# Pass 3 -- ADMINISTRATOR REPORT: tests review (container-layer elimination) **Author:** the Phase-3 administrator (multi-agent pass, `SCOPE-AND-EXECUTION-PLAN.md` Section 4). **Date:** 2026-08-09. **Inputs:** `pass3-w1-harnesses-gauntlet.md`, `pass3-w2-gates.md`, `pass3-w3-new-tests.md` -- read in full, adversarially cross-checked against repo ground truth (checks logged in Section 1). Baseline consumed: `pass0-admin-report.md` incl. Section 7a (**Option 1 CONFIRMED**; **cross-DC handling (a) CONFIRMED**; MAAS region stays on `vr1-dcN-maas-01`), `pass1-admin-report.md` (planning change-set; the (a)-control consolidated spec, Section 3), `pass2-admin-report.md` (tools change-set; the THREE isolation concerns, Section 2; the 13 owed artifacts, Section 5). READ-ONLY synthesis; no mutation; findings are LOGGED, not executed. All dispositions are proposals feeding Phase 4 (GA-R5); contingent items are marked with their blocking ruling, never pre-picked. Repo discipline governing every row: an assertion must be provably able to FAIL (GA-R6, `SKILL.md:321-333`); assert on CONTENT not existence; REFUSE on unrecognised input, never pass silently; a fix that makes an assertion stale gets REPLACED with the new invariant, never deleted to go green. --- ## 1. Reconciliation / adversarial-check results (run against repo ground truth this session) 1. **The two harness universes UNIFY cleanly -- with two count corrections, no contradictions.** - **W3.1's "13 of 103 affected" needs granularity:** its own verdict line ("2 clean RETIRE, 2 contingent RETIRE, 6 CHANGE, 1 contingent CHANGE") sums to 11 verdict-blocks; the survey table names 14 harnesses (one, `netem-link`, a declared grep false-positive). Reconciled: **13 harnesses carried a survey hit; 8 of them carry CHANGE/RETIRE verdicts; 5 are graded STAY.** The unified table (Section 2) is presented at verdict-block granularity so the counts fall out of it. - **W3.3's summary line "6 new + 5 extend-existing + 2 ride" does not decompose against its own rows -- CORRECTED.** By its own per-artifact dispositions: **7 new-build** (#12 dc-site, #2 (a) control, #1 teardown primitive, #11 power-key mitigation, #13 D-131 evidence, #4 R7 checklist, #5 MAAS record release/delete), **3 extend-existing** (#3 SEC-010 successor -> `tests/site-headend-install` (conditional: new harness if the extraction becomes its own script), #7 FIT extension -> `tests/dc-dc-whole-host-budget`, #9 NetBox migration -> `tests/dc-rack-mgmt-import`), **3 ride** (#6 rides #1's harness, #8 rides `dc-site`'s MAC invariant, #10 rides `geneve-encap-assert` unchanged). 7+3+3 = 13; all owed artifacts accounted for. (The phase prompt inherited the 6/5/2 figure from W3.3's own summary line -- this is a worker-count correction.) - **Overlap check (the load-bearing one):** of the 3 extend-existing, **#3 and #9 map INTO W3.1's affected set** (`site-headend-install` Section-8 SEC-010 sub-case; `dc-rack-mgmt-import` vvr1 pins) -- the same edit seen from two sides, MERGED in Section 2, not double-counted. **#7 crosses the universe boundary knowingly:** `dc-dc-whole-host-budget` sits OUTSIDE W3.1's 13 (its Sec 3.4 supplementary note routes it to W3.2/W3.3 explicitly), and W3.3 #7 picks it up -- the one clean boundary crossing, now inside the unified set (Section 2 row C8). No worker contradicts another anywhere in the two universes. 