# session-ledger summaries rotated 2026-07-27 (GA-R4 rule 3 / F1 -- oldest-first)

Moved VERBATIM from `docs/session-ledger.md` at the Stage 4 close, to restore the 300-line
cap (the live ledger was 317). These are the three 2026-07-23 closed-session summaries --
the oldest still-live ones. Each still points at its own archived full body; only the
summaries moved. Status is in `docs/CURRENT-STATE.md` ONLY; this file is history.

## SESSION CLOSE 2026-07-23 -- G12 dc1 edge->commission + CLOSE + MERGE (bounded, GA-R4)

- Resumed from the 07-22 handoff (edge at login prompt); drove dc1 to a commissioned fleet,
  every mutation operator-gated in `manual` permission mode (auto-mode classifier blocks
  remote sudo shapes instead of prompting -- manual mode is the fix; noted).
- Edge: D-112(c) console bootstrap (payload needed util.inc/shell_safe -- dc0 lesson iv the
  .b64 lacked) + key auth + D-113(a2) API mint (transient post-restart-sshd scp, ssh-pipe
  workaround) + v4 addressing WAN 172.30.3.2 / LAN 10.12.64.1 (egress 0%).
- dc-rack-net dc1 arm (harness 18/18) + install (forwarder answers maas-internal); region MAAS
  D-120 range + D-131 dns + DHCP primary_rack=nmpcq4 (dhcpd verified running).
- SEC-016 RULED "Mint a dedicated dc1 power key" (per-DC isolation) + wired (script=svc key,
  MAAS snap=dedicated key). Commissioning ALL 9 READY ~3.5 min, shapes exact D-121 Option C --
  dc0's two stacked faults pre-empted by pinned MACs + forwarder.
- G12 CLOSED: gauntlet 76 GREEN, repo-lint 0-fail, consolidation + skill sweep (per-DC power
  key invariant) + GA-R7 memory review; MERGED to main (merge commit a5c0a49), branch retired.
- Open after: SEC 12 rows (incl. SEC-015/-016); 3 findings (util.inc, scp readiness, snap-key
  refresh fragility); D-068 item1, D-131 sub-4, D-132 pinned. Next stage branches off main.
- Full body: docs/archive/changelogs/changelog-20260723-g12-dc1-edge.md. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-23 -- Stage 4 OPEN + carve + mirrors (bounded, GA-R4)

- Stage 4 OPENED (branch dc-dc-stage4-phase3-maas-deploy); discovery captured; D-133
  (flat per-NIC carve; hw-faithful NICs next deployment) + D-134 (+amendment: contiguous
  bands, Option B swap) ADOPTED, utterances quoted.
- CARVE EXECUTED both DCs (logged stage4-carve): ranges .201-.254, 10 fabrics, 90 NIC
  re-homes, subnets+spaces, 18 nodes statics + br-ex; all Ready; capture committed.
- Deploy model RULED: Ready handoff (DOCFIX-200 -- runbook Step 4 would have broken
  Stage 5); jammy images synced; per-DC tags applied 9+9.
- Mirror: exception REJECTED -> D-135 ADOPTED; dc-mirror.sh shipped (19/19, gauntlet 77);
  INSTALLED both racks; initial syncs RUNNING at last check (hours; verify
  last-sync.status before citing). INCIDENT: dc1 edge pf never regenerated post-
  addressing -- filter reload fixed; appendix-A + DoD + script amendment QUEUED.
- OWNED: pipe-masked L10 lint FAIL (repaired); dc0-only egress probe wrongly assumed
  symmetric (item 9).
- Delivery batch LANDED before close (item 11): lib-hosts VR1 arms populated (tofu-name
  keys, pinned MACs, D-134 octets, host_sysid_by_bootmac) + D-133 guards in the two VR0
  flow scripts + appendix-A pf entry + DoD items 8-9 + item-4 range fix; dc-selector 48,
  gauntlet 77 GREEN. At close: both syncs RUNNING (dc0 13G / dc1 15G pulled).
- OPEN in-stage for the NEXT session: verify last-sync.status OK both racks (this
  session's watcher dies with it -- check at open); mirror node-side reachability gate;
  set-interface-v4 reload amendment (queued OPTION, unruled); local permission-rules
  prune (`Bash(ssh *)` flag); then the stage close-out set (consolidation, skill sweep,
  GA-R7 memory review, final gauntlet, operator-gated merge).
- Details: docs/archive/changelogs/changelog-20260723-stage4-open.md. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-23 -- queue pass + D-068 rulings (bounded, GA-R4)

