# FINAL PLAN -- container-layer elimination + layered module workflow (Phase-4 consolidated plan) **Author:** the Phase-4 administrator (multi-agent container-elim pass, `SCOPE-AND-EXECUTION-PLAN.md` Section 4; no model name asserted, operator instruction). **Date:** 2026-08-09. **Inputs read in full this session:** `SCOPE-AND-EXECUTION-PLAN.md`; the four prior administrator reports (`pass0-admin-report.md` .. `pass3-admin-report.md`); the four Phase-4 worker docs (`pass4-w1-master-change-inventory.md`, `pass4-w2-module-workflow-design.md`, `pass4-w3-execution-sequencing.md`, `pass4-w4-decision-framing.md`). **READ-ONLY planning synthesis** -- no mutation performed; every owed artifact below is LOGGED, not built (hard rule 1). All recommendations are graded "recommend," never "ruled" (GA-R5). This document is the input to the final advisor review (`FINAL-advisor-review.md`) and the operator report. --- ## 1. The confirmed target + as-is -> to-be **Target (operator-confirmed at the Phase-0 gate, 2026-08-09 -- a DIRECTIONAL PLANNING CONFIRMATION, not yet the GA-R5 [ARCH] ruling; that ruling is Section 5's package):** - **Option 1:** flat node VMs on vcloud libvirt + one small non-hypervisor `vr1-dcN-client` VM per DC (metal-admin + transit legs) carrying the D-138 client role and that DC's credential residencies. - **Cross-DC adjacency handling (a):** accept co-residency + a NEW vcloud-level host isolation control (SEC-010's nftables pattern one layer up) with a mechanical `--check` gate and its own SEC row. - **MAAS region stays on `vr1-dcN-maas-01`** (.6, D-132 addendum -- no change). **As-is (Model B, D-122/D-123):** `vcloud (outer libvirt) -> vvr1-dcN (containment VM = inner libvirt) -> node VMs`. Two tofu roots per DC + a bash bootstrap gate between them; a qemu+ssh provider dial from voffice1 into the containment VM (D-126 keys, D-128 Plane 2); D-125 bridge-in WAN plumbing (`modules/wan-bridge`, IP-less uplink NIC, `br-vr1-dcN-wan`); SEC-010 FORWARD-drop on the containment VM's transit leg; nesting depth 4. **To-be (Option 1, flat 10.13):** `vcloud (libvirt) -> node VMs` directly -- depth 2 (VR0-proven). Per DC: six planes + DC edge + 12 node VMs (9 D-121 role + juju-01/.5 + maas-01/.6 + tailscale-01/.7) + the new `vr1-dcN-client` VM (recommended `.8`, ~4 vCPU / 8192 MiB / 80 GiB, non-hypervisor), all siblings in ONE flat apply per DC. Eliminated outright: the containment VMs + inner libvirtd, the two inner roots AS roots, the bootstrap gate's `--host-nodes` duty (~134 lines), the qemu+ssh dial + D-126 per-env keys (no successor), `modules/wan-bridge` + netplan bridge (edge WAN attaches directly to the per-DC `site-wan` NAT). Preserved unchanged: the mesh triangle + netem link, plane CIDRs/families/MTU (D-139/D-143 own the values -- the removal changes NO byte budget), Office1/voffice1 wholesale (D-114 -- a DIFFERENT, KEPT containment pattern), Stages 6-7. **What the flattening costs, carried honestly:** D-122's one-command site-down (`virsh destroy vvr1-dcN`) is lost -- re-earned via the root-scoped teardown primitive (owed #1) + emergency lever (#6). Three NEW isolation exposures are created and each gets its own control (Section 5 / the three concerns): (i) cross-DC plane-bridge co-residency on vcloud's one kernel, (ii) the SEC-010 transit-drop successor on the new endpoints, (iii) the MAAS power-key blast radius (each DC's region key would open virsh control over EVERY vcloud domain -- SEC-012/SEC-016's per-DC separation becomes vacuous without the #11 mitigation). **Both changes ride one redeploy, two attributable axes:** `[D-143]` (10.12->10.13 value substitution, ruled) vs `[CE]` (container-elim shape change, ruled by Section 5's package); four confirmed dual-cause items carry `[both]` (G17; D-124 transit bearer; R7 revocation; the juju execution-host/overlay step), per pass1 check 5. --- ## 2. The master change-set (W4.1 -- 104 rows; summarized here, full table in `pass4-w1-master-change-inventory.md`) | Category | Rows | Character | |---|---|---| | DEC (open rulings) | 23 | Not changes -- the decisions that gate the change rows (Section 7 tiers them) | | TF (tofu roots/modules) | 13 | 3 retire (containment modules+vars, inner roots, wan-bridge), 5 re-home unchanged bodies, 3 change (site-wan rewire, opnsense input, D-124 transit re-point), 2 NEW (`modules/dc-site`, per-DC flat roots). Zero module bodies rewritten | | LB (lib-hosts/lib-net) | 3 | 2 lib-hosts edits (power-address re-derivation **BLOCKED on DEC-15**; comment currency); lib-net = ZERO container-elim edits (D-143 axis only, grep-verified) | | SC (scripts/procedures) | 19 | 8 change, 3 retire/split, 8 NEW (the 13 owed artifacts' script halves). Carve/power/tag script BODIES: no code change (pure MAAS-API, ``-parameterized) | | DC (workflow-doc prose) | 6 | Stage 3 = THE restructured stage; Stage-5 literals; gap-register updates; the D-114-vs-D-123 two-patterns distinction note | | RB (runbooks) | 5 | teardown-rollback rewrite; phase2 heaviest rewrite; phase3 low-delta; phase4 RUN-LOCATION 3rd correction; phase6 pre-existing stale-D-138 ride-along fix | | GT (gates) | 10 | NEW Stage-1 (a)-gate + A11a/A11b + P10; P4/P5/P8/P9 extensions; G9/G10 single successor gate; G17 dual-cause edit; G14 count flag | | HN (harnesses) | 21 | 9 existing-change + 5 existing-retire + 7 new-build (matches pass3's decomposition exactly); 3 rides (#6, #8, #10) build nothing | | SEC (ledger rows) | 4 | 2-or-3 new rows ((a) control; #11 -- critical path; concern-(ii) disposition may be a SEC-010 amendment) + register-row re-points | | **Total** | **104** | (arithmetic shown in Appendix A.7) | **The three critical-path chains (W4.1 Section 2, verbatim import -- the sequence in Section 4 must and does honor all three):** - **Chain A (power-key, owed #11 -- the single largest blocker):** DEC-15 mechanism choice -> SEC row -> SC-11 artifact -> HN-C4 harness (itself a PRECONDITION, not just coverage) -> lib-hosts re-derivation + `maas-region-power-key` shape -> call-site literals -> A4/A5 harness edits (TOGETHER, same session -- hazard H1) -> A9/A11b -> P5 row. **Six test/tool edits are frozen until DEC-15 rules**; the interim RED on A4/A5 is the desired fail-loud state, never something to "fix" early. - **Chain B (the (a)-control invariant, owed #2):** DEC-14 -> SEC row -> SC-10 -> HN-C2 -> Stage-1 gate installed + `--check`-verified -> **MUST PRECEDE the first flat apply of EITHER per-DC root** (fork-robust under any DEC-11 outcome) -> A11a re-verify at each apply's close -> re-verified at Stage-5 live traffic. - **Chain C (R7 + MAAS-release before destroy):** SC-12 R7 revocation checklist + SC-13 MAAS record-release/rack-decommission run BEFORE any substrate destroy (revoking after the hosts are gone degrades to "assume it's moot"); then inner-root destroys, then outer. Governs the CURRENT 10.12 teardown; largely independent of DEC-11. - **Cross-cutting:** the DEC-11 root-topology fork gates the largest single cluster of "ready once ratified" rows -- ratify it EARLY (with the decision package, Section 7). --- ## 3. The layered module-workflow design (W4.2 -- full design in `pass4-w2-module-workflow-design.md`) The backbone (adopted from pass1 W1.4, populated by pass2/pass3): ``` L0 Host & inter-site substrate (IaC) -- Stage 1 [mesh triangle, pools, office1-net, base image] L1 Site/edge nodes (IaC) -- Stage 2/3 [voffice1 (D-114, untouched), DC edges, THE CLIENT VM] L2 DC substrate: planes + node VMs (IaC) -- Stage 3 [modules/dc-site composing pool -> planes -> edge -> node-vm x12 -> client VM; ONE flat root/state per DC] L3 Enlist/commission (procedure) -- Stage 4 [MAAS carve/power/tags -- bodies unchanged, values re-derive] L4 Juju/OpenStack deploy (procedure) -- Stage 5-7 [D-140 PINS as procedure for this redeploy] L5 Verify/gate (cross-cutting, re-invoked at every layer boundary) ``` **The load-bearing rule:** each layer's input is the layer below's OUTPUT only; the IaC<->procedure boundary is IDENTITY (a MAC, an IP, a hostname), never orchestration (a state-file read, a cross-host provider dial). The container layer was the ONE place this rule was violated (the inner root's qemu+ssh dial into the outer root's own output) -- Option 1 removes the violation structurally: L2 becomes