Change Records #
One record per significant change to a site: what was changed and why, the end state it aimed for, the procedure, how to undo it, and what actually happened.
The runbook and these records hold different kinds of information. The runbook is maintained: procedures and templates, kept current, and edited whenever reality changes. A change record is retained: evidence of a change made on a given day. It is written once and then left alone, apart from follow-ups closing. Incidents are kept the same way, under Incident Records.
New records start from the change record template. Change Management says when a change needs one.
Records #
| ID | Date | Change | Type | Site | Status |
|---|---|---|---|---|---|
| CHG-0066 | Unscheduled | The Management Hypervisor Moves to Proxmox VE 9 | Upgrade | mobile | Planned |
| CHG-0065 | 2026-11-12 | Removing a Tenant Leaves Nothing Behind | Deployment | mobile | Complete |
| CHG-0064 | 2026-11-12 | The Inventory Vault Under a New Password | Configuration | mobile | In progress |
| CHG-0063 | 2026-11-12 | The Core Router’s Untagged LAN Loses Its Flat-Network Address | Decommission | mobile | Complete |
| CHG-0062 | 2026-11-11 | Router and Wi-Fi Controller Backed Up After Every Change | Deployment Β· Configuration | mobile | Complete |
| CHG-0061 | 2026-11-11 | The Core Router Restored From Its Vaulted Backup | Configuration | mobile | Complete |
| CHG-0060 | 2026-11-09 | An Operator Reissue of a Tenant’s State Secret | Deployment | mobile | Complete |
| CHG-0059 | 2026-11-07 | The Secret Store Refuses Reserved Names | Configuration Β· Deployment | mobile | Complete |
| CHG-0058 | 2026-11-04 | Windows Tenant Laptops | Deployment Β· Configuration | mobile | Complete |
| CHG-0057 | Unscheduled | Build the Home Site | Deployment Β· Configuration | home | Planned |
| CHG-0056 | 2026-10-25 | A Deevnet Pi by Default, With a Starter PKI Kit | Deployment | mobile | Complete |
| CHG-0055 | 2026-11-01 | Existing Tenants Reissued Under Site-Less Names | Configuration Β· Migration | mobile | Complete |
| CHG-0054 | 2026-10-25 | Tenant Names Without a Site | Deployment Β· Configuration | mobile | Complete |
| CHG-0053 | 2026-11-08 | OpenBao Sealed by Shamir Shares | Configuration | mobile | Complete |
| CHG-0052 | 2026-10-25 | A Sealed OpenBao Is Unavailable, Not a Lost Secret | Deployment | mobile | Complete |
| CHG-0051 | 2026-10-18 | The Take-Home Image on deevnet-kit 0.12.0 | Deployment | mobile | Complete |
| CHG-0050 | 2026-10-18 | Extra Names on a Pi’s Certificate (deevnet-kit 0.12.0) | Deployment | mobile | Complete |
| CHG-0049 | 2026-10-18 | The Take-Home Image on deevnet-kit v0.11.0 | Deployment | mobile | Complete |
| CHG-0048 | 2026-10-18 | A Switch Port for dv02rpi003p01 | Configuration | mobile | Complete |
| CHG-0047 | 2026-10-11 | Server Certificates for Tenants’ Services | Deployment Β· Configuration | mobile | Complete |
| CHG-0046 | 2026-10-10 | Tenant-Facing Services on 443 | Deployment Β· Configuration | mobile | Complete |
| CHG-0045 | 2026-10-10 | A Service Name for Grafana | Configuration | mobile | Complete |
| CHG-0044 | 2026-10-06 | Fixed Addresses for Tenants’ Devices | Deployment Β· Configuration Β· Migration | mobile | Complete |
| CHG-0043 | Unscheduled | A Local Package Mirror | Deployment Β· Configuration | mobile | Planned |
| CHG-0042 | Unscheduled | Two Undeclared VMs Moved Off the Management Hypervisor | Migration | mobile | Planned |
| CHG-0041 | Unscheduled | The Artifact Server Over HTTPS | Configuration | mobile | Planned |
| CHG-0040 | Unscheduled | Device Secrets in Tenant Code | Deployment Β· Migration | mobile | Planned |
| CHG-0039 | 2026-10-07 | Backup to an Attached USB Drive | Deployment | mobile | In Progress |
| CHG-0038 | Unscheduled | The Reconcile Restores Everything | Deployment Β· Configuration | mobile | Planned |
| CHG-0037 | 2026-11-08 | Substrate Builds Off OpenBao | Configuration | mobile | In Progress |
