# Queued findings -- session 2026-08-07: dc0 Tailscale .7 provisioning to carved-and-ready
# Survives-a-clear sweep (savegame Step 3). Status authority is CURRENT-STATE.md.
# Body: docs/changelog-20260807-dc0-tailscale-provisioning.md. Commits d36d815..c8ddfb6.
# Each item says where it already lives, or that THIS file is its first surface.

=== FIRST SURFACE (transcript/changelog-only until this file) ===

F1  GAP -- NO RUNBOOK for building a per-DC MAAS REGION in the DC. The 2026-08-07 operator
    ruling "No migration. Build region on DC1 correctly." makes dc1's next step the standup of
    vr1-dc1-region on vr1-dc1-maas-01 (init / PostgreSQL / image sync / SSH-key import / DHCP /
    rack attach), but no runbook covers it. runbooks/dc-dc-phase3's own gap-#1 notes "No
    OpenTofu module stands up a per-DC MAAS rack controller VM" -- a DIFFERENT gap (substrate).
    The REGION-CONFIG runbook is absent. dc0's region came from the ONE-TIME migration (not a
    procedure). Next session building dc1's region has no tested path -- propose authoring one
    (or extending phase-00-maas-standup, which currently REFUSES vr1-* per the skill). HIGH
    consequence: the ruled dc1 work is blocked on an unwritten runbook.

F2  FINDING (candidate SEC row / D-137 fork) -- vr1-dc0-region injects the vr1-office1-svc SSH
    key into DEPLOYED machines (MEASURED: `maas vr1-dc0-region sshkeys read` = 1 key,
    "vr1-office1-svc"). So the .7 VM (and every dc0-region deploy) is reachable ONLY by the
    holder of the OFFICE1 service key, not a per-DC key. This is cross-DC key reuse in tension
    with SEC-012/SEC-016 (per-DC power/SSH key isolation, "NEVER a cross-DC reuse"). The
    vr1-office1-svc key name is already on surface (CURRENT-STATE, changelog-20260730-migration);
    the finding that it is the DEPLOY-INJECTED key on dc0-region -- and the SEC tension -- is new.
    Pre-existing (region-wide), logged-not-actioned (hard rule 1). Consequence for the join:
    `site-tailscale.sh install` must run as the vr1-office1-svc holder over `ssh -J voffice1,<rack>
    ubuntu@10.12.8.7` (operator has this key; I did NOT fish for it).

F3  DOCFIX candidate -- runbooks/dc-dc-phase3 Step 4 (DOCFIX-200) reads "nodes STAY Ready; NO
    MAAS deploy" as a blanket rule. It is JUJU-NODE-specific (Juju allocates Ready machines and
    cannot allocate a Deployed one). A NON-juju aux VM (the Tailscale .7 router) is NOT in the
    juju model and MUST be MAAS-deployed to carry an OS -- the runbook carries no exception note,
    so a reader could wrongly leave an aux VM in Ready forever. Owed: an aux-VM carve+deploy note
    on phase-3 (the carve-while-Ready -> MAAS-deploy order, since MAAS refuses interface changes
    on a Deployed machine).

F4  ENV/CLASSIFIER -- the carve `check` command with a trailing `| tail -12; rc=${PIPESTATUS...}`
    was BLOCKED by the auto-mode classifier; the identical plain form (no pipe/PIPESTATUS) passed.
    Matches the standing multi-workstation memo (a wrapped form fails to MATCH an ask rule). Use
    the plain form for remote carve/maas reads; do not add a bypass.

=== ALREADY ON SURFACE (recorded where noted) ===

R1  Ruling (GA-R5, verbatim 2026-08-07): dc1 = "No migration. Build region on DC1 correctly."
    -> CURRENT-STATE tailscale block + changelog-20260807 header + F1 above. Reaffirms the
    standing region-per-DC (D-132 q1); NO new D-number (operational sequencing + reaffirmation).

