QUEUED FINDINGS -- session 2026-08-08 (dc0 tailscale install incident + the 10.12->10.13 re-IP pivot) Sweep method: model read the session, grepped each candidate. FIRST SURFACE items lead. Status authority is docs/CURRENT-STATE.md; this file is a sweep record, not status. ================================================================================ FIRST SURFACE (existed ONLY in the transcript / auto-memory -- would be lost on a clear) ================================================================================ F1. THE PIVOT -- 10.12.0.0/16 COLLIDES WITH THE LIVE IPv4 CLOUD; RE-IP TO 10.13.0.0/16. The VR1 build's 10.12.0.0/16 is already consumed by the still-online IPv4 single-DC cloud (the NetBox draft that seeded VR1 was that cloud's external export). Surfaced at the Headscale step -- advertising 10.12.8.0/22 overlaps the live cloud on the shared tailnet (Headscale has no 4via6; routes must be non-overlapping). PLAN (operator): drive dc0 to FULL deployment as a clean stopping point, then TEARDOWN + REDEPLOY on 10.13.0.0/16 -- a fresh subnetting build, never editing live infra. Operator utterances (verbatim, for the owed ruling): "I missed that and should have moved to 10.13.0.0/16 for this deployment"; "bring DC0 to full deployment ... use that as a stopping point for the upcoming teardown and redeploy ... clean starting point for a new subnetting deployment without trying to edit live infra." OWED: (a) a GA-R5 ruling for the re-IP + teardown/redeploy (governed by D-101/D-115/D-124/D-134); (b) a docs/CURRENT-STATE.md update recording the pivot + the dc0-checkpoint posture. Currently lives ONLY in memory (dc0-checkpoint-then-reip-redeploy.md) + this sweep. A background agent is drafting the 10.13 subnetting -> docs/audit/netbox-1013-subnetting-draft-20260808.md (Task #2). F2. RETRACTION of the committed changelog's F3 ("maas snap refresh wiped the vr1-dc0-region profile"). changelog-20260807-dc0-tailscale-install.md:104 is WRONG. MEASURED this session: voffice1's ~/snap/maas/41649/.maascli.db AND ~/snap/maas/current/.maascli.db BOTH hold [admin, vr1-dc0-region, vr1-dc1-region]; the :5243 tunnel is UP; `maas vr1-dc1-region version read` returns capabilities. The earlier "empty db" reading queried the wrong paths (~/.maascli.db and a path that didn't exist). A correction note is added to that changelog in this close. Contradiction-detector item (GA-R1 C2: measurement wins). F3. MAAS PROFILES MISSING ON THE DC RACKS (operator-flagged: fix for BOTH the existing deployment AND the rebuild). MEASURED: the dc0 rack (172.31.0.2) has the maas CLI but an EMPTY profile db (~/snap/maas/*/.maascli.db -> []); openstack + jq + admin-openrc ARE present. Consequence: phase-04-network-create.sh (and the phase-05 octavia path) need `maas` AND `openstack` on ONE host, but D-138 split them -- maas profiles live on voffice1 (no L3 to the cloud), openstack runs on the rack (no maas profile). The phase-04 gate itself is satisfied (provider gw 10.12.4.1 confirmed via voffice1). FIX OWED (rebuild tooling too): either give each rack its own maas profile at standup, or split the maas gate from the openstack create in the phase-04/05 scripts. F4. REBUILD MAAS TOPOLOGY -- NO SERVICE MIGRATION (operator, savegame note, ruling-intent). Verbatim: "we need to make sure we are not migrating services like we did with office1-dc0 maas. MAAS buildout DC0>MAAS-regional>MAAS-rack as the proper nest." The office1->dc0 MAAS migration (2026-07-30) was a ONE-TIME historical remediation, NOT a procedure. The rebuild stands the MAAS region + rack up FRESH inside each DC and nodes enlist from the start -- consistent with the standing invariant already in the skill ("MAAS region installed directly in the DC, never migrated"). Capture for the redeploy plan; formalize as a GA-R5 ruling at redeploy planning. F5. dc0 LIVE INVENTORY (measured 2026-08-08 from the dc0 rack: juju status -m vr1-dc0 + openstack). 