diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index ae134e5..f53f356 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -69,7 +69,7 @@ > redeploy (specs in days); this teardown/redeploy is the test of the module-deployment project, > and it compresses the Roosevelt-review Group-4 horizon from far-future to weeks-away (re-run that > assessment against real hardware sheets when they land). -> **CONTAINER-ELIM PASS RAN (2026-08-09) -- READ-ONLY planning complete; the [ARCH] ruling is now OWED.** +> **CONTAINER-ELIM PASS RAN (2026-08-09) + CORE [ARCH] RULING LANDED (2026-08-10) -- D-144 ADOPTED; execution owed.** > The multi-agent read-only pass (phases 0-4, 4 sonnet workers + 1 administrator per phase + a final > advisor; agents recorded as "the administrator"/"the advisor", no model name asserted per operator) > executed this session. NOTHING was built or executed against the cloud -- it produced a PLAN. @@ -79,12 +79,16 @@ > ruling. Deliverables in `docs/audit/container-elim-pass/`: **`operator-report.md`** (the single > report), **`FINAL-PLAN.md`** (104-row change-set + L0-L5 module design + Part-A/B sequencing + > decision package), **`FINAL-advisor-review.md`** (verdict SOUND + 2 follow-ups), + 20 worker/admin -> docs. **OWED (operator, GA-R5): the Tier-1 decision package** -- DEC-01 = adopt the container-elim as -> a new **D-144** (recommended; supersedes D-123 Model B; D-143 is the precedent) + amendments D-128/ -> D-134/D-131 + DEC-15 (power-key mitigation incl. reach) + DEC-14/16 ((a) control) + DEC-11 (root -> topology (B)) + DEC-08 (rack retirement, live-re-measure-gated) + DEC-24 (dc0<->dc1 mesh/Ceph path). -> Model B remains the LIVE shape until D-144 is ruled and the redeploy executes. Scope handoff (history): -> `docs/audit/container-elim-pass/SCOPE-AND-EXECUTION-PLAN.md`. +> docs. **CORE RULED 2026-08-10 (GA-R5, 3 exchanges -> D-144 ADOPTED, `docs/design-decisions.md`):** +> DEC-01 = "New D-144, supersedes D-123"; DEC-11 = "(B) shared-outer + per-DC-flat" roots; DEC-13 = +> ".8 / vr1-dcN-client" (dated D-134 amendment). D-144 SUPERSEDES D-123, TERMINATES D-125, AMENDS +> D-122/D-124/D-127(deferred)/D-128/D-131(gated)/D-134, PRESERVES D-126/D-132-addendum/D-138. **Model B +> remains the LIVE shape until the redeploy executes** (this ruling decides the shape, builds NOTHING -- +> hard rule 1). **STILL OWED (redeploy design time; several GATED on live measurement per hard rule 2; +> all recorded in D-144):** DEC-15 power-key mitigation mechanism incl. REACH (+ SEC-034); DEC-14/16 the +> (a) control + SEC-010 successor; DEC-08/09 rack / D-131 retirement (live-re-measure-gated); DEC-24 the +> dc0<->dc1 mesh + cross-DC Ceph path; the 13 owed artifacts + 9 owed live measurements. Next-free now +> D-145. Scope handoff (history): `docs/audit/container-elim-pass/SCOPE-AND-EXECUTION-PLAN.md`. > > **dc0 checkpoint scope (operator 2026-08-08): "activate + smoke-test"** -- networks + Octavia (1 test > LB) + Designate (1 test zone) + wrap gates (cloud-assert BOM, controller backup, verify-live diff --git a/docs/design-decisions.md b/docs/design-decisions.md index 7dd90e8..6b3c252 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -4864,6 +4864,11 @@ ## D-123: VR1 DC site-down DR model -- node-VM placement + the per-DC MAAS headend (resolves a D-122/D-103 tension) [ARCH] +> **SUPERSEDED 2026-08-10 by D-144** (GA-R5, DEC-01: "New D-144, supersedes D-123"). The 10.13 +> redeploy ELIMINATES the Model-B `vvr1-dcN` containment layer and flattens to Option 1 (node VMs +> directly on vcloud libvirt + a per-DC `vr1-dcN-client` VM). This entry is retained as history -- +> **do not build from it**; Model B remains the LIVE shape only until the redeploy executes. See D-144. + **Status:** ADOPTED **Model B** (operator ruling 2026-07-16 -- see the AMENDMENT at the end of this entry). The earlier "ADOPTED Model A" (2026-07-15) was INFERRED from "Do it all now" (a delivery-workflow directive, NOT an A/B answer -- Model A/B was never a presented option) and is @@ -5083,6 +5088,11 @@ ## D-125: VR1 Model B per-DC ISP egress -- bridge-in single-NAT (resolves OBS-3's design gap; egress efficacy is a deploy-time gate) [ARCH] +> **TERMINATED 2026-08-10 by D-144** (container-layer elimination). The bridge-in single-NAT existed +> only to give the `vvr1-dcN` containment VM egress (OBS-3); with the containment layer gone the DC +> edge WAN attaches directly to the per-DC `site-wan` NAT and `modules/wan-bridge` retires -- no +> successor. Retained as history. See D-144. + **Status:** ADOPTED (operator ruling 2026-07-16 -- "DC0 and DC1 are supposed to have ISP connections", then chose bridge-in over double-NAT). Governs how each DC's simulated ISP uplink (`vr1-dc0-wan`, D-122) egresses under D-123 **Model B**. Authored present-only; the L2-NAT path is a DEPLOY-TIME gate (see below) @@ -5342,6 +5352,11 @@ ## D-128: VR1 operating model -- Claude on the vcloud jumphost; two-plane origin; workstation tailnet is the human path [OPS] +> **AMENDED 2026-08-10 by D-144** (container-layer elimination). With the `vvr1-dcN` containment VM +> eliminated, Plane 2's definition SHRINKS to MAAS / NetBox / inner-tofu; the DC substrate build +> becomes wholly Plane 1 (one flat vcloud-local `tofu` apply, no qemu+ssh substrate dial). The +> two-plane model itself stands. See D-144. (The D-138 amendment to Plane 2 is preserved.) + **Status:** RULED 2026-07-17 (operator: "I will go with your recommendation"). Recorded + folded into the operating skill so no future session re-derives it. Governs WHERE work originates, not any built surface. @@ -6222,6 +6237,18 @@ onto D-134 (the per-DC identity standard) rather than a new number -- naming is the sibling of the octet map this decision already governs. +## D-134 -- AMENDMENT (2026-08-10): utility-band .8 = the per-DC container-elim client VM (vr1-dcN-client) + +**Status: RULED 2026-08-10 (GA-R5)** as DEC-13 of the D-144 container-layer-elimination ruling. +Question as presented: whether the new per-DC `vr1-dcN-client` VM (D-144 -- inherits the D-138 +cloud-facing client role once the containment VM is eliminated) takes the next-free utility octet or +a different one. **Operator selection, exact utterance: ".8 / vr1-dcN-client".** The standing cross-DC +utility-band map GAINS `.8`: `.4` artifact / `.5` juju / `.6` MAAS region / `.7` tailscale / **`.8` +client**. Reserved at EVERY DC per this map's standing-cross-DC-standard clause (divergence at the +same octet is a defect). Under D-143 octet-preserving addressing it reads `10.13.8.8` (dc0) / +`10.13.68.8` (dc1) on metal-admin. Governing ruling: D-144. The client VM is a flat non-hypervisor +sibling (`expose_nested_virt=false`) -- the name deliberately avoids the eliminated `vvr1-dcN` class. + ## D-135: ADOPTED (AMENDED 2026-07-24) -- VR1 per-DC artifact mirror realization (D-107 build-out, staged) [ARCH] **Status:** ADOPTED 2026-07-23 (Stage 4, branch dc-dc-stage4-phase3-maas-deploy). Two @@ -8179,3 +8206,124 @@ every downstream consumer reads. Roosevelt relevance: the octet-preserving-shift discipline and the "never re-label a live record; give the new build its own role" pattern (B2) transfer directly to any future re-IP or parallel-build. + +## D-144: ADOPTED -- VR1 container-layer ELIMINATION + layered module workflow (SUPERSEDES D-123 Model B; the 10.13 redeploy flattens to Option 1) [ARCH] + +**Status: RULED 2026-08-10 (GA-R5).** The dc0/dc1 CONTAINMENT VM layer (`vvr1-dcN`, D-122/D-123 +Model B: `vcloud outer libvirt -> vvr1-dcN inner libvirt -> node VMs`) is ELIMINATED as part of the +D-143 `10.13.0.0/16` redeploy. Node VMs become flat siblings directly on vcloud's libvirt +(`vcloud libvirt -> node VMs`, nesting depth 4->2, the VR0-proven shape). This ruling DECIDES the +shape; it does NOT build or execute -- **Model B remains the LIVE shape until the redeploy runs** +(hard rule 1). Planning pass of record: `docs/audit/container-elim-pass/` (multi-agent READ-ONLY, +phases 0-4 + a final advisor; agents recorded as "the administrator"/"the advisor", no model name +asserted). Operator report: `docs/audit/container-elim-pass/operator-report.md`; full change-set + +module design + sequencing: `FINAL-PLAN.md`; advisor review: `FINAL-advisor-review.md`. Next-free +verified at ruling time (`ledger-scan`: highest-header D-143 -> D-144 free; SEC-034 next-free). + +**Ruled in THREE operator exchanges (GA-R5; option selections are the exact utterances):** + +- **Exchange 1 (DEC-01 -- the decision FORM).