diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 8a9783e..e114c01 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -46,7 +46,8 @@ > (self + fable advisor) decision package -- NOT a ruling, mutates no status. Conclusion: the > backlog is overwhelmingly correctly-deferred; the re-IP GA-R5 ruling (would be D-143) is the > only item gating the end goal; R7 teardown-credential-revocation + R16 10.13 naming-DOCFIX are -> the two re-IP-coupled gaps to build. `docs/audit/open-items-review-20260809.md`. +> the two re-IP-coupled gaps to build. `docs/audit/open-items-review-20260809.md`; sweep: +> `docs/audit/queued-findings-20260809-open-items-review.txt`. > > **dc0 checkpoint scope (operator 2026-08-08): "activate + smoke-test"** -- networks + Octavia (1 test > LB) + Designate (1 test zone) + wrap gates (cloud-assert BOM, controller backup, verify-live diff --git a/docs/archive/session-ledger-rotated-20260809.md b/docs/archive/session-ledger-rotated-20260809.md index ee77be0..6d5effb 100644 --- a/docs/archive/session-ledger-rotated-20260809.md +++ b/docs/archive/session-ledger-rotated-20260809.md @@ -29,3 +29,27 @@ - OWNED: shipped the substrate commits without re-running the gauntlet -> node-vm exact-count 11/66->12/72 went red, caught only at the savegame gauntlet (the EXACT 2026-07-30 lesson this harness's own comment records, repeated); v6-posture mis-frame (operator corrected before it biased Decision B); app-aggregate PO: near-miss (caught per-unit); jget + g3-harness bugs (caught by fixtures); ADVISOR caught a would-be D-143 mint. - Gates: repo-lint 0 fail (1 legacy warn); gauntlet ALL GREEN 101 AFTER the node-vm reconcile. Sweep: docs/audit/queued-findings-20260807-tailscale-substrate.txt (O1-O4 FIRST SURFACE). Body: docs/changelog-20260806-step34-g3-probe.md. - NEXT: when Headscale access -> the join + Office1-untagged fix; else MAAS commission/deploy/carve/install the 3 VMs + the dc1 region setup; then Horizon-over-tailnet confirm closes Step 3.3. Status ONLY in CURRENT-STATE.md. + + + +## SESSION CLOSE 2026-08-07 (dc0 tailscale + dc1 region) -- dc0 .7 carved-and-ready; naming convention; vr1-dc1-region LIVE (bounded, GA-R4) + +- Branch dc-dc-stage5-preconditions; commits `d36d815..9216bdf` (+ a final close) all pushed; voffice1 synced. Scan: 4 open decisions, SEC 29, next-free D-143 / DOCFIX-213 / BUNDLEFIX-059 (NO new numbers). Body: `docs/changelog-20260807-dc0-tailscale-provisioning.md` (Items 1-10). Sweep: `docs/audit/queued-findings-20260807-dc0-tailscale-provisioning.txt` (F1-F4). +- dc0 `.7` DRIVEN TO CARVED-AND-READY (gated): power->commission->carve pass=8/0 (metal-admin 10.12.8.7 + provider-public 10.12.4.7, no br-ex)->deploy jammy, both legs live. C2 correction: it had already self-enlisted (`known-marten`). Join still blocked (PLAIN key + no Headscale ACL; `.7` reachable only via vr1-office1-svc). +- NEW aux-carve tooling: `dc-node-carve.sh` is_tailscale/is_region/is_two_plane_host + lib-hosts CARVE_AUX_HOSTS (isolates aux VMs from HOSTS consumers); harness 63/0; gauntlet 101. +- NAMING convention corrected + RULED standing: renamed dc0 machines to `vr1-dc0-*`; **D-134 AMENDMENT** ("Record that as the preferred naming convention going forward") + lib-hosts comment + memory. +- dc1 RULED "No migration. Build region on DC1 correctly." + "Rebuild fresh into dc1-region"; then BUILT it: `.6` (`vr1-dc1-maas-01`) power->recommission->carve (10.12.68.6/10.12.64.6, `--profile admin`)->deploy jammy; **vr1-dc1-region MAAS LIVE** (maas 3.7.2 + postgresql 16.14; the shared vr1-office1-svc key is ON VCLOUD `~/vr1-office1-creds/office1_svc_ed25519`; reached