diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 0db6ccf..526dd32 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -521,13 +521,14 @@ (monthly-review window trigger; patch-only controller jumps; order; acceptable single-controller risk) as amended by the confirmed backup posture (:1677). -5. D-129 -- two OPEN sub-decisions (OPEN / PARTIALLY RULED; (i) RULED +5. D-129 -- one OPEN sub-decision (OPEN / PARTIALLY RULED; (i) RULED 2026-07-21: COS scrapes the edge, in-scope per-DC; (ii) RULED - 2026-07-21: os-frr pinned to Roosevelt design time -- status line in - design-decisions.md is the authority): (iii) consolidate the - Tailscale subnet-router onto the edge vs keep D-107 as-is? (iv) does - the edge anchor site NTP? Plus the operator-gated live install of - the ruled VR1 profile (`scripts/opnsense-plugins.sh apply vr1-edge`). + 2026-07-21: os-frr pinned to Roosevelt design time; (iii) RULED + 2026-07-21: per-site Tailscale = dedicated node on metal-admin, + edge excluded -- status line in design-decisions.md is the + authority): (iv) does the edge anchor site NTP? Plus the + operator-gated live install of the ruled VR1 profile + (`scripts/opnsense-plugins.sh apply vr1-edge`). 6. Audit Phase 4 rulings: GA-R1..GA-R6 individually, plus the legal stage-status vocabulary A/B (GA-F10 operator note) -- each gated, one ruling per exchange. diff --git a/docs/changelog-20260721-tenant-review-pin.md b/docs/changelog-20260721-tenant-review-pin.md index 2397f02..bb9fa6e 100644 --- a/docs/changelog-20260721-tenant-review-pin.md +++ b/docs/changelog-20260721-tenant-review-pin.md @@ -100,3 +100,17 @@ alongside the D-100 link spec + D-132 topology. Status line updated; CURRENT-STATE item 5 + ledger D-129 line coupled same-commit. - **Revert:** git revert this commit (records only). + +## 8. D-129 sub-decision (iii) RULED: per-site Tailscale = dedicated node, edge excluded + +- One clarifying round (recorded verbatim in the Status block): the + operator disclosed that this deployment AND Roosevelt will run a site + Tailscale installation for metal-admin access at EVERY location. The + agent's recommendation survived with one self-correction (edge-failure + survivability is weak at DC sites -- all site egress rides the edge; + the load-bearing reasons are plane-reach, blast radius, lifecycle + decoupling). Selection, exact utterance: "Dedicated node per site + (Recommended)". D-107 shape becomes the standing per-site pattern; + edge gets no metal-admin leg; D-131 sub-2 revisit clause dead. Per-site + ACL/key-custody design + SEC row queued to implementation time. +- **Revert:** git revert this commit (records only). diff --git a/docs/design-decisions.md b/docs/design-decisions.md index 2682397..333b560 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -4065,7 +4065,19 @@ ## D-129: OPNsense edge plugin / add-on base profile (VR1 -> Roosevelt) [OPS] **Status:** OPEN (PARTIALLY RULED 2026-07-18; sub-decision (i) RULED 2026-07-21) -- profile -adopted, TWO sub-decisions still OPEN ((iii)-(iv)). Sub-decision (ii) RULED 2026-07-21 (GA-R5): +adopted, ONE sub-decision still OPEN ((iv)). Sub-decision (iii) RULED 2026-07-21 (GA-R5, one +clarifying round): first presentation drew an operator clarification, quoted verbatim as it is +itself standing architectural context: "Roosevelt deisgn, and this deployment, will have a site +tailscale installation to access the metal-admin plane at each location. Does that change your +recommendation?" [sic]. Question as re-presented = "where does each site's Tailscale +installation live?"; operator selection, exact utterance: "Dedicated node per site +(Recommended)". The D-107 shape becomes the STANDING PER-SITE pattern: a dedicated +subnet-router (small VM or container; placement per-DC is deployment-time engineering, may +land on D-132's utility nodes) on each site's metal-admin plane. The edge gets NO +management-plane leg and NO os-tailscale; the D-131 sub-2 revisit clause therefore never +triggers. Per-site ACL scoping, key custody, and a SEC row land at implementation. D-107 +remains the governing decision for the Office1 installation; this ruling extends its shape +per-site rather than amending its text. Sub-decision (ii) RULED 2026-07-21 (GA-R5): question as presented = "how do we dispatch the os-frr dynamic-routing question for the edge?"; operator selection, exact utterance: "Pin to Roosevelt design (Recommended)". VR1 stays static (D-124/D-125, already ruled); os-frr is PINNED to Roosevelt inter-DC network design time, to be @@ -4085,8 +4097,8 @@ rest is PINNED to its deployment step (mapping below). **FOUR sub-decisions remain OPEN** (a one-line directive does not rule these -- they were flagged as decisions, not adds): (i) COS-scrapes-the-edge scope (RULED 2026-07-21, see Status), (ii) `os-frr` dynamic routing (RULED 2026-07-21: pinned -to Roosevelt design, see Status), (iii) `os-tailscale` subnet-router consolidation, (iv) -edge-as-site-NTP. +to Roosevelt design, see Status), (iii) `os-tailscale` subnet-router consolidation (RULED +2026-07-21: dedicated node per site, edge excluded -- see Status), (iv) edge-as-site-NTP. **Pinned at deployment steps (the "engineering for the rest").** - **VR1 edge base profile = {`os-qemu-guest-agent`, `os-iperf`}** -> applied at DC-edge bring-up. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 902a36d..530e714 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -34,8 +34,9 @@ - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt), D-071 (routine update cadence + Juju controller patch policy), D-129 (OPNsense edge plugin/add-on base - profile -- OPEN / partially ruled, two sub-decisions ((iii)-(iv)); (i) COS-scrapes-edge ruled - in-scope per-DC + (ii) os-frr pinned to Roosevelt design, both 2026-07-21), D-131 (node-facing DNS strategy for + profile -- OPEN / partially ruled, one sub-decision ((iv) edge-as-site-NTP); (i) COS-scrapes-edge + in-scope per-DC, (ii) os-frr pinned to Roosevelt design, (iii) per-site Tailscale = dedicated + node not edge, all ruled 2026-07-21), D-131 (node-facing DNS strategy for rack-only controllers -- PARTIALLY RULED: sub-1 ruled + delivered 2026-07-21, sub-2 ruled 2026-07-21 (metal-admin only), sub-3 resolved 2026-07-21 (no defect), sub-4 open + pinned DNS architectural review;