diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index ad3d328..9e97cf8 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -794,6 +794,38 @@ A `brexip` fixture (correctly-parented OVS bridge carrying the WRONG static) was added and the kill re-proved. **This is the "prove each new assertion can FAIL" rule catching a real hole for the second time in four days.** + **A LIVE DRY-RUN THEN CAUGHT WHAT THE WHOLE FIXTURE SUITE HAD MISSED** -- the tool refused + `enp1s0` on every machine, because every PXE leg comes out of enlistment holding an `auto` + link on metal-admin and the "wrong address on the right subnet is a FAILURE" rule was too + broad. **A commissioning link is the EXPECTED STARTING STATE, not a conflict.** Narrowed + BY MODE: `auto`/`dhcp`/`link_up` is MAAS's own default and gets unlinked and re-created as + STATIC; a `static` link with the wrong address is still REFUSED. Both directions are + fixtures now and both mutation-proven. The `raw` fixture DID model the auto link + correctly -- what the harness lacked was any assertion that `apply` over the raw state + EXITS 0, so a refusal on the very first NIC read as green. **Third time in two days a live + run caught what fixtures did not**, which is exactly why the tool was not written blind. + **>>> THE dc0 v4 NODE CARVE IS COMPLETE, ALL TEN MACHINES, 2026-07-30. NAMED GATE + `dc-node-carve.sh check vr1-dc0` = pass 134 / fail 0, EXIT 0 <<<** (capture + `docs/audit/dc0-node-carve-20260730.txt`, 195 lines). Was 25/109 before the apply. + Executed canary-first (`vr1-dc0-storage-04`, the migration canary) then node by node, + never batched; 11 + 13x8 + 4 mutations, **every single one read back and compared**. + Final shape: nine role nodes on all six planes with an OVS `br-ex` parented on `enp2s0` + (the member holding NO L3 link), and `vr1-dc0-juju-01` on metal-admin `10.12.8.5` + + provider-public `10.12.4.5` RAW with no `br-ex` and `enp3s0..enp6s0` left on auto VLANs. + **VERIFIED BY DIFF AGAINST THE PRE-MIGRATION CAPTURE, and the diff is EMPTY** -- every + node's six v4 legs match the Office1 carve ADDRESS FOR ADDRESS. Compared by LEG SET, not + by name: the hostname differs on every row (re-minted at re-enlistment). **INSTRUMENT + NOTE, recorded because it nearly became a false negative:** the first extraction read + field 8 of the capture (`parents=`) instead of field 9 and returned `-` for every old + address, which would have read as "the old region had no statics". Caught by the New side + being fully populated against an all-empty Old side -- an implausible shape, not a + plausible one. **G17 and the node's actual routing table remain FIRST-BOOT facts**; this + gate proves the MAAS model that produces them, and says so in its own output. + **STILL OWED before bootstrap:** `dc-node-v6-carve.py apply vr1-dc0 --commit --profile + vr1-dc0-region` (it needs `br-ex` to exist, which it now does), then re-point Juju at + `10.12.8.6:5240` -- which needs a region-scoped MAAS API key (the Office1 key will NOT + authenticate), an updated juju cloud + credential, and `juju unregister + vr1-dc0-controller` on the rack. - Project: Omega Cloud, VR1 DC-DC rehearsal -- a two-DC + Office1-headend virtual rehearsal on KVM (vcloud host), rehearsing the future bare-metal diff --git a/docs/audit/dc0-node-carve-20260730.txt b/docs/audit/dc0-node-carve-20260730.txt new file mode 100644 index 0000000..d624e66 --- /dev/null +++ b/docs/audit/dc0-node-carve-20260730.txt @@ -0,0 +1,195 @@ +OK profile 'vr1-dc0-region' -> region with racks [hot-kid] (as expected) + +=== region + plane preconditions (vr1-dc0 via profile 'vr1-dc0-region') === + [ok] provider-public 10.12.4.0/22 carries a gateway (got '10.12.4.1') -- the node default route depends on it + [ok] metal-admin 10.12.8.0/22 has NO gateway (got 'none') -- D-134/D-125: it is not an egress plane + +=== vr1-dc0-control-01 -> 677cta/mint-roughy (octet 100, 6 plane(s), status Ready) === + [ok] vr1-dc0-control-01 enp1s0 STATIC 10.12.8.100 on metal-admin (got 