the .6 from vcloud; snap egress via snapd proxy; operator-authorised credential one-shot, creds 0600 on the .6, never in context; `10.12.68.6:5240/MAAS/`->301). PROFILE registered+verified (voffice1 tunnel -L 5243; rack vr1-dc1-maas-01, 0 machines). +- OWNED: nearly read "powered off" as "not enlisted" (measured first); advisor caught the unverified provider-public leg + the missing bookend; a false-negative `curl -x` 400 vs snap-egress-works (tested definitively); `run-logged.sh` NOT opened (O3, 3rd consecutive). +- OWED: consolidate the .6 MAAS creds to `~/vr1-dc1-creds/` (SEC-020); RE-OPEN the voffice1:5243 tunnel after any reboot before `maas vr1-dc1-region ...`. +- NEXT (dc1, `--profile vr1-dc1-region --expect-rack vr1-dc1-maas-01`, tunnel up): `dc-region-topology.sh apply` (6-plane) -> `maas-region-power-key.sh` (.6 snap) + `dc-plane-ipam.sh` + DHCP + jammy image sync -> import office1_svc pubkey -> REBUILD 9 nodes+juju+.7 fresh in (delete from Office1 admin -> enlist/commission/deploy/carve, name vr1-dc1--NN). Separately dc0 Step 3.3 on a TAGGED key + Headscale. +- NEXT (NetBox, operator-flagged -- do not miss): record this session's new IPAM objects into `office1-netbox` (live apex, DOCFIX-195) -- dc0 .7 + dc1 .6 region VM + new vr1-dc1-region + dc1 .7 (when live) + D-134 utility `.4-.9` assignments + dc0 renames. Enumerated: changelog-20260807 Item 11. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-08-07 (part 2) -- dc1 region STANDUP (topology/IPAM/DHCP cutover/power-key) + SEC-031 edge REBUILT + NetBox util-host importer (bounded, GA-R4) + +- Branch dc-dc-stage5-preconditions; 2 commits (b6798df, 2b476e4) pushed at close; voffice1 pulled to sync. Scan: 4 open decisions, **SEC 29->28 (SEC-031 CLOSED)**, next-free D-143 / DOCFIX-213 / BUNDLEFIX-059 (no new numbers assigned). +- **F:** built `netbox/dc-util-hosts-import.py` (+harness 19/19) closing the D-134 utility-HOST IP gap; landed 8 ip-addresses into office1-netbox (186->194, ids 187-194). `.4` artifact + dc1 `.5`/`.7` DEFERRED (S3). +- **dc1 region STANDUP** (`--profile vr1-dc1-region`): topology apply 40/0; IPAM carve-v6 6/6 + reserve 13/13 (check 24/0); DHCP CUTOVER off-admin->on-region, `.6` sole server (no dual-serve, false-alarm resolved); power-key install 9/9 (SEC-016). Captures `docs/audit/dc1-*-20260807`. +- **SEC-031 CLOSED:** dc1 edge REBUILT via the proven dc0 procedure (operator "look back at dc0"), `dc-egress-check dc1` 8/8, `.6` egress restored -> now a RUNBOOK (`runbooks/dc-edge-rebuild.md`) + tool (`scripts/opnsense-console-rebuild.py`) per operator "log accurately so we don't re-derive". jammy image sync TRIGGERED + downloading at close. +- **OWNED:** `pgrep -c dhcpd` self-match false-alarm (instrument #21); recalled DHCP range .100-.200, MEASURED .201-.254; shipped `opnsense-console-rebuild.py` WITHOUT a harness (F1 owed); reserve skipped=6 glance owed; run-logged NOT opened (F2, 4th+ consecutive). +- Gates: repo-lint 0 fail/1 legacy warn; gauntlet ALL GREEN (102); ledger-scan reconciled. Ledger rotated (2026-08-05 x2 -> archive/session-ledger-rotated-20260807.md). +- **NEXT:** verify jammy sync completes; **D** (import ssh keys into vr1-dc1-region) -> **E** (rebuild 9 nodes+juju+.7 FRESH, destructive batches of 3, SEC-028 in-region juju mint + SEC-026 residency) -> **G** (dc1 .6 creds SEC-020); the 2 NetBox findings (S3); the console-driver harness (F1). Sweep: `docs/audit/queued-findings-20260807-dc1-region-sequence.txt` (F1-F3 FIRST SURFACE). Body: `docs/changelog-20260807-dc1-region-sequence.md`. Status ONLY in CURRENT-STATE.md. diff --git a/docs/audit/queued-findings-20260809-open-items-review.txt b/docs/audit/queued-findings-20260809-open-items-review.txt new file mode 100644 index 0000000..35ae691 --- /dev/null +++ b/docs/audit/queued-findings-20260809-open-items-review.txt @@ -0,0 +1,143 @@ +SAVEGAME SWEEP -- 2026-08-09 session: open-items review (D/SEC/DOCFIX/BUNDLEFIX) + live-free confirmation +======================================================================================================= + +Session shape: READ-ONLY analysis + operator-authorized LIVE read-only discovery. No cloud +mutation. One durable deliverable committed+pushed this session: f4aee80 +(docs/audit/open-items-review-20260809.md + a CURRENT-STATE pointer). This sweep proves the +session's substance is on a repo surface so a /clear loses nothing. + +PRIMARY DURABLE SURFACE: docs/audit/open-items-review-20260809.md (committed f4aee80). Nearly +all session substance lives there. Items below are either (A) ALREADY ON SURFACE (where), or +(B) FIRST SURFACE (this file is the durable home). FIRST SURFACE items lead. + + +== FIRST SURFACE (transcript-only until this file) == + +FS1. THE REPEATABLE METHOD for the two completed re-IP live-free checks (the review appendix + records the RESULTS; the exact commands were transcript-only). Fills the ruling-prep's + noted tooling gap (reip-1013-...:268 "is-this-prefix-free checker") as a MANUAL procedure: + - Check #2, live NetBox apex (from vcloud; token never printed): + set -a; . ~/vr1-office1-creds/vr1-netbox-sandbox.env; set +a + python3 netbox/office1-record-dump.py --out .json # tested tool, read-only + # then check prefixes/aggregates/ranges/ips for 10.13.0.0/16 (10.12 = positive control) + Result 2026-08-09: 10.13 = 0 objects; 10.12 = 149. office1-netbox reachable FROM vcloud + (10.10.1.10:8000; the ruling-prep's "unreachable from vcloud" caveat was over-stated -- + the record env lives on vcloud and vcloud has L3 to 10.10.1.10). + - Check #1, Headscale/tailnet routes (from the live office1-tailscale node, on the tailnet): + ssh office1-tailscale 'tailscale status --json' # extract per-peer AllowedIPs + # subnet routes only (skip /32,/128); check overlap vs 10.13.0.0/16 (10.12 = control) + Result 2026-08-09: no 10.13 overlap; positive control reproduced the exact 10.12 + collision (vopenstack-jesse-tailscale advertising 10.12.4.0/22 + 10.12.8.0/22). + RECOMMENDATION (logged, not built -- hard rule 1): if the operator wants this repeatable, + build the ruling-prep's "is-this-prefix-free" read-only checker wrapping these two probes. + +FS2. ACCESS / ENVIRONMENT facts confirmed live this session (some partially in the review + appendix; consolidated here so none is lost): + - tailscale is NOT installed on vcloud (the D-107 workstation path is the human tailnet + route; vcloud reaches the tailnet only via a tailnet node like office1-tailscale). + - office1-tailscale (10.10.1.11) runs tailscale 1.98.9 and is the usable tailnet vantage. + - The shared self-hosted tailnet (tailscale.baldurkeep.com) ALSO carries OTHER projects: + Roosevelt (10.17.4.0/22, 10.17.8.0/22, 10.0.0.0/24), willamette (10.1.0.0/24, + 10.16.0.0/24), Office1 (10.10.0.0/22). 