2. **The power-key (#11) critical-path dependency is CONSISTENT across all three workers** -- W3.1 (edit-list item 4: `dc-selector` + `maas-region-power-key` edited ONLY together with #11's ship, from the ruled URI/key shape), W3.2 (P4's power-address assertion and P5's new register row BLOCKED on #11's mechanism; Sec 4 risk 1), W3.3 (Sec 2.4: the harness + artifact are a stated PRECONDITION for the `lib-hosts.sh` re-derivation and every call-site literal). Stated plainly as the sequencing constraint in Section 4: **owed artifact #11 blocks a six-item cluster of test edits**, and the interim RED those harnesses will show once `lib-hosts.sh` changes is the DESIRED fail-loud state, not a defect to green out. 3. **Gate homes are COHERENT and each assertion is failable** (Section 3 verified row-by-row against W3.2 Sec 1-3 and W3.3 Sec 2): (i) Stage-1 gate + cloud-assert A11a -- enumerates the live bridge set and REFUSES if fewer than the full plane count resolves (SEC-010's fail-open lesson generalized), plus W3.3's no-host-address-on-bridge and does-not-globalize failing fixtures; (ii) preflight **P10** (P10 confirmed the next free slot; P6 is the reserved non-executing reminder block) -- host-bound `--check` on the P7 model, REFUSE off-host, REFUSE on an absent transit interface; (iii) P4-dependency + A11b -- the pass verdict is tied to a NEGATIVE test (the key CANNOT reach the wrong domains) plus W3.3's positive-coverage diff against the DC's own roster and a must-not-over-restrict control. None is an existence-only check; none is a checker-that-cannot-fail. **One administrator spec amendment (recommendation grade): P8's root enumeration must come from a DECLARED root list, not a filesystem glob** -- a glob loop is a checker-that-cannot-fail for a missing/renamed root (it silently drops out of coverage instead of FAIL/WARN). Section 3 carries it. 4. **Two coverage gaps the workers left dangling -- CLOSED BY MEASUREMENT this session:** - **`scripts/pre-flight-checks.sh` body sweep** (W3.2 Sec 4 risk 3 flagged it read by neither worker): grep for W3.1's exact term set (`vvr1|qemu+ssh|172.31|host-nodes|expose_nested|inner root|bootstrap gate|Model B| node_host`) returned **zero hits (rc=1)**. Its container-layer exposure is entirely INDIRECT via sourced `lib-hosts.sh` (`pre-flight-checks.sh:44-45`) -- the dc-selector-covered surface. No direct edit owed to its body; the NEW post-#11 content assertion (Section 3) is net-new, homed in `tests/pre-flight-checks` (harness exists, verified `ls tests/`). - **`lib-identity.sh` harness status** (pass2 Section 6's unclosed worker handoff): ANSWERED by W3.1's no-hit list -- `tests/lib-validate` exercises the `lib-hosts`/`lib-net`/`lib-identity` plumbing generically. Closed. 5. **One pass2 Phase-3 handoff was addressed by NO worker -- carried OPEN, not dropped:** the `maas-fabric-prune.sh`/`maas_fabric_classify.py` harness gap (pre-existing; pass2 Section 6 routed "build vs accept-as-named-exception" to this phase). Verified this session: `tests/maas-fabric-prune` does not exist. None of W3.1/W3.2/W3.3 mentions it. Routed to Phase 4 as a named decision exactly as pass2 framed it (Section 7 open item 8). It is container-elim-ADJACENT only (a pre-existing gap), so parking it there loses nothing from this change-set. 6. **Next-free SEC number: SEC-034 CONFIRMED** -- with the verification shape stated honestly. `ledger-scan.sh` computes next-free for D/DOCFIX/BUNDLEFIX only (run this session: D next-free=144, DOCFIX=214, BUNDLEFIX=059), NOT for SEC rows; the SEC confirmation rests on the direct ledger grep: highest row in `docs/security-ledger.md` = **SEC-033**, and the sole repo-wide SEC-034 mention is W3.2's own doc. **2-or-3 new SEC rows are owed** ((a) control; #11 mitigation; and concern (ii)'s row, which pass2 deliberately left as a "SEC-row disposition" -- it may land as a SEC-010 amendment rather than a new number). Nothing assigned here; delivery greps next-free at mint time per repo numbering discipline. 