Sync network redesign repo state and cutover artifacts

home/doris-dashboard/docs/network-cutover-red-team-card.md

@@ -0,0 +1,103 @@
+# Network Cutover Red Team Card
+
+Use this during the live window when your brain gets dumb.
+
+Goal:
+- make one clean change
+- validate it
+- either continue or revert
+
+If you feel rushed, stop.
+
+---
+
+## DO
+
+- Keep one known-good Trusted admin client online the entire time.
+- Keep Rocinante alive as the live control box until the main server batch is done or a fallback admin path is proven.
+- Keep UniFi open.
+- Keep the master operator sheet open.
+- Change one thing at a time.
+- Validate after every host, SSID, profile, or firewall change.
+- Revert the last change fast if the break is not obvious.
+- Write down temporary exceptions immediately.
+- Treat Legacy CIA as quarantine, not a place to hide problems.
+
+## DO NOT
+
+- Do not move unrelated core hosts casually.
+- Do not move Rocinante early if you are actively driving the migration from it.
+- Do not touch port 27 casually.
+- Do not touch port 1 unless intentionally normalizing infra.
+- Do not "clean up" Google/cast weirdness early.
+- Do not add broad allow-any-any panic rules.
+- Do not keep pushing forward while tired or annoyed.
+- Do not trust memory when the docs already exist.
+
+---
+
+## FIRST IF BROKEN
+
+1. Ask: what was the very last change?
+2. Revert that exact change first.
+3. Restore management reachability before anything else.
+4. Confirm UniFi gateway, switch, and AP visibility.
+5. Confirm the Trusted admin client still reaches the controller.
+6. Only then decide whether to retry.
+
+If management breaks:
+- revert the last infra/profile/VLAN change immediately
+- stop until control-plane access is stable
+
+If the Nomad/Serenity/PD batch breaks:
+- revert the last moved host first and unwind in reverse order
+- do not start debugging Google nonsense in the middle of a storage/service outage
+
+If a server breaks:
+- revert only that server/port/profile
+- do not move the next server yet
+
+If an IoT device breaks:
+- revert only that device
+- keep the rest of the window moving
+
+If Google/cast gets weird:
+- defer it
+- do not poison policy for the whole network
+
+---
+
+## SAFE ORDER
+
+1. Baseline capture
+2. Create/confirm objects only
+3. Management cleanup
+4. Security/chimes/camera lane
+5. Server ports one by one
+6. Easy IoT wins
+7. Legacy CIA quarantine pass
+8. Google weirdness only if time and confidence remain
+9. Guest/SSID cleanup
+10. Final validation
+11. Stop
+
+---
+
+## SUCCESS LOOKS LIKE
+
+- Management materially cleaner
+- Camera/Security lane exists
+- Servers lane exists and core hosts are moved or clearly staged
+- Easy-value IoT devices are moved
+- Legacy CIA is now an explicit quarantine/sunset lane
+- No broad insecure emergency rules were added
+
+## HARD STOP
+
+Stop if:
+- you lose clear management reachability
+- you are stacking unresolved breakage
+- you are guessing instead of validating
+- you catch yourself saying "it’ll probably be fine"
+
+That sentence means stop.