# Changelog 2026-07-10 -- NetBox roles + aggregates prerequisite (VR1 DC-DC)

## Added

- **`netbox/roles-aggregates-import.py`** -- idempotent, preview-by-default script that creates
  the five missing six-plane IPAM roles and the aggregates that `netbox/dc-dc-prefixes-import.py`
  assumes already exist. Closes gaps G1 + G2 (below).
- **`docs/dc-dc-netbox-buildout-scope.md`** -- consolidated planning/decision scope for the VR1
  NetBox buildout, reconciling the repo (D-100..D-110), a live read of `netbox.baldurkeep.com`
  (v4.5.8, 2026-07-10), and the parallel IPAM-design chats. The authoritative reference the Code
  stream builds from.

## Why -- reconciliation findings (live NetBox vs repo vs design chats)

A live NetBox read surfaced gaps and divergences that the prefixes-import tool would trip on:

- **G1 -- six-plane roles:** only `storage` exists; `provider-public`, `metal-admin`,
  `metal-internal`, `data-tenant`, `replication` were **missing**. The prefixes-import tool
  `die()`s on a missing role by design (does not create roles).
- **G2 -- aggregates:** **0 aggregates** despite ARIN being the RIR and NetBox being the IPAM
  apex (D-010).
- **Authoritative model = D-101** (six-plane, ULA-internal, GUA-external, `/60` tenant). The
  byte-aligned `/32` / `/64`-per-tenant carve from the parallel IPAM-design project **diverged and
  is superseded for the DC-DC buildout** (it used the old role set, `/64` tenants, and a
  nibble-1 VR0/VR1 placement; deployed NetBox + D-101 use the six-plane set, `/60` tenants from a
  separate delegation pool, and nibble-2 VR placement). Details in the scope doc, section 3.
- **Still open (not this delivery):** G5 DC-naming mismatch (`vr1-dc0`/`vr1-dc1` in NetBox vs
  DC1/DC2 in decisions + the prefixes tool's `vr1-dc1`/`vr1-dc2`) blocks the prefixes import until
  resolved; VR1 VLAN groups absent (G4); the three D-101 literals (`ORG_ULA_48`, per-DC
  `DC_GUA_PREFIX`, `DC2_V4_SUPERNET`) still need assignment.

## Aggregate detail

`2602:f3e2::/36` (the HELD allocation = region-0 of the planned `/32`; NOT `/32` -- declaring
space not yet allocated is dishonest for an IPAM apex; update to `/32` after the expand),
`23.157.124.0/24`, `10.0.0.0/8`, `172.16.0.0/12`, and -- only if `ORG_ULA_48` is passed -- the
org ULA `/48`. New RIRs `RFC 4193 ULA` and `RFC 1918` are created for the private aggregates;
`ARIN` is assumed pre-existing (it is).

## Validation

Script previewed (read-only) against live NetBox 4.5.8: correctly reports 12 objects to create
(5 roles + 2 RIRs + 5 aggregates) and 0 pre-existing, `storage` detected as existing, `ARIN`
detected (id=1). Not committed -- Code runs `--commit` after review.

## Sub-decisions requiring ratification (candidate D-111+, assign via ledger-scan)

Per the scope doc section 5: the prefixes tool's per-plane subcarve (align to the deployed `NN`
role mnemonic); DC naming (G5); DC2 v4 supernet value; tenant `/60` confirmation; VR0-DC0
old-model retirement. None block this delivery (roles + aggregates are model-independent).