- Queue fully processed. Repo: 5 script/harness fixes (prep-image bash -s; headend hints +
  idempotent sec010 nft + staging dir; apikey readiness/retry) + DOCFIX-198 (Steps 9-10
  superseded; DC standup DoD) + DOCFIX-199 (D-112(c) payload spec). Gauntlet 76 ALL GREEN.
- Live (logged ops-sec010-reassert, all operator-approved): SEC-010 files idempotent on all
  3 hosts (double-restart proof); G13 CLOSED -- office1 qga channel 0/1/0 saved-plan apply
  (guest-ping proven), edge 26.7 -> 26.7.1, os-iperf in after a measured refusal; outer plan
  re-converged zero diff. vr1-dc0-maas cache residue deleted (association-checked FIRST).
- D-068 item 1: plan DRAFTED then Q1 (rehearsal EOL acceptance, 1b), Q2 STRUCTURE (Roosevelt
  on 1.8 + funded remediation track), Q3 (monthly checks -> ops-update-procedure 0c) ALL
  RULED -- individually confirmed after a volunteered batch answer (GA-R5 kept). Remainder:
  Q2 path at Roosevelt design time. NetBox residue -> docs/netbox-write-path-findings.md.
- Owned: one capture commit pushed with a pipe-masked L10 lint FAIL; repaired same-hour.
- GA-R7 memory review: no changes. AT CLOSE: ledger-scan FALSE-CLOSE defect found (tail-appended
  detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED
  number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded.
- Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md.

---

## SECOND ROTATION PASS 2026-07-27 (at the Stage-5 grounding audit close)

The live ledger reached 305 lines against the 300-line cap after that session's
bookend landed. The oldest remaining live summary moved here VERBATIM, oldest-first
per GA-R4 rule 3 / F1. It still points at its own archived full body.

## SESSION CLOSE 2026-07-24 -- caveman guardrails + DC1 proxy-build start (bounded, GA-R4)

- caveman plugin DISABLED (enabled:false both scopes) + SEC-017 + guardrails (repo-lint L11
  *.original.md detector; deny compress; CLAUDE.md norm). commits up to 338c919..d0db020.
- DC-mirror: DC0 full mirror still syncing; DC1 debmirror PAUSED ~330G (bandwidth NOT the
  bottleneck, measured) + switched to an INTERIM apt caching proxy (D-135 AMENDED 2026-07-24):
  scripts/dc-cache-proxy.sh shipped + INSTALLED on dc1 (serves archive+UCA 200). Two per-DC
  Stage-5 test methods (dc0 full-mirror / dc1 proxy) = gates on ONE branch, not sub-branches.
- DC1 Stage-5 deploy STARTED: per-DC MAAS creds (SEC-018/-019); Juju 3.6.25 on voffice1
  (headend, D-128); add-cloud vr1-maas + add-credential both DCs; VIP overlay
  overlays/vr1-dc1-vips.yaml; phase-4 Step 2.0 (MAAS-cred task) added. commits ..116e9b2.
- **BLOCKED before bootstrap (committee-reviewed):** committed bundle.yaml is still VR0 4-node
  HYPERCONVERGED; VR1 dc1 is 9 ROLE-SEPARATED (D-121 Option C). Architecture DECIDED, deploy
  ARTIFACTS not rendered (dc-ha-scaleup.yaml partial/unrendered/dc0-named/stale/unwired; tag/
  placement/num_units unhandled; phase-4 runbook stale). DNS confirmed GREEN for bootstrap
  (D-131 forwarder resolves external; hang can't recur) -- but bootstrap needs edge egress OPEN
  (juju agents/snaps unmirrored); do NOT narrow egress until after bootstrap.
- OWNED: I fabricated a "D-193" reference in analysis (cardinal sin) -- corrected to D-121;
  verified NOT persisted to repo. NEXT SESSION: render vr1-dc1 role-separated HA bundle +
  wire overlays + de-stale phase-4, THEN bootstrap. Full detail: CURRENT-STATE Stage-4 bullet.
- Status ONLY in CURRENT-STATE.md. Changelog: docs/archive/changelogs/changelog-20260724-caveman-disable.md.

---

## THIRD ROTATION PASS 2026-07-27 (at the Stage-5 grounding-audit close)

The live ledger reached 321 lines against the 300-line cap after the audit's addendum
landed. The oldest remaining live summary moved here VERBATIM, oldest-first per GA-R4
rule 3 / F1. It still points at its own archived full body.