IaC end to end, and the first live dial into anything L2 produced is L3's MAAS commissioning, exactly where the boundary belongs. **Placement of the pass's key objects** (W4.2 Section 6): client VM = L1 instance (same `cloudinit-vm` module type as voffice1/edges), apply-grouped with its DC's flat root; the (a) control = L0-scoped L5 gate (procedure, NOT a tofu module); SEC-010 successor = L1-scoped procedure on both transit endpoints (client VM + voffice1, one role-agnostic installer); power-key mitigation = L3-scoped credential control with an L3/L4-split gate (P4 dependency + A11b standing); teardown primitive = L2/L5 boundary (procedure wrapping a root-scoped `tofu destroy`, verified by an L5-style completeness check). **Design principles** (each grounded in an existing repo pattern): site-token parameterization, never hardcoded DC identity; every module ships its tested harness from the same commit (per-module harness contract, pass3 Section 6); idempotence at every layer; no layer reaches past the one directly below; findings logged at their true layer; D-140 is a distinct future axis (a later `-juju` root consumes `dc-site` outputs without reshaping L0-L3). **Roosevelt transfer, judged per layer** (the operator's "module deployment project" lens): L0 does NOT transfer (mesh/netem are virtualization shims); L1's client-VM PATTERN is the direct pre-Roosevelt D-138 bastion deliverable; L2 transfers as CONTRACT ("booted object with correct MAC-per-NIC identity"), not as libvirt mechanism; **L3 and L4 transfer verbatim -- they ARE the module deployment project's payload**; L5 mostly transfers, EXCEPT the (a) control and the power-key mitigation, both artifacts of vcloud's single-hypervisor co-residency with no bare-metal analog in the same shape (flagged so no future session assumes parity). --- ## 4. Execution sequencing (W4.3 -- full step tables in `pass4-w3-execution-sequencing.md`) **Part A -- teardown of the current 10.12 Model-B checkpoint** (today's tooling tears down today's shape; unchanged by the target): A.1 state backups both roots/both hosts -> A.2 MAAS census (two lenses) -> **A.3 R7 credential revocation (Chain C -- BEFORE any destroy)** -> A.4 MAAS record release/delete + rack-controller decommission -> A.5/A.6 plan destroys (inner first, then outer, `-target`ed -- mesh/netem EXCLUDED) -> A.7 apply destroys (each individually operator-approved, never batched -- hard rule 3) -> A.8 drift gate -> A.9 NetBox decommission -> A.10 repeat/batch per DC. **Part B -- redeploy on flat 10.13 (Option 1):** B.1 prerequisites (**B.1.1 FIT/capacity HARD GATE** -- extended calculator + fresh vcloud measurement, closes before any apply; B.1.2-B.1.4 NetBox apex re-carve, lib-net 10.13 literals, D-124 transit re-point) -> B.2 vcloud/Office1 prep -> **B.3 the (a) control installed + `--check`-verified (Chain B HARD GATE, before ANY flat apply)** -> B.4 the flat apply per DC (`dc-site` composition; client VM; **B.4.3 MAC re-measurement before anything trusts a MAC**) -> B.5 surviving duties re-targeted (rack-retirement recommend + owed live re-measure; D-131 retire-with-evidence; artifact-service sizing via B.1.1's numbers; SEC-010 successor both ends) -> B.6 MAAS enlist/commission/carve (**B.6.1 power-key mitigation closes, harness green, BEFORE the B.6.2 lib-hosts edit -- Chain A**) -> B.7 juju/bundle from the client VM + verify-live (Ceph-v6, geneve assert, the (a) `--check` RE-RUN under real traffic) -> B.8 close-out (NetBox registration; **B.8.2 the [ARCH] decision record -- the redeploy is NOT "done" while it is owed**). **Critical-path invariant verification (W4.3 Section 0, re-checked this synthesis -- Appendix A.2):** all three chains are honored -- (a)-control B.3 before B.4 (Chain B); #11/B.6.1 before B.6.2 (Chain A); R7/A.3-A.4 before A.5-A.7 (Chain C); every step carries its axis tag (invariant 4). **One harmonization this synthesis adds** (advisor-reviewed): W4.3 places the DEC-15 mechanism CHOICE at B.6.1 (its last responsible moment); W4.2's composition needs the ruled key shape at its Stage 3.5.3. Both honor Chain A; the plan's recommendation is that **DEC-15 (with DEC-14 and DEC-11/12) be RULED up front with the decision package** (Section 7), so no operator ruling is discovered mid-Part-B inside a live teardown window -- B.6.1 then marks where the built artifact + C4 harness must be green, not where the ruling happens. This matches W4.1's own "ratify DEC-11 early" note. **Pre-Roosevelt bare-metal plug-in points:** hardware specs (owed "within days") plug into B.1.1 (FIT re-derivation), B.4.1/B.4.2 (sizing + provider target -- same module composition), B.4.3/B.6.4 (real NIC MACs via enlistment -- the re-measurement discipline transfers, the injection mechanism does not), B.5.3 (artifact-service disk). B.1.2/B.1.3, B.6.5, and B.7 are hardware-agnostic; **the module INVOCATION ORDER itself (B.1->B.8) is the reusable deliverable**. B.5's placement should be RE-DECIDED for bare metal, not carried blindly. The (a) control and #11 mitigation likely do NOT transfer as-is (flagged explicitly). --- ## 5. The decision package (W4.4 -- framed for the operator, GA-R5; nothing here is ruled) ### 5.1 The core recommendation: mint a NEW D-number (next-free **D-144**, re-grep at mint) The GA-R3 admission test fires on all three prongs independently (each verified across the passes): (1) architectural consequence beyond the stage -- Stage 3 restructured wholesale, D-128's own definition amended, a D-124 clause re-caused, D-125 terminated, D-131's standing-pattern status reopened, D-132-addendum premise mooted, a D-134 map addition, D-138's concrete host changed; (2) Roosevelt-delta (A1 test) -- operator-stated: the layered module workflow is the pre-Roosevelt deliverable a future build session would grep before touching substrate shape; (3) supersession -- D-123's core Model-B ruling is directly reversed. **The precedent is D-143 itself** (header verified verbatim this session: "AMENDS D-115 premise; TERMINATES D-101 v4-inherit clause" -- yet minted as its OWN number): a new entry states its verb against each affected decision rather than the affected decision being edited to absorb the reversal. A third D-123 amendment reversing D-123's own central ruling would have the entry amend itself out of existence; append-only discipline is better served by a fresh entry naming D-123 SUPERSEDED. **Alternative presented for completeness (not recommended):** amend D-123 in place -- one canonical entry, but it fights the D-143 precedent and requires rewriting D-123's body to point at the new shape anyway. D-144's body would need, at minimum (W4.4 Section 4): (a) the D-123 supersession; (b) the D-125 termination + D-124 sizing re-cause as named consequences; (c) **the accepted power-key blast-radius tradeoff named explicitly in the body** (flattening knowingly voids SEC-012/016's per-DC scoping, mitigated by the #11 SEC-row control -- burying this only in a SEC row nobody greps before touching architecture would repeat the failure class A1 exists to prevent); (d) pointers to the amendments filed alongside. ### 5.2 The seven ride-alongs (W4.4 Section 2 -- classifications, all recommendation-grade) | # | Item | Grade | Recommended form | |---|---|---|---| | 1 | D-128 Plane-2 shrink (substrate build becomes wholly Plane 1) | [ARCH] | Own dated D-128 AMENDMENT, filed with the package | | 2 | D-125 bridge-in retirement | [ARCH] substance, no independent existence | TERMINATION recorded inside D-144's reconciliation ledger (the D-143/D-101 pattern), not its own entry | | 3 | Client-VM `.8` octet into the D-134 map | [ARCH]-adjacent, narrow | Own dated D-134 AMENDMENT (identical shape to the `.5`/`.6`/`.7` precedents) | | 4 | Root topology (B) + root naming | [OPS] | Ratified in the delivery change-set (changelog + workflow-doc text), no D-number | | 5 | The three isolation controls' SEC rows | (i)/(ii) [OPS] SEC rows; (iii) [ARCH]-adjacent FINDING, [OPS] mechanism | (i)/(ii) SEC-ledger rows (next-free SEC-034, verified); (iii) finding folded into D-144's BODY, mechanism as its own SEC row | | 6 | Rack-controller retirement + D-131 retire-with-evidence | Split: retirement [OPS]; D-131 [ARCH]-touching, independently triggered | Retirement rides