diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 526dd32..6455735 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -474,7 +474,7 @@ | G10 | Deploy steps B-E in-sequence gates: SEC-010 `--host-nodes --check` on vvr1-dc0; depth-4 nested boot; D-125 foreign-MAC egress test; MAAS reachability + `TF_VAR_maas_api_key` before step D; netem placeholder step E | [V] exercised during the gated deploy | session (each mutation operator-approved) | Step B DONE 2026-07-20 (`--check` EXIT 0 incl. SEC-010, `docs/audit/stepB-check-20260720-final.txt`; interfaces enp1s0/enp2s0). Depth-4 nested boot DONE (10 domains running inside vvr1-dc0). D-125 egress isolation test PASS 2026-07-20 (`docs/audit/d125-egress-gate-20260720-matrix.txt`), and the edge itself now egresses 0% loss after the v4 addressing. Step D COMPLETE incl. commissioning: ALL 9 NODES READY 2026-07-21 (two stacked faults diagnosed + fixed -- `docs/audit/commissioning-diag-20260721.txt`; section 1). Step E (netem) DONE 2026-07-21: sudo fragment installed+verified, module local-mode amendment, targeted apply 1/0/0 exact (operator-ruled at the 1/1/0 STOP), placeholder profile live on virbr5, virbr7/virbr3 untouched (`docs/audit/stepE-netem-20260721.txt` + `outer-{plan,apply}-20260721-netem*.txt`). **G10 CLOSED 2026-07-21** | | G11 | Operator signs THIS document | [R] read top-to-bottom; discrepancies resolved in the document | operator | CLOSED: RE-SIGNED 2026-07-19 at audit exit, section 11 (replaces the 2026-07-18 signature) | | G12 | `vr1-dc1` build | [R] operator rules dc1 transit/rack addressing; then vars + substrate authored | operator | HELD (`docs/dc0-deploy-readiness.md:100-103`) | -| G13 | D-129 residuals | [R] operator-gated live plugin install on the edge; qga channel retrofit at next scheduled edge restart; 4 sub-decisions (section 8) | operator | OPEN / PARTIALLY RULED (`docs/design-decisions.md:4017`) | +| G13 | D-129 residuals | [R] operator-gated live plugin install on office1-opnsense; qga channel retrofit at that edge's next scheduled restart. All 4 sub-decisions RULED 2026-07-21 (D-129 Status line) -- only the two execution items remain | operator | OPEN (execution only; decision content complete) | | G14 | 9 OPEN SEC rows (SEC-001, -003..-008, plus SEC-012 + SEC-013 opened 2026-07-20 for credentials this deploy created; SEC-010 CLOSED 2026-07-20, operator-ruled, applied+verified both transit ends) | [R] per-row: rotations/flips at v1 close (external to VR1 track); SEC-012 also carries a SCOPE question (libvirt-group grant is broader than the power verbs MAAS needs), SEC-013 is tied to whether `opentofu/vr1-dc0-maas` is retired | operator / external | `docs/security-ledger.md` (register of record, GA-R4/F3); count re-verified vs `bash scripts/ledger-scan.sh` 2026-07-20 | | G15 | D-068 / D-071 rulings | [R] operator rules (section 8); neither blocks the VR1 substrate | operator | PROPOSED/OPEN (status lines, section 8) | | G16 | office1 edge `channels = []` state reconcile (the D-129 module-schema residual) | [R] operator rules the mechanism; then [V] the converged re-plan capture | operator + session | CLOSED 2026-07-21: RULED "State surgery (Recommended)" (GA-R5, session changelog item 16); executed per G6 precedent -- channels null -> [] injected, serial 29 -> 30, backup kept, guests untouched (office1-opnsense Id 2 running throughout); convergence = ZERO DIFF (`docs/audit/outer-plan-20260721-postG16-converged.txt`); section 5 re-recorded | @@ -521,14 +521,15 @@ (monthly-review window trigger; patch-only controller jumps; order; acceptable single-controller risk) as amended by the confirmed backup posture (:1677). -5. D-129 -- one OPEN sub-decision (OPEN / PARTIALLY RULED; (i) RULED - 2026-07-21: COS scrapes the edge, in-scope per-DC; (ii) RULED - 2026-07-21: os-frr pinned to Roosevelt design time; (iii) RULED - 2026-07-21: per-site Tailscale = dedicated node on metal-admin, - edge excluded -- status line in design-decisions.md is the - authority): (iv) does the edge anchor site NTP? Plus the - operator-gated live install of the ruled VR1 profile - (`scripts/opnsense-plugins.sh apply vr1-edge`). +5. D-129 -- ALL FOUR sub-decisions RULED 2026-07-21 ((i) COS scrapes + the edge in-scope per-DC; (ii) os-frr pinned to Roosevelt design; + (iii) per-site Tailscale = dedicated node on metal-admin, edge + excluded; (iv) MAAS hierarchy stays the time authority -- status + line in design-decisions.md is the authority). No open question + remains; the operator-gated live install of the ruled VR1 profile + on office1-opnsense (`scripts/opnsense-plugins.sh apply vr1-edge`) + + the qga retrofit at that edge's next restart are EXECUTION items + tracked at gate G13. 