66 machines / 162 units; EVERY core service active (keystone, nova+2 compute, neutron/OVN, glance, cinder, ceph mon/osd/radosgw, barbican, vault unsealed, rabbitmq, mysql-innodb, all dashboards, magnum). NOT active: octavia (blocked "configure-resources"), designate (blocked "nameservers must be set"), ceph-rbd-mirror (blocked "ceph-remote missing" -- cross-DC/dc1), glance-simplestreams-sync (unknown). Tenant-resource-empty: networks=0 flavors=0 images=0; auth works (39 endpoints, 4 projects, 13 services). CURRENT-STATE owes this (or accepts it as transient pre-teardown). F6. CHECKPOINT SCOPE RULING (operator, AskUserQuestion 2026-08-08): "Activate + smoke-test" -- create flavor + amphora image + provider/tenant networks; activate Octavia (one test LB) + Designate (one test zone); then wrap gates (cloud-assert.sh --capture, controller backup, verify-live Ceph/geneve-over-v6). Magnum/CAPI DEFERRED to the redeploy. Recorded in Task #1. F7. STALE office1-region subnet record: the office1 'admin' MAAS region STILL holds 10.12.4.0/22 (gateway 10.12.4.1) after the dc0->vr1-dc0-region migration -- a duplicate with vr1-dc0-region. Cleanup owed on the existing deployment (moot at teardown, but a migration-hygiene datapoint). F8. INSTRUMENT-CURRENCY (self-match trap, twin of #21 pgrep): `pkill -f "tailscale up"` matched the bash running my OWN diagnostic script (the pattern was in its command line) and killed the ssh session. Kill by PID, or match on a pattern the invoking command does not itself contain. F9. dc0 .7 disable_ipv6 is RUNTIME-ONLY (sysctl -w, not persisted). On reboot v6 returns and the tailscale re-join takes ~7 min (tailscale tries the v6 control endpoints -- no v6 egress -- then falls back to v4). The .7 has NO global v6 address, so persisting disable_ipv6 is safe and makes reconnect instant. Persist-or-accept decision owed (relevant to the REBUILD tailscale tooling). F10. PRE-AUTH KEY ROTATION owed. The Headscale pre-auth key leaked to ps/argv AND this transcript during the first (accept-routes) join attempt. Operator reused it for the re-join ("Use the existing key for now"). Rotate/revoke it at cleanup. Custody: ~/vr1-tailnet-creds/headscale- preauth-vr1-dc0.key (0600, sha256 d2e74720...). The tool now uses --authkey=file: so it cannot recur. F11. A NetBox-review SUBAGENT (NOT spawned by this session) completed with a SECURITY FLAG for credential-folder scanning (enumerated ~/vr1-*-creds/, extracted NETBOX_URL/token structure). Not acted on by this session. Its output: office1-netbox live apex = http://10.10.1.10:8000/; web password at ~/vr1-office1-creds/netbox-admin-password; vr1-netbox.env token targets the baldurkeep v1 reference (NOT the live apex). Flagged for operator awareness only. ================================================================================ ALREADY ON SURFACE (verified present -- recorded here for completeness) ================================================================================ - Tailscale INCIDENT (accept-routes on the dc0 .7 subnet router blackholed its own L3; recovered via qemu-nbd offline-mask of tailscaled on /var/lib/libvirt/vr1-dc0-inner/vr1-dc0-tailscale-01-disk.qcow2 root nbd0p2; purged + rebuilt advertise-only) -> docs/changelog-20260807-dc0-tailscale-install.md (UPDATE section), committed faef662. - FIX: install is advertise-only (no --accept-routes) + --authkey=file:; check asserts own-subnet-not- via-tailscale0 + control-plane reachability -> committed faef662, harness 27/0. - prep verb / staged-deb method (.7 has no external egress; rack+vcloud do) / forwarding assertion -> changelog + committed 02e0b12. - D-129(iii) AMENDMENT (VR1 untagged, office1-mirrored; tags/autoApprovers/star-ACL deferred to bare-metal) -> docs/design-decisions.md, committed faef662. Utterance quoted there. - dc0 .7 CURRENT STATE: tailscale up advertise-only (TSIP 100.64.0.57), route UNAPPROVED (operator stopped the tailscale workstream -- do NOT approve 10.12.8.0/22, it overlaps the live cloud), v6-disabled-runtime. Left as-is (inert on the tailnet; torn down at redeploy). - dc1 held entirely: 0 machines in vr1-dc1-region, all dc1 nodes powered off (task #1/memory). ================================================================================ ALWAYS-SWEEP FIVE ================================================================================ 1. GITIGNORED STATE: no .claude/settings.local.json changes this session. CLASSIFIER WALL: `maas vr1-dc1-region sshkeys create` was AUTO-DENIED by the permission classifier -- a targeted allow/ask rule for `maas vr1-dc1-region *` (+ virsh on the racks + dc-node-carve.sh) would unblock autonomous dc1 provisioning if it resumes. Gitignored creds created/used: ~/vr1-tailnet-creds/headscale-preauth- vr1-dc0.key (see F10). 