# Changelog 2026-08-05 -- vault init DONE + ovn-central RESOLVED; D-142 vault-init QoL saved

Session body (the "what changed" record; status authority stays in `docs/CURRENT-STATE.md`).
Commits: `ca3c0d3` (engineering + as-built), `8305ceb` (GA-R4 close), plus this close-fix.
No cloud mutation by the agent this session -- the vault init one-shot was operator-run
(secret custody); the agent's changes are all docs.

## What happened (live, operator-run -- recorded no-secrets)

- Fresh read-only `phase-02-vault-preflight vr1-dc0` on the dc0 rack -> **PROCEED** (9
  machines started; mysql 3/3 active+ONLINE, 1 R/W; vault fresh; census 66 units, 0
  workload-error, 0 agent-error).
- Operator ran `runbooks/phase-02-vault-bringup.md` Steps 2.1-2.3 VERBATIM on the dc0 rack
  (`-m vr1-dc0`, VR0 `-m openstack` head-substituted): init (5 shares + TOKEN_OK,
  `2>&1|tee`, pre-init writability probe PROBE_OK, off-host save by hand), unseal 3/3
  (Sealed=false), authorize-charm + generate-root-ca -> **vault/0 active/idle "Unit is
  ready"**.
- Root CA (PUBLIC anchor; openssl-verified on the rack from the pasted PEM):
  subject `CN = Vault Root Certificate Authority (charm-pki-local)`; notBefore
  `Aug 5 02:05:57 2026 GMT`; notAfter `Aug 2 01:06:27 2036 GMT`;
  sha256 `75:DF:33:97:43:48:17:FE:85:97:1C:EC:60:DB:D5:4B:0D:FB:60:4A:0B:F4:60:08:92:E8:12:E5:29:69:35:A1`.
- **>>> ovn-central/3,4,5 ALL active/idle "Unit is ready"** (/4 leader ovnnb_db+ovnsb_db,
  /5 northd active) -- the OVN NB/SB cluster FORMED. This closes the multi-session
  ovn-central cert saga via BOTH fixes landed this cycle: `dc-node-etchosts.sh` Step 1.2b
  (CN delivery) + the D-052 re-amendment `''`->metal-admin (reachability). Census 40->47
  active, 0 error.

## Files changed (docs only)

- **NEW** `docs/audit/vault-init-qol-proposal-20260805.md` -- full R1-R5 QoL engineering +
  hidden-prompt safety analysis + tee-write residual + pre-init writability probe + R3
  harness constraints + operator's verbatim safety constraint.
- **NEW** `docs/audit/queued-findings-20260805-vault-init-close.txt` -- 3 first-surface items.
- `docs/design-decisions.md` -- **D-142 PROPOSED / OPEN** (vault-init workflow QoL sweep;
  approved-in-principle, impl deferred; R2 transport unresolved). Distinct from D-068
  (substrate) / D-011.6 (unseal bar).
- `docs/runbook-fold-register.md` -- **F13** (D-138: `-m openstack`->`-m vr1-dc0` +
  run-location = DC rack on `phase-02-vault-bringup.md`; scope-stretch stated; OPEN).
- `docs/audit/stage5-dc0-redeploy-asexec-20260804.txt` -- appended the vault-init outcome
  (no secrets), root CA as-built (openssl-verified), ovn-central resolution, and the
  remaining ceph item.
- `docs/CURRENT-STATE.md` -- 2026-08-05 (CONTINUED) status block + close reference.
- `docs/session-ledger.md` -- GA-R4 close block.

## Security hygiene

The child token printed by `vault token create -field=token` appeared in plaintext in the
operator's otherwise-redacted paste (init keys + root token WERE redacted). It was
`-ttl=10m`, `unset` after use, and long expired by paste time -> dead/benign, no rotation.
NOT stored/echoed/committed. Lesson recorded: redact token-create output too.

## Remaining (separate, NOT vault/ovn)

`ceph-mon/2` + `ceph-radosgw/0` stuck `allocating` ("waiting for machine", apt-wedge class)
-> cascade to `ceph-osd x4` (Incomplete monitor) -> `glance` + `nova-compute x2` (Incomplete
storage-backend). Triage via appendix-A after this close.

## Revert

Docs-only. To revert: `git revert 8305ceb ca3c0d3 <this-commit>` (or `git checkout d6975fb --
<file>` per file). No cloud state to unwind -- the vault init was operator-run and is not
reverted by touching the repo.