** Question as presented: "How should the + container-layer elimination (flatten Model B -> Option 1 flat topology + per-DC client VM, + adopted for the 10.13 redeploy) be recorded -- a new D-144 that supersedes D-123 (Model B), or an + amendment appended to D-123 in place?" **Operator selection, exact utterance: "New D-144, + supersedes D-123".** CONSEQUENCE: minted as its own entry naming D-123 SUPERSEDED (following the + D-143 precedent -- which amended D-115 and terminated a D-101 clause yet was minted as its own + number); the reconciliation ledger below is adopted with it. + +- **Exchange 2 (DEC-11 -- root topology).** Question: "Ratify the tofu root shape for the flat + topology -- (B) shared-outer + per-DC-flat roots (3 roots: unchanged outer + two per-DC roots = + today's inner roots minus the qemu+ssh indirection), or a single merged root for both DCs?" + **Operator selection, exact utterance: "(B) shared-outer + per-DC-flat".** CONSEQUENCE: 3 roots; + per-DC state-blast-radius isolation; destroy scoping re-earns D-122's one-command site-down almost + literally; the client VM's apply groups with its DC's flat root. [OPS]-grade shape, ratified in the + delivery change-set. NOTE: (B) is tofu STATE isolation only -- it mitigates NONE of the three + isolation concerns below (both DCs still share vcloud's one kernel). + +- **Exchange 3 (DEC-13 -- client-VM octet + name).** Question: "The new per-DC `vr1-dcN-client` VM + needs a utility-band octet. D-134's standing map is `.4` artifact / `.5` juju / `.6` MAAS region / + `.7` tailscale -- all occupied. Adopt `.8` (next free, reserved cross-DC) and the name + `vr1-dcN-client`?" **Operator selection, exact utterance: ".8 / vr1-dcN-client".** CONSEQUENCE: + the client VM takes utility-band `.8` (`10.13.8.8` dc0 / `10.13.68.8` dc1 under D-143 + octet-preserving); name avoids the eliminated `vvr1-dcN` class; filed as a dated D-134 AMENDMENT + (this session) so the standing octet map stays self-contained. + +**What is adopted (the shape -- Option 1, operator-confirmed at the Phase-0 gate 2026-08-09, ruled +here):** flat node VMs on vcloud libvirt + one small non-hypervisor `vr1-dcN-client` VM per DC +(~4 vCPU / 8192 MiB / 80 GiB; metal-admin + transit legs) carrying the D-138 cloud-facing client role +and that DC's credential residencies. ELIMINATED: the containment VMs + their inner libvirtd, the two +inner tofu roots AS roots, the bootstrap gate's `--host-nodes` duty (~134 lines), the qemu+ssh +provider dial + its D-126 per-env keys (no successor), `modules/wan-bridge` + the D-125 bridge-in +plumbing. RE-HOMED with zero body changes: the six planes, the 12 node VMs, the DC edge (WAN attaches +directly to the per-DC `site-wan` NAT). One new IaC module `modules/dc-site` composes the per-DC +stack. The MAAS region stays on `vr1-dcN-maas-01` (.6, D-132 addendum -- unchanged). Structural win: +the container layer was the ONE violation of the repo's IaC->procedure boundary (the inner root's +qemu+ssh provider is IaC reaching across a live-dial boundary); flattening removes it structurally. + +**The accepted power-key blast-radius tradeoff (named in the body per GA-R3 A1, NOT buried in a SEC +row):** flattening puts both DCs' node fleets + `voffice1` on vcloud's ONE libvirtd (verified: +`voffice1` is a vcloud-libvirtd domain, `opentofu/main.tf:175`; no libvirt access-scoping exists +in-repo). Re-deriving node power to that libvirtd would give each DC's region VM virsh control over +EVERY vcloud domain, so **SEC-012/016's per-DC power-key separation becomes VACUOUS** absent a +mitigation. Adopted knowingly; mitigated by the owed power-key control (DEC-15, below); its gate is a +NEGATIVE test (the key CANNOT reach the other DC / voffice1), never existence-only. + +**Decision reconciliation (verbs -- from the pass's Phase-4 ledger, each governing block read in full +during the pass):** +- **D-123 (Model B) -- SUPERSEDED.** Its core node-placement ruling is reversed; history stays + intact (append-only). Do not build from D-123. +- **D-125 (bridge-in) -- TERMINATES.** OBS-3's precondition (nested containment egress) disappears + with the nesting; `modules/wan-bridge` retires, no successor. +- **D-122 (site shape) -- AMENDS.** Intent preserved; the one-command site-down LITERAL + (`virsh destroy vvr1-dcN`) regresses to a root-scoped `tofu destroy` + an emergency virsh-loop + lever -- a real, honestly-stated capability loss re-earned by owed tooling. +- **D-124 (transit) -- AMENDS.