA-R5, all utterances quoted):** prefer-ipv6 dropped from the six, then from ALL thirteen; P5's five new findings accepted; **option D** (explicit base on 56 apps AND a clean model); jammy-backports synced; UCA points in-DC; snaps get an in-DC forward proxy; and the MAAS proxy declined in favour of the owned one. -- **THE RESEARCH INVERTED ITS OWN PREMISE.** Read from the charm ARTIFACTS: `prefer-ipv6` is NOT what makes HAProxy bind `:::port` -- that is gated on the kernel `disable_ipv6` sysctl, and pacemaker picks IPv6addr by family detection. Neither consults the option. vault ships no haproxy at all (`[::]:8200` hardcoded). -- **>>> THE BUNDLE DEPLOYED (attempt 3, `Deploy of bundle completed.`) <<<** after three failures each one layer deeper: unknown option; a missing `policies/overrides.zip` on the client host; and a bundle relying on `default-base` being deployable exactly ONCE. -- **FOUR ARTIFACT DEFECTS, each masked by the one before it** (`apt-get update --error-on=any` fails on the first bad source): backports 404, upstream UCA unreachable, `prefer-ipv6` fatal on containers with only link-local v6, and snaps with no path. Units tracked 22 -> 17 -> 4 -> 7-in-one-class. -- **THE v6 HALF IS CARVED AS ADDRESSES BUT NEVER MADE OPERATIONAL** -- all six v6 plane subnets carry ZERO allocatable ranges, the rack has NO global v6 at all, the mirror does not answer on v6, and nodes have no v6 default route. Operator: dual-stack was "only a safety net". DC1 carries the IPv6 build; DC0 folds it back. -- **TEARDOWN STALLED AND WAS FORCED.** All 26 agents were `stopped`, so no hook could run -- a fixed point, not backoff. `--force` cleared it; NOTHING was stranded. All nine nodes renamed to their ruled `vr1-dc0--NN` by pinned boot MAC and back to `Ready`. -- **SNAP PROXY BUILT AND INDEPENDENTLY REVIEWED, NOT APPLIED.** squid at the utility `.4:3129`, allowlisted, 53/53 mutations killed; review says the ruled design is HONOURED on all four counts and logs FOUR real bugs. Nothing proven end to end. -- **OWNED:** a red-lint push (`| tail` masked the exit code); a `git add -A` that swept an agent's files into an unrelated commit; two instrument misreads (a `juju models` summary read as progress, and stale unit logs read as current); and a wrong "immutable system_id" claim the operator corrected. -- **NEXT:** apply the review cuts, re-run the mutation pass (S8 invalidates it), confirm BUG-3's deny shape once, install the proxy, then `add-model` + spaces + `deploy`. Sweep: `docs/audit/queued-findings-20260731-stage5-deploy.txt` (11 FIRST SURFACE). Bodies: `docs/changelog-20260731-prefer-ipv6-research.md`. Status ONLY in CURRENT-STATE.md. - -## ROTATED 2026-08-01 (GA-R4 rule 3 / F1 -- cap restored at this close) - -The oldest closed-session summary/summaries moved VERBATIM to -`docs/archive/session-ledger-rotated-20260801.md`. The live ledger stood at 296 lines -and this close's summary would have breached the 300-line cap. - -## SESSION CLOSE 2026-08-01 -- snap proxy LIVE, D-139 adopted, IPv6 PROVEN on the node planes (bounded, GA-R4) - -- Branch `dc-dc-stage5-preconditions`, **8 commits** pushed (`d555b90..844b2e4`). NO stage opened or closed. Scan: 3 open decisions, SEC **26** (none opened this session), D **140** / DOCFIX 207 / BUNDLEFIX 053. -- **THE dc0 SNAP PROXY IS LIVE.