diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index bc79fda..ff83c2b 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -20,6 +20,32 @@ ## 1. Where the project IS +> ## >>> STANDING OPERATOR DIRECTIVE, 2026-07-30: THE NEXT SESSION PROCEEDS TO THE JUJU DEPLOYMENT (STAGE 5). NO MATTER WHAT. <<< +> +> Verbatim: **"we have to continue to juju deployment next session no matter what"**. +> +> **Precondition work is DONE.** Stage-5 preconditions were hardened across 2026-07-27..30 +> (allocation blocker closed, per-DC Octavia PKI generated AND reissued, gate integrity fixed, +> P7 wired, identity centralised). Further hardening, auditing, or record repair is **OUT OF +> SCOPE** next session unless it directly blocks the deploy. +> +> **This is the GA-F06 circuit-breaker made explicit by the operator.** This project's measured +> failure mode is record-churn presenting as progress; the standing rule already says to STOP +> and escalate after one cycle of fixing records to match records. The directive removes the +> judgement call: open the stage and deploy. +> +> **Entry facts so the next session does not re-derive them:** +> - Run FROM `voffice1` (D-128 Plane-2 host). `juju` 3.6.27 is there; the jumphost has none. +> - `preflight.sh` currently exits **FAIL on P5 only** -- the credential register is red on +> PRE-EXISTING defects (SEC-021 declaration gaps, the SEC-020 identity conflation, three +> power-key asymmetries). **Decide accept-or-remediate AT the gate; do not re-audit it.** +> Every other gate is green, and **P7 reports `[ok]` for both DCs on the headend.** +> - The deploy input is the bundle + that DC's `-vips`, `-machines` and `-octavia-pki` overlays. +> - **G17 arms at first boot** -- it is a Stage-5 artefact, not a precondition. Capture it when +> the nodes come up rather than treating it as a blocker beforehand. +> - Stage-5 runbook: `runbooks/dc-dc-phase4-juju-bundle-per-dc.md`; Step 4 delegates to +> `phase-01-bundle-deploy.md` verbatim. + - Project: Omega Cloud, VR1 DC-DC rehearsal -- a two-DC + Office1-headend virtual rehearsal on KVM (vcloud host), rehearsing the future bare-metal Roosevelt deployment (D-100, `docs/design-decisions.md:1946`). diff --git a/docs/archive/session-ledger-rotated-20260730.md b/docs/archive/session-ledger-rotated-20260730.md new file mode 100644 index 0000000..2a0d181 --- /dev/null +++ b/docs/archive/session-ledger-rotated-20260730.md @@ -0,0 +1,81 @@ +# Session-ledger summaries rotated 2026-07-30 (GA-R4 rule 3 / F1) + +Moved VERBATIM from `docs/session-ledger.md` at the 2026-07-30 (part 2) close, oldest +first, to restore the 300-line cap. Only the SUMMARIES moved; each still points at its +own full body. Rotated early and deliberately: the operator directed that the NEXT +session proceed to the juju deployment no matter what, so it should not inherit a +ledger already at the cap. + +--- + +## SESSION CLOSE 2026-07-27 -- STAGE-5 GROUNDING AUDIT (bounded, GA-R4) + +- Operator-directed reconciliation before Stage 5 opens; ran AUTONOMOUSLY while they were + away, read-only, rulings QUEUED not adopted. Branch `dc-dc-stage5-grounding-audit` off + `main` at `71519a2`; 4 commits `514f0aa..de11bf4` pushed. NO stage opened or closed. +- **VERDICT: Stage 5 would NOT run error-free today and would fail early.** SUBSTRATE is + excellent -- all THREE tofu roots ZERO DIFF (first time in one session), 18 nodes Ready + exact to D-121 C, MACs/power/statics/fabrics/interfaces all verified, both artifact + paths serving, gauntlet 81 GREEN. The gap is the layer between substrate and deploy. +- Blockers, each measured: **voffice1 -- the D-128 host Stage 5 RUNS FROM -- is 105 commits + behind on a retired branch**, both dc1 overlays ABSENT, bundle still VR0 4-node; NO + `openstack` client on either host (10 scripts need it); 10th controller VM UNAUTHORED + + no tag, and dc1 has exactly 9 nodes for a 9-machine bundle; `osd-devices=/dev/vdb` but + every node has only `vda`; per-role tags authored nowhere; ZERO IPv6 vs D-101's RULED + dual-stack; and phase-01, which Step 4 delegates to "verbatim", ABORTS on dc1. +- **Gates that should have caught these cannot fail:** repo-lint PASSES over ZERO files on + a one-char typo; `cluster_count` checked nowhere so decorative HA passes; preflight + ignores any sub-gate rc not in {1,2}; P3 verified ZERO of 33 channel pins (no `juju` on + PATH). Three Stage-5 gate commands cannot execute on juju 3.6.27; four of five owed + VERIFY-LIVE gates have no runbook step at all. +- Deliverables: `docs/audit/stage5-readiness-20260727.md` (READ FIRST), + `stage5-committee-raw-20260727.md` (7 lenses verbatim), **`queued-rulings-20260727.md` + -- 11 blocking + 4 standing questions, ONE exchange each, NONE adopted**, + `stage5-live-measurement-20260727.txt`, charter `stage5-grounding-audit-scope-*.md`. +- 21-item DOCFIX batch LOGGED NOT EXECUTED (interlocks with unanswered rulings); next-free + unchanged D 138 / DOCFIX 205 / BUNDLEFIX 053. ONE mechanical fix: G3's stale FREEZE + clause, which would have blocked the remediation batch itself. +- OWNED: ran the rack checkers locally and got a false FAIL (they pipe to the rack); read + `tail`'s exit code not the script's; waved P3's 33 warns through as expected when the + CAUSE was a missing binary; called the privileged creds sweep a newly-closed item when + 07-26 had already done it. All four corrected in place, not silently. +- **A SESSION-SCOPED PERMISSION BLOCK IS LIVE in the gitignored settings.local.json -- + REMOVE IT.** Its only durable record is scope-doc section 6. SEC 21 open, unchanged. +- Full body: `docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md`. + Status ONLY in CURRENT-STATE.md. + +## POST-CLOSE ADDENDUM 2026-07-27 -- 14 RULINGS + SKILL SWEEP (GA-R4; 07-25/07-26 precedent) + +- The STAGE-5 GROUNDING AUDIT close bookend above landed while the operator was away, by + design. They then returned and worked the queued rulings. This addendum records what + followed rather than re-opening that entry -- the same shape as the 2026-07-26 addendum. + +- Operator-directed full reconciliation before Stage 5; 7-lens read-only committee + live + measurement, run AUTONOMOUSLY while away. Branch `dc-dc-stage5-grounding-audit`, ~30 commits + `514f0aa..HEAD` pushed. **NO stage opened or closed.** +- **VERDICT: Stage 5 would NOT run error-free.** Substrate excellent (all THREE tofu roots ZERO + DIFF, 18 nodes exact to D-121 C, gauntlet 81 GREEN); the gap is between substrate and deploy. +- Blockers: voffice1 -- the D-128 host Stage 5 RUNS FROM -- is 105 commits stale on a branch + deleted upstream; no `openstack` client on EITHER host; the 10th controller VM is UNAUTHORED; + `osd-devices` points at a device no node has; per-role tags authored nowhere; ZERO IPv6 vs + D-101's ruling; and phase-01, which Step 4 delegates to "verbatim", ABORTS on dc1. +- **Gates that should have caught these CANNOT FAIL:** repo-lint PASSES over ZERO files on a + one-char typo; `cluster_count` checked nowhere; preflight fails open on rc not in {1,2}; P3 + verified ZERO of 33 channel pins. All ruled fixed (R15). +- **14 RULINGS, 2 WITHDRAWN, G18 OPENED** (blocking, deferred until the cloud is live). + Authority = each D-number's Status block; questions+utterances in + `docs/audit/queued-rulings-20260727.md`. Execution ALL logged-not-executed. +- Next-free UNCHANGED: D 138 / DOCFIX 205 / BUNDLEFIX 053. SEC rows unchanged at 21. +- **Two RULED-BUT-NEVER-BUILT decisions found** (D-134 bands, D-020 vault VIP), neither + detectable by any gate. **R8's evidence base collapsed on reading the cited bugs** -- the + charm's own default was the opposite of the repo's draft. +- OWNED: three of my own premises needed correcting by measurement (R2a, R9, R14); used a + 2-day dump instead of polling the apex; pushed one red-lint commit; hit the repo-lint L5 + heading trap twice. All corrected on-surface, none silently. +- Close sweep found **3 stale surfaces THIS AUDIT created** (readiness doc's 13 dead + NEEDS-RULING markers, "nothing is adopted" header, 6 blank utterance lines) -- all fixed. +- SKILL SWEEP done despite no stage close (operator-directed): 3 new invariants + 4 authoring + traps folded in; snapshot regenerated 1695 lines, ASCII/LF verified. +- **Session-scoped permission block REMOVED at close.