diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 6fb914b..010c6b8 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2246,6 +2246,31 @@ wedged on the 08-03 apt-cacher-ng hang class; remediated (proxy restart + remove/re-add as mysql/3). Full record: `docs/audit/stage5-dc0-redeploy-asexec-20260804.txt`, `docs/changelog-20260804-stage5-dc0-redeploy.md`. + **>>> 2026-08-05 (CONTINUED) -- VAULT INIT DONE + ovn-central RESOLVED end-to-end. Stage 5 + remains OPEN. <<<** After the D-052 re-home, ovn-central re-home was VALIDATED live (both + fixes: two-legged containers = controller-reachable, and the `/etc/hosts` postruncmd = CN + resolvable). Fresh read-only `phase-02-vault-preflight vr1-dc0` -> **PROCEED** (9 machines + started, mysql 3/3 active+ONLINE 1 R/W, vault fresh, census 66 units 0 workload-error 0 + agent-error). **The operator then ran phase-02-vault-bringup.md Steps 2.1-2.3 VERBATIM on + the dc0 rack** (D-138; model `-m vr1-dc0` head-substituted from VR0 `-m openstack` -- fold + F13 / D-142 R1; the agent does NOT run these -- guard-hook/secret custody): init (5 shares + + TOKEN_OK, `2>&1|tee`, off-host save by hand), unseal 3/3 (Sealed=false), authorize-charm + + generate-root-ca -> **vault/0 active/idle "Unit is ready"**. Root CA (PUBLIC, as-built + metadata only): "Vault Root Certificate Authority (charm-pki-local)", valid **2026-08-05 + 02:05:57 -> 2036-08-02 01:06:27 UTC**. **>>> ovn-central/3,4,5 ALL active/idle "Unit is + ready" (/4 leader ovnnb_db+ovnsb_db, /5 northd active) -- the OVN NB/SB cluster FORMED. <<<** + This is the redeploy's PURPOSE and it closes the multi-session ovn-central saga (CN-from- + reverse-DNS-on-isolated-plane, 08-04 root cause) via BOTH fixes landed this cycle: + dc-node-etchosts.sh Step 1.2b (CN delivery) + D-052 re-amendment `''`->metal-admin + (reachability). Census 40->47 active, 0 error. **QoL ENGINEERING SAVED (not executed): + D-142 PROPOSED** (vault-init workflow QoL sweep, APPROVED-IN-PRINCIPLE / IMPL-DEFERRED per + operator "complete a vault init using current commands ... test them on the next + opportunity"; R2 off-host transport UNRESOLVED) -> `docs/audit/vault-init-qol-proposal-20260805.md` + + fold-register F13. Security hygiene: the child token printed in the operator's paste + (init keys + root token redacted) was ttl=10m/unset/expired -> benign, not stored. + **REMAINING (separate, NOT vault/ovn):** ceph-mon/2 + ceph-radosgw/0 stuck `allocating` + (apt-wedge class) -> cascade to ceph-osd/glance/nova-compute; triage after the bookend. + Full record: `docs/audit/stage5-dc0-redeploy-asexec-20260804.txt`. **>>> SESSION CLOSE 2026-08-03 (GA-R4 bookend). Stage 5 remains OPEN; this is a session bookend, NOT a stage close. <<<** DEPLOY IS MID-STAGE-5: bundle deployed + mostly converged (9 machines started, mysql ONLINE, vault init+unseal+root-CA, ~25 units active, 0 error), diff --git a/docs/audit/stage5-dc0-redeploy-asexec-20260804.txt b/docs/audit/stage5-dc0-redeploy-asexec-20260804.txt index bae06e7..790ba66 100644 --- a/docs/audit/stage5-dc0-redeploy-asexec-20260804.txt +++ b/docs/audit/stage5-dc0-redeploy-asexec-20260804.txt @@ -209,6 +209,76 @@ changelog/appendix-A regardless of the binding ruling. Model state PRESERVED (converged-but-ovn-blocked) for whichever way the operator rules. -## NEXT (pending): converge to pre-vault-init -> verify /etc/hosts on an ovn-central unit +## D-052 RE-AMENDMENT APPLIED -- ovn-central re-homed to metal-admin [MUTATION, GA-R5 2026-08-05] +Operator ruling (exact utterance): "Once that is done then move on to the proposed move to metal-admin". +Repo half committed d6975fb (bundle '' -> metal-admin; D-052 re-amendment; reference doc). Live half: +[2026-08-05] vr1-dc0-rack :: + scp -p bundle.yaml -> rack ~/repo-stage (sha 213b51baea23a3f9 verified) + juju remove-application ovn-central --force --no-prompt -> rc=0 (3 stuck units removed; agents + never came up, so --force clean -- containers were single-legged on metal-internal, unremovable in place) + DRY-RUN re-deploy: plan = add ovn-central + 4 relations (certificates, ovsdb-cms, ovsdb x2) + 3 + units ONLY; no other app touched. Confirmed before applying. + juju deploy ./bundle.yaml --overlay {vips,machines,octavia-pki} -m vr1-dc0 -> "Deploy of bundle + completed" rc=0. ovn-central/3,4,5 on fresh 0/lxd/0, 1/lxd/0, 2/lxd/0 with '' = metal-admin. +GATE (pending verify): new containers must have a metal-admin leg (10.12.8.x) -> controller + reachable -> agent starts (NOT stuck allocating). Then /etc/hosts postruncmd at cloud-init end. +REVERT: n/a (this IS the fix; the prior binding is superseded by the D-052 re-amendment). + +## >>> D-052 RE-AMENDMENT VALIDATED LIVE -- BOTH ovn-central FIXES CONFIRMED. <<< + (1) REACHABILITY: ovn-central/3,4,5 agents went allocating -> executing (poll 5). New + containers are TWO-LEGGED: ovn-central/3 (0/lxd/19) eth0 10.12.9.14 (metal-admin) + + eth1 10.12.12.129 (metal-internal). The metal-admin leg = controller reachable = agent + starts. The single-leg failure is CLOSED by the '' -> metal-admin re-amendment. + (2) CERT-CN DELIVERY: /etc/hosts on ovn-central/3 carries "10.12.12.129 + juju-d4f45a-0-lxd-19.maas juju-d4f45a-0-lxd-19" and getent hosts reverse-RESOLVES it -> + get_hostname(metal-internal addr) will return a non-empty CN -> vault will issue the + server cert. This is the postruncmd DELIVERY PROOF that was impossible on 08-04 (the + containers were wedged/mis-bound). BOTH fixes work end-to-end pre-cert. + PRE-VAULT-INIT SETTLE RE-CONFIRMED after the re-home: phase-02-vault-preflight vr1-dc0 -> + PROCEED (mysql 3/3 active+ONLINE 1 R/W, vault fresh, census 66 units 0 workload-error + 0 agent-error, 40 active). Model ready for vault init. + +## HANDED OFF (operator-only one-shot): phase-02 vault init. + runbooks/phase-02-vault-bringup.md Step 2.1 (init/unseal/root-CA), run VERBATIM by the + operator on the DC rack (D-138 juju client); guard-hook blocks the agent (DOCFIX-006/D-069). + On completion: vault issues certs -> ovn-central requests its server cert with the resolved + CN -> OVN NB/SB cluster forms (6641/6642 listen) -> the redeploy's purpose is achieved. ## (delivery proof) -> phase-02 Step 2.1 vault init (OPERATOR-ONLY one-shot) -> ovn cert ## issues -> converge. (below appended as each further mutation executes) + +## >>> VAULT INIT COMPLETE (operator-run one-shot) + ovn-central RESOLVED end-to-end. 2026-08-05 <<< +Operator ran phase-02-vault-bringup.md Steps 2.1-2.3 VERBATIM on the dc0 rack (D-138), +model -m vr1-dc0 (VR0 -m openstack head-substituted -- fold item F13 / D-142 R1). The agent +did NOT run these (guard-hook, secret custody); recorded here from the operator's pasted +transcript with ALL secret material excluded. + 2.1 init: PROBE_OK (pre-init writability probe, D-142 safety add, run manually); pre-check + Initialized=false; init one-shot with `2>&1 | tee ~/vault-init/init.txt` -> GATE: 5 unseal + keys + TOKEN_OK. Off-host save handled by the operator by hand (R2 transport gap surfaced + verbally at hand-off; still the D-142 open item). + 2.2 unseal: 1/3 -> 2/3 -> 3/3 -> Sealed=false, Initialized=true, Storage=mysql, HA=false; + Cluster vault-cluster-12969e82. + 2.3 authorize + root CA: authorize-charm op1/task2 completed; generate-root-ca op3/task4 + returned the root CA PEM. vault/0 -> active/idle "Unit is ready (active: true, mlock: + disabled)"; vault-mysql-router/0 active. EXIT GATE MET. + ROOT CA (PUBLIC -- no secret custody; as-built metadata only): subject "Vault Root + Certificate Authority (charm-pki-local)"; validity 2026-08-05 02:05:57 -> 2036-08-02 + 01:06:27 UTC (~10y anchor). PEM body NOT stored (public but unnecessary). + SECURITY HYGIENE NOTE: the child token printed by `vault token create -field=token` appeared + in plaintext in the operator's paste (init keys + root token WERE redacted). It was + ttl=10m, unset after use, and long expired by paste time -> dead/benign, no rotation. + Lesson: redact the token-create output too. NOT stored/echoed/committed anywhere. + +## >>> ovn-central CERT CASCADE -- the redeploy's PURPOSE -- ACHIEVED (measured, read-only). <<< +Post-init `juju status -m vr1-dc0`: ovn-central/3,4,5 ALL active/idle "Unit is ready"; +/4 leader (ovnnb_db, ovnsb_db); /5 northd active. The OVN NB/SB cluster FORMED. This closes +the multi-session ovn-central saga: the CN-from-reverse-DNS-on-isolated-plane root cause +(08-04) is defeated by BOTH fixes landed this cycle -- the /etc/hosts postruncmd (CN delivery, +dc-node-etchosts.sh Step 1.2b) AND the D-052 re-amendment '' -> metal-admin (reachability). +Census moved 40 -> 47 active, 0 workload-error, 0 agent-error. + +## REMAINING (separate item, NOT vault/ovn, logged not fixed -- hard rule 1): +ceph-mon/2 + ceph-radosgw/0 still `allocating`/"waiting for machine" (container provisioning, +likely the 08-03 apt-cacher-ng/cloud-init wedge class). Cascade: ceph-mon can't reach 3-peer +quorum -> ceph-osd x4 "Incomplete relation: monitor" -> glance + nova-compute x2 "Incomplete +storage-backend". To be triaged AFTER the bookend. Expected-waiting (not stuck): designate +(Stage-7 DNS), octavia (end-user configure-resources), ceph-rbd-mirror (two-DC). diff --git a/docs/audit/vault-init-qol-proposal-20260805.md b/docs/audit/vault-init-qol-proposal-20260805.md new file mode 100644 index 0000000..97cf966 --- /dev/null +++ b/docs/audit/vault-init-qol-proposal-20260805.md @@ -0,0 +1,181 @@ +# Vault-init workflow QoL sweep -- engineering (PROPOSED, not executed) + +**Filed 2026-08-05.** Governing decision: **D-142** (design-decisions.md). Status: +**APPROVED IN PRINCIPLE, IMPLEMENTATION DEFERRED.** Operator approved all of R1-R5 +(*"Yes, I approve of all the recommendations so far"*) and then directed, 2026-08-05: +*"We will complete a vault init using current commands, take the qol and updated +script/steps developed and we can test them on the next opportunity."* So the +**2026-08-05 dc0 vault init was run on the CURRENT runbook, unchanged**; this document +is the saved engineering to implement + TEST next opportunity. **R2's off-host transport +is UNRESOLVED** (open question to operator, below). + +Target runbook: `runbooks/phase-02-vault-bringup.md`. This is a QoL / interaction-shape +sweep -- distinct scope from **D-068** (vault *substrate* hardening: version/listener-TLS/ +AppRole -- Roosevelt) and **D-011.6** (manual-unseal acceptance *bar*, a preserve-item). +Neither governs the init *workflow*; hence a new number, not an amendment. + +--- + +## Operator safety constraint (verbatim -- binds every change here) + +*"when the keys are printed (to either file or in the terminal) that at no point is the +data caught up with the hidden prompt options that could cause the keys to generate and be +lost. It has happened in the past and so changes around this part of the process have to +be doublechecked."