Sync network redesign repo state and cutover artifacts

home/doris-dashboard/docs/legacy-cia-triage-worksheet.md

@@ -0,0 +1,151 @@
+# Legacy CIA Via Device Triage Worksheet
+
+> For Doris: this worksheet exists so tomorrow does not devolve into vibes and guessing. Every device on Legacy CIA gets one label: migrate, quarantine, or kill.
+
+Goal: classify every remaining device on the legacy CIA Via VLAN/SSID so we can make deliberate decisions during and after the cutover.
+
+Rules:
+- No new devices join Legacy CIA.
+- If a device has a clean future home, move it.
+- If a device is still useful but cannot be re-homed cleanly, quarantine it.
+- If nobody knows what it is or nobody misses it, kill it.
+
+---
+
+## 1. Decision Criteria
+
+### Migrate
+Use `migrate` when all or most are true:
+- device still matters
+- app/admin control still exists
+- owner is known
+- function is understood
+- a target VLAN/SSID is obvious
+- there is a reasonable validation method after moving
+
+### Quarantine
+Use `quarantine` when all or most are true:
+- device still provides value
+- current owner/function is known enough
+- moving it is risky, annoying, or impossible right now
+- app/pairing/discovery state is fragile
+- acceptable to leave it internet-only or nearly so
+
+### Kill
+Use `kill` when all or most are true:
+- nobody knows what it is
+- nobody can still administer it
+- nobody notices when it is offline
+- it duplicates something better
+- it exists only because history happened
+
+## 2. Recommended First-Pass Classification
+
+### Migrate tomorrow if practical
+- Main-Floor ecobee -> IoT VLAN 40
+- Upstairs ecobee -> IoT VLAN 40
+- MyQ -> IoT VLAN 40
+- Samsung FamilyHub -> IoT VLAN 40
+- LG dryer -> IoT VLAN 40
+- doorbell -> Cameras VLAN 60
+- Protect chimes -> Cameras VLAN 60
+
+### Migrate later / careful handling
+- Google Home Mini -> IoT VLAN 40 after discovery testing
+- Chromecast-class devices -> IoT VLAN 40 after discovery testing
+- any Google cast/speaker/display weirdness -> probably last batch
+
+### Quarantine on Legacy CIA
+- old bulbs still doing useful work
+- old plugs still doing useful work
+- retained mystery devices with known household function but bad migration prospects
+- any device that still works but has no sane re-pair workflow tonight
+
+### Likely kill candidates
+- unknown stale MACs
+- orphaned historical smart-home junk
+- dead bulbs/plugs nobody notices
+- duplicate or long-gone clients still mentally treated as active
+
+## 3. Live Worksheet Table
+
+Fill one row per client discovered on Legacy CIA.
+
+| Device name | MAC | IP | Vendor | Physical location | