# Changelog 2026-08-05 -- Task #2: D-020 vault-metal-only amendment committed + provider-bundle-check harness reconciled Session scope (GA-R2, one changelog per session). Picks up the durability debt the 2026-08-05 (part 2) close left explicitly open: three uncommitted files on the vcloud working tree (the RULED-but-uncommitted D-020 vault-metal-only amendment) plus a RED provider-bundle-check harness (6 fail) and repo-lint L10. All offline; no live-cloud mutation this session. Advisor-reviewed before commit. Branch: `dc-dc-stage5-preconditions`. Stage 5 dc0 remains OPEN. ## Context (measured this session, not carried from prose) - HEAD `a5cf01a` did NOT contain the D-020 2026-08-05 amendment despite its commit message naming "vault metal-only" -- the work was uncommitted on disk. Verified: `git show HEAD:docs/design-decisions.md | grep -c "D-020 -- AMENDMENT (2026-08-05)"` = 0. - BUNDLEFIX-053 (committed `ae06c72`) folded the FULL 13-subordinate HA chain (`vault-hacluster` included) and `num_units: 3` into `bundle.yaml`. Confirmed: 13 `:ha` relations + 13 hacluster subordinates in `bundle.yaml`; `num_units: 3` on mysql/ovn-central/ceph-mon (so the harness rolesep builder must be num_units-aware). - Real checker output MEASURED on the merged dc0 deploy input: `12 clustered VIP(s) ... (0 dual-family)`, `13 hacluster principal(s) all carry a VIP`, vault excluded from the triple count via its own metal-only [ok] line. Dual fixture: `12 ... (12 dual-family)`. These are the numbers the harness assertions were re-pointed to. ## Items ### 1. `scripts/provider-bundle-check.py` -- vault metal-only exception, HARDENED (DOCFIX-210) - WHAT: the vault VIP branch (invariant 9c region) now asserts vault is the metal PAIR (metal-admin + metal-internal), NO provider-public leg, **per-DC and family-aware** against the `--dc` PROVIDER/ADMIN/INTERNAL bands -- replacing the first draft's hardcoded `10.12.4.` literal (which was blind to dc1's `10.12.64.x` provider). The metal pair is STILL band-checked (50-99) and STILL registers in `octet_owner` for uniqueness. Docstring invariant 2 records the exception. - WHY: the ruled D-020 amendment (2026-08-05) makes vault the single non-triple clustered VIP. **Advisor-caught defect in the first draft:** its `continue` ran BEFORE the band check and `octet_owner[h] = n`, silently disarming octet-uniqueness for `.61` -- a second app given `.61` would collide with nothing and pass (a gate that cannot fail; this repo's named failure mode). PROVEN: the reconstructed draft returns rc=0 on a glance-takes-vault's-`.61` input (gap); the fixed checker returns rc=1 `VIP last octet .61 shared by glance and vault` (caught). - REVERT: `git checkout HEAD -- scripts/provider-bundle-check.py` restores the no-vault-exception version (vault treated as a normal triple; the live metal-only overlay would then FAIL the check -- so revert the overlays in item 3 together). ### 2. `tests/provider-bundle-check/run-tests.sh` -- harness reconciled to 58/0 - WHAT: (a) rolesep fixture builder is now num_units-aware -- 3-unit HA apps land on lxd:0/1/2, single-unit on lxd:0, guarded with a `SystemExit` if any `to:` app has num_units>3 (only 3 control machines exist). Fixes T9, broken by BUNDLEFIX-053's `num_units: 3` against the old `to:[lxd:0]` pin. (b) Count assertions re-pointed to the measured values: T16 `12 -> 13` hacluster principals (vault-hacluster now in the BASE bundle, dissolving the old T16/T17 pre/post-overlay ordering distinction -- comment re-pointed; the dc-ha-scaleup.yaml-now-redundant question LOGGED as a Task #1 finding, not fixed here per hard rule 1); T19 `13 -> 12` clustered VIPs; T21/T45 `13 -> 12` clustered + `13 -> 12` dual-family (vault leaves the triple count). (c) NEW failing-direction fixtures T54 (provider leg on vault FAILS), T55 (triple FAILS), T56 (another app taking vault's `.61` octet FAILS -- guards the item-1 defect). Result 49/6 -> 58/0 ALL PASS. - WHY: a bundle change breaks the check's harness even when the script is untouched; every new assertion must be proven able to FAIL (T54-56 have failing fixtures). - REVERT: `git checkout HEAD -- tests/provider-bundle-check/run-tests.sh`. ### 3. `overlays/vr1-dc0-vips.yaml` + `overlays/vr1-dc1-vips.yaml` -- vault metal pair, RE-RENDERED - WHAT: dc0 vault vip -> `"10.12.8.61 10.12.12.61"`; dc1 vault vip the dual-family sextet -> the dc1 metal pair `"10.12.68.61 10.12.72.61"` (provider leg + the D-141-deprecated `fd50:` ULA metal v6 legs dropped). Both stay a v4 metal pair THROUGH a future D-141 rule-3 promotion until a new amendment. **These overlays are GENERATED by `render-dc-overlays.py` from `render/values/*.yaml` (D-136), NOT hand-editable** -- see the FINDING below. Both files were re-rendered from the values files (items 6-7); the diff vs HEAD is EXACTLY the one vault line in each, no other drift. - WHY: implements the D-020 amendment. - REVERT: revert items 6-7 (values) and re-render, or `git checkout HEAD -- overlays/vr1-dc*-vips.yaml`. ### 6. `scripts/render-dc-overlays.py` -- vault