'static:10.12.8.100') + [ok] vr1-dc0-control-01 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-control-01 br-ex STATIC 10.12.4.100 on provider-public (got 'static:10.12.4.100') + [ok] vr1-dc0-control-01 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-control-01 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-control-01 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-control-01 enp3s0 STATIC 10.12.12.100 on metal-internal (got 'static:10.12.12.100') + [ok] vr1-dc0-control-01 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-control-01 enp4s0 STATIC 10.12.16.100 on data-tenant (got 'static:10.12.16.100') + [ok] vr1-dc0-control-01 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-control-01 enp5s0 STATIC 10.12.32.100 on storage (got 'static:10.12.32.100') + [ok] vr1-dc0-control-01 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-control-01 enp6s0 STATIC 10.12.36.100 on replication (got 'static:10.12.36.100') + [ok] vr1-dc0-control-01 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-control-02 -> wpftxc/gentle-raven (octet 101, 6 plane(s), status Ready) === + [ok] vr1-dc0-control-02 enp1s0 STATIC 10.12.8.101 on metal-admin (got 'static:10.12.8.101') + [ok] vr1-dc0-control-02 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-control-02 br-ex STATIC 10.12.4.101 on provider-public (got 'static:10.12.4.101') + [ok] vr1-dc0-control-02 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-control-02 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-control-02 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-control-02 enp3s0 STATIC 10.12.12.101 on metal-internal (got 'static:10.12.12.101') + [ok] vr1-dc0-control-02 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-control-02 enp4s0 STATIC 10.12.16.101 on data-tenant (got 'static:10.12.16.101') + [ok] vr1-dc0-control-02 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-control-02 enp5s0 STATIC 10.12.32.101 on storage (got 'static:10.12.32.101') + [ok] vr1-dc0-control-02 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-control-02 enp6s0 STATIC 10.12.36.101 on replication (got 'static:10.12.36.101') + [ok] vr1-dc0-control-02 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-control-03 -> 6p8pbx/square-insect (octet 102, 6 plane(s), status Ready) === + [ok] vr1-dc0-control-03 enp1s0 STATIC 10.12.8.102 on metal-admin (got 'static:10.12.8.102') + [ok] vr1-dc0-control-03 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-control-03 br-ex STATIC 10.12.4.102 on provider-public (got 'static:10.12.4.102') + [ok] vr1-dc0-control-03 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-control-03 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-control-03 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-control-03 enp3s0 STATIC 10.12.12.102 on metal-internal (got 'static:10.12.12.102') + [ok] vr1-dc0-control-03 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-control-03 enp4s0 STATIC 10.12.16.102 on data-tenant (got 'static:10.12.16.102') + [ok] vr1-dc0-control-03 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-control-03 enp5s0 STATIC 10.12.32.102 on storage (got 'static:10.12.32.102') + [ok] vr1-dc0-control-03 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-control-03 enp6s0 STATIC 10.12.36.102 on replication (got 'static:10.12.36.102') + [ok] vr1-dc0-control-03 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-compute-01 -> m3cgc7/pure-condor (octet 120, 6 plane(s), status Ready) === + [ok] vr1-dc0-compute-01 enp1s0 STATIC 10.12.8.120 on metal-admin (got 'static:10.12.8.120') + [ok] vr1-dc0-compute-01 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-compute-01 br-ex STATIC 10.12.4.120 on provider-public (got 'static:10.12.4.120') + [ok] vr1-dc0-compute-01 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-compute-01 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-compute-01 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-compute-01 enp3s0 STATIC 10.12.12.120 on metal-internal (got 'static:10.12.12.120') + [ok] vr1-dc0-compute-01 