owed #5; D-131 gets its own dated AMENDMENT, **gated on the owed live re-measure landing first** | | 7 | Artifact-service placement/sizing | [OPS] | Resolved WITH the #7 FIT numbers at delivery; changelog only | **Net: 0 new D-numbers beyond D-144; 3 amendments filed with the package (D-128, D-134, D-131) + 1 deferred amendment (D-127's client-VM autostart row, filed once DEC-22 rules the value -- a reconciled note this synthesis adds: W4.4's "3 amendments" count and its own D-127 ledger row are consistent only when the D-127 amendment is stated as DEFERRED, see Appendix A.5); 2 findings folded into D-144's body (D-125 termination, power-key tradeoff); the rest is SEC/changelog/runbook work.** ### 5.3 The reconciliation ledger (D-144 -> every touched decision; verb vocabulary = D-143's) | Decision | Verb | One-line basis | |---|---|---| | D-123 (Model B) | **SUPERSEDED** | Core ruling reversed; history stays intact, append-only | | D-125 (bridge-in) | **TERMINATES** | OBS-3's precondition disappears with the nesting; no successor | | D-122 (site shape) | **AMENDS** | Intent preserved; the one-command site-down LITERAL regresses to a root-scoped destroy -- a real, honestly-stated capability loss | | D-124 (transit) | **AMENDS** | Scheme-A addressing survives on the client VM; the Model-B sizing-void clause is RE-CAUSED (exact figure owed) | | D-127 (autostart) | **AMENDS** | Containment row loses its object; client-VM row OWED (DEC-22), amendment deferred until ruled | | D-128 (two-plane) | **AMENDS** | Plane 2's definition shrinks to MAAS/NetBox; the model itself stands | | D-131 (node DNS) | **AMENDS** | Independently triggered by D-132's per-DC regions; gated on live re-measure; dc1 asymmetry is real | | D-134 (octet map) | **AMENDS** | Adds `.8` = client VM; bands/CIDRs unchanged | | D-126 (SSH convention) | **PRESERVES** | Pattern reusable; only the qemu+ssh consumer's key retires, no successor | | D-132-addendum (region VM) | **PRESERVES** | Region stays on maas-01; hypervisor-fate rationale gets a premise-currency note only | | D-138 (client in DC) | **PRESERVES** | The principle IS what the client VM realizes; only the concrete host changes | | D-114, D-133, D-139, D-140, D-143 | **untouched** | Named to prevent scope creep (D-114 especially: a DIFFERENT, KEPT containment pattern) | (One divergence between this ledger and the Phase-4 tasking prompt's shorthand is logged at Appendix A.6 -- the worker document, grounded in the pass evidence, governs.) --- ## 6. OWED artifacts (13) + OWED live measurements ### 6.1 The 13 owed artifacts (pass2 Section 5 spec; harness dispositions per pass3 -- all LOGGED, none built) | # | Artifact | Harness | Blocker | |---|---|---|---| | 1 | Teardown primitive (root-scoped gated `tofu destroy`) | C3 (new) | DEC-11 | | 2 | The (a) cross-DC host isolation control | C2 (new) | DEC-14 | | 3 | SEC-010 transit-leg successor (one installer, both ends) | A3 (extend) | DEC-16 (shape) | | 4 | R7 credential-revocation checklist | C6 (new) | ready | | 5 | MAAS record release/delete + rack-controller decommission | C7 (new) | ready (decommission half: DEC-08) | | 6 | Emergency site-down lever | rides C3's fixture library | DEC-11 | | 7 | FIT-calculator extension (+ artifact-service sizing) + fresh capacity measure | A8 (extend) | ready | | 8 | MAC re-measurement pass post-apply | rides C1's MAC invariant | TF-13 | | 9 | NetBox DCIM migration | A6 (extend) | DEC-21 | | 10 | Post-build live asserts (geneve/jumbo; gap-#20 re-verify) | rides `geneve-encap-assert` verbatim, new invocation only | TF-13 | | 11 | **Power-key blast-radius mitigation -- CRITICAL PATH** | C4 (new; itself a precondition for A4/A5/A9) | DEC-15 | | 12 | `modules/dc-site` + per-DC flat roots | C1 (new) | DEC-11/12/13 | | 13 | D-131 retirement-evidence checker | C5 (new; dc1 = standing-RED until live retirement) | DEC-09 | Every net-new artifact ships its `tests//run-tests.sh` FROM THE SAME COMMIT (per-module harness contract), with changelog + revert, repo-lint clean. ### 6.2 OWED live measurements (read-only where pre-build; NONE performed by this pass) **Before the recommendation-grade rulings are ratified:** (1) current-day `primary_rack`/rackd state, BOTH DCs (gates DEC-08/DEC-09 -- the pass2 cites are 2-10 days old, instrument-currency #20/#25); (2) vcloud's LIVE polkit/libvirt access config (input to DEC-15's mechanism design). **Before/at build:** (3) fresh vcloud host-capacity measurement + (4) exact FIT for the flat 12+1-VM/DC roster (until then "~176 GiB freed" stays DIRECTIONAL only -- B.1.1 hard gate); (5) post-build geneve/jumbo live assert on the vcloud-level planes (analytically unchanged, live proof owed); (6) MAC re-measurement post-apply (B.4.3); (7) the client VM's transit NIC name (dc0's live was `enp1s0`, not `mgmt` -- before any SEC-010-successor rule is written); (8) D-131 dig-evidence per fresh region (owed #13); (9) gap-#20 verdict re-verify post-build (its own expiry clause triggers). --- ## 7. >>> OPEN DECISIONS FOR THE OPERATOR <<< Two tiers. Nothing below is ruled by this pass (GA-R5). The 23 DEC rows of the master inventory partition exactly into these tiers + already-covered ledger rows (Appendix A.3). ### Tier 1 -- the [ARCH] decision package (rule together, BEFORE Part B's Stage 3 ever runs) 1. **DEC-01 -- THE ruling: adopt the container-elim as new D-144 (recommended) or as a D-123 amendment.** **This is the single most important decision in the plan**: it is the root every ride-along hangs off, W4.2's composition names it a PRECONDITION for the first flat Stage-3 apply, and per SCOPE Section 7 the redeploy is NOT done while it is owed. 2. **DEC-02 / DEC-13 / DEC-09** -- the three amendments filed with it: D-128 (Plane-2 shrink), D-134 (`.8` client VM), D-131 (retire-with-evidence -- **only after owed live measurement (1)**). D-127's amendment (DEC-22, autostart value) is deferred until ruled. 3. **DEC-15 -- the power-key mitigation mechanism** (restricted SSH key / per-DC virsh wrapper / polkit ACL) + its SEC row. **The sharpest EXECUTION blocker: six test/tool edits are frozen until it rules** (Chain A). Recommended: rule it WITH this package, not mid-sequence (Section 4's harmonization). **AMENDED by the advisor review (Section 8, follow-up 1): the mechanism must decide REACH as well as authorization** -- how an in-plane `vr1-dcN-maas-01` reaches vcloud's own libvirtd at L3 without putting a host address on a plane bridge (which the (a) control forbids). Reach + auth ruled together. 4. **DEC-14 / DEC-16** -- the (a) control's concrete nftables mechanism + SEC row; the SEC-010-successor row disposition (new row vs SEC-010 amendment) + endpoint ratification (client VM + voffice1, recommended). 5. **DEC-11 / DEC-12 / DEC-23** -- ratify root topology (B) shared-outer + per-DC-flat (recommended; state-isolation only -- it mitigates NONE of the three concerns), root naming (`vr1-dcN-flat` vs reserving `-substrate`), and the state-blast-radius weighing that rides it. Unblocks the largest cluster of "ready once ratified" rows. 6. **DEC-08 -- rack-controller retirement ratification** (recommended; gated on owed live measurement (1)). 7. **DEC-24 -- the dc0<->dc1 mesh-leg consumer + cross-DC Ceph replication path** (NEW, from the advisor review, Section 8 follow-up 2). Who holds the dc0<->dc1 mesh leg (`virbr5`, netem target) endpoints post-flatten, and how the flat-topology replication plane routes cross-DC Ceph traffic (D-100/D-108) THROUGH netem without violating the (a) control. Pairs with DEC-14. Partly pre-existing (cross-DC replication never built -- dc1 HELD), so the flat design must DEFINE this path; it is not a regression into a working path. OWED: a design + its gate; not a blocker for the D-144 package. ### Tier 2 -- delivery-grade rulings (needed before their specific rows, not before the package) - **DEC-10** artifact-service (`.4`) placement + sizing -- ruled WITH the #7 FIT numbers. - **DEC-22** D-127 client-VM autostart value (unblocks harness A1's new case + the deferred D-127 amendment). - **DEC-21** NetBox-migration design (rename-in-place vs concept retirement, shapes A6). - **DEC-20** A11's home (fold into `cloud-assert.sh` vs a dedicated `isolation-assert.sh`). - **DEC-17** `wan-bridge` module