** Scheme-A addressing survives on the client VM (the new transit + bearer); the Model-B sizing-void clause is re-caused (exact figure owed). +- **D-127 (autostart) -- AMENDS (DEFERRED).** The containment row loses its object; the client-VM + autostart value is owed (DEC-22) -- the D-127 amendment is filed once that value is ruled. +- **D-128 (operating model) -- AMENDS.** Plane 2's definition shrinks to MAAS/NetBox/inner-tofu; the + substrate build becomes wholly Plane 1 (no qemu+ssh substrate dial). The two-plane model stands. +- **D-131 (node DNS) -- AMENDS (GATED).** Retire-with-evidence; independently triggered by D-132's + per-DC regions; GATED on an owed current-day live re-measure; the dc0/dc1 asymmetry (dc1's + forwarder currently load-bearing, dc0's not) is real and closes in the rebuild. +- **D-134 (octet map) -- AMENDS.** Adds `.8` = `vr1-dcN-client` (this session's dated amendment); + bands/CIDRs otherwise unchanged. +- **D-126 / D-132-addendum / D-138 -- PRESERVE.** Principles intact; only the concrete realization + changes (D-126: the qemu+ssh consumer's key retires with no successor; D-138: the client role's + concrete host moves from `vvr1-dcN` to `vr1-dcN-client`, IN the DC as the principle requires). +- **D-114 / D-133 / D-139 / D-140 / D-143 -- UNTOUCHED.** Named to prevent scope creep -- D-114 + especially: Office1/voffice1's containment is a DIFFERENT, KEPT pattern, not eliminated here. + +**OWED (this ruling decides the SHAPE; the following are ruled/built at redeploy design time, several +GATED on owed live measurements -- no inferred values, hard rule 2. Full spec: `FINAL-PLAN.md` +Section 7):** +- **DEC-15 -- the power-key mitigation MECHANISM** (restricted SSH key / per-DC virsh wrapper / + polkit ACL) + its SEC row (SEC-034 next-free). Must decide REACH (how an in-plane `vr1-dcN-maas-01` + reaches vcloud's own libvirtd WITHOUT a host address on a plane bridge -- which the (a) control + forbids) AND authorization together. GATED on vcloud's live polkit/libvirt config. CRITICAL PATH: + six test/tool edits are frozen until it rules; the interim RED on `dc-selector`/`maas-region-power-key` + is the wanted fail-loud state. +- **DEC-14 / DEC-16 -- the (a) cross-DC host isolation control** (vcloud-level nftables asserting no + inter-DC/inter-plane forwarding; a mechanical `--check` gate + SEC row) and the SEC-010 transit-drop + successor (endpoints = client VM + voffice1; new-row-vs-SEC-010-amendment disposition). Two distinct + controls; neither exists yet. +- **DEC-08 / DEC-09 -- rack-controller retirement + D-131 retire-with-evidence.** GATED on a + current-day live re-measure of `primary_rack`/rackd state at BOTH DCs (the pass cites are 2-10 days + old). +- **DEC-24 -- the dc0<->dc1 mesh-leg consumer + cross-DC Ceph replication path** (raised by the + advisor review). `virbr5` (the netem target, `opentofu/main.tf:334-356`) is the D-100/D-108 + cross-DC replication carrier; the pass reassigned the Office1-transit legs to the client VM cleanly + but left this leg's post-flatten attachment + netem routing undefined. Partly pre-existing (dc1 HELD + -> never built), so the flat design must DEFINE it without violating the (a) control. Pairs with + DEC-14. +- **13 owed artifacts + 9 owed live measurements** (teardown primitive, `dc-site` module, the three + isolation controls, R7 revocation checklist, MAAS record-release, FIT-calc extension, geneve/jumbo + live assert, MAC re-measure, ...). All LOGGED, none built. +- **Two-axis discipline:** every redeploy change is attributable to `[D-143]` (10.12->10.13 value + substitution) or `[CE]` (this shape change); four dual-cause items carry `[both]`. `lib-net.sh` + carries ZERO container-elim edits. + +**A1 TEST (GA-R3):** admitted -- SUPERSEDES D-123's core Model-B ruling; a Roosevelt / pre-Roosevelt +build session greps this before laying out substrate shape; and the layered module workflow (L0-L5, +IaC + procedure modules) is the pre-Roosevelt-bare-metal deliverable, with the L1 client-VM / L3 MAAS +/ L4 juju-bundle procedure modules transferring to bare metal UNCHANGED (L0/L2 virtualization IaC and +the two co-residency-specific controls do not transfer). Precedent for the mint-not-amend form: D-143.