* + +Everything below is subordinate to this constraint. The init one-shot's key generation +must never be entangled with a hidden prompt, and no change may introduce that entanglement. + +--- + +## Where the friction actually is (the commands are correct; the clunk is the shape) + +1. **Three separate interactive `juju ssh vault/0` opens** (2.1 init, 2.2 unseal, 2.3 + token-mint), each carrying the DOCFIX-029 "paste this line alone, wait for the prompt, + then paste the block" dance. Single biggest source of clunk. +2. **A cross-session secret hop:** the child token is minted inside vault/0, printed, you + copy it, exit manually, then paste it into a `read -s` on the other host. Manual copy of + live secret material between two terminals. +3. **Per-line mental substitution:** the runbook is VR0-shaped -- `-m openstack` and + run-location "jumphost" throughout. For VR1 every command is really `-m vr1-dc0` on the + dc0 rack (D-138). It "functions" because you substitute in your head -- friction on every + line and a wrong-model foot-gun. +4. **The highest-stakes step is unguarded:** saving `~/vault-init/init.txt` off-host is a + manual "remember to do this" between the init gate and unseal -- and losing it is the + unrecoverable B15 catastrophe (DOCFIX-006). Everything else has a GATE; this one relies + on discipline. (See R2 -- and its still-open transport question.) + +--- + +## Recommendations (prioritized) -- ALL operator-approved in principle + +**R1 -- Parameterize for VR1 (HIGH, low risk).** Replace `-m openstack` with `-m "$DC_MODEL"` +and change the run-location legend from "jumphost" to "the DC rack (D-138)". Kills the +per-line substitution and the wrong-model error class. **This is a defect fix, not a +nicety** -- `-m openstack` targets a model that does not exist in VR1 (fails closed here, +but against a stale controller could resolve unintended). Belongs on the +**runbook-fold-register** (D-138 retrofit) regardless -- filed there as **F13**. + +**R2 -- Make the off-host save an enforced GATE (HIGH).** After the init gate, add a +checkpoint that will not let 2.2 proceed until the operator confirms the off-host copy +exists (paste the secret-store path; the helper `sha256`-compares it to +`~/vault-init/init.txt`). Turns the one catastrophic manual step into a gate like every +other step. **OPEN QUESTION -- transport not yet defined:** `~/vault-init/init.txt` lives +inside the vault/0 juju unit, whose only durable path is inside a container a redeploy +destroys. R2 cannot gate on a step with no defined mechanism. Candidate: +`juju scp -m "$DC_MODEL" vault/0:vault-init/init.txt ` run from the +rack, with R2 verifying by **sha256 only, never reading/storing the contents**. **Must +learn the operator's actual off-host practice before building R2** -- build around real +practice, not an assumed one. (During the 2026-08-05 run this gap was surfaced verbally at +the hand-off and the operator handled the save by hand.) + +**R3 -- A `scripts/vault-init-assist.sh ` scaffold (HIGH, guard-safe).** A NON-SECRET +helper that does everything AROUND the one-shots: runs `phase-02-vault-preflight`, prints +the exact per-DC commands with model/location already substituted (copy-paste ready), runs +the read-only `vault status` / action-schema checks, and does R2's off-host-save +verification. It NEVER runs the init/unseal/token one-shots (the guard blocks those, +correctly) -- it removes the boilerplate and substitution around them. **This is the risky +one** (a script emitting paste-able commands, in the exact place that has burned us). Build +constraints are mandatory -- see below. + +**R4 -- Cut interactive sessions from 3 -> the genuine minimum (MED).** Use non-interactive +`juju ssh vault/0 -- 'VAULT_ADDR=... vault status'` for the pre-check and schema read (no +session open, no DOCFIX-029 dance). Reserve interactive ttys for only the three steps that +truly need a hidden prompt (init, unseal, token-mint). Since the DISCRETE gate is only +between *init* and *unseal*, **unseal (2.2) and the child-token mint (2.3a) can share one +vault/0 session** -- one fewer open and one fewer copy hop. **Init (2.1) stays its own +isolated session -- untouched** (see safety analysis). + +**R5 -- Small conveniences (MED).