R2  Operator statement 2026-08-07: the tagged-join key on hand is PLAIN (not tag-scoped) ->
    CURRENT-STATE (join prereq a) + changelog header + Item 5. The join was deliberately NOT
    attempted (an untagged first-advertise is the office1 defect; Headscale does not approve
    routes retroactively).

R3  Measured corrections (GA-R1 C2): (i) dc0 .7 already self-enlisted as known-marten (n4parh),
    New/power-unset -- prior "powered off" omitted the enlisted part; (ii) vr1-dc1-region NOT
    registered, dc1 rack nmpcq4 + 9 nodes in the Office1 admin region; (iii) subtle-grouse is the
    juju controller (power_id vr1-dc0-juju-01), MAAS-random name, carved by lib-hosts LOGICAL name
    + boot MAC. -> changelog-20260807 "Measured corrections" + CURRENT-STATE.

R4  dc0 .7 driven to carved-and-ready: power set (10.12.8.2), commissioned Ready, aux-carve
    tooling (gauntlet 101), carve pass=8/0, deployed jammy, BOTH legs live (ping 10.12.8.7 +
    10.12.4.7 0% from the rack, provider-public leg virbr5 10.12.4.2/22). -> changelog Items 1-4,
    CURRENT-STATE, docs/audit/gauntlet-20260807-tailscale-carve.txt, commits d36d815/c8ddfb6.

R5  aux-carve tooling (CARVE_AUX_HOSTS, is_tailscale_host/is_two_plane_host, harness 58/0) ->
    changelog Item 2; implements D-129(iii) amdt + D-134 octet map, no new D-number.

=== STRUCTURALLY INVISIBLE (savegame Step 3d) ===

S1  Gitignored state: no NEW gitignored artifact created this session (no settings.local.json
    permission change, no new key/overlay). Last session's applied throwaway tfplans unchanged.

S2  Dangling refs: commits d36d815/c8ddfb6 cite docs/audit/gauntlet-20260807-tailscale-carve.txt
    and docs/changelog-20260807-dc0-tailscale-provisioning.md -- both EXIST.

S3  As-executed log (O3, SECOND CONSECUTIVE session): run-logged.sh was NOT opened (it opens an
    interactive script(1) subshell a background agent cannot drive). Every live mutation is gated
    + captured in the changelog with read-backs, but the as-executed log MUST NOT be read as
    complete for this window. Recurs in queued-findings-20260807-tailscale-substrate (O3) and
    earlier -- the recurrence itself is the finding; a durable fix (non-interactive capture path)
    is owed.

S4  Contradiction detector: the known-marten-enlisted vs "powered off" divergence is the only
    doc-vs-measurement conflict; corrected in CURRENT-STATE (C2). No unrecorded contradiction.

=== DELIBERATELY NOT DONE (owed, next sessions) ===

N1  The Tailscale JOIN: tagged pre-auth key + Headscale autoApprovers / star ACL / Office1-untagged
    fix, then site-tailscale.sh install, then browser-login https://10.12.8.58 closes Step 3.3.
    BLOCKED on a TAGGED key (operator has a plain one) + control-plane policy work.
N2  dc1 MAAS-region build (vr1-dc1-region on vr1-dc1-maas-01) -- ruled this session, no runbook (F1).
N3  dc1 .7 provisioning (power/commission/carve/deploy) -- AFTER N2. lib-hosts already carries
    vr1-dc1-tailscale-01 (octet 7, MAC 52:54:00:f9:d6:df); the aux-carve reuses on dc1.
N4  dc0 .7 package pre-install + in-VM default-route verify -- needs SSH via vr1-office1-svc
    (F2), which I do not hold. Deferred to the join session (site-tailscale.sh install exercises
    egress + route directly).
N5  SEC row for per-DC Tailscale key custody -- opens at tagged-key mint (carried from last
    session's N4 / D-129(iii) amdt note).