directory: delete vs leave-unreferenced (append-only bias). - **DEC-18** SEC-013 `maas-vm-host` retire-or-keep (flagged to its owner, not this pass). - **DEC-19** `maas-fabric-prune.sh`/`maas_fabric_classify.py` harness gap: build vs accept-as-named-exception (pre-existing, container-elim-ADJACENT only). - DEC-03..DEC-07 are covered by the package's reconciliation ledger (they are the named consequence-notes inside/alongside D-144, not separate operator forks). ### Also owed from the operator (SCOPE Section 8, unchanged) Pre-Roosevelt hardware specs ("within a few days" -- plug-in points mapped in Section 4); any external "module deployment project" artifacts (none identified in-repo at any phase). --- ## 8. Advisor-review follow-ups (added post-synthesis; full text in `FINAL-advisor-review.md`) The advisor reviewed the aggregate and returned **verdict SOUND** -- Option 1, root (B), and the D-144 framing all stand. It raised TWO follow-up gaps of the same shape (an attachment object is deleted; a survivor glossed "unchanged"), both VERIFIED against the full pass docs this session: - **Follow-up 1 (folded into DEC-15):** the MAAS power-dial REACH path (in-plane `maas-01` -> vcloud's own libvirtd) is assumed, not designed, and collides with the (a) control's no-host-address-on-a-plane-bridge rule. The DEC-15 mechanism ruling must decide reach + auth together. Sharpens DEC-15; does not block the package. - **Follow-up 2 (new DEC-24):** the dc0<->dc1 mesh leg (`virbr5`, netem target) is the cross-DC Ceph replication carrier (D-100/D-108); the pass reassigned the Office1-transit legs cleanly to the client VM but left the dc0<->dc1 leg's post-flatten consumer + netem routing undefined. Partly pre-existing (dc1 HELD -> never built), so the flat design must DEFINE it. Own open item. Neither changes the plan's direction; each is now a named open item (Section 7 DEC-15 / DEC-24). --- ## Appendix A -- cross-consistency check results (this synthesis's adversarial pass) **Verdict: CONSISTENT -- zero contradictions across the four Phase-4 dimensions; six reconciled notes, enumerated below. No manufactured contradiction survives into this plan.** **A.1 W4.1 rows <-> W4.3 sequence steps.** Every Part-A/Part-B step that invokes a change-artifact resolves to a W4.1 inventory row (spot-mapped: A.3=SC-12, A.4=SC-13, A.9/B.8.1=SC-18, B.1.1=SC-16, B.3.1=SC-10/GT-01/SEC-01/HN-C2, B.4.1=TF-12/TF-13, B.4.3=SC-17, B.5.1=DEC-08/SC-05, B.5.2=SC-15/HN-C5, B.5.4=SC-04/GT-03, B.6.1=DEC-15/SC-11/ HN-C4/SEC-02, B.6.2=LB-01, B.6.3=SC-01, B.7.3=SEC-04/GT-06, B.7.5=SC-19/GT-02, B.8.2=DEC-01). *Reconciled note 1:* W4.3's B.1.2/B.1.3a (NetBox apex re-carve; 10.13 naming-collision DOCFIX) are NOT W4.1 rows -- correctly so: they are D-143's OWN owed-execution items (D-143 axis), and W4.1's LB-03 explicitly quarantines that axis. By-design separation, not a gap. **A.2 The three critical-path chains vs the sequence.** All honored: Chain B at B.3-before- B.4 (fork-robust "before ANY flat apply", not merely "before the second DC's"); Chain A at B.6.1-before-B.6.2 (with A4/A5 edited together, same session); Chain C at A.3/A.4-before-A.5-A.7. *Reconciled note 2 (elevated into Section 4):* W4.2's Stage 3.5.3 needs the #11-ruled key shape earlier in its composition than W4.3's B.6.1 choice-point -- no invariant is violated (both keep the ruling before B.6.2/any literal), but the plan recommends DEC-15 be ruled with the up-front package so the choice never lands mid-window. **A.3 W4.4's decision list <-> W4.1's 23 DEC rows.** Not identical, and correctly so: W4.4 frames the [ARCH]-relevant subset -- DEC-01 (core), DEC-02..09/13 (ride-alongs + ledger rows), DEC-10..12, DEC-14..16, DEC-22 (via the D-127 ledger row), DEC-23 (rides DEC-11) = 18 of 23. The remaining five (DEC-17, 18, 19, 20, 21) are OPS/delivery-grade decisions with clean provenance in pass2 Section 6 / pass3 Section 7 open lists -- no invented rows, no dropped [ARCH] item. *Reconciled note 3:* the FINAL-PLAN unions them as Tier 2 (Section 7) so the operator sees all 23. **A.4 W4.2's modules <-> W4.1's 13 TF rows.