10.13.0.0/16 is clear of ALL of them -- so the + re-IP does not collide with Roosevelt or willamette either, not just the live VR0 cloud. + - VR0 (vopenstack, logxen's live cloud) is a SEPARATE TRUST DOMAIN: 10.12.64.1:22 + unreachable from vcloud; no VR0 juju/openrc/clouds.yaml on vcloud; juju not installed on + vcloud. VR0 is reachable only over the tailnet (which vcloud is deliberately not joined + to -- STOPPED tailscale workstream). => re-IP owed check #3 (VR0 internals) is an + operator accept-or-run-from-workstation choice, NOT completable from the jumphost. + +FS3. RAW CAPTURES ARE EPHEMERAL. The apex dump ($CLAUDE_JOB_DIR/tmp/apex-live-20260809.json) + and tailnet json live in the job tmp dir and are CLEANED when the job is deleted. Their + DERIVED findings are durable (review appendix + FS1), but the raw JSON is not retained. + Not a loss (re-runnable via FS1); recorded so no one hunts for a missing capture path. + + +== ALREADY ON SURFACE (verified by grep) == + +OS1. The full open-items review + all recommendations R1-R16, the 28-SEC partition, the P5=11 + correction, the SEC bucketing, the two-pass advisor consensus: + docs/audit/open-items-review-20260809.md (committed f4aee80). + +OS2. re-IP 2/3 live-free checks PASS + check#3 accept-or-run + review pointer: + docs/CURRENT-STATE.md (pointer block added under the reip-prep pointer, f4aee80). + +OS3. Credential residency inventory (dc0 rack / region VM / voffice1 shadow stores): + open-items-review-20260809.md Appendix item 5. + +OS4. dc0 checkpoint state 66 machines / 162 units active: measured live and matches + CURRENT-STATE section 1 (already recorded there pre-session). + +OS5. The 10.13 naming-collision literals (netbox/README.md:49, test_logic.py:265): + open-items-review-20260809.md R16 + they are the live files themselves. + + +== CONTRADICTION DETECTOR (measurement vs standing docs -- all logged as recommendations) == + +CD1. P5 acceptance recorded as "6 findings" (CURRENT-STATE / SEC-028) vs live authoritative 11 + on voffice1 -- but the delta is BY DESIGN (matrix grew 101->121 via SEC-027/028/029). Not + a doc defect; a note owed when P5 is re-cited. Review Section 3f. NO ACTION here. + +CD2. SEC-021(a) record text ("needs a decision between RE-MINT and locating an off-jumphost + copy") is stale -- SEC-032 located+minted the copy; S2 still RED because the DERIVED + manifest was not regenerated. Review R11. Recommendation only (hard rule 1). + +CD3. SEC-ledger "CURRENT-STATE G14 reads 12 / reconciles at Stage 4 close" count-notes + (SEC-017/020/023) are stale -- CURRENT-STATE now carries 28, Stage 4 long closed. + Review R13. Recommendation only. + +CD4. creds-matrix note n-dc0-edge-api-absent (creds-matrix.tsv:76 / notes:123) factually stale + (the cred now exists). Review R12 + SEC-032 already flags it. Recommendation only. + + +== RULING FIDELITY == + +RF1. NO GA-R5 rulings this session (analysis only). The operator directives were operational, + not rulings: (a) "Run as much discover as you need on the live environment ... full + permission into any system for this entire session" (authorized live read-only discovery); + (b) "Yes, run the savegame and present" (this bookend + present the re-IP ruling next). + Neither mints a D-number. + +RF2. The re-IP GA-R5 ruling (would be D-143) is NOT minted -- it is to be PRESENTED to the + operator (the session's next action). Grep next-free again at ruling time. + + +== AS-EXECUTED LOG == + +AX1. run-logged.sh was NOT opened this session -- correctly, no cloud MUTATION occurred. All + live access was read-only (NetBox dump, tailnet status, juju status, creds-matrix, ls of + credential dirs by name only, tcp reachability probes). Recorded so the absence of an + as-executed log for this window is explained, not a silent gap. + + +== OWNED (own-mistakes; all corrected before reaching the operator as fact) == + +OW1. Ran the HOST-DEPENDENT P5 gate (creds-matrix --tier2) on VCLOUD and framed the result as + "P5 silently grew to 12, you now face 12" -- a