** Full body: + `docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md`. Status ONLY in + CURRENT-STATE.md. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index b2e4a4f..367553c 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -47,9 +47,11 @@ exposure the copy CREATES, not the gap it closed. (SEC-024, 2026-07-26, was the previous addition.) The SEC register of record is `docs/security-ledger.md`; row-level dispositions live THERE only (GA-R4/F3) -- this block carries pointer + count, never rows. -- **Next-free numbers:** D = **138**, DOCFIX = **205** (204 assigned 2026-07-27 -- the stale - "NTP from edge" Stage-4 gate bullet, superseded by D-129(iv), repaired across four surfaces), - BUNDLEFIX = **053**. +- **Next-free numbers:** D = **138**, DOCFIX = **206**, BUNDLEFIX = **053**. RE-SEEDED from + `bash scripts/ledger-scan.sh` at the 2026-07-30 close: **DOCFIX-205 was assigned that day** + (the D-117 annotation batch -- four ratified decision texts annotated, D-117's own overstated + "FULLY EXECUTED" Status corrected, phase-6's selector-into-FQDN defect fixed). 204 remains + 2026-07-27's stale "NTP from edge" Stage-4 gate bullet. - **Gates:** G17 OPENED 2026-07-27 by operator ruling (node-side artifact reachability split out of Stage 4; the gate table in `docs/CURRENT-STATE.md` is the authority). - **Standing numbering rule:** never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN) @@ -153,79 +155,14 @@ been 321 lines against the 300-line cap once this session's bookend was appended. Sessions from the 2026-07-27 grounding audit onward remain live below. -## SESSION CLOSE 2026-07-27 -- STAGE-5 GROUNDING AUDIT (bounded, GA-R4) +## ROTATED 2026-07-30 (GA-R4 rule 3 / F1 -- oldest-first, cap restored at this close) -- Operator-directed reconciliation before Stage 5 opens; ran AUTONOMOUSLY while they were - away, read-only, rulings QUEUED not adopted. Branch `dc-dc-stage5-grounding-audit` off - `main` at `71519a2`; 4 commits `514f0aa..de11bf4` pushed. NO stage opened or closed. -- **VERDICT: Stage 5 would NOT run error-free today and would fail early.** SUBSTRATE is - excellent -- all THREE tofu roots ZERO DIFF (first time in one session), 18 nodes Ready - exact to D-121 C, MACs/power/statics/fabrics/interfaces all verified, both artifact - paths serving, gauntlet 81 GREEN. The gap is the layer between substrate and deploy. -- Blockers, each measured: **voffice1 -- the D-128 host Stage 5 RUNS FROM -- is 105 commits - behind on a retired branch**, both dc1 overlays ABSENT, bundle still VR0 4-node; NO - `openstack` client on either host (10 scripts need it); 10th controller VM UNAUTHORED + - no tag, and dc1 has exactly 9 nodes for a 9-machine bundle; `osd-devices=/dev/vdb` but - every node has only `vda`; per-role tags authored nowhere; ZERO IPv6 vs D-101's RULED - dual-stack; and phase-01, which Step 4 delegates to "verbatim", ABORTS on dc1. -- **Gates that should have caught these cannot fail:** repo-lint PASSES over ZERO files on - a one-char typo; `cluster_count` checked nowhere so decorative HA passes; preflight - ignores any sub-gate rc not in {1,2}; P3 verified ZERO of 33 channel pins (no `juju` on - PATH). Three Stage-5 gate commands cannot execute on juju 3.6.27; four of five owed - VERIFY-LIVE gates have no runbook step at all. -- Deliverables: `docs/audit/stage5-readiness-20260727.md` (READ FIRST), - `stage5-committee-raw-20260727.md` (7 lenses verbatim), **`queued-rulings-20260727.md` - -- 11 blocking + 4 standing questions, ONE exchange each, NONE adopted**, - `stage5-live-measurement-20260727.txt`, charter `stage5-grounding-audit-scope-*.md`. -- 21-item DOCFIX batch LOGGED NOT EXECUTED (interlocks with unanswered rulings); next-free - unchanged D 138 / DOCFIX 205 / BUNDLEFIX 053. ONE mechanical fix: G3's stale FREEZE - clause, which would have blocked the remediation batch itself. -- OWNED: ran the rack checkers locally and got a false FAIL (they pipe to the rack); read - `tail`'s exit code not the script's; waved P3's 33 warns through as expected when the - CAUSE was a missing binary; called the privileged creds sweep a newly-closed item when - 07-26 had already done it. All four corrected in place, not silently. -- **A SESSION-SCOPED PERMISSION BLOCK IS LIVE in the gitignored settings.local.json -- - REMOVE IT.