** Full coverage both directions: every W4.2 layer-table IaC artifact maps to a TF row or a confirmed-unchanged note (mesh-link x3, netem-link, office1-network -- deliberately not itemized; maas-vm-host dead/orthogonal -> DEC-18); every TF row appears in W4.2's design. *Reconciled note 4 (cosmetic):* W4.1's TF IDs skip TF-11 (TF-01..10, 12, 13, 14) -- the count of 13 rows is CORRECT; the gap is a numbering artifact only. Flagged so no future reader "finds" a missing row. **A.5 The D-144 package's internal soundness.** GA-R3 three-prong argument checked against the pass evidence -- each prong independently grounded (Section 5.1); the D-143 precedent verified VERBATIM against `docs/design-decisions.md:8083` this session; next-free D-144 re-verified this session by direct grep (highest = D-143), next-free SEC-034 re-verified (highest = SEC-033) -- both re-grepped again at mint time per numbering discipline. *Reconciled note 5:* W4.4's summary line "3 existing-decision amendments (D-128, D-134, D-131) filed separately" is consistent with its own D-127 AMENDS ledger row only when the D-127 amendment is stated as DEFERRED on DEC-22's value ruling -- Section 5.2 states it that way ("3 filed + 1 deferred"). **A.6 The reconciliation ledger vs decision statuses.** No contradiction found between W4.4's ledger and any decision's verified status (D-128/D-138/D-131/D-134/D-123 texts were direct-read by prior admins at cited lines; D-122/D-123/D-125/D-131/D-140/D-143 headers re-confirmed present this session). *Reconciled note 6:* the Phase-4 tasking prompt's shorthand ("D-122 ... preserved"; D-127 omitted) DIVERGES from W4.4's evidence-grounded ledger (D-122 = AMENDS -- the site-down literal regresses; D-127 = AMENDS-deferred). The worker document governs; this plan carries W4.4's verbs. Named explicitly so a later reader cannot manufacture a contradiction from the prompt text. **A.7 Count arithmetic (lesson #25: show the addition, don't assert it).** 23 (DEC) + 13 (TF) + 3 (LB) + 19 (SC) + 6 (DC) + 5 (RB) + 10 (GT) + 21 (HN) + 4 (SEC) = **104**. Harness decomposition 9 + 5 + 7 = 21 matches pass3 exactly; 13 distinct owed-artifact tags all appear; the three no-double-count folds (rack decommission -> #5; artifact-service sizing -> #7; SEC-010-writer extraction = #3's shape) carried intact. **A.8 Two-axis separation, end to end.** Every W4.1 row and every W4.3 step carries `[CE]`/`[D-143]`/`[both]`; lib-net is quarantined to D-143 (grep-verified at pass2); the four dual-cause items are dual-labeled, never folded. HOLDS. **A.9 Read-only / logged-not-built.** All eight input documents state READ-ONLY with no mutation; this synthesis performed only reads + greps of repo files and writes only this planning document. All 13 owed artifacts remain LOGGED, none built; all mutations in Section 4 are PLANNED steps for later gated execution (hard rules 1/3 respected). **A.10 Remaining inferred/uncited-claim sweep.** None found beyond items already marked OWED by their sources. Recommendation-grade items still needing a live re-measure before ratification: rack retirement (DEC-08/09) and FIT/capacity (Section 6.2 items 1-4). Standing doc-currency nits carried, not fixed here: CLAUDE.md "98 harnesses" vs 103; the workflow doc's stale "~416 GiB"; `maas-node-power` cosmetic URI fixture. --- ## Verification note Author = "the administrator" (no model name asserted, operator instruction). Direct measurements THIS session: `grep -nE '^## D-1(22|23|25|31|40|43)'` + `grep -oE 'D-1[0-9]{2}' | sort -u | tail` on `docs/design-decisions.md` (D-143 header verbatim incl. the AMENDS/TERMINATES precedent; highest D = D-143 -> next-free D-144) and `grep -oE 'SEC-0[0-9]{2}'` on `docs/security-ledger.md` (highest = SEC-033 -> next-free SEC-034). Everything else rests on the four Phase-4 worker docs and the four prior administrator reports, read IN FULL this session, whose own verification notes record the underlying direct reads/greps -- their citations were relied upon as verified there, not re-derived wholesale here; no claim was upgraded beyond its source's stated grade. READ-ONLY; findings LOGGED only; nothing executed against the cloud.