## SESSION CLOSE 2026-07-25 -- handoff-pack execution + recon + Chat D-136 coupling (bounded, GA-R4)
- ~~**IMMEDIATE NEXT (do FIRST):** MAAS WEB-GUI login does NOT exist -- SEC-018/019 are API/Juju-only
  keys; the juju-vr1-dc0/dc1 superusers have RANDOM UNSTORED passwords, so the operator is locked
  out of the MAAS webpage (never minted; no prior task did it). Fix, operator-run on voffice1:
  `sudo maas createadmin --username=<you> --email=<you>` (or `maas changepassword <user>`); +SEC row.~~
  **-> FALSIFIED + RESOLVED 2026-07-25 (SEC-020).** The premise was wrong: GUI login DID exist. The
  `admin` superuser's password was minted 2026-07-13 by `site-headend-install.sh:452` and MEASURED
  working this session (login 204 with the stored value vs 400 wrong-password control) -- it was
  merely root-only on voffice1 and un-consolidated (the SEC-009 miss class, not a missing account).
  Only the two `juju-*` clause was correct. DONE under operator-ruled scope "New account +
  consolidate only": `admin` password consolidated byte-identical to `~/vr1-office1-creds/`
  (VM copy stays source-of-record, NOT rotated); NEW `operator` superuser minted for human GUI
  login (stdin, never argv); dc0/dc1 manifest backfill -> `creds-audit` CLEAN all three sites.
  The `juju-vr1-dc0/dc1` passwords remain random+unstored BY RULING -- their API keys are
  load-bearing for the blocked Stage-5 bootstrap, and `operator` removes any need to log in as them.
- RECORD PHASE DONE + pushed (thru 87cec53): Rulings 1/2/3 (GA-R5 verbatim), D-136 PROPOSED (NetBox
  render pipeline, opt C, non-gating), DOCFIX-201 (D-020 not D-036, 7 sites)/-202/-203; pack-review
  committee + Chat open-Q5 (Jenkins IS the runner) folded in. DC0 mirror COMPLETE (949G+342M). lint 0.
- GATED EXECUTION pending (each gated): verify MAAS role tags LIVE (deploy-blocking) -> 10th
  controller VM -> dc0 VIP extract (2 commits) -> vault-VIP repair (BLOCKER-1/2 + VIP_OCTET_MAX) ->
  DC-aware gates -> bootstrap. KEEP _handoff-not-committed/ (item 60 vault values not yet consumed).
- Open sub-rulings: octavia family, reserved-range registry, vault-vip-derivation file. Deferred:
  CURRENT-STATE s4 stale-HIGH, G14 SEC 12->15, phase-4 designate. Chat skill pkg:
  .claude/skills/openstack-cloud-ops-consolidated-20260725.md. Detail: changelog items 1-17.

---

## FOURTH ROTATION PASS 2026-07-27 (same close; cap still breached after the third)

The third pass left the live ledger at 307 lines against the 300-line cap, so the next
oldest live summary moved here VERBATIM as well.

## SESSION CLOSE 2026-07-25 -- MAAS admin-account recovery (SEC-020; bounded, GA-R4)
- **PREMISE FALSIFIED before any mutation:** MAAS GUI login DID exist -- `admin` pw minted
  2026-07-13 by site-headend-install.sh:452, MEASURED working (204 vs 400 wrong-pw control).
  Defect was root-only + un-consolidated on voffice1 (SEC-009 class), NOT a missing account.
- Scope RE-RULED by operator: "New account + consolidate only" -- no existing password rotated.
- DONE: `operator` superuser minted (pw via stdin, never argv); `admin` pw consolidated
  byte-identical to ~/vr1-office1-creds/ (**VM copy stays source-of-record**); dc0/dc1 manifest
  backfill -> creds-audit CLEAN x3; README index lists both. juju-* UNTOUCHED by ruling (their
  SEC-018/019 keys gate the blocked Stage-5 bootstrap). SEC-020 opened (open rows 15->16);
  falsified IMMEDIATE NEXT struck; machine-derived block re-seeded.
- OWNED: called a login probe read-only; it authenticated, writing last_login twice (benign).
- LOGGED not executed: headend-install consolidate-at-mint; conflation proposable as next-free D
  [ARCH]; 3 /root secrets unmoved. **GA-R4 F1: ledger 370 lines at OPEN vs 300 cap -- rotation OWED.** (DISCHARGED 2026-07-26: rotated oldest-first to 280 lines; see the ROTATED block above.)
- Gauntlet 79 GREEN, repo-lint 0-fail, b2b0c80 pushed. Bookend EARLY (07-21 precedent); further
  work appends a POST-CLOSE ADDENDUM. Details: docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md.