metal-only render exception (DOCFIX-210) - WHAT: `render()` gains a `name == "vault"` branch that drops the provider-public leg AND forces v4 (no v6 append) so vault renders exactly the 2-leg metal pair in BOTH v4 and dual-family DCs. Named exception, mirroring provider-bundle-check.py + pre-flight-checks.sh -- fires for every DC's values file (the ruled Roosevelt delta), not a per-DC flag a new DC could omit. - WHY: the overlays are rendered artifacts; the vault metal-only change is only lawful through the renderer (render-drift forbids hand-editing). - REVERT: `git checkout HEAD -- scripts/render-dc-overlays.py` (then vault re-renders as a triple). ### 7. `render/values/vr1-dc0-vips.yaml` + `render/values/vr1-dc1-vips.yaml` -- vault comment - WHAT: vault's per-app `comment:` field updated (dc0) / added (dc1) to the D-020 metal-only note. The comment is part of the rendered bytes, so it belongs in the values file, not the overlay. Octet 61 unchanged; vault stays in the apps list (T12 count still 13). - WHY: carries the amendment provenance into the rendered overlay. - REVERT: `git checkout HEAD -- render/values/vr1-dc0-vips.yaml render/values/vr1-dc1-vips.yaml`. ### 8. `scripts/pre-flight-checks.sh` -- CHECK 1 vault metal-only exception - WHAT: the awk VIP validator gains app-name tracking (2-space header lines) and a `name == "vault"` branch accepting exactly the metal PAIR (metal-admin + metal-internal, octet-aligned, in-band, no provider column) as OK. `VIP_COUNT_EXPECT` stays 13 (vault still joins the OK count). Without this, vault's 2-leg pair was reported MALFORMED (not 3/6 IPs). - WHY: this is P4's live VIP validator; it is a fourth consumer of the vault VIP shape. - REVERT: `git checkout HEAD -- scripts/pre-flight-checks.sh`. ### FINDING (report to operator) -- overlays are RENDERED; render-drift was ALREADY red pre-session - The overlays are generated from `render/values/*.yaml`; `tests/render-drift` byte-compares every values file against its overlay and FAILS with "re-render, do not hand-edit the overlay." Task #2's guidance ("edit overlays/vr1-dc1-vips.yaml vault->metal pair") and the part-2 session's dc0 hand-edit BOTH violated this. **render-drift + render-dc-overlays + pre-flight-checks were red at the part-2 close but NOT in its "RED AT CLOSE" list** (which named only repo-lint L10 + provider-bundle-check). The part-2 dc0 overlay edit was non-reproducible from the moment it was made. Resolved here by teaching the renderer (item 6) + values (item 7) and re-rendering, per the advisor -- the amendment is RULED, so this is OPS implementation, not a new decision. ### Harness updates for items 6-8 - `tests/render-dc-overlays`: T15 count 13->12 dual-family (vault excluded) + vault metal-only [ok]; NEW T15b proof-of-teeth (renaming vault restores the 6-leg sextet -- the exception is name-keyed). T3b/T14 heal on re-render. 20/3 -> 24/0. - `tests/render-drift`: heals on re-render (2/2 -> 4/0). - `tests/pre-flight-checks`: T27/T28 heal; NEW T28b proof-of-teeth (vault as a triple FAILS CHECK 1). 29/2 -> 32/0. ### 4. `docs/design-decisions.md` -- D-020 amendment text finalized - WHAT: the RULED 2026-08-05 D-020 amendment (vault metal-only) CONSEQUENCE section augmented -- dc1 overlay now done (not "when it exists"), the per-DC/family-aware checker + retained band/octet gates recorded, and the "stays a v4 metal pair through D-141 rule-3" durability note added so a later dual-stack session does not "restore" the dropped v6 legs as an oversight. - WHY: the amendment was operator-ratified ("Ratify as written") but uncommitted. - REVERT: `git checkout HEAD -- docs/design-decisions.md`. ### 5. `docs/CURRENT-STATE.md` -- D-121 12/14 -> 14/14 + D-020 amendment; L10 satisfied - WHAT: the D-121 HA scale-up status updated to 14/14 (keystone + vault added), with the D-020 vault-metal-only landing recorded. **EVIDENCE GAP DECLARED (GA-R1 rule 2):** the 14/14 count is OPERATOR-ATTESTED + part-2 records, NOT yet a committed `juju status` capture -- flagged OWED, riding the F4 live-verify sweep. Not papered over. - WHY: L10 requires the design-decisions Status-line change to touch CURRENT-STATE in the same commit; and the committed status still read 12/14. - REVERT: `git checkout HEAD -- docs/CURRENT-STATE.md`. ## Verification (this session) - `provider-bundle-check` 58/0; `render-dc-overlays` 24/0; `render-drift` 4/0; `pre-flight-checks` 32/0. Full gauntlet re-run after the renderer work. - Draft-vs-fixed collision proof captured (rc=0 draft / rc=1 fixed). - Re-rendered overlays diff vs HEAD = exactly the one vault line each (no other drift). - `scripts/repo-lint.sh` -> 0 fail (1 pre-existing L1 non-ASCII warn, unchanged). ## Owed / NOT done this session (out of Task #2 scope) - Live `juju status -m vr1-dc0` capture backing 14/14 (F4 sweep, next live step). - F8 ceph-radosgw "Services not running: radosgw" verify; F9 dc0 rack repo-stage staleness. - Task #1 post-wave bundle/overlay review, incl. whether dc-ha-scaleup.yaml is now redundant.