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-compute-01 enp4s0 STATIC 10.12.16.120 on data-tenant (got 'static:10.12.16.120') + [ok] vr1-dc0-compute-01 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-compute-01 enp5s0 STATIC 10.12.32.120 on storage (got 'static:10.12.32.120') + [ok] vr1-dc0-compute-01 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-compute-01 enp6s0 STATIC 10.12.36.120 on replication (got 'static:10.12.36.120') + [ok] vr1-dc0-compute-01 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-compute-02 -> t6kpe3/able-puma (octet 121, 6 plane(s), status Ready) === + [ok] vr1-dc0-compute-02 enp1s0 STATIC 10.12.8.121 on metal-admin (got 'static:10.12.8.121') + [ok] vr1-dc0-compute-02 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-compute-02 br-ex STATIC 10.12.4.121 on provider-public (got 'static:10.12.4.121') + [ok] vr1-dc0-compute-02 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-compute-02 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-compute-02 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-compute-02 enp3s0 STATIC 10.12.12.121 on metal-internal (got 'static:10.12.12.121') + [ok] vr1-dc0-compute-02 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-compute-02 enp4s0 STATIC 10.12.16.121 on data-tenant (got 'static:10.12.16.121') + [ok] vr1-dc0-compute-02 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-compute-02 enp5s0 STATIC 10.12.32.121 on storage (got 'static:10.12.32.121') + [ok] vr1-dc0-compute-02 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-compute-02 enp6s0 STATIC 10.12.36.121 on replication (got 'static:10.12.36.121') + [ok] vr1-dc0-compute-02 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-storage-01 -> t7ymp6/amused-corgi (octet 150, 6 plane(s), status Ready) === + [ok] vr1-dc0-storage-01 enp1s0 STATIC 10.12.8.150 on metal-admin (got 'static:10.12.8.150') + [ok] vr1-dc0-storage-01 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-storage-01 br-ex STATIC 10.12.4.150 on provider-public (got 'static:10.12.4.150') + [ok] vr1-dc0-storage-01 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-storage-01 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-storage-01 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-storage-01 enp3s0 STATIC 10.12.12.150 on metal-internal (got 'static:10.12.12.150') + [ok] vr1-dc0-storage-01 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-storage-01 enp4s0 STATIC 10.12.16.150 on data-tenant (got 'static:10.12.16.150') + [ok] vr1-dc0-storage-01 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-storage-01 enp5s0 STATIC 10.12.32.150 on storage (got 'static:10.12.32.150') + [ok] vr1-dc0-storage-01 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-storage-01 enp6s0 STATIC 10.12.36.150 on replication (got 'static:10.12.36.150') + [ok] vr1-dc0-storage-01 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-storage-02 -> fg6gxm/known-alpaca (octet 151, 6 plane(s), status Ready) === + [ok] vr1-dc0-storage-02 enp1s0 STATIC 10.12.8.151 on metal-admin (got 'static:10.12.8.151') + [ok] vr1-dc0-storage-02 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-storage-02 br-ex STATIC 10.12.4.151 on provider-public (got 'static:10.12.4.151') + [ok] vr1-dc0-storage-02 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-storage-02 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-storage-02 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-storage-02 enp3s0 STATIC 10.12.12.151 on metal-internal (got 'static:10.12.12.151') + [ok] vr1-dc0-storage-02 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-storage-02 enp4s0 STATIC 10.12.16.151 on data-tenant (got 'static:10.12.16.151') + [ok] vr1-dc0-storage-02 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-storage-02 enp5s0 STATIC 10.12.32.151 on storage (got 'static:10.12.32.151') + [ok] vr1-dc0-storage-02 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-storage-02 enp6s0 STATIC 10.12.36.151 on replication (got 'static:10.12.36.151') + [ok] vr1-dc0-storage-02 