** Its only durable record is scope-doc section 6. SEC 21 open, unchanged. -- Full body: `docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md`. - Status ONLY in CURRENT-STATE.md. - -## POST-CLOSE ADDENDUM 2026-07-27 -- 14 RULINGS + SKILL SWEEP (GA-R4; 07-25/07-26 precedent) - -- The STAGE-5 GROUNDING AUDIT close bookend above landed while the operator was away, by - design. They then returned and worked the queued rulings. This addendum records what - followed rather than re-opening that entry -- the same shape as the 2026-07-26 addendum. - -- Operator-directed full reconciliation before Stage 5; 7-lens read-only committee + live - measurement, run AUTONOMOUSLY while away. Branch `dc-dc-stage5-grounding-audit`, ~30 commits - `514f0aa..HEAD` pushed. **NO stage opened or closed.** -- **VERDICT: Stage 5 would NOT run error-free.** Substrate excellent (all THREE tofu roots ZERO - DIFF, 18 nodes exact to D-121 C, gauntlet 81 GREEN); the gap is between substrate and deploy. -- Blockers: voffice1 -- the D-128 host Stage 5 RUNS FROM -- is 105 commits stale on a branch - deleted upstream; no `openstack` client on EITHER host; the 10th controller VM is UNAUTHORED; - `osd-devices` points at a device no node has; per-role tags authored nowhere; ZERO IPv6 vs - D-101's ruling; and phase-01, which Step 4 delegates to "verbatim", ABORTS on dc1. -- **Gates that should have caught these CANNOT FAIL:** repo-lint PASSES over ZERO files on a - one-char typo; `cluster_count` checked nowhere; preflight fails open on rc not in {1,2}; P3 - verified ZERO of 33 channel pins. All ruled fixed (R15). -- **14 RULINGS, 2 WITHDRAWN, G18 OPENED** (blocking, deferred until the cloud is live). - Authority = each D-number's Status block; questions+utterances in - `docs/audit/queued-rulings-20260727.md`. Execution ALL logged-not-executed. -- Next-free UNCHANGED: D 138 / DOCFIX 205 / BUNDLEFIX 053. SEC rows unchanged at 21. -- **Two RULED-BUT-NEVER-BUILT decisions found** (D-134 bands, D-020 vault VIP), neither - detectable by any gate. **R8's evidence base collapsed on reading the cited bugs** -- the - charm's own default was the opposite of the repo's draft. -- OWNED: three of my own premises needed correcting by measurement (R2a, R9, R14); used a - 2-day dump instead of polling the apex; pushed one red-lint commit; hit the repo-lint L5 - heading trap twice. All corrected on-surface, none silently. -- Close sweep found **3 stale surfaces THIS AUDIT created** (readiness doc's 13 dead - NEEDS-RULING markers, "nothing is adopted" header, 6 blank utterance lines) -- all fixed. -- SKILL SWEEP done despite no stage close (operator-directed): 3 new invariants + 4 authoring - traps folded in; snapshot regenerated 1695 lines, ASCII/LF verified. -- **Session-scoped permission block REMOVED at close.** Full body: - `docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md`. Status ONLY in - CURRENT-STATE.md. - - +The TWO oldest live summaries -- the 2026-07-27 STAGE-5 GROUNDING AUDIT close and its +14-RULINGS post-close addendum -- moved VERBATIM to +`docs/archive/session-ledger-rotated-20260730.md`. The live ledger stood at exactly 300 +lines, so the next append would have breached the cap. Rotated HERE rather than leaving it +owed, because the next session is directed straight at the juju deployment. +Sessions from the 2026-07-27 Phase-0 close onward remain live below. ## SESSION CLOSE 2026-07-27 -- Phase 0, R15 gates, D-136, step 3 executed (bounded, GA-R4) @@ -279,3 +216,20 @@ - OWNED: the operator's own working commands were NOT in the repo until the pre-bookend sweep asked; I waved through 664 CA certs as "harmless" (integrity, not secrecy); two silenced errors (`| grep -q` under pipefail, `git pull -q &&`); four consecutive cwd mistakes. All corrected on-surface. - **NEXT:** F8 residue (heredoc -> printf when a real generation can be run); D-137 fork-1 guard ruling (blocked correctly once, misfired 5x); preflight still has NO verified-green reading; G17 fixture-green only; the two `phase-04-network-*` scripts. - Sweep capture `docs/audit/queued-findings-20260730.txt` (F10-F13 + 2 ruling questions). Body: `docs/changelog-20260729-stage5-preconditions.md`. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-30 (part 2) -- F9 CLOSED live, the reissue tool, P7, lib-identity (bounded, GA-R4) + +- Branch `dc-dc-stage5-preconditions`, **19 commits** pushed (`1ddb078..`). NO stage opened/closed. Scan unchanged: 3 decisions, SEC 21, D 138 / **DOCFIX 206** / BUNDLEFIX 053. +- **>>> OPERATOR DIRECTIVE, STANDING: THE NEXT SESSION PROCEEDS TO THE JUJU DEPLOYMENT (Stage 5), NO MATTER WHAT.** Verbatim: "we have to continue to juju deployment next session no matter what". Precondition polishing is DONE; further hardening is OUT OF SCOPE unless it blocks the deploy. This is the GA-F06 circuit-breaker made explicit -- do not spend the session on records. +- **DOCFIX-205:** Q1 WITHDRAWN -- D-117 ruled it 2026-07-13; it resurfaced only because D-117's annotation half was never executed (0 of 4) while its own Status claimed "FULLY EXECUTED". All four annotated; Status corrected. Q2 withdrawn too (D-137 fork 1 ruled 2026-07-25). **Third stale premise in one findings file.** +- **F9 CLOSED LIVE, both DCs** (gated per DC, never batched): controller certs reissued into their own zones -- `omega.dc0.vr1` / `omega.dc1.vr1`, fresh P-256 keys, CAs untouched. Capture `docs/audit/octavia-reissue-executed-20260730.txt`. +- **`octavia-pki.sh reissue` SHIPPED** (operator: "Full script minter now"): derived zone, printf config (F8 paid off), stage-assert-promote, single-value overlay surgery, backup-before-mint. +- **VALIDATION AGENTS EARNED THEIR COST.** Mutation testing deleted my three new assertions and the harness stayed GREEN every time. Six defects closed: **A15** (no keyUsage/EKU minted + passed everything), **A16** (`-days` defaults to **30** and verify had NO validity check), **A17** (overlay/workspace desync read PASS), the re-run guard REFUSING to fix broken certs, A8's vacuous negative, two overlay checks moved pre-mint. +- **F8 + F9 FIXED AT SOURCE in 1.0-GEN.c** -- the generation path would otherwise recreate both at the next DC standup. F10 handled: 13 mint-refs re-anchored single-pass by row id; S4 clean. +- **P7: the PKI is now an actual GATE** in `preflight.sh` -- headend-only, NOT EVALUATED elsewhere, rc3 mapped explicitly, and it requires the literal zone line because `verify` exits 0 on a wrong-zone cert while inert. +- **`scripts/lib-identity.sh`** -- CLOUD_NAME + CLOUD_DOMAIN in ONE file; a rebuild that renames the estate edits one file. T47 catches shell-vs-OpenTofu drift, proven able to fail. +- **Backup custody done + REGISTERED** (2 rows, manifests, `n-reissue-backup`); the secrets-storage PIN now covers this step's creds and certs. Hazard recorded: these archives carry CA issuance state -- never restore over a workspace that has issued since. +- **OWNED:** I withdrew two of my own recommendations after measuring (the vr0-dc0 retirement, and the D-137 escalation framing); pushed one red-lint commit via `;` instead of `&&`; two harness stub bugs. All corrected on-surface. +- Guard misfire tally now **SEVEN** -- it blocked a command that only TESTED it, then the heredoc documenting its own misfires. Hardening it needs no ruling (fork 1 is ruled). +- Gauntlet ALL GREEN (89) BOTH hosts; repo-lint 0 fail; octavia-pki 51/51; preflight 33/33; creds-matrix 65/65 + 5 pre-existing findings. **verify 37/0 and P7 [ok] on both DCs.** +- **NEXT (Stage 5 entry):** preflight is RED only on P5's pre-existing credential register -- decide accept-or-remediate at the gate, do not re-audit it. G17 arms at first boot. Bodies: `docs/changelog-20260730-docfix205-d117-annotation.md`, `-octavia-reissue-tool.md`. Status ONLY in CURRENT-STATE.md.