** A read-only `vault-status` wrapper (the +`vault status ... | grep -E ...` repeated verbatim 3x), and a one-page "at-a-glance" card -- +the 3 gates + the save checkpoint -- so you are not scrolling a 179-line runbook mid-secret-op. + +--- + +## PRESERVE -- these are deliberate, not clunk (a QoL pass must NOT erode them) + +- The **DISCRETE, un-batched gating** (init -> save -> unseal -> authorize) -- a security + invariant, not friction. +- **Hidden prompts / `read -s`**, **`2>&1 | tee` (never `>`)**, the **short-lived child + token** instead of the root token, and **manual unseal** (v1 standard, D-011.6). All + intentional; keep them. + +--- + +## Safety analysis -- key/hidden-prompt entanglement (the operator's constraint) + +**Mechanism of loss.** When multiple lines are pasted into an interactive session they +BUFFER. If any buffered line opens a hidden prompt (`vault operator unseal`, `read -s`), +the prompt reads from the buffer and SWALLOWS the next buffered line as the "secret." Two +outcomes: (a) a following command line gets eaten as a secret (wrong secret entered; that +command never runs), or (b) the dangerous inverse for init -- `vault operator init` runs +(generates the 5 shares + token IRREVERSIBLY, printed once) but its capture is compromised. + +**Confirmation of the CURRENT process -- Step 2.1 (init) is structurally safe,** because +three things hold together and all three currently do: +1. The session open (`juju ssh vault/0`) is pasted ALONE, waiting for the remote prompt + (DOCFIX-029) -- the in-session block is not fed to the SSH connect. +2. The in-session init block contains NO hidden prompt -- `export`, `vault status`, + `vault operator init ... 2>&1 | tee`, two greps. Nothing reads a hidden secret, so + nothing can swallow the init line. +3. The init line is ONE atomic line with `2>&1 | tee` and `mkdir -p ~/vault-init` ahead of + it -- keys land in the file even if the display is mangled, and the line cannot be + half-executed (swallowed whole = init did not run = no keys generated = safe; or run + intact = captured). +Because init runs isolated with no preceding hidden prompt, **the irreversible key +generation cannot be entangled with a hidden prompt.** + +**Residual risk that IS real (advisor-caught -- NOT a hidden-prompt problem).** +`vault operator init` can succeed server-side and FAIL the client-side `tee` write +(unwritable/full path). Keys are generated once, irreversibly -- if `tee` wrote nothing they +are gone. The `grep -c '^Unseal Key' == 5` GATE catches this only AFTER the fact, when the +keys already exist and are already lost. **Fix (bake in): a pre-init writability probe** -- +`touch ~/vault-init/.probe && rm ~/vault-init/.probe` (with `mkdir -p` + `umask 077` already +present) -- prove the capture path is writable BEFORE generating anything irreversible. +Strictly additive. *(This probe was offered and run manually during the 2026-08-05 dc0 init +-- it printed `PROBE_OK` before the one-shot.)* + +**Latent trap the current runbook mitigates only with discipline.** Steps 2.2 (unseal) and +2.3 (token-mint) each present their hidden-prompt commands inside a SINGLE fenced code +block (2.2: three `vault operator unseal` lines together; 2.3: `read -s` then +`vault token create`). Bulk-pasting either block lets the first hidden prompt swallow the +next command line. These are RECOVERABLE (unseal re-runs; token re-mints -- neither is the +irreversible init), so not the catastrophic loss -- but the block presentation invites the +exact bulk-paste the prose warns against. R3 turns this prose-only warning into a +STRUCTURAL safeguard. + +**Double-check on the proposed changes themselves:** +- **R4 does NOT combine init with anything.