7. **Denominator + doc-currency:** `tests/HARNESS-MANIFEST` lists 103 harnesses (`tests/` holds 104 entries including the manifest itself) -- W3.1's denominator confirmed. CLAUDE.md's "98 harnesses" line is stale vs 103 -- logged as a doc-currency nit OUTSIDE this pass's change-set (rides the next CLAUDE.md touch; no action here). 8. **No inferred-value violations found** in the three worker docs. Spot-checked load-bearing cites (`preflight.sh` P8 root literal `:284,298`; `cloud-assert.sh` A0-A10 shape; `site-headend-install.sh` SEC-010 writer/check line ranges; `node-vm/variables.tf:38-62` MAC validation; `security-ledger.md:21` fail-open hardening note; the changelog cites for D-131 asymmetry) resolved to the cited lines. Every unknown (root naming, #11 mechanism, (a) rule set, P10's body, D-127's client-VM autostart value) is marked OWED in the source docs rather than guessed. --- ## 2. THE UNIFIED TESTS CHANGE-SET (one table, three dispositions, no double-counting) Blocker legend: `ready` = editable/buildable at delivery with no ruling owed; `#11` = blocked on the power-key mitigation design (Section 4); `root-naming`, `rack-ret` (rack-controller retirement + owed live re-measure), `D-131` (retirement ratification + owed live re-measure), `netbox` (NetBox migration design, owed #9), `mechanism` (the artifact's own Phase-4 mechanism choice), `root-fork` (root-topology ratification). ### A. EXISTING -- CHANGE (9 verdict-blocks across 9 harnesses) | # | Harness (cases) | Edit | Blocker | Failing-direction fixture | |---|---|---|---|---| | A1 | `opentofu-validate` T14/T15 | Re-point autostart pins at the flat root's file; **ADD a new case for the `vr1-dcN-client` VM's autostart value** (D-127's table predates the client VM -- value is an OWED ruling, not inferred) | root-naming (+ the D-127 client-VM ruling for the new case) | Keep exact-value asserts (edge=true / node=false); a flipped bool or wrong path must redden | | A2 | `node-vm` T8-T11 | Re-point hardcoded `INNER=` path at the flat root's file; count invariant likely unchanged (12 `macs=[` / 72 MACs -- the client VM is `cloudinit-vm`, not `node-vm`) -- confirm at build, do not assume | root-naming | Wrong count or missing MAC list must still redden (this harness has gone red twice before, `tests/node-vm/run-tests.sh:68-81`) | | A3 | `site-headend-install` Section-8 SEC-010 sub-case **= owed #3's harness half (MERGED W3.1/W3.3 row)** | Re-target the extracted role-agnostic installer subcommand (both ends: client VM + voffice1); **MIGRATE every proven SEC-010 assertion** (transit-if existence check, br_netfilter never-global, idempotent declare-then-delete reload) -- a migration-completeness grep of the new location for every old trap-string is itself a required test | ready once #3's extraction shape is picked (subcommand -> extend this harness; own script -> new harness inheriting all of it) | Both-ends fixture (fake client role + fake voffice1 role, BOTH get the drop); wrong-role interface-name fixture must FAIL; NIC-naming trap carried (dc0 live was `enp1s0`, not `mgmt`) | | A4 | `dc-selector` power-address rows (`:204-247`) | New values dial vcloud's own libvirtd -- URI shape + whether the FROM_OFFICE1/FROM_DCREGION split survives are #11 design outputs | **#11** | Edit ONLY together with A5, from the ruled URI shape; interim RED once `lib-hosts.sh` changes is correct fail-loud, not a defect | | A5 | `maas-region-power-key` URI assertions (`:67,82,102,108`) | Same dependency, same ruled shape, same edit session as A4 (or they silently diverge) | **#11** | Same as A4 | | A6 | `dc-rack-mgmt-import` vvr1 pins (`:77-78`) **= owed #9's harness half (MERGED W3.1/W3.3 row)** | Rename-in-place vs full-concept retirement is the NetBox-migration design's call -- do not pre-pick; when it lands, add the decommission-completeness assertion | netbox (+ rack-ret for the concept question) | A stale `vvr1-dcN` device record surviving import must FAIL; the D-124 transit-scheme pins (`:73,79` + `d124-transit-seed`) STAY -- mesh facts, not containment facts | | A7 | `maas-profile-assert` office1-profile fixture (`:41,68,72,80`) | Drop the two `vvr1-dcN` rows from the simulated machine list; the client VM does NOT replace them (not MAAS-carved, pass2 3.2) | rack-ret | Post-retirement roster fixture; lowest-risk of the CHANGE set, independent of the #11 cluster | | A8 | `dc-dc-whole-host-budget` **(W3.3 #7; the one universe-boundary crossing -- outside W3.1's 13 by its own routing)** | Extend with the 3 utility-node classes + the artifact-service disk-sizing branch + the flat model; the old Model-A/B comparison cases must not remain the only coverage (they stay green forever against a retired topology) | ready (spec = owed #7; capacity re-measure owed at delivery) | A roster total EXCEEDING the measured host budget must FAIL, not round/omit a class | | A9 | `tests/pre-flight-checks` -- NEW case post-#11 | Assert the LIVE power-address in use matches the mitigation's issued form (restricted-key/wrapper shape), not a raw containment-shaped URI -- the regression detector for concern (iii) | **#11** | A containment-shaped (`qemu+ssh://...@172.31.0.2`-class) or unrestricted URI fixture must FAIL | ### B. EXISTING -- RETIRE (5 verdict-blocks across 3 harnesses) | # | Harness (cases) | Disposition | Blocker | Failing-direction handling (retire rows still need one) | |---|---|---|---|---| | B1 | `opentofu-validate` T13 (D-127 containment autostart pin) | RETIRE -- object deleted, not renamed; D-127 boot-matrix comment block updated in the same edit | ready | **Recommend the negative-assertion case** ("no `vvr1` domain block exists in `opentofu/main.tf`") over W3.1's accept-residual-gap alternative -- a stray re-add then still reddens; grep-checkable comment-currency fixture rides along | | B2 | `site-headend-install` `--host-nodes` block (~15 cases: `node_host_setup()`/`node_host_check()`, D-125 WAN-bridge asserts, hint-neutrality) | RETIRE wholesale (dead code, D-125 has no successor) -- EXCEPT the SEC-010 sub-case, which is A3 | ready (when the code deletion ships) | Re-derive every surviving arg-contract rc from the NEW parse contract (hazard H2) -- do not let a stale `-> 2` case pass on an unrecognized-flag coincidence | | B3 | `site-headend-install` Section 6 (`--role rack`) | CONTINGENT retire; if ratified, a new case asserts `--role rack` is REFUSED/removed; if rejected, stays as-is | rack-ret | The REFUSE case IS the replacement failing-direction fixture -- hold unedited until the ruling lands | | B4 | `dc-rack-net` LEGS cases (T3,T5,T13,T15,T17) | RETIRE (stronger-settled: structural consequence of Option 1 itself -- no flat VM is a libvirt host with own bridges) | ready at script retirement | Append-only bias: file stays in git history; removal via `--record-manifest` + changelog with revert | | B5 | `dc-rack-net` DNS-forwarder cases (T4,T9,T16) + its 8 hygiene cases | CONTINGENT retire wholesale with `dc-rack-net.sh` if D-131 retirement ratifies; if D-131 is kept for a DC, the DNS half survives re-targeted | D-131 | Same manifest/changelog discipline as B4; note `DNS_UPSTREAM="10.10.0.20"` is a pre-existing stale defect either way | **STAY, named so they are not re-litigated:** `opentofu-validate` T8-T10 (S3 module-body cases); `node-vm` T1-T7/T12-T15; `site-headend-install` Sections 1-5,7; `maas-node-power` (URI fixture is an opaque pass-through arg -- cosmetic refresh optional); `preflight` pending-change fixture; `geneve-encap-assert` (all cases -- its post-build live re-run is a new INVOCATION, owed #10, not a harness edit); `site-baseleg` (guard already forward-compatible; comment re-cite is doc-currency); `cloudinit-vm`; `d124-transit-seed`; `netem-link` (declared grep false-positive); the 90 no-hit harnesses. ### C. NEW-BUILD (7 harnesses, one per owed artifact; specs in `pass3-w3-new-tests.md` Sec 2-3) | # | Owed artifact | Harness (model) | Blocker | Signature failing-direction fixture | |---|---|---|---|---| | C1 | #12 `modules/dc-site` | `tests/dc-site/run-tests.sh`, static fixture `.tf` trees (`opentofu-validate` `--static-only` model) | module build (spec ready) | 5-plane tree FAILS count; 11/13-node roster FAILS; 2 client-VM calls FAILS exactly-one; empty `interface_macs` on post-apply tree FAILS; v4-only CIDR on a D-139 v6 plane FAILS; `mtu=1500` FAILS; hardcoded DC literal FAILS site-token check | | C2 | #2 the (a) cross-DC host isolation control | offline fixture-file (`geneve-encap-assert` model); name minted with its SEC row | mechanism | Forward-accept between a dc0 and a dc1 bridge FAILS; **a host ADDRESS on a plane bridge FAILS (distinct failure mode)**; empty/missing ruleset FAILS (never clean); absent-interface-name rule FAILS (SEC-010 fail-open lesson); bare `policy drop` FAILS does-not-globalize | | C3 | #1 teardown primitive (+#6 emergency lever rides the same fixture library) | stateful-fakebin (`phase-00-teardown-d061` model) | root-fork | A dc1 domain in a dc0-targeted set FAILS before any destroy; a shared-outer object leaking in FAILS; a missing expected domain FAILS completeness; EMPTY resolved set REFUSES (rc=2), never "nothing to do" success; failed canary blocks the group destroy | | C4 | #11 power-key mitigation | offline rendered-ACL/`authorized_keys`/polkit parsing (`site-headend-install` grep-the-artifact model) | mechanism -- **and this harness is itself the precondition for the A4/A5/A9 cluster** | dc0 key reaching a dc1 domain FAILS; reaching `voffice1` FAILS; mirror both directions; a wildcard matching nothing FAILS as under-specified; excluding a dc0-own domain FAILS the must-not-over-restrict control | | C5 | #13 D-131 retire-evidence checker | offline dig-capture fixtures; region IPs read from `lib-hosts`/`lib-net`, never duplicated | ready (fixtures exist in the two cited changelogs) | Resolution that SUCCEEDS via the forwarder alias IP FAILS (resolver IDENTITY asserted, not mere success); dc0's measured evidence PASSES; **dc1's current config is a standing-RED case until the live retirement happens** | | C6 | #4 R7 credential-revocation checklist | offline; mock `vm-secret-locations` rows | ready | An unlisted/orphan row for the retiring host class that enumeration misses FAILS (SEC-027's "an unlisted location is not audited") | | C7 | #5 MAAS record release/delete (+ rack-controller decommission) | fakebin `maas` (`dc-egress-check`/`phase-00` model) | ready | A surviving machine record OR the surviving rack-controller/`primary_rack`/DHCP reference after "release" must not report clean | **Rides (no build):** #6 -> C3's fixture library; #8 MAC re-measure -> C1's MAC invariant; #10 geneve/jumbo -> existing `geneve-encap-assert` verbatim, new invocation point in the runbook only. --- ## 3. GATE-HOME MAP -- the three isolation controls + preflight/cloud-assert changes | Control / gate | Home(s) | Failable assertion (content-based, REFUSE-on-unrecognised) | |---|---|---| | **(i) cross-DC host isolation (the (a) control)** | **NEW Stage-1 gate** (host-scoped -- NOT a `DC=`-scoped preflight gate, which would double-run or silently check only the last DC); re-run at each per-DC apply's close and at **cloud-assert A11a** (periodic: post-deploy/restart/pre-change/post-incident) | `--check` on vcloud enumerates the live bridge set for BOTH DCs' six planes (from `lib-hosts.sh` conventions), asserts FORWARD denial between every dc0-tagged/dc1-tagged bridge pair, and **REFUSES if fewer than the full plane count resolves to a live interface**; rule COUNT/hash matched against the artifact's own expected state, not "a table named X exists". Ordering invariant: installed + verified **before the first flat apply of EITHER root** | | **(ii) SEC-010 transit-drop successor** | **NEW preflight P10** (P10 confirmed next free; P6 reserved), DC-scoped, host-bound on the P7/`node_host_check()` model; one role-agnostic installer/checker covers BOTH ends (client VM + voffice1) | `nft` table present keyed to the CLIENT VM'S OWN re-measured transit interface (NIC-naming trap: dc0 live was `enp1s0`); mirrored voffice1 check; REFUSE if the keyed interface does not exist | | **(iii) power-key mitigation** | **Split home:** (a) P4 dependency -- before P4 trusts a power-address literal, verify it matches the mitigation's issued shape (the A9 case); (b) **cloud-assert A11b** -- standing re-verification (the exposure exists whenever libvirtd is up, not only at deploy) | Verdict tied to a NEGATIVE test: connecting with either DC's region key CANNOT enumerate/control domains outside that DC's own roster (mechanism-dependent concrete form: forced-command rejects raw `virsh list --all`, or polkit ACL covers exactly the `vr1-dcN-*` roster); an existence-only key check is explicitly ruled out (GA-R6) | | **rack-retirement / D-131 evidence** | ONE-TIME build-step evidence capture inside the promoted Part-A release/delete step (owed #5/#13) -- NOT a standing gate | The C5 checker: resolver-identity dig per fresh 10.13 region, captured into the build changelog; dc1's asymmetry is a standing-red case until closed | | **P8 substrate drift** | Extend from the single hardcoded `opentofu/` path (`preflight.sh:284,298`) to **loop over every post-flatten root** (shared-outer + each per-DC-flat root under (B)), each printing which root it evaluated; the voffice1 "inner state lives elsewhere" WARN branch goes dead for the DC half | Existing pending-FAILs/refresh-WARNs logic is already content-based and stays. **Administrator amendment: the root list must be DECLARED, not globbed** -- a glob loop cannot fail on a missing/renamed root (it silently drops coverage); a declared list FAILS/WARNs. Blocked on root-naming ratification | | **P5 creds-matrix** | DATA change, not code: `rack`-class register rows re-point to the `client` class; NEW rows owed for #3/#11 key material when minted -- else P5 silently stops covering the new credential-bearing hosts (SEC-022's exact coverage-gap class) | Already failable by construction (D-137 ruling 1); flagged as a delivery dependency on #3/#5/#11, not a script edit | | **P4 / P9 / A11 placement** | P4: no body edit owed (measured clean, check 4) -- the A9 case is the net-new half. P9 (`dc-egress-check`): invocation-host literal only, re-points to the ruled B.5 host (client VM the structural candidate). **A11's home (cloud-assert vs a dedicated `isolation-assert.sh`) is recommendation-grade -- Phase 4 confirms** | -- | | Unchanged | P1, P2 (D-143 axis only), P3, P6, P7 (already host-indirect via `host-identity` -- the pattern P4/P5 should imitate), cloud-assert A0-A10 (zero container-layer assumptions, verified by W3.2 full read) | -- | SEC rows: next-free **SEC-034** (check 6); 2-or-3 rows owed ((a) control, #11, and concern (ii)'s disposition -- possibly a SEC-010 amendment); minted at delivery, next-free re-grepped then. --- ## 4. THE CRITICAL-PATH SEQUENCING CONSTRAINT (stated plainly) **Owed artifact #11 (the power-key blast-radius mitigation) is a BLOCKER for a six-item cluster of test work.