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-storage-03 -> yws74f/loyal-oyster (octet 152, 6 plane(s), status Ready) === + [ok] vr1-dc0-storage-03 enp1s0 STATIC 10.12.8.152 on metal-admin (got 'static:10.12.8.152') + [ok] vr1-dc0-storage-03 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-storage-03 br-ex STATIC 10.12.4.152 on provider-public (got 'static:10.12.4.152') + [ok] vr1-dc0-storage-03 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-storage-03 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-storage-03 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-storage-03 enp3s0 STATIC 10.12.12.152 on metal-internal (got 'static:10.12.12.152') + [ok] vr1-dc0-storage-03 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-storage-03 enp4s0 STATIC 10.12.16.152 on data-tenant (got 'static:10.12.16.152') + [ok] vr1-dc0-storage-03 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-storage-03 enp5s0 STATIC 10.12.32.152 on storage (got 'static:10.12.32.152') + [ok] vr1-dc0-storage-03 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-storage-03 enp6s0 STATIC 10.12.36.152 on replication (got 'static:10.12.36.152') + [ok] vr1-dc0-storage-03 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-storage-04 -> 6q4syf/civil-bug (octet 153, 6 plane(s), status Ready) === + [ok] vr1-dc0-storage-04 enp1s0 STATIC 10.12.8.153 on metal-admin (got 'static:10.12.8.153') + [ok] vr1-dc0-storage-04 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-storage-04 br-ex STATIC 10.12.4.153 on provider-public (got 'static:10.12.4.153') + [ok] vr1-dc0-storage-04 br-ex is a bridge (got 'bridge') + [ok] vr1-dc0-storage-04 br-ex parent is enp2s0 (got 'enp2s0') + [ok] vr1-dc0-storage-04 enp2s0 holds no L3 link (got 0) -- it is an OVS member + [ok] vr1-dc0-storage-04 enp3s0 STATIC 10.12.12.153 on metal-internal (got 'static:10.12.12.153') + [ok] vr1-dc0-storage-04 enp3s0 on the metal-internal VLAN (got '5004' want '5004') + [ok] vr1-dc0-storage-04 enp4s0 STATIC 10.12.16.153 on data-tenant (got 'static:10.12.16.153') + [ok] vr1-dc0-storage-04 enp4s0 on the data-tenant VLAN (got '5005' want '5005') + [ok] vr1-dc0-storage-04 enp5s0 STATIC 10.12.32.153 on storage (got 'static:10.12.32.153') + [ok] vr1-dc0-storage-04 enp5s0 on the storage VLAN (got '5006' want '5006') + [ok] vr1-dc0-storage-04 enp6s0 STATIC 10.12.36.153 on replication (got 'static:10.12.36.153') + [ok] vr1-dc0-storage-04 enp6s0 on the replication VLAN (got '5007' want '5007') + +=== vr1-dc0-juju-01 -> arfr7p/subtle-grouse (octet 5, 2 plane(s), status Ready) === + [ok] vr1-dc0-juju-01 enp1s0 STATIC 10.12.8.5 on metal-admin (got 'static:10.12.8.5') + [ok] vr1-dc0-juju-01 enp1s0 on the metal-admin VLAN (got '5001' want '5001') + [ok] vr1-dc0-juju-01 enp2s0 STATIC 10.12.4.5 on provider-public (got 'static:10.12.4.5') + [ok] vr1-dc0-juju-01 enp2s0 on the provider-public VLAN (got '5002' want '5002') + [ok] vr1-dc0-juju-01 enp3s0..enp6s0 carry NO plane link (0 found) -- deliberately left on auto VLANs + [ok] vr1-dc0-juju-01 has NO br-ex (got id '') -- the controller takes the provider leg RAW + +NOTE: this gate proves the MAAS MODEL. The node's actual routing table is a + FIRST-BOOT observation (G17) -- a green carve is not a proven default route. +RESULT: pass=134 fail=0 +PASS: dc-node-carve check vr1-dc0 + +============================================================================== +DIFF AGAINST THE PRE-MIGRATION CAPTURE (docs/audit/dc0-maas-carve-premigration-20260730.txt) +Keyed by LEG SET, since system_id and hostname are both re-minted across regions. +============================================================================== + +--- OLD (Office1, pre-migration) --- +ace-robin br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +alert-cub br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +first-oryx br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +keen-dove br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +moral-salmon br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +moved-troll enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +real-filly br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +superb-piglet br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +wired-thrush br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- +wise-stud br-ex=- enp1s0=- enp2s0=- enp3s0=- enp4s0=- enp5s0=- enp6s0=- + +--- NEW (per-DC region, live after this carve) --- +able-puma br-ex=10.12.4.121 enp1s0=10.12.8.121 enp2s0=- enp3s0=10.12.12.121 enp4s0=10.12.16.121 enp5s0=10.12.32.121 enp6s0=10.12.36.121 +amused-corgi br-ex=10.12.4.150 enp1s0=10.12.8.150 enp2s0=- enp3s0=10.12.12.150 enp4s0=10.12.16.150 enp5s0=10.12.32.150 enp6s0=10.12.36.150 +civil-bug br-ex=10.12.4.153 enp1s0=10.12.8.153 enp2s0=- enp3s0=10.12.12.153 enp4s0=10.12.16.153 enp5s0=10.12.32.153 enp6s0=10.12.36.153 +gentle-raven br-ex=10.12.4.101 enp1s0=10.12.8.101 enp2s0=- enp3s0=10.12.12.101 enp4s0=10.12.16.101 enp5s0=10.12.32.101 enp6s0=10.12.36.101 +known-alpaca br-ex=10.12.4.151 enp1s0=10.12.8.151 enp2s0=- enp3s0=10.12.12.151 enp4s0=10.12.16.151 enp5s0=10.12.32.151 enp6s0=10.12.36.151 +loyal-oyster br-ex=10.12.4.152 enp1s0=10.12.8.152 enp2s0=- enp3s0=10.12.12.152 enp4s0=10.12.16.152 enp5s0=10.12.32.152 enp6s0=10.12.36.152 +mint-roughy br-ex=10.12.4.100 enp1s0=10.12.8.100 enp2s0=- enp3s0=10.12.12.100 enp4s0=10.12.16.100 enp5s0=10.12.32.100 enp6s0=10.12.36.100 +pure-condor br-ex=10.12.4.120 enp1s0=10.12.8.120 enp2s0=- enp3s0=10.12.12.120 enp4s0=10.12.16.120 enp5s0=10.12.32.120 enp6s0=10.12.36.120 +square-insect br-ex=10.12.4.102 enp1s0=10.12.8.102 enp2s0=- enp3s0=10.12.12.102 enp4s0=10.12.16.102 enp5s0=10.12.32.102 enp6s0=10.12.36.102 +subtle-grouse enp1s0=10.12.8.5 enp2s0=10.12.4.5 enp3s0=- enp4s0=- enp5s0=- enp6s0=- + +RESULT: diff of the sorted leg sets is EMPTY -- every node's six v4 legs match the +pre-migration carve address for address. NOTE the hostnames DIFFER on every row +(re-minted at re-enlistment); the leg set is what was compared, not the name. diff --git a/docs/changelog-20260730-dc0-node-carve.md b/docs/changelog-20260730-dc0-node-carve.md index e873b04..b0b437c 100644 --- a/docs/changelog-20260730-dc0-node-carve.md +++ b/docs/changelog-20260730-dc0-node-carve.md @@ -126,3 +126,32 @@ FAILS on a harness that is present but unpinned. **Revert.** `git checkout ^ -- tests/HARNESS-MANIFEST`. + +## Item 3 -- the dc0 v4 node carve EXECUTED, all ten machines + +**What.** `dc-node-carve.sh apply` run canary-first then node by node, never batched. +11 mutations on the canary + 13 on each of the other eight role nodes + 4 on the Juju +controller. Every one read back and compared. + +**Named gate (GA-R6):** `dc-node-carve.sh check vr1-dc0` = **pass 134 / fail 0, exit 0**. +Capture `docs/audit/dc0-node-carve-20260730.txt` (195 lines). Before the apply the same +gate read 25/109. + +**Verified independently by diffing against the pre-migration capture, and the diff is +EMPTY** -- every node's six v4 legs match the Office1 carve address for address. Compared +by LEG SET rather than by name, because system_id AND hostname are both re-minted at +re-enlistment (`moral-salmon` -> `civil-bug`, and so on for all ten). + +**INSTRUMENT NOTE, recorded because it nearly became a false negative.** The first +extraction read field 8 of the capture (`parents=`) instead of field 9, and returned `-` +for every OLD address. Presented as-is that reads "the old region had no statics" -- a +confident, well-formed, wrong result. It was caught only because the NEW side was fully +populated against an all-empty OLD side, which is an implausible shape rather than a +plausible one. This is the same class as the five instrument errors swept on 2026-07-30. + +**What this does NOT establish.** The node's actual routing table. G17 and the default +route are first-boot observations; the carve proves the MAAS model that produces them. + +**Revert.** There is no single-command revert, and none is wanted: the target state IS the +pre-migration carve, now re-established. To undo a single leg, +`maas vr1-dc0-region interface unlink-subnet id=`.