** The discrete gate sits between init and + unseal; init (2.1) stays its own isolated session with no hidden prompt. Init isolation + preserved. R4 only merges unseal + token-mint (both post-init, both recoverable). +- **R3 will NEVER emit a bulk block containing a hidden-prompt command followed by more + lines.** It emits the init command as a STANDALONE atomic unit (with `mkdir -p` + + `2>&1 | tee` intact and a "paste this line ALONE" banner), and each unseal / `read -s` + step as its OWN separate paste unit with a "wait for the prompt before the next paste" + gate. It never runs the one-shots (guard blocks them) and never reads/echoes/stores key + material. +- **R2 runs strictly AFTER** the init file is confirmed populated -- reads/verifies + `~/vault-init/init.txt`, never re-runs or restructures the init capture. Compares + checksums only. +- **R1 touches only `-m openstack` -> `-m "$DC_MODEL"` and the run-location legend.** + +--- + +## Build constraints (mandatory when R3 is implemented -- same discipline as dc-node-etchosts T10) + +- The harness MUST **mutation-prove** that the emitted init unit contains BOTH `2>&1 | tee` + AND `mkdir -p`, and that **no** emitted block puts a hidden-prompt command ahead of + another line. (Revert the property -> the case must FAIL.) +- The script **never reads, echoes, paths, or stores key material**; R2 compares `sha256` + checksums only. +- Assert the **emitted artifact**, never a comment or the script's own prose about itself. +- Add the pre-init **writability probe** to the emitted init unit. + +--- + +## What was already delivered vs deferred + +- **DELIVERED this session:** this proposal, D-142 (PROPOSED), and F13 on the fold-register. +- **DEFERRED to next opportunity (operator directive):** the runbook edits (R1, R4, R5), + the `scripts/vault-init-assist.sh` scaffold + harness (R3), and the R2 save-gate -- + the last blocked on the operator's off-host transport answer. diff --git a/docs/design-decisions.md b/docs/design-decisions.md index 76ab1ab..a4bd5b3 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -7681,3 +7681,54 @@ prefix and must not be treated as answered by this. Roosevelt analog: every bare-metal DC's IPAM is authored dual-stack from day one, v6 reserved until the platform is v6-capable, so no DC ever needs a v4->v6 re-carve -- only a status promotion. + +--- + +## D-142: PROPOSED -- Vault-init workflow QoL sweep (interaction-shape, VR1-fit, save-gate) + +**Status:** APPROVED IN PRINCIPLE, IMPLEMENTATION DEFERRED. Filed 2026-08-05. Operator +approved all of R1-R5 (exact utterance: *"Yes, I approve of all the recommendations so +far"*), then directed that the 2026-08-05 dc0 vault init run on the CURRENT (unchanged) +runbook and the QoL work be implemented + TESTED next opportunity (exact utterance: *"We +will complete a vault init using current commands, take the qol and updated script/steps +developed and we can test them on the next opportunity"*). **R2's off-host transport is +UNRESOLVED** (open question to operator). So: approved-in-principle, NOT yet built, one +sub-item still needs an operator input before it can be built. + +**Scope.** A QoL / interaction-shape sweep of `runbooks/phase-02-vault-bringup.md` (the +vault init/unseal/authorize secret-handling runbook). The commands are correct; the target +is the *friction* -- three interactive `juju ssh` opens, a cross-terminal secret hop, VR0 +`-m openstack` / "jumphost" substitution on every line (D-138), and the one unguarded +catastrophic step (off-host save of `init.txt`). + +**Distinct from existing vault decisions (checked before numbering, per CLAUDE.md):** +- **D-068** = vault *substrate* hardening (version / listener-TLS / AppRole lifecycle) -- + Roosevelt-durability. Not