** Until its mechanism is chosen (Phase 4) and its artifact + C4 harness ship, NONE of the following may be written -- a guessed URI/key value here is the false-green mint this repo's inferred-value rule exists to prevent: 1. `lib-hosts.sh` `VIRSH_POWER_ADDRESS_FROM_OFFICE1`/`_FROM_DCREGION` re-derivation (the tools-side edit the tests then pin); 2. `dc-selector` power-address rows (A4); 3. `maas-region-power-key` URI assertions (A5) -- A4/A5 edited TOGETHER, same session, same ruled shape; 4. the new `tests/pre-flight-checks` P4 content case (A9); 5. cloud-assert A11b's concrete body; 6. the P5 register row for the mitigation's key material. Order: Phase-4 mechanism choice -> #11 artifact + C4 harness -> then the cluster, as one delivery unit. **Interim state is deliberate:** A4/A5 go honestly RED the moment `lib-hosts.sh` changes -- that fail-loud RED is wanted; do not "fix" it early. Independent of this cluster (may proceed in parallel once their own blockers clear): A1/A2 (root-naming), A7 (rack-ret), B1/B2 (ready), C1/C5/C6/C7 (ready/spec-ready). --- ## 5. HARNESS-EDIT HAZARDS (delivery-time warnings, consolidated from W3.1 Sec 3) - **H1 -- the plausible-URI swap (sharpest risk in the survey):** swapping a plausible-looking new power URI into A4/A5 ("just point it at vcloud") before #11's mechanism exists produces a harness GREEN against a value nothing enforces -- worse than the current honest RED. Only the ruled shape, only both harnesses together. - **H2 -- the rc=2 coincidence:** if `--host-nodes` is REMOVED as a flag, a stale case like `--host-nodes without --role rack -> 2` can keep passing on the unrecognized-flag exit code, silently changing what the assertion proves. Re-derive every expected rc from the NEW arg-parse contract; never assume rc=2 still means what it meant. - **H3 -- delete-to-go-green:** a stale hardcoded path in A1/A2 fails LOUD (safe); the hazard is a sloppy fix that deletes the case instead of re-pointing it, quietly dropping D-127 autostart-drift / MAC-count regression coverage (this class has gone red twice before, `tests/node-vm/run-tests.sh:68-81`). Replace, never delete to go green. - **H4 -- the harness that stays green against a dead topology:** `dc-dc-whole-host-budget`'s Model-A/B math keeps passing indefinitely after the topology it models is gone; nothing forces a re-run until #7 ships. A8's extension must land WITH the redeploy, and the old cases must not remain the sole coverage. - **H5 -- the retirement residual gap:** retiring T13 leaves a stray `vvr1` autostart re-add uncaught unless B1's negative-assertion case is added (recommended over accept-and-declare). - **H6 -- glob-based gate enumeration (administrator addition):** P8's root loop -- and any future multi-root/multi-host gate -- must iterate a declared list; a glob cannot fail on an absent member. --- ## 6. THE PER-MODULE HARNESS CONTRACT (adopted from W3.3 Sec 4 -- the template every Section-2 row follows) Adopted unchanged as the Phase-4 backbone; every principle grounded in an existing repo precedent (cited in `pass3-w3-new-tests.md` Sec 4): **prove-it-can-fail** (every assertion ships a fixture engineered to redden it); **assert the ARTIFACT, not the intent** (the