diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 6b418d9..d669de1 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -475,7 +475,7 @@ | G9 | DC0 outer apply (deploy step A) | [V] operator-gated, logged (`run-logged.sh`), after G1-G8; audit exit criteria met (charter Phase 6). SEC pre-apply dependency (S2): SEC-010's transit FORWARD-drop is applied+verified at deploy step B via `site-headend-install.sh --host-nodes --check` on vvr1-dc0 (gate G10) -- the ONLY SEC row gated on this apply (register of record: security-ledger). CANONICAL ENTRY DOC (probe hole H1): `runbooks/dc-dc-phase2-tofu-dc-substrate.md`, with `docs/dc0-deploy-readiness.md` section E as the step table | operator | CLOSED 2026-07-19: G8 same-session planes check passed (6x 0 leases, 0 attachments); saved plan == 6/0/6 applied in the logged dc0-deploy window; convergence re-plan = no differences; vvr1-dc0 running, prior guests untouched | | G10 | Deploy steps B-E in-sequence gates: SEC-010 `--host-nodes --check` on vvr1-dc0; depth-4 nested boot; D-125 foreign-MAC egress test; MAAS reachability + `TF_VAR_maas_api_key` before step D; netem placeholder step E | [V] exercised during the gated deploy | session (each mutation operator-approved) | Step B DONE 2026-07-20 (`--check` EXIT 0 incl. SEC-010, `docs/audit/stepB-check-20260720-final.txt`; interfaces enp1s0/enp2s0). Depth-4 nested boot DONE (10 domains running inside vvr1-dc0). D-125 egress isolation test PASS 2026-07-20 (`docs/audit/d125-egress-gate-20260720-matrix.txt`), and the edge itself now egresses 0% loss after the v4 addressing. Step D COMPLETE incl. commissioning: ALL 9 NODES READY 2026-07-21 (two stacked faults diagnosed + fixed -- `docs/audit/commissioning-diag-20260721.txt`; section 1). Step E (netem) DONE 2026-07-21: sudo fragment installed+verified, module local-mode amendment, targeted apply 1/0/0 exact (operator-ruled at the 1/1/0 STOP), placeholder profile live on virbr5, virbr7/virbr3 untouched (`docs/audit/stepE-netem-20260721.txt` + `outer-{plan,apply}-20260721-netem*.txt`). **G10 CLOSED 2026-07-21** | | G11 | Operator signs THIS document | [R] read top-to-bottom; discrepancies resolved in the document | operator | CLOSED: RE-SIGNED 2026-07-19 at audit exit, section 11 (replaces the 2026-07-18 signature) | -| G12 | `vr1-dc1` build | [R] operator rules dc1 transit/rack addressing; then vars + substrate authored | operator + session | OPEN -- [R] leg CLOSED 2026-07-21: addressing RATIFIED (D-124 amendment 2026-07-21, utterance quoted). [V] leg IN PROGRESS (branch `dc-dc-g12-dc1-substrate`): apex confirm-free DONE 2026-07-21 -- planes/uplink already assigned+consistent, transit 172.31.0.4/30 + rack 10.12.68.2 FREE (`docs/audit/dc1-apex-confirm-20260721.txt`); importer per-site dc1 support shipped (harness 117/117) with live dry-run preflight PASS (`docs/audit/dc1-rack-import-dryrun-20260721.txt`). PENDING: operator-gated apex `--commit` (transit /30 + rack IP -- the only owed apex write), then vars + substrate root + build | +| G12 | `vr1-dc1` build | [R] operator rules dc1 transit/rack addressing; then vars + substrate authored | operator + session | OPEN -- [R] leg CLOSED 2026-07-21: addressing RATIFIED (D-124 amendment 2026-07-21, utterance quoted). [V] leg IN PROGRESS (branch `dc-dc-g12-dc1-substrate`): apex confirm-free DONE 2026-07-21 -- planes/uplink already assigned+consistent, transit 