** `check dc0` PASS exit 0, 16 assertions, re-verified independently of the agent that installed it -- and **a real snap payload fetched through it** (HTTP 206, first bytes `hsqs`). No longer fixture-green. BUG-3 confirmed by measurement (no assertion changed); BUG-4 fixed at BOTH sites where the review had named one. -- **D-139 ADOPTED** -- two rulings taken in separate exchanges: IPv6-only on the east-west planes, and the whole plane carve moved to GUA on the octet map VR0 and Willamette already use. -- **THEN ITS DECIDING REASON WAS REFUTED BY MY OWN VERIFICATION** -- glibc 2.35 implements RFC **3484**, not 6724, so ULA and GUA are EQUAL at precedence 40. Put back to the operator rather than quietly kept; ruling CONFIRMED on its other grounds and the dead rationale STRUCK IN PLACE, not deleted. -- **RULING A IS NOT ACHIEVABLE at current charm revisions** -- `ceph-osd` fails a v6-only plane in BOTH directions, `hacluster` still ships `ip_version: ipv4`, OVN documents encap as IPv4-only. Narrowed by ruling ("B plus C") to a storage+replication experiment plus the upstream fix; LP draft written, operator files it. -- **>>> IPv6 IS PROVEN ON THE dc0 NODE PLANES <<<** 6/6 addresses live on the NICs, 0% loss node-to-node on all six planes, ND resolving from a COLD neighbour table. Gate **G19** built AND run live. **IPv6 is also already load-bearing: node time sync runs over `fd50:840e:74e2:220::6`, stratum 3.** -- **THE RECORDED ROOT CAUSE OF THE v4-ONLY CONTAINERS WAS WRONG.** MAAS has 100% of every v6 `/64` available; the real limit is juju taking `addrs[0]` from an unsorted query, family-blind, with no knob (LP #1723240, open since 2017). Corrected per GA-R1 C2. -- **THE "JUJU CLIENT BLOCKER" WAS NOT ONE** -- the client is live and registered on the rack, exactly where D-138 puts it. Corrects this repo's own 2026-07-31 finding 9d. -- **D-139's OWN EXECUTION LIST WAS DEFECTIVE AND IS REPLACED.** `dc-node-v6-carve.py` pivots on IPv4 existing, so run after v4 removal it would carve four fewer planes per node **and exit clean**. -- **OWNED:** my BUG-1 fix was wrong (a secondary alias is never the kernel's chosen source); I scoped the v6 experiment wrong (ceph couples storage+replication); I stated an agent's input source wrongly; I scoped a research agent with no repo path, so 355 lines landed in `/tmp` and needed rescuing; and one commit went red on ASCII-only em-dashes. -- Gauntlet **ALL GREEN (96)**, repo-lint 0 fail, `d139-gua-carve` 71/71, `dc-node-v6-verify` 55/55. **voffice1's clone is 36 commits BEHIND** -- no loss, but a live hazard on the Plane-2 host. -- **AMENDED AFTER THE BOOKEND (2026-08-01):** both DC containment VMs resized **416 -> 480 GiB** through tofu (operator: *"Option 2 look sgood me"*), **128 GiB swap** added (operator-run), and preflight gained **gate P8, substrate drift** (harness 33 -> 38, proven live at zero diff). Host used **809 -> 63 GiB**. Found: dc0's MAAS region and juju controller have `autostart=disable`. Bodies: changelog items 21-22. -- **NEXT:** apex CREATE-only push (tool built, independently reviewed, dry-run byte-identical), then the bundle deploy -- its blockers are cleared. `network-get` on a v6-only bound space is still unmeasured and gates the v4-removal experiment. Sweep: `docs/audit/queued-findings-20260801-stage5-ipv6-d139.txt` (**6 FIRST SURFACE**). Body: `docs/changelog-20260731-snap-proxy-apply-ipv6.md`. Status ONLY in CURRENT-STATE.md. +The two oldest closed-session summaries (2026-07-31 prefer-ipv6/deploy-then-teardown, and +2026-08-01 snap-proxy/D-139/IPv6) moved VERBATIM to +`docs/archive/session-ledger-rotated-20260805.md`. The live ledger stood at 315 lines and the +2026-08-05 (part 2) close breached the 300-line cap. (The 2026-08-01 rotation's own pointer -> +`docs/archive/session-ledger-rotated-20260801.md` is subsumed here; that archive is