# Changelog 2026-07-18 -- OPNsense edge plugin profile-installer (D-129)

Autonomous processing of the D-129 "engineering for the rest" that does NOT need
the operator at a keyboard. **Nothing was applied to the cloud** (the live plugin
install remains classifier-gated). Repo-only: one new script + harness + pin
refinements. Gauntlet ALL GREEN (68), repo-lint 0-fail.

## Items

1. **NEW `scripts/opnsense-plugins.sh` + `tests/opnsense-plugins/run-tests.sh` (17/17).**
   - WHAT: a named-profile plugin installer for an OPNsense edge over the D-113
     firmware API. `list` + `apply <vr1-edge|metal-edge>`. Thin orchestrator over
     `scripts/opnsense-api.sh` (auth/secret handling reused, never re-implemented).
   - WHY: closes the D-129 pin "build the reusable profile-installer at the DC-edge
     step". Encodes the two 2026-07-18 lessons so they are not re-learned: (a)
     install ONE plugin at a time and POLL `core/firmware/upgradestatus` -- back-to-
     back `firmware/install` POSTs collide on the OPNsense firmware lock and the
     second fails silently (this is why `os-iperf` did not install); (b) loudly warns
     that `os-qemu-guest-agent` is a package, NOT a working agent (needs the libvirt
     channel + service enable + restart). `--dry-run` is offline (no net/creds) so
     the harness proves the shape.
   - REVERT: `git rm scripts/opnsense-plugins.sh tests/opnsense-plugins/run-tests.sh`.

2. **D-129 + `dc-dc-phase2` pin refined (doc-only).**
   - WHAT: recorded the installer as BUILT (runbook now says USE it, not build it);
     logged the qga-channel design (add to `modules/opnsense-edge` as an OPT-IN var
     defaulting OFF, so the shared-module edit does NOT change the live
     `office1-opnsense` plan or dirty the DC0 outer plan; mechanism-to-verify on
     dmacvicar 0.9.8 -- native `qemu_agent` arg vs `xml{xslt}` injection, not assumed);
     logged the exact `os-git-backup` operator input needed (target repo + deploy key).
   - WHY: advances the items I cannot execute autonomously to "ready to implement
     safely" without touching the cloud or the imminent DC0 deploy.
   - REVERT: revert the D-129 Implementation-prep block + the phase2 pin edit.

## Still operator-only (cannot be processed autonomously)
- `os-iperf` re-install (classifier-gated firmware POST) -- operator-run or add a Bash
  permission rule.
- qga functional enablement (module opt-in channel + service enable + edge RESTART).
- `os-git-backup` wiring (choose repo + add the plugin's deploy key on GitBucket).
- The four D-129 sub-decisions (COS-edge scope, os-frr, os-tailscale, edge-NTP).