6. Audit Phase 4 rulings: GA-R1..GA-R6 individually, plus the legal stage-status vocabulary A/B (GA-F10 operator note) -- each gated, one ruling per exchange. diff --git a/docs/changelog-20260721-tenant-review-pin.md b/docs/changelog-20260721-tenant-review-pin.md index bb9fa6e..9010cab 100644 --- a/docs/changelog-20260721-tenant-review-pin.md +++ b/docs/changelog-20260721-tenant-review-pin.md @@ -114,3 +114,16 @@ edge gets no metal-admin leg; D-131 sub-2 revisit clause dead. Per-site ACL/key-custody design + SEC row queued to implementation time. - **Revert:** git revert this commit (records only). + +## 9. D-129 sub-decision (iv) RULED: MAAS NTP hierarchy stays; D-129 decision content COMPLETE + +- Presented per GA-R5; operator selection, exact utterance: "Keep MAAS + hierarchy (Recommended)". No NTP role on the edge; vendor-default + nodes -> rack -> region -> upstream chain stays (measured working: + tonight's dhcpd capture + commissioning proof). All FOUR D-129 + sub-decisions are now ruled; Status flipped to RULED with the two + remaining EXECUTION items (office1 live install, qga retrofit) + re-pointed at gate G13. G13 row, CURRENT-STATE item 5, and the ledger + machine block updated same-commit; D-129 drops off ledger-scan's + open-decisions list by design. +- **Revert:** git revert this commit (records only). diff --git a/docs/design-decisions.md b/docs/design-decisions.md index 333b560..e3f559d 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -4064,8 +4064,16 @@ ## D-129: OPNsense edge plugin / add-on base profile (VR1 -> Roosevelt) [OPS] -**Status:** OPEN (PARTIALLY RULED 2026-07-18; sub-decision (i) RULED 2026-07-21) -- profile -adopted, ONE sub-decision still OPEN ((iv)). Sub-decision (iii) RULED 2026-07-21 (GA-R5, one +**Status:** RULED -- all four sub-decisions ruled as of 2026-07-21 (profile adopted +2026-07-18). REMAINING EXECUTION, tracked at gate G13 (not a decision): operator-gated live +install of the VR1 profile on office1-opnsense + qga channel retrofit at that edge's next +scheduled restart. Sub-decision (iv) RULED 2026-07-21 (GA-R5): question as presented = "does +the OPNsense edge anchor site NTP, or does the MAAS NTP hierarchy remain the time authority?"; +operator selection, exact utterance: "Keep MAAS hierarchy (Recommended)". No NTP role on the +edge; the vendor-default MAAS chain (nodes -> rack -> region -> upstream) stays the time +authority -- measured working (rendered dhcpd option ntp-servers = the rack, +docs/audit/d131-sub3-dhcpd-option6-20260721.txt; commissioning proved node sync). A dedicated +Roosevelt site time source, if ever wanted, rules with D-132's utility-node design. Sub-decision (iii) RULED 2026-07-21 (GA-R5, one clarifying round): first presentation drew an operator clarification, quoted verbatim as it is itself standing architectural context: "Roosevelt deisgn, and this deployment, will have a site tailscale installation to access the metal-admin plane at each location. Does that change your @@ -4098,7 +4106,8 @@ directive does not rule these -- they were flagged as decisions, not adds): (i) COS-scrapes-the-edge scope (RULED 2026-07-21, see Status), (ii) `os-frr` dynamic routing (RULED 2026-07-21: pinned to Roosevelt design, see Status), (iii) `os-tailscale` subnet-router consolidation (RULED -2026-07-21: dedicated node per site, edge excluded -- see Status), (iv) edge-as-site-NTP. +2026-07-21: dedicated node per site, edge excluded -- see Status), (iv) edge-as-site-NTP +(RULED 2026-07-21: MAAS hierarchy stays the time authority, no edge NTP role -- see Status). **Pinned at deployment steps (the "engineering for the rest").** - **VR1 edge base profile = {`os-qemu-guest-agent`, `os-iperf`}** -> applied at DC-edge bring-up. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 530e714..295c6a5 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -33,10 +33,10 @@ _Re-seeded from the 2026-07-21 evening scan (post-stage-3-close). Re-run `bash scripts/ledger-scan.sh` to refresh._ - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt), D-071 (routine - update cadence + Juju controller patch policy), D-129 (OPNsense edge plugin/add-on base - profile -- OPEN / partially ruled, one sub-decision ((iv) edge-as-site-NTP); (i) COS-scrapes-edge - in-scope per-DC, (ii) os-frr pinned to Roosevelt design, (iii) per-site Tailscale = dedicated - node not edge, all ruled 2026-07-21), D-131 (node-facing DNS strategy for + update cadence + Juju controller patch policy), D-129 (RESOLVED as a decision 2026-07-21: all four subs ruled -- (i) COS scrapes edge per-DC, + (ii) os-frr to Roosevelt design, (iii) per-site Tailscale = dedicated node not edge, (iv) MAAS + NTP hierarchy stays; office1 live install + qga retrofit remain as G13 execution items; entry + drops off the scan's open list), D-131 (node-facing DNS strategy for rack-only controllers -- PARTIALLY RULED: sub-1 ruled + delivered 2026-07-21, sub-2 ruled 2026-07-21 (metal-admin only), sub-3 resolved 2026-07-21 (no defect), sub-4 open + pinned DNS architectural review;