# 2026-07-16 -- D-124 addressing pinned: transit supernet 172.31.0.0/24 + ratified rack values

## Context

The operator resolved the three scoping flags `netbox/dc-rack-mgmt-import.py` had surfaced (seed the
`transit` role; carve a dedicated transit supernet; prefix scope) and ratified the transit /30 + rack IP.
This pins the importer's `CONTAINER` and records the values. **NO apex mutation happened here** --
office1-netbox (10.10.1.10) is UNREACHABLE from the vcloud jumphost (measured: ping/TCP:8000/HTTP all
fail, no SSH/tunnel), and the apex token lives on that host. The `--commit` is an on-host operator step.

## Operator rulings (2026-07-16)

1. Seed a NEW dedicated `transit` role (not the shared `infra` role).
2. **Carve** a dedicated transit supernet, NOT under Cloud `10.12.0.0/16`. Ratified **`172.31.0.0/24`**
   (mirrors the Edge role's dedicated `172.30.0.0/16`; /24 = 64 /30s, ample for ptp transit links).
3. Transit prefix scope = `dcim.site:vr1-dc0` ("mirror the edge").
4. Ratified values: transit /30 `172.31.0.0/30` (region/peer `.1`, rack `.2`); rack IP `10.12.8.2`.

## What changed (repo-side; pushable)

- **`netbox/dc-rack-mgmt-import.py`:** `CONTAINER = "10.12.0.0/16"` -> **`"172.31.0.0/24"`** (+ header
  note: dedicated transit supernet, operator-pinned; scope-flag comment updated to RULED). Usage example
  updated to the ratified values. The importer STILL takes `--transit-cidr`/`--rack-ip` as required inputs
  (no invented literal) and still fail-loud on a missing/collision container.
- **`tests/dc-rack-mgmt-import/` (harness + `test_logic.py`):** the `CONTAINER` assertion + every transit
  fixture rebased Cloud->`172.31.0.x` (preserving each /30,/31,/29,host-bit shape so the shape/host-bit
  rejections still die for the RIGHT reason, inside the new container). `10.12.8.x` rack fixtures unchanged
  (metal-admin is unchanged). **96/96 PASS.**
- **`docs/design-decisions.md`:** D-124 AMENDMENT recording the carve + ratified addressing.

## Still operator-gated (cannot run from the vcloud jumphost)

The apex is unreachable here + the token is a secret on office1-netbox, so the operator runs, on that host:

**A. edge-WAN /24s (IPAM hygiene; the edge role/container must exist first):**
    # d115-office-carve.py --commit  (seeds Office + Edge roles/containers), THEN:
    NETBOX_URL=http://10.10.1.10:8000 NETBOX_TOKEN="$(sudo cat /root/netbox-secrets/api.token)" \
      python3 netbox/dc-edge-wan-import.py            # dry-run; add --commit  (loads 172.30.2.0/24, .3.0/24)

**B. D-124 transit + rack IP (unblocks `tofu plan`):**
    # 1. seed the `transit` role in office1-netbox
    # 2. carve 172.31.0.0/24 (a container prefix, role transit) -- confirm free in the LIVE apex
    NETBOX_URL=http://10.10.1.10:8000 NETBOX_TOKEN="$(sudo cat /root/netbox-secrets/api.token)" \
      python3 netbox/dc-rack-mgmt-import.py --transit-cidr 172.31.0.0/30 --rack-ip 10.12.8.2   # dry-run; add --commit

**C. fill the four rack tfvars** (a gitignored local `opentofu/*.auto.tfvars` on the host that runs
`tofu plan`), matching the committed NetBox values:
    vr1_dc0_rack_metal_admin_ip = "10.12.8.2"
    vr1_dc0_rack_transit_ip     = "172.31.0.2"
    vr1_dc0_rack_transit_prefix = 30
    vr1_dc0_rack_transit_peer_ip = "172.31.0.1"

Only C unblocks `tofu plan` (D-125 needs no NetBox object). The importers' die-if-absent preconditions
(role/container/site) are the safety net; run them in the order above.

## Verification

- `bash tests/dc-rack-mgmt-import/run-tests.sh` -> 96/96 PASS.
- `bash scripts/repo-lint.sh` -> 0 fail (1 legacy WARN).

## Revert

- `git checkout netbox/dc-rack-mgmt-import.py tests/dc-rack-mgmt-import/` (restores `CONTAINER` = Cloud +
  the old fixtures); delete the D-124 AMENDMENT (transit supernet) from `docs/design-decisions.md`. No
  cloud/apex state touched (nothing was committed to the apex).