diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index e114c01..f8a86b6 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -29,11 +29,17 @@ > `10.13.0.0/16` -- never editing live infra.** Tailscale workstream STOPPED (do NOT approve > `10.12.8.0/22`); **dc1 HELD entirely** (0 machines in vr1-dc1-region, all nodes powered off). > -> **NOT YET RULED -- owed (GA-R5) BEFORE any dependent re-carve.** The re-IP is a **D-115 SUPERSESSION** -> (D-115, adopted, REJECTED 10.13 and set the NetBox Cloud role to `10.12.0.0/16`) AND it TERMINATES -> D-101's "vr1 inherits vr0-dc0 unchanged" (`lib-net.sh` ~124-134). The ruling must reconcile -> D-101/D-115/D-124/D-134 and confirm `10.13.0.0/16` is LIVE-free (existing cloud + tailnet). Draft -> mapping (octet-preserving `10.12.a.b -> 10.13.a.b`): `docs/audit/netbox-1013-subnetting-draft-20260808.md`. +> **RULED 2026-08-09 (GA-R5) -> D-143 ADOPTED.** The re-IP is now ruled: adopt `10.13.0.0/16` +> (octet-preserving `10.12.a.b -> 10.13.a.b`), tailnet+apex evidence ACCEPTED as sufficient for +> owed check #3 (VR0 internals, tailnet-only/unreachable), apex fork **B2** (new NetBox role +> `Cloud -- VR1 rebuild` owns 10.13; `Cloud` stays 10.12-only, no live record re-labelled), +> `lib-net.sh` shape **(i)** (flat defaults stay 10.12 = vr0-dc0 live; VR1 arms get full 10.13 +> blocks). Reconciliation: **AMENDS D-115** (factual premise; role-based ruling holds), +> **TERMINATES D-101**'s v4-inherit clause, **CONSISTENT-WITH D-124/D-134**. Live checks 2026-08-09: +> apex 10.13=0/10.12=149; tailnet no 10.13 overlap (10.12 collision reproduced as control). +> Ruling: `docs/design-decisions.md` D-143. Execution (NOT done -- hard rule 1): B2 apex re-carve, +> lib-net.sh (i) + F13 comment fix, R16 naming DOCFIX, D-124 route re-point, R7 teardown revocation. +> Draft mapping (octet-preserving `10.12.a.b -> 10.13.a.b`): `docs/audit/netbox-1013-subnetting-draft-20260808.md`. > Sweep: `docs/audit/queued-findings-20260808-dc0-tailscale-incident-reip-pivot.txt`. > Ruling-prep package (drafted GA-R5 question + D-101/115/124/134 reconciliation + measured blast > radius + the 3 OWED live-free checks): `docs/audit/reip-1013-ga-r5-ruling-prep-20260808.md` (2026-08-08). diff --git a/docs/design-decisions.md b/docs/design-decisions.md index 1a03a0c..8346acd 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -8077,3 +8077,99 @@ and **D-011.6** are the invariants preserved. Roosevelt analog: the per-DC Vault standup gets a tested, low-friction, guard-safe init procedure rather than a head-substituted VR0 runbook. + +--- + +## D-143: ADOPTED -- VR1 re-IP `10.12.0.0/16` -> `10.13.0.0/16` (AMENDS D-115 premise; TERMINATES D-101 v4-inherit clause) [ARCH] + +**Status: RULED 2026-08-09 (GA-R5).** The VR1 build's `10.12.0.0/16` collides with the +still-online live IPv4 cloud (`vr0-dc0`, `vopenstack`), surfaced 2026-08-08 at the Headscale +route step. dc0 finishes as a checkpoint, then the DC substrate is torn down and REDEPLOYED +on `10.13.0.0/16` -- never editing live infra. Ruling-prep package (blast radius, decision +reconciliation, owed checks): `docs/audit/reip-1013-ga-r5-ruling-prep-20260808.md`. Next-free +verified at ruling time (`ledger-scan`: highest-header D-142, D-143 free). + +**Ruled in TWO operator exchanges (GA-R5; option selections are the exact utterances):** + +- **Exchange 1 (direction + check-#3 acceptance + octet-preserving mapping).** Question as + presented: "The re-IP ruling (VR1 10.12.0.0/16 -> 10.13.0.0/16, would be D-143): 2 of 3 + owed live-free checks now PASS with fresh measurement; check #3 (VR0 internals) is a + separate tailnet-only trust domain unreachable from the jumphost. How do you want to + proceed?" -- the question text specified "adopt 10.13.0.0/16 ... octet-preserving + 10.12.a.b -> 10.13.a.b". **Operator selection, exact utterance: "Accept evidence + adopt + 10.13".** CONSEQUENCE: the tailnet + apex measurements are ACCEPTED as sufficient for owed + check #3 (the VR0-internal MAAS/neutron sweep is NOT required before the re-carve); the + re-IP is ADOPTED; the mapping is the octet-preserving `10.12.a.b -> 10.13.a.b` shift (C.2). + +- **Exchange 2 (the two structural sub-forks; C.1 governs C.3).** + - **C.1 apex fork.** Question: "the live cloud stays on 10.12 untouched. Where does the + newly-allocated 10.13.0.0/16 land in the NetBox IPAM role model?" **Operator selection, + exact utterance: "B2: new 'Cloud -- VR1 rebuild' role".** CONSEQUENCE: 10.13.0.0/16 gets + its OWN VR1-scoped NetBox role; the `Cloud` role STAYS 10.12-only (the VR0/live record is + NOT re-labelled -- B3 was rejected for exactly that reason). No live object is edited. + - **C.3 lib-net.sh structure.** Question: "scripts/lib-net.sh's flat defaults ARE + vr0-dc0's live as-built values (line 37), and the vr0-dc0 arm is a no-op over them. After + the re-IP, which shape?" **Operator selection, exact utterance: "(i) Keep flat defaults + at 10.12; VR1 arms get full 10.13 blocks".