the init workflow. +- **D-011.6** = manual-unseal acceptance *bar* -- a PRESERVE-item this sweep explicitly keeps. +Neither governs the init *workflow/interaction shape*; hence a new number, not an amendment. + +**The five recommendations (full engineering + safety analysis):** +`docs/audit/vault-init-qol-proposal-20260805.md`. In brief: **R1** parameterize +`-m "$DC_MODEL"` + run-location = DC rack (a DEFECT fix -- `-m openstack` targets a +non-existent VR1 model; also filed as fold-register **F13**); **R2** enforce the off-host +save as a GATE (blocked on the transport question); **R3** a guard-safe +`scripts/vault-init-assist.sh` scaffold that does everything AROUND the one-shots and never +runs them; **R4** cut 3 interactive sessions to the minimum (init stays isolated); **R5** +small conveniences (status wrapper + at-a-glance card). + +**Binding safety constraint (operator, verbatim):** *"when the keys are printed ... that at +no point is the data caught up with the hidden prompt options that could cause the keys to +generate and be lost ... changes around this part of the process have to be doublechecked."* +The proposal doc carries the full paste-buffer/hidden-prompt analysis, the advisor-caught +residual `tee`-write-failure risk + the pre-init writability probe, and the mandatory R3 +harness constraints (mutation-prove the emitted init unit carries `2>&1 | tee` + `mkdir -p` +and that no emitted block puts a hidden-prompt line ahead of another). + +**PRESERVE (do not let the QoL pass erode):** discrete un-batched gating; hidden prompts / +`read -s`; `2>&1 | tee` never `>`; short-lived child token; manual unseal (D-011.6). + +**Relationships:** target runbook is the phase-02 vault bring-up; **D-138** (client on the +DC rack) is the source of R1's substitution; **DOCFIX-006/029** (init capture + paste-alone) +and **D-011.6** are the invariants preserved. Roosevelt analog: the per-DC Vault standup +gets a tested, low-friction, guard-safe init procedure rather than a head-substituted VR0 +runbook. diff --git a/docs/runbook-fold-register.md b/docs/runbook-fold-register.md index 123ab3e..363a9be 100644 --- a/docs/runbook-fold-register.md +++ b/docs/runbook-fold-register.md @@ -51,6 +51,7 @@ | F10 | **C** | Nothing compares D-139's ruled family/GUA tables to the artifact. `dc-node-v6-verify` asserts NIC-against-MAAS and its own header says explicitly NOT against the ruled table. | -- | a new gate, or an extension of an existing one | OPEN | | F12 | **A** | `SKILL.md` -- the always-loaded routing layer -- stated "Plane 2 EXECUTES on `voffice1`" with **ZERO mentions of D-138**. More dangerous than any runbook instance: every fresh session reads it BEFORE any runbook. | D-138 | `.claude/skills/openstack-cloud-ops/SKILL.md` | **DONE 2026-08-02** | | F11 | **B** | The edge rebuild path (D-112(c) console bootstrap + D-113(a2) key mint + addressing) is documented across a changelog and a runbook section rather than as one followable procedure. Exercised three times now (dc0 twice, dc1 once). | D-112 / D-113 | phase2 | OPEN | +| F13 | **A** | `phase-02-vault-bringup.md` (vault init/unseal/authorize) is VR0-shaped -- `-m openstack` and run-location "jumphost" on every line; VR1 needs `-m vr1-dc0` on the DC rack (D-138), head-substituted on the 2026-08-05 dc0 run. `-m openstack` is a non-existent VR1 model (fails closed, but a wrong-model foot-gun). **Scope stretch, stated: this register is scoped to the DC-DC phase2/3/4 runbooks; phase-02-vault-bringup is a VR0-track runbook reused for VR1 vault init -- F12 (SKILL.md) is the precedent for stretching beyond that set.** = D-142 R1. | D-138 / D-142 R1 | `runbooks/phase-02-vault-bringup.md` (model + run-location legend) | OPEN | ## Out of scope for this fold, deliberately