installed rule / rendered file / deployed value, never a comment or self-report); **stage-assert-then-promote** (mutating subjects write to staging, assert staged, then promote); **join the workspace to the deploy input** (byte/value equality between generator output and what the consumer actually reads); **fail-closed on absent/empty/unreachable input** (incl. the interface-name fail-open class); **offline/fixture-driven by default** (fakebin or captured text; a separately-named LIVE gate re-run proves the deployed state -- two tiers, never conflated); **`$SITE`/`$DC`-parameterized** (fixtures exercise both DCs or a synthetic site); **standard exit contract** (`lib-validate.sh` 0/1/2/3/4); **delivery discipline** (own `tests//run-tests.sh`, changelog with revert, repo-lint clean -- no new-module exception). --- ## 7. Settled vs OPEN **SETTLED at this phase (do not re-open):** the unified change-set decomposition (9 existing-change / 5 existing-retire verdict-blocks / 7 new-build harnesses / 3 rides; count corrections in check 1); the gate-home map (Stage-1 for (i), P10 for (ii), P4+A11b split for (iii), P8 declared-list loop, rack-evidence as one-time); the #11 sequencing constraint (Section 4); SEC-034 next-free; the harness contract template; `pre-flight-checks.sh` measured clean of direct container-layer literals; the lib-identity handoff (covered by `tests/lib-validate`); `geneve-encap-assert` and cloud-assert A0-A10 confirmed topology-agnostic. **OPEN -- carried to Phase 4 (rulings; operator rules, GA-R5):** 1. Root NAMING (blocks A1/A2 path re-points; pass2 Section 6 item 2). 2. Rack-controller retirement ratification + the owed live re-measure (blocks A7, B3; shapes A6's concept question). 3. D-131 retirement ratification + live re-measure (blocks B5; C5's dc1 case stands RED until the live retirement). 4. **The #11 mechanism choice** (restricted key / wrapper / polkit ACL) -- unblocks the Section-4 cluster; its SEC row minted with it. 5. The (a) control's concrete nftables rule set + SEC number (C2's fixtures are mechanism-agnostic until then). 6. A11's home: fold into cloud-assert vs a dedicated `isolation-assert.sh` (W3.2 Sec 4 risk 5 -- recommendation-grade either way). 7. NetBox-migration design (owed #9) -- rename-in-place vs concept retirement for A6. 8. **`maas-fabric-prune` harness gap** (pre-existing; no Phase-3 worker addressed it, check 5): build vs accept-as-named-exception -- a named Phase-4 decision. 9. D-127 client-VM autostart value (A1's new case needs the ruled value). 10. The teardown primitive's fixture shape rides the root-fork ratification (C3). **Doc-currency nits (ride other edits, no action here):** CLAUDE.md "98 harnesses" vs 103; `opentofu-validate` header "416 GiB" comment; `maas-node-power` cosmetic URI fixture refresh. --- ## 8. Verification note Author = "the administrator" (no model name asserted, operator instruction). Direct measurements this session: `grep -oE 'SEC-[0-9]{3}' docs/security-ledger.md` (highest = SEC-033) + repo-wide SEC-034 grep (sole hit = W3.2's own doc) + `bash scripts/ledger-scan.sh` (D/DOCFIX/BUNDLEFIX next-free; confirms it does not compute SEC); `grep -nE '' scripts/pre-flight-checks.sh` -> zero hits (rc=1) + lib-hosts sourcing at `:44-45`; `ls tests/` + `wc -l tests/HARNESS-MANIFEST` (103; 104 entries incl. the manifest); `tests/maas-fabric-prune` absent; `tests/pre-flight-checks` and `tests/preflight` both exist (distinct). The three worker docs and three prior admin reports were read in full; worker citations were spot-checked at their load-bearing points, not re-derived wholesale. READ-ONLY; findings LOGGED only; nothing executed.