2. DANGLING REFS: paths cited in the faef662 commit/changelog resolve (script, harness, qcow2, changelog). 3. RULING FIDELITY: D-129(iii) amendment utterance quoted + committed. The PIVOT re-IP/teardown (F1), the MAAS-topology note (F4), and the checkpoint-scope (F6) are captured verbatim here but are NOT yet GA-R5 D-rulings -- OWED before dependent work. 4. AS-EXECUTED LOG GAP: run-logged.sh was NOT opened this session (Nth consecutive), despite many live mutations (tailscale install/incident/recovery, qemu-nbd disk edit, sysctl, virsh reboot/destroy). The window is UNDER-RECORDED; this sweep + the changelog are the record. 5. CONTRADICTION DETECTOR: F2 (changelog F3 "profile wiped" vs measured profiles-exist). Corrected. NEXT: operator PUSH the 2 tailscale commits (02e0b12, faef662) -> then voffice1 git pull (it lags by 2). Then: the re-IP GA-R5 ruling + CURRENT-STATE pivot update; the 10.13 NetBox draft (Task #2, in flight); dc0 activation (Task #1: networks -> Octavia -> Designate -> smoke -> wrap gates) resolving the F3 maas- profile/D-138 co-location gap. Body: docs/changelog-20260807-dc0-tailscale-install.md. Status ONLY in CURRENT-STATE.md. ================================================================================ ADDENDUM -- 10.13 NetBox draft agent findings (docs/audit/netbox-1013-subnetting-draft-20260808.md) These MATERIALLY reframe F1: the re-IP is not a clean shift; it reverses adopted rulings. ================================================================================ F12. **D-115 CONFLICT (adopted decision reversal).** D-115 (ADOPTED) explicitly REJECTED 10.13 as "outside every allocated block" and set the NetBox **Cloud** role to 10.12.0.0/16. Reviving 10.13 FORKS the IPAM apex -- the owed GA-R5 ruling must decide: does the Cloud role MOVE to 10.13, or does 10.13 become a new coexisting role? The re-IP is a D-115 SUPERSESSION, not just a subnet swap. This is the single most important thing to resolve before drafting the rebuild. F13. **D-101 INHERITANCE TERMINATES.** The live 10.12 cloud IS vr0-dc0; moving VR1 to 10.13 splits the vr0-dc0 and vr1-dc0 case arms for the first time and makes lib-net.sh (~lines 124-134) "inherits VR0 DC0 unchanged" FALSE. The ruling + lib-net.sh both need this reconciled. F14. **Proposed mapping (agent):** octet-preserving 10.12.a.b -> 10.13.a.b for the whole VR1 DC space; everything outside DC 10.12 held (office1 10.10.x stays; 172.31 transit /30s stay but their ROUTES re-point to 10.13). Remaps: 12 planes, 13 NetBox prefixes, 24 ip-ranges, 80 ip-addresses (78 VIP legs + 2 rack .2 statics), 2 FIP pools, 2 keystone VIPs. dc1 /19 shifts 10.12.64.0/19 -> 10.13.64.0/19; D-134 utility octet map (.4-.7) preserved. F15. **Record gaps the draft found:** FIP pools are MAAS reserved ipranges, NOT NetBox objects; the dc1 /19 supernet has no NetBox prefix object; a stale `10.13.0.0/19` importer default lingers at netbox/README.md:49. Consumer blast radius beyond NetBox (grep): lib-net.sh's named twins opentofu/variables.tf + overlays/*-vips.yaml (via tests/dc-selector), plus scripts/bundle/ tests/runbooks/docs (excluding frozen asbuilt/ + audit captures). F16. **Open questions the draft leaves for the operator (not decided):** (a) confirm 10.13.0.0/16 is genuinely free LIVE (not just absent from the dated snapshot) of the still-online cloud AND the shared tailnet; (b) exact 1:1 shift vs. regularizing dc0's non-contiguous plane offsets while greenfield; (c) the re-IP + D-115 supersession needs a GA-R5 ruling (D-101/D-115/D-124/D-134), number not minted.