# 2026-07-22 -- G12 [V] leg: dc1 apex write + substrate build step A (session changelog)

Session scope: continue the G12 [V] leg from the reconciled tree (predecessor
delivery landed as changelog-20260721-g12-dc1-authoring.md items 3-4, commit
`d2bf743`): the one owed apex write, tfvars, and the gated outer build.
Branch: `dc-dc-g12-dc1-substrate`. One changelog for the session (GA-R2/D1);
every item carries its revert.

## Item 1 -- apex `--commit` EXECUTED (the one owed dc1 apex write; operator-gated)

Same-session read-only preflight FIRST (verify-before-mutate): dry-run re-run
against the live apex = would-create exactly 2, already-present 0 --
`docs/audit/dc1-rack-import-dryrun-20260722.txt`, identical to the 07-21
preflight. Then the gated write (piped to office1-netbox over ssh; token
sourced on-host from `/root/netbox-secrets/api.token` per
`creds-manifests/vr1-office1.manifest`, value never printed or brought into
context):

- CREATED `172.31.0.4/30` (prefix id=139) role=transit scope=dcim.site:vr1-dc1
- CREATED `10.12.68.2/22` (ip id=4) dns=vvr1-dc1

Post-commit idempotency read-back: would-create 0 / already-present 2. Both
runs captured in `docs/audit/dc1-rack-import-commit-20260722.txt`. Values
verbatim from the D-124 amendment (ruled 2026-07-21); exactly the two objects
the dc0 precedent registered.

Revert: delete the two apex objects by id (prefix 139, ip-address 4) via the
NetBox UI/API on office1-netbox; delete the capture files.

## Item 2 -- vr1-dc1 service keypair MINTED (manifest-prescribed at-deploy step)

`~/vr1-dc1-creds/vr1-dc1_svc_ed25519{,.pub}` generated on vcloud (ed25519,
modes 600/644) per `creds-manifests/vr1-dc1.manifest` ("MINTED AT DC DEPLOY").
`bash scripts/creds-audit.sh vr1-dc1` = CLEAN. D-126 option (a) per-env key;
pubkey feeds vvr1-dc1 cloud-init (item 3), private half jumphost-local.

Revert: remove both key files (couples to item 4 -- vvr1-dc1's cloud-init
authorizes this pubkey; re-mint requires a seed rebuild).

## Item 3 -- dc1 tfvars authored (LOCAL, gitignored -- recorded here, not committed)

`opentofu/d124-rack.auto.tfvars` gained the five vr1_dc1_* values, verbatim
from the D-124 amendment's own tfvars line (rack_metal_admin_ip=10.12.68.2,
rack_transit_ip=172.31.0.6, rack_transit_prefix=30,
rack_transit_peer_ip=172.31.0.5) + `vr1_dc1_ssh_pubkey_path` to the item-2
pubkey. Stale "dc1 DEFERRED" header comment replaced. `tofu fmt` applied;
`scripts/opentofu-validate.sh` PASS (all roots).

Revert: remove the vr1_dc1_* block from the local file.

## Item 4 -- outer apply: dc1 substrate step A (operator-gated, logged, saved-plan exact)

Preconditions measured in-session: host RAM 1007 GiB with 450 GiB committed
(voffice1 32 + edge 2 + vvr1-dc0 416) -> +416 GiB fits with ~140 GiB headroom;
vCPU 234/256 post-apply; dc-dc-whole-host-budget 13/13 PASS.

Saved plan `tfplan-dc1-20260722` = **5/0/0 exact** (vr1-dc1-uplink network +
vvr1-dc1 domain/disk/seed/cloudinit; ZERO touches to live resources) --
capture `docs/audit/outer-plan-20260722-dc1-substrate.txt`. Applied via the
saved plan under a per-command as-executed wrap
(`~/as-executed/2026-07-22-dc1-deploy.log`; index row added): **5 added, 0
changed, 0 destroyed**. Convergence re-plan = **zero diff**
(`docs/audit/outer-plan-20260722-postdc1-converged.txt`). Live verify:
vvr1-dc1 RUNNING (Id 8), voffice1/office1-opnsense/vvr1-dc0 untouched and
running; vr1-dc1-uplink + both dc1 mesh legs active.

Revert: `runbooks/dc-dc-teardown-rollback.md` decision tree; the targeted
destroy set is the five applied resources (module.vvr1_dc1.* +
module.vr1_dc1_uplink.*); delete the plan/capture files and the tfplan.

CORRECTION (same session): commit `0bd6342` accidentally included the spent
binary saved plan (repo-lint L1 x2 -- the lint's exit code was masked by a
pipeline; owned). The file deviated from the `.gitignore` naming convention
(`opentofu/**/*.tfplan`) -- saved plans must be named `*.tfplan`. Removed in
the follow-up commit; lint back to 0-fail. The applied-plan record remains
the two dated captures.

## Next (gated, not run here)

Step B analog for dc1 per the dc0 sequence of record: transit leg
(region end 172.31.0.5/30 on voffice1), vvr1-dc1 bootstrap
(site-headend-install rack role + SEC-010 both ends), OPNsense 26.7 nano
staging; then the inner apply FROM voffice1 (D-128 Plane 2) with MAC pins
from the FIRST apply, and the D-131/D-124-amendment standup
definition-of-done items (dc-rack-net.sh install, forwarder 10.12.68.3,
maas-node-power per-machine virsh). Runbook + CURRENT-STATE govern.