| CHG-0036 | 2026-10-25 | OpenBao’s Keys From the Vault | Configuration | mobile | Complete |
| CHG-0035 | 2026-10-06 | Previously Exposed Credentials Checked and Rotated | Configuration | mobile | Complete |
| CHG-0034 | Unscheduled | Device Certificates Through the Deevnet API | Deployment Β· Configuration | mobile | Planned |
| CHG-0033 | 2026-10-03 | The Deevnet PKI | Configuration | mobile | Complete |
| CHG-0032 | 2026-10-02 | The Appliances on Site Certificates | Configuration | mobile | Complete |
| CHG-0031 | 2026-10-02 | The Site Root and Its Intermediate | Configuration | mobile | Superseded |
| CHG-0030 | 2026-09-27 | The State Store Over TLS | Configuration | mobile | Complete |
| CHG-0029 | 2026-09-27 | One Key per Tenant on DVNTM-TD | Configuration | mobile | Complete |
| CHG-0028 | 2026-09-27 | Tenants Log In to Their Own Workloads | Deployment | mobile | Complete |
| CHG-0027 | 2026-09-25 | A Switch Port for dv02rpi004p01 | Configuration | mobile | Complete |
| CHG-0026 | 2026-09-25 | Build Secrets Off the Disk | Configuration | mobile | Complete |
| CHG-0025 | 2026-09-24 | Tenant Downloads | Deployment Β· Configuration | mobile | Complete |
| CHG-0024 | 2026-09-24 | Tenant Dashboards | Deployment Β· Configuration | mobile | Complete |
| CHG-0023 | 2026-09-23 | Internet Means Internet | Configuration | mobile | Complete |
| CHG-0022 | 2026-09-23 | The Tenant Dev Network | Configuration | mobile | Complete |
| CHG-0021 | 2026-09-22 | The MQTT Log Bridge | Deployment | mobile | Complete |
| CHG-0020 | 2026-09-22 | The API Issues Tenant Log Tokens | Deployment Β· Configuration | mobile | Complete |
| CHG-0019 | 2026-09-22 | Strip the Log Store to Tenant Scope | Configuration Β· Decommission | mobile | Complete |
| CHG-0018 | 2026-09-21 | The Central Log Store | Deployment Β· Configuration | mobile | Complete |
| CHG-0017 | 2026-09-20 | Retire Mosquitto | Configuration Β· Cleanup | mobile | Complete |
| CHG-0016 | 2026-09-20 | The API Writes Broker Accounts | Deployment Β· Configuration | mobile | Complete |
| CHG-0015 | 2026-09-20 | The VerneMQ Broker | Deployment | mobile | Complete |
| CHG-0014 | 2026-09-20 | The Tenant Device Registry | Deployment | mobile | Complete |
| CHG-0013 | 2026-09-18 | Tenant Wi-Fi PPSK Keys | Deployment | mobile | Complete |
| CHG-0012 | 2026-09-18 | Operator Access to Tenant Workloads | Configuration | mobile | Complete |
| CHG-0011 | 2026-09-17 | Tenant Workloads Get a Resolver | Configuration Β· Deployment | mobile | Complete |
| CHG-0010 | 2026-09-17 | Deploy the Deevnet API and Cut Tenants Over | Build-out and migration | mobile | Complete |
| CHG-0009 | Unscheduled | Access Switch Omada Adoption | Migration | mobile | Planned (on hold) |
| CHG-0008 | 2026-09-15 | Management Domain VMs, First Build | Deployment Β· Decommission | mobile | Complete |
| CHG-0007 | 2026-09-19 | Core Router Zone Policy, First Application | Configuration | mobile | Complete |
| CHG-0006 | 2026-09-16 | Access Switch Firmware Upgrade | Upgrade | mobile | Complete |
| CHG-0005 | 2026-09-15 | Wireless AP Firmware and Omada Adoption | Migration | mobile | Complete |
| CHG-0004 | 2026-09-10 | Omada Controller Upgrade | Upgrade | mobile | Complete |
| CHG-0003 | 2026-09-05 | Host Rename (ADR-0008) | Migration | mobile | Complete |
| CHG-0002 | 2026-03-26 | Authority Transition Rework | Configuration | mobile | Complete |
| CHG-0001 | 2026-03-21 | Flat Network β VLANs | Migration | mobile | Complete |
Records are numbered CHG-NNNN in the order they are opened, like
ADRs: the number is global, never reused, and is how a record
is cited. They are grouped by year, and each carries the date execution started.
Retrospective records #
Changes made before this section existed are written up retrospectively. Each one is rebuilt from the plan that drove the change, the automation logs, and git history, and says so at the top. A retrospective record reshapes what was captured at the time. Where the original material is silent, the record says so rather than filling the gap.