manufactured decision. Authoritative host is + voffice1 (11 findings); the count grew 101->121 BY DESIGN (SEC-027/028/029). Framing + inverted. Caught by the fable advisor, not self-review. => instrument-currency memory #25. + +OW2. Claimed SEC-021(a)'s creds-matrix E1 was "now CLEAN / effectively resolved" from the RECORD + without measuring; live run showed S2 still RED (manifest regen owed). Corrected same pass. + +OW3. Asserted the SEC categorization "sums to the 28 open rows" while it summed to 24 + (SEC-003/015/016/024 unplaced) -- a completeness claim that failed its own count, the exact + "checker that cannot fail" class. Caught by the advisor; re-partitioned (10/8/3/3/3/1). + +OW4. R15 first offered "declare OR shred" for opnsense-api-rebuild-20260807.txt, which is very + likely the LIVE dc1 edge credential (2026-08-07 rebuild) -- shred was a hazard, not an + alternative. Reframed to declare-only (shred only on a proven-dead live auth-test). + +All four are recorded in open-items-review-20260809.md Section 8 (consensus, corrections +visible) and OW1/OW2 in memory instrument-currency-before-negatives.md #25. + + +== DELIBERATELY NOT DONE (hard rule 1 -- findings logged, not executed) == + +ND1. R7 teardown credential-revocation checklist NOT built (recommendation; build at re-IP). +ND2. No SEC-row edits, no manifest regeneration, no DOCFIX applied, no re-IP ruling minted -- + all are gated exchanges for the operator (the review is the decision package). +ND3. re-IP owed check #3 (VR0 internals) NOT run -- not reachable from the authorized vantage + (FS2); it is an operator accept-or-run choice. + +NEXT: present the re-IP GA-R5 ruling package (would be D-143) with the check#3 accept-or-run +choice. Body: docs/audit/open-items-review-20260809.md. Status ONLY in CURRENT-STATE.md. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index e8e9e84..dd5bec3 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -228,27 +228,9 @@ `docs/archive/session-ledger-rotated-20260809.md`. Rotated at the 2026-08-08 (part 3) close (amphora build FIXED + geneve-over-v6 root-caused) to keep the live ledger under the 300-line cap. -## SESSION CLOSE 2026-08-07 (dc0 tailscale + dc1 region) -- dc0 .7 carved-and-ready; naming convention; vr1-dc1-region LIVE (bounded, GA-R4) - -- Branch dc-dc-stage5-preconditions; commits `d36d815..9216bdf` (+ a final close) all pushed; voffice1 synced. Scan: 4 open decisions, SEC 29, next-free D-143 / DOCFIX-213 / BUNDLEFIX-059 (NO new numbers). Body: `docs/changelog-20260807-dc0-tailscale-provisioning.md` (Items 1-10). Sweep: `docs/audit/queued-findings-20260807-dc0-tailscale-provisioning.txt` (F1-F4). -- dc0 `.7` DRIVEN TO CARVED-AND-READY (gated): power->commission->carve pass=8/0 (metal-admin 10.12.8.7 + provider-public 10.12.4.7, no br-ex)->deploy jammy, both legs live. C2 correction: it had already self-enlisted (`known-marten`). Join still blocked (PLAIN key + no Headscale ACL; `.7` reachable only via vr1-office1-svc). -- NEW aux-carve tooling: `dc-node-carve.sh` is_tailscale/is_region/is_two_plane_host + lib-hosts CARVE_AUX_HOSTS (isolates aux VMs from HOSTS consumers); harness 63/0; gauntlet 101. -- NAMING convention corrected + RULED standing: renamed dc0 machines to `vr1-dc0-*`; **D-134 AMENDMENT** ("Record that as the preferred naming convention going forward") + lib-hosts comment + memory. -- dc1 RULED "No migration. Build region on DC1 correctly." + "Rebuild fresh into dc1-region"; then BUILT it: `.6` (`vr1-dc1-maas-01`) power->recommission->carve (10.12.68.6/10.12.64.6, `--profile admin`)->deploy jammy; **vr1-dc1-region MAAS LIVE** (maas 3.7.2 + postgresql 16.14; the shared vr1-office1-svc key is ON VCLOUD `~/vr1-office1-creds/office1_svc_ed25519`; reached the .6 from vcloud; snap egress via snapd proxy; operator-authorised credential one-shot, creds 0600 on the .6, never in context; `10.12.68.6:5240/MAAS/`->301). PROFILE registered+verified (voffice1 tunnel -L 5243; rack vr1-dc1-maas-01, 0 machines). -- OWNED: nearly read "powered off" as "not enlisted" (measured first); advisor caught the unverified provider-public leg + the missing bookend; a false-negative `curl -x` 400 vs snap-egress-works (tested definitively); `run-logged.sh` NOT opened (O3, 3rd consecutive). -- OWED: consolidate the .6 MAAS creds to `~/vr1-dc1-creds/` (SEC-020); RE-OPEN the voffice1:5243 tunnel after any reboot before `maas vr1-dc1-region ...`. -- NEXT (dc1, `--profile vr1-dc1-region --expect-rack vr1-dc1-maas-01`, tunnel up): `dc-region-topology.sh apply` (6-plane) -> `maas-region-power-key.sh` (.6 snap) + `dc-plane-ipam.sh` + DHCP + jammy image sync -> import office1_svc pubkey -> REBUILD 9 nodes+juju+.7 fresh in (delete from Office1 admin -> enlist/commission/deploy/carve, name vr1-dc1--NN). Separately dc0 Step 3.3 on a TAGGED key + Headscale. -- NEXT (NetBox, operator-flagged -- do not miss): record this session's new IPAM objects into `office1-netbox` (live apex, DOCFIX-195) -- dc0 .7 + dc1 .6 region VM + new vr1-dc1-region + dc1 .7 (when live) + D-134 utility `.4-.9` assignments + dc0 renames. Enumerated: changelog-20260807 Item 11. Status ONLY in CURRENT-STATE.md. - -## SESSION CLOSE 2026-08-07 (part 2) -- dc1 region STANDUP (topology/IPAM/DHCP cutover/power-key) + SEC-031 edge REBUILT + NetBox util-host importer (bounded, GA-R4) - -- Branch dc-dc-stage5-preconditions; 2 commits (b6798df, 2b476e4) pushed at close; voffice1 pulled to sync. Scan: 4 open decisions, **SEC 29->28 (SEC-031 CLOSED)**, next-free D-143 / DOCFIX-213 / BUNDLEFIX-059 (no new numbers assigned). -- **F:** built `netbox/dc-util-hosts-import.py` (+harness 19/19) closing the D-134 utility-HOST IP gap; landed 8 ip-addresses into office1-netbox (186->194, ids 187-194). `.4` artifact + dc1 `.5`/`.7` DEFERRED (S3). -- **dc1 region STANDUP** (`--profile vr1-dc1-region`): topology apply 40/0; IPAM carve-v6 6/6 + reserve 13/13 (check 24/0); DHCP CUTOVER off-admin->on-region, `.6` sole server (no dual-serve, false-alarm resolved); power-key install 9/9 (SEC-016). Captures `docs/audit/dc1-*-20260807`. -- **SEC-031 CLOSED:** dc1 edge REBUILT via the proven dc0 procedure (operator "look back at dc0"), `dc-egress-check dc1` 8/8, `.6` egress restored -> now a RUNBOOK (`runbooks/dc-edge-rebuild.md`) + tool (`scripts/opnsense-console-rebuild.py`) per operator "log accurately so we don't re-derive". jammy image sync TRIGGERED + downloading at close. -- **OWNED:** `pgrep -c dhcpd` self-match false-alarm (instrument #21); recalled DHCP range .100-.200, MEASURED .201-.254; shipped `opnsense-console-rebuild.py` WITHOUT a harness (F1 owed); reserve skipped=6 glance owed; run-logged NOT opened (F2, 4th+ consecutive). -- Gates: repo-lint 0 fail/1 legacy warn; gauntlet ALL GREEN (102); ledger-scan reconciled. Ledger rotated (2026-08-05 x2 -> archive/session-ledger-rotated-20260807.md). -- **NEXT:** verify jammy sync completes; **D** (import ssh keys into vr1-dc1-region) -> **E** (rebuild 9 nodes+juju+.7 FRESH, destructive batches of 3, SEC-028 in-region juju mint + SEC-026 residency) -> **G** (dc1 .6 creds SEC-020); the 2 NetBox findings (S3); the console-driver harness (F1). Sweep: `docs/audit/queued-findings-20260807-dc1-region-sequence.txt` (F1-F3 