172.31.0.4/30 + rack 10.12.68.2 FREE (`docs/audit/dc1-apex-confirm-20260721.txt`); importer per-site dc1 support shipped (harness 117/117) with live dry-run preflight PASS (`docs/audit/dc1-rack-import-dryrun-20260721.txt`). vars + substrate root + lib-net dc1 arm AUTHORED 2026-07-21 but IN TREE UNCOMMITTED (session disconnected mid-item; drop-state record: changelog-20260721-g12-dc1-authoring.md item 3): dc-selector 40/40 but gauntlet **6/76 FAILED** -- six harnesses still assert the retired vr1-dc1 fail-loud selector arm (`docs/audit/gauntlet-20260722-g12-dropstate.txt`). Owed: harness reconcile -> gauntlet ALL GREEN -> commit+push. PENDING after that: operator-gated apex `--commit` (transit /30 + rack IP -- the only owed apex write), then tfvars + gated build | | G13 | D-129 residuals | [R] operator-gated live plugin install on office1-opnsense; qga channel retrofit at that edge's next scheduled restart. All 4 sub-decisions RULED 2026-07-21 (D-129 Status line) -- only the two execution items remain | operator | OPEN (execution only; decision content complete) | | G14 | 9 OPEN SEC rows (SEC-001, -003..-008, plus SEC-012 + SEC-013 opened 2026-07-20 for credentials this deploy created; SEC-010 CLOSED 2026-07-20, operator-ruled, applied+verified both transit ends) | [R] per-row: rotations/flips at v1 close (external to VR1 track); SEC-012 also carries a SCOPE question (libvirt-group grant is broader than the power verbs MAAS needs), SEC-013 is tied to whether `opentofu/vr1-dc0-maas` is retired | operator / external | `docs/security-ledger.md` (register of record, GA-R4/F3); count re-verified vs `bash scripts/ledger-scan.sh` 2026-07-20 | | G15 | D-068 / D-071 rulings | [R] operator rules (section 8); neither blocks the VR1 substrate | operator | D-071 ADOPTED 2026-07-21 (all four points); D-068 remains PROPOSED/OPEN (items 2-3 + the item-1 re-scoped migration plan) | diff --git a/docs/audit/gauntlet-20260722-g12-dropstate.txt b/docs/audit/gauntlet-20260722-g12-dropstate.txt new file mode 100644 index 0000000..333e399 --- /dev/null +++ b/docs/audit/gauntlet-20260722-g12-dropstate.txt @@ -0,0 +1,92 @@ + carve-host-interfaces SOME FAILED + MISS expected /no assigned network literals yet/ + checks ALL PASS (62 checks) + claude-guard ALL PASS + clientdocs-scripts ALL PASS + clientdocs-skill ALL PASS + cloud-assert ALL PASS + cloudinit-vm cloudinit-vm: 6 passed, 0 failed + cloud-snapshot ALL PASS + creds-audit creds-audit: 7/7 PASS + d063-apply ALL PASS (7/7) + d115-office-carve d115-office-carve: 20/20 PASS + d120-compose-bands d120-compose-bands: 16/16 PASS + d124-transit-seed d124-transit-seed: 21/21 PASS + dc-dc-ceph-disk-budget ALL PASS + dc-dc-dr-drill RESULT: PASS=21 FAIL=2 + FAIL T21 + FAIL T22 failback --apply is BLOCKED by the dc2 gate (rc 3) (rc=2 want=3) + FAIL: juju required on PATH for --apply + dc-dc-mtu-geneve-budget ALL PASS + dc-dc-prefixes-import ALL PASS (91 checks) + dc-dc-radosgw-multisite RESULT: PASS=17 FAIL=2 + FAIL T16 + FAIL T17 dc2 --apply is BLOCKED by the gate (rc 3) (rc=2 want=3) + FAIL: juju required on PATH for --apply + dc-dc-rbd-mirror RESULT: PASS=17 FAIL=2 + FAIL T17 + FAIL T18 dc2 --apply is BLOCKED by the gate (rc 3) (rc=2 want=3) + FAIL: juju required on PATH for --apply + dc-dc-whole-host-budget dc-dc-whole-host-budget: 13/13 PASS + dc-edge-wan-import dc-edge-wan-import: 58/58 PASS + dc-rack-mgmt-import dc-rack-mgmt-import: 117/117 PASS + dc-rack-net dc-rack-net: 14 passed, 0 failed + dc-selector ALL PASS (40 checks) + juju-spaces-check ALL PASS (5/5) + keystone-policy-drift ALL PASS + ledger-scan ALL PASS (46 checks) + lib-validate ALL PASS (35 checks) + maas-node-power maas-node-power: 24/24 PASS + netem-link netem-link: 12 passed, 0 failed + netem-sudoers netem-sudoers: 9 passed, 0 failed + node-vm node-vm: 15 passed, 0 failed + opentofu-validate ALL PASS + opnsense-api ALL PASS + opnsense-bootstrap-apikey ALL PASS + opnsense-plugins opnsense-plugins: 20 passed, 0 failed + opnsense-prep-image ALL PASS + opnsense-set-interface-v4 opnsense-set-interface-v4: 53/53 PASS + opnsense-set-interface-v6 opnsense-set-interface-v6: 40/40 PASS + phase-00-maas-standup SOME FAILED + [XX] DC=vr1-dc1: net selector fails loud (NetBox gap) exit 0 (want 1) + MISS expected /no assigned network literals yet/ + LEAK forbidden /DO:|WOULD:/ + phase-00-teardown-d061 ALL PASS + phase-02 ALL PASS + phase-03-adminrc ALL PASS + phase-03 ALL PASS + phase-04-create ALL PASS + phase-04-internal-cert-san ALL PASS + phase-04 ALL PASS + phase-05-amphora ALL PASS + phase-05 ALL PASS + phase-06-bootstrap ALL PASS + phase-06-capi-stack ALL PASS + phase-06-k8s-bootstrap ALL PASS + phase-06-kubeconfig-gate ALL PASS + phase-06-mgmt-vm ALL PASS + phase-06-net-setup ALL PASS + phase-07-conductor-graft ALL PASS + preflight ALL PASS + prereqs prereqs: 32/32 PASS + provider-bundle-check ALL PASS + record-audit record-audit: 35/35 PASS + reenroll-hosts SOME FAILED + MISS expected /no assigned network literals yet/ + repo-lint ALL PASS + roles-aggregates-import roles-aggregates-import: 24/24 PASS + sandbox-fidelity-check sandbox-fidelity-check: 14/14 PASS + sandbox-seed sandbox-seed: 22/22 PASS + site-baseleg site-baseleg: 24 passed, 0 failed + site-forward site-forward: 38/38 PASS + site-headend-install site-headend-install: 54/54 PASS + site-ssh-config site-ssh-config: 30/30 PASS + tenant-acceptance ALL PASS + tenant-assert ALL PASS + tenant-offboard ALL PASS (22/22) + tenant-onboard ALL PASS + trust_filter ALL PASS + validate ALL PASS (29 checks) + vault-kv-health ALL PASS (10/10) + +GAUNTLET: 6/76 FAILED -- carve-host-interfaces dc-dc-dr-drill dc-dc-radosgw-multisite dc-dc-rbd-mirror phase-00-maas-standup reenroll-hosts diff --git a/docs/changelog-20260721-g12-dc1-authoring.md b/docs/changelog-20260721-g12-dc1-authoring.md index 1563673..b6237be 100644 --- a/docs/changelog-20260721-g12-dc1-authoring.md +++ b/docs/changelog-20260721-g12-dc1-authoring.md @@ -62,3 +62,44 @@ Revert: `git checkout main -- netbox/dc-rack-mgmt-import.py tests/dc-rack-mgmt-import/` (restores the dc0-only tool); delete the two capture files. No apex state touched (dry-run only). + +## Item 3 -- IN FLIGHT AT DISCONNECT (drop-state record, landed 2026-07-22 by the successor session; NOT a delivery) + +The session DISCONNECTED mid-item, before its bookend. This item records what +exists so the next session resumes without re-derivation; nothing here claims +delivery. Authored and sitting UNCOMMITTED in the tree at the drop: + +- `opentofu/variables.tf`: `vr1_dc1_planes` (apex-verified D-124-amendment + /22s), `vvr1_dc1_{vcpu,memory_mib,disk_bytes}` sizing, `vr1_dc1_ssh_pubkey_path`, + and the deliberately NO-DEFAULT rack/transit vars (tfvars-only after the + gated apex `--commit` -- hard rule 2). +- `opentofu/main.tf`: `module "vr1_dc1_uplink"` (172.30.3.0/24) + + `module "vvr1_dc1"` containment VM (dc0 pattern of record, dedicated dc1 key). +- `opentofu/vr1-dc1-substrate/` (NEW): full inner root mirroring dc0's + (same file set + variable shape); all 54 node MACs PRE-PINNED from first + apply, scheme `52:54:01:d1:NN:PP` (locally-administered, outside libvirt's + 52:54:00 auto space). +- `scripts/lib-net.sh`: vr1-dc1 arm (literals land; unruled OpenStack-layer + values UNSET) + a one-selection-per-shell guard. +- `tests/dc-selector/run-tests.sh`: reconciled, 40/40 PASS. + +DROP POINT: after the dc-selector harness went green, BEFORE the full +gauntlet. Successor-run gauntlet = **6/76 FAILED** (capture +`docs/audit/gauntlet-20260722-g12-dropstate.txt`): carve-host-interfaces, +dc-dc-dr-drill, dc-dc-radosgw-multisite, dc-dc-rbd-mirror, +phase-00-maas-standup, reenroll-hosts -- all still assert the retired +"vr1-dc1 fails loud (NetBox gap)" selector behavior that the new dc1 arm +retires. Also sighted for the reconcile sweep: `tests/dc-dc-prefixes-import/ +test_logic.py` greps the old message (currently passing); dc-dc-rbd-mirror's +reminder text prints dc0's replication CIDR under `dc=vr1-dc1` (cross-DC +value surfacing). repo-lint 0-fail; `tofu fmt -check` clean on all touched tf. + +OWED to finish the item: reconcile the six harnesses (+ the two sighted +surfaces) -> gauntlet ALL GREEN -> delivery entry here -> commit + push. +THEN G12's next gated step is unchanged: operator-gated apex `--commit` +(transit /30 + rack IP), tfvars, build. + +Revert (drops the in-flight work, NOT items 1-2): `git checkout -- +opentofu/main.tf opentofu/variables.tf scripts/lib-net.sh +tests/dc-selector/run-tests.sh && rm -rf opentofu/vr1-dc1-substrate/`; +delete the gauntlet capture file. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 6aad762..66eaae4 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -220,3 +220,19 @@ (pinned), G12 [V], G13 execution, 10 SEC rows, LP filing (operator). - Details: docs/archive/changelogs/changelog-20260721-tenant-review-pin.md. Status lives ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-21 -- G12 dc1-authoring session (fifth same-day; bounded, GA-R4) + +- Session DISCONNECTED before its bookend; entry landed by the successor session 2026-07-22 + after read-only re-verification (tree, branch, harnesses). No cloud state was touched. +- Delivered pre-drop (commit cbc1104 on branch dc-dc-g12-dc1-substrate -- branch UNPUSHED at + the drop): dc1 apex confirm-free capture (transit /30 + rack 10.12.68.2 FREE, planes already + consistent) + dc-rack-mgmt-import per-site --site support (117/117; live dry-run PASS). +- INTERRUPTED mid-item-3, authored UNCOMMITTED in tree: vr1_dc1 vars + vvr1-dc1 module + + vr1-dc1-uplink, inner root opentofu/vr1-dc1-substrate/ (54 MACs pre-pinned 52:54:01:d1), + lib-net.sh dc1 arm + selection guard, dc-selector 40/40. Drop point: BEFORE the gauntlet -- + successor run = 6/76 FAILED, six harnesses still assert the retired vr1-dc1 fail-loud arm + (docs/audit/gauntlet-20260722-g12-dropstate.txt). Owed: reconcile -> ALL GREEN -> delivery + entry -> commit+push; THEN the operator-gated apex --commit stays G12's next gated step. +- Details: docs/changelog-20260721-g12-dc1-authoring.md (item 3 = drop-state record). Status + lives ONLY in CURRENT-STATE.md.