unchanged.) ## ROTATED 2026-08-02 (GA-R4 rule 3 / F1 -- cap restored at this close) @@ -300,3 +273,16 @@ - **Security hygiene:** child token printed in the operator's paste (init keys + root token WERE redacted) was ttl=10m/unset/expired -> benign, not stored/echoed/committed. Lesson: redact token-create output too. - **Durability:** vcloud 0 uncommitted / 0 unpushed at close; repo-lint 0 fail / 1 legacy warn; **voffice1 PULLED to sync** (was at `3321c57`, 4 behind -> `8305ceb`); dc0 rack `~/repo-stage` UNAFFECTED (docs-only session, no staged script touched; `phase-02-vault-preflight.sh` sha `90910dfb` verified == repo today). Gauntlet not owed (docs-only, no script/harness change). Root CA + vault init recorded no-secrets (root CA openssl-verified on the rack) in `docs/audit/stage5-dc0-redeploy-asexec-20260804.txt`. - **NEXT:** triage the ceph-mon/2 + ceph-radosgw/0 apt-wedge (appendix-A) -> ceph/storage-backend convergence -> continue Stage 5 (phase-03 core verify). Sweep: `docs/audit/queued-findings-20260805-vault-init-close.txt` (3 items). **Body: `docs/changelog-20260805-vault-init-ovn-resolved.md`.** Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-08-05 (part 2) -- D-121 HA scale-up 14/14 LIVE + vault METAL-ONLY (D-020 amdt); harness + amendment UNCOMMITTED (Task #2) (bounded, GA-R4) + +- Branch dc-dc-stage5-preconditions; 5 commits pushed today (33f9158 71c5b97 c1111a3 ae06c72 4392118). Scan: 4 open decisions, SEC 29, next-free D-143 / DOCFIX-210 / BUNDLEFIX-054. +- **CEPH:** ceph-mon/2 + ceph-radosgw/0 "allocating" ROOT-CAUSED to apt-cacher-ng CLOSE-WAIT (NOT proxy-down; proxies PASS), remediated (remove-unit -> remove-machine --force -> re-add); appendix-A entry added. Body: `changelog-20260805-stage5-dc0-ceph-remediation.md`. +- **D-121 EXECUTED LIVE -- all 14 control-plane apps scaled 1->3 HA** (8 Wave-1 + placement pilot + nova-cc + rabbitmq + barbican + keystone + vault). barbican-vault RESOLVED. Findings: apt-concurrency forces 1-app/2-container batches; PROACTIVE cluster_count=3 avoids the keystone VIP auth-blip (F5). +- **BUNDLE:** BUNDLEFIX-053 -- num_units/cluster_count 1->3, vault-hacluster + vault:ha, rabbitmq min-cluster-size; every change charm-doc-verified; provider-bundle-check PASS. Body: `changelog-20260805-d121-ha-scaleup.md`. +- **VAULT:** 3-unit HA on MySQL backend (operator unsealed vault/1,2). D-020 AMENDMENT ratified 2026-08-05 -> vault METAL-ONLY (PKI/CA root not tenant-facing; provider VIP unhostable -- no provider leg, findif). Live metal-only DONE, vault-hacluster UNBLOCKED. +- **SKILL:** DOCFIX-209 (session-close bookend text). Body: `changelog-20260805-skill-close-convention-docfix.md`. +- **OWNED:** shipped BUNDLEFIX-053 (ae06c72) WITHOUT running its harness -> harness now RED (Task #2, F1); twice mis-framed vault init-state before measuring the settling mysql-router; nearly concluded MySQL backend un-shared during a relation-settle. +- **RED AT CLOSE (both = Task #2):** repo-lint L10 (held amendment) + provider-bundle-check harness 6/? FAIL. Amendment + dc0 overlay + check-exception are UNCOMMITTED (on disk). +- **DURABILITY:** vcloud 0 unpushed; **3 files UNCOMMITTED** (Task #2, held); voffice1 PULLED to 4392118; dc0 rack `~/repo-stage/bundle.yaml` may be STALE post-BUNDLEFIX-053 (F9). +- **NEXT:** Task #2 (harness reconcile + amendment/overlay/check commit + CURRENT-STATE 14/14); Task #1 (post-wave bundle/overlay review); verify vault `ha_enabled`/(v-a) (F4) + ceph-radosgw radosgw-service (F8). Sweep: `docs/audit/queued-findings-20260805-d121-ha-vault.txt`. Status ONLY in CURRENT-STATE.md.