FIRST SURFACE). Body: `docs/changelog-20260807-dc1-region-sequence.md`. Status ONLY in CURRENT-STATE.md. +At the **2026-08-09 (open-items review) close**, the two **2026-08-07** blocks (dc0 tailscale + +dc1 region; and dc1 region STANDUP + SEC-031 edge rebuilt) were APPENDED VERBATIM to that same +`session-ledger-rotated-20260809.md` (oldest-first preserved) for the same cap reason. ## SESSION CLOSE 2026-08-08 -- dc0 .7 tailscale FIXED (advertise-only) + MAJOR 10.13 re-IP PIVOT + dc0-full-deployment checkpoint plan (bounded, GA-R4) @@ -292,3 +274,12 @@ - OWNED (#24): a wrong "v6 broken -> v4-forced" NEGATIVE rode into the audit record from a localport-sourced test (never tunnels by design); caught by the FABLE ADVISOR, retracted, corrected. - Gates: repo-lint 0-fail (1 legacy warn); gauntlet ALL GREEN (103); ledger-scan reconciled. - NEXT (rebuild-time): confirm fixed ovn-chassis rev or wire the unbracket override; container v6 carve; build the metal-admin-leg-IPv4 gate; DC1 GUA carve + OOB v4 (ride re-IP); present the re-IP GA-R5 ruling. Sweep: docs/audit/queued-findings-20260809-geneve-v6.txt. Body: docs/changelog-20260809-geneve-v6-rootcause-gate.md. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-08-09 (part 2) -- open-items review (D/SEC/DOCFIX/BUNDLEFIX) vs the hardened end goal + LIVE re-IP free-checks (bounded, GA-R4) + +- Branch dc-dc-stage5-preconditions; 1 commit pushed (f4aee80: the review + CURRENT-STATE pointer); this bookend uncommitted (savegame prepares, does not commit). voffice1 synced f4aee80. Scan: 4 open decisions (D-068/131/132/142), SEC 28, next-free D-143/DOCFIX-214/BUNDLEFIX-059 (NO new numbers -- analysis session). +- DELIVERABLE: `docs/audit/open-items-review-20260809.md` -- two-pass (self + fable advisor) decision package, R1-R16. Conclusion: backlog overwhelmingly correctly-deferred; the re-IP GA-R5 ruling (would be D-143) is the ONLY end-goal blocker; R7 (teardown credential-revocation checklist) + R16 (10.13 naming-collision DOCFIX) are the re-IP-coupled gaps to build. +- LIVE (operator-authorized read-only discovery): re-IP owed check #2 (NetBox apex) PASS 10.13=0 / 10.12=149; check #1 (Headscale/tailnet) PASS no 10.13 overlap, the 10.12 collision reproduced as the positive control; check #3 (VR0 internals) NOT reachable from vcloud -> operator accept-or-run. P5 authoritative on voffice1 = 11 findings (6 accepted + 5 dc1 by-design; matrix grew 101->121 by design). dc0 checkpoint 66/162 active; DC-substrate credential residency measured. +- OWNED: ran the host-dependent P5 gate on the WRONG host (vcloud not voffice1) -> a "12 findings, gate grew" manufactured-decision framing, caught by the fable advisor (instrument-currency #25); asserted the SEC partition "sums to 28" when it summed to 24; overstated SEC-021(a) as resolved (S2 still RED); a shred-hazard on a likely-live dc1 token -> declare-only. AND: CLOBBERED `session-ledger-rotated-20260809.md` with a Write (overwrote a tracked file I had not read) -- caught in `git status`, restored from HEAD + appended correctly. +- Gates: repo-lint 0-fail (1 legacy warn); gauntlet ALL GREEN (103); ledger-scan reconciled. Ledger rotated (the two 2026-08-07 blocks -> `session-ledger-rotated-20260809.md`). Memory: instrument-currency #25 added. +- NEXT: present the re-IP GA-R5 ruling (would be D-143) with the check#3 accept-or-run choice; then teardown (build R7's revocation checklist) -> redeploy on 10.13. Sweep: `docs/audit/queued-findings-20260809-open-items-review.txt`. Body: `docs/audit/open-items-review-20260809.md`. Status ONLY in CURRENT-STATE.md.