** CONSEQUENCE: `lib-net.sh`'s flat defaults + STAY at 10.12 (= the live cloud's measured values, preserving the line-37 invariant and + the honest vr0-dc0 no-op); the `vr1-dc0` and `vr1-dc1` arms each gain a COMPLETE explicit + 10.13 literal block. + +**Decision reconciliation (verbs, from the ruling-prep Section A -- each governing block read +in full):** +- **D-101 -- TERMINATES one clause.** D-101's "VR1 DC0 INHERITS the DC0 six-plane v4 layout + ... unchanged" (`:2304`) is TERMINATED: `vr1-dc0` no longer inherits `vr0-dc0`'s v4 layout, + it takes a distinct non-overlapping one. The IPv6 family matrix, the "IPv6 wherever + possible" principle (`:2282`) and the dual-stack ruling are UNTOUCHED -- this is a v4-only + re-IP. The inheritance rationale D-101 gave (minimize delta to Roosevelt / reuse the + validated bundle) is the cost the re-IP knowingly trades for collision-freedom. +- **D-115 -- AMENDS a factual premise (its ruling holds).** D-115's v4-role-based ruling + (v4 role-based; /22 per office; DC2 inside the Cloud /16) is NOT reversed. What is + superseded is its FINDING that "10.13.x is unallocated / outside every allocated block" + (`:3766-3767`, `:3856-3858`) -- post-pivot, 10.13.0.0/16 is DELIBERATELY allocated under + the existing `10.0.0.0/8` Corp Private parent. Verb: AMENDS the factual premise; + CONSISTENT-WITH the role-based ruling. +- **D-124 -- CONSISTENT-WITH (routes re-point).** The `172.31.0.0/24` transit supernet is NOT + in 10.12 and does not move. The rack metal-admin statics shift by the 12->13 rule + (`10.12.8.2 -> 10.13.8.2`, `10.12.68.2 -> 10.13.68.2`) and the transit-`/30` routes to DC + destinations re-point 10.12.* -> 10.13.*. +- **D-134 -- CONSISTENT-WITH (survives; endorses the map).** The per-plane octet bands and the + standing cross-DC octet map (`.4` artifact / `.5` juju / `.6` MAAS region / `.7` tailscale) + are offset-relative to the plane /22, not tied to the second octet, so `10.12.8.5 -> + 10.13.8.5` preserves "juju = .5" exactly. D-134's standing-cross-DC-standard clause + (`:5965-5968`) actively ARGUES FOR the 1:1 octet-preserving shift. + +**LIVE evidence at ruling time (measured 2026-08-09, operator-authorized read-only +discovery; captures + method in `docs/audit/open-items-review-20260809.md` Appendix and its +sweep `docs/audit/queued-findings-20260809-open-items-review.txt` FS1):** +- Check #2 (live NetBox apex, `office1-record-dump.py`): **10.13.0.0/16 = 0 objects; 10.12 = + 149 (positive control).** Nests cleanly under the existing `10.0.0.0/8` aggregate. +- Check #1 (Headscale/tailnet, `tailscale status --json` from `office1-tailscale`): **no + approved subnet route overlaps 10.13.0.0/16**; the positive control reproduced the exact + 10.12 collision (`vopenstack-jesse-tailscale` advertising `10.12.4.0/22` + `10.12.8.0/22`). + 10.13 is also clear of Roosevelt (`10.17.x`), willamette (`10.1`/`10.16`) and Office1 + (`10.10`) on the shared tailnet. +- Check #3 (live VR0 internals): NOT run -- VR0 is a tailnet-only separate trust domain + unreachable from the authorized vantage; the tailnet+apex evidence was ACCEPTED as + sufficient (Exchange 1). Blind spot recorded: the tailnet view is approved-routes + (AllowedIPs); an advertised-but-pending view would need the Headscale server itself. + +**OWED EXECUTION (hard rule 1 -- this ruling DECIDES; it does NOT re-carve here). The re-IP +work is subsequent gated steps, sequenced by the checkpoint plan:** +1. NetBox apex: create the B2 role `Cloud -- VR1 rebuild` owning `10.13.0.0/16`; re-carve the + VR1 prefixes/VIPs/ranges under it by the octet-preserving map. `Cloud` (10.12) untouched. +2. `scripts/lib-net.sh`: keep flat defaults at 10.12; give `vr1-dc0`/`vr1-dc1` full 10.13 + literal blocks; UPDATE the now-false `:124-134` "inherits VR0 unchanged" comment (F13). +3. `10.13` naming-collision DOCFIX (review R16): reconcile `netbox/README.md:49` + (`VR1_DC1_V4_SUPERNET=10.13.0.0/19`, pre-D-115) and the `10.13.0.5` test literal at + `tests/dc-rack-mgmt-import/test_logic.py:265` so the /16 adoption does not put a rack-IP + fixture inside the new Cloud space. +4. D-124 transit routes re-point + rack statics shift (12->13). +5. Teardown must REVOKE the dc0-substrate credentials before redeploy (review R7). + +**A1 TEST (GA-R3):** admitted as a D-number -- a future/Roosevelt build session greps this +before laying out addressing, it supersedes a prior ruling's premise (D-115) and terminates a +clause of another (D-101), and it decides the apex role model + the `lib-net.sh` shape that +every downstream consumer reads. Roosevelt relevance: the octet-preserving-shift discipline +and the "never re-label a live record; give the new build its own role" pattern (B2) transfer +directly to any future re-IP or parallel-build.