# K3s Phase 2 implementation report

## Baseline

Phase 2 was derived from the fresh post-Phase-1 merge checkout at:

```text
832acc72665e49a1a3f4f19b66fd2810b59d2e48
```

Phase 1 was reported deployed and its encrypted pre/post recovery backups were verified before Phase 2 work began.

## Delivered implementation

- trusted-workstation entrypoint `tools/k3s/enroll-node.sh`;
- stdlib-only enrollment orchestrator and common contract library;
- read-only ephemeral candidate and control-plane helpers;
- exact Tailscale identity and collision gates;
- candidate capacity, systemd, cgroup, clock, root-path and pre-existing-agent checks;
- deterministic 17-step transaction and rollback plan;
- durable transaction ledger with strict ordering and plan binding;
- three-door recovery contract;
- temporary-token metadata without token values;
- paired non-dispatch registry previews;
- recursive secret scanning;
- independent receipt validator;
- sanitized live-topology fixture;
- unit, failure-injection, helper, validator and deterministic shell tests;
- design, runbook, agent instructions and interactive migration presentation.

## Safety improvements found during implementation

Two defects were corrected before packaging:

1. Python does not classify the carrier-grade shared-address block as ordinary private IPv4 on every version. Candidate validation now explicitly requires membership in Tailscale's `100.64.0.0/10` range.
2. The initial plan self-check inverted digest equality. It now recomputes the canonical hash domain and requires an exact match.

The recursive secret scanner was also narrowed so structural metadata such as `bootstrap_token.value_recorded=false` is accepted while scalar token/password/private-key fields and recognizable token/key material are rejected.

## Deliberate Phase 2 limits

- no K3s install or join;
- no token creation or revocation;
- no host/recovery-door convergence;
- no Kubernetes labels, taints, Jobs or Node deletion;
- no tracked registry publication;
- no Phase 3 authorization;
- no product UI or new UI primitive.

The external launcher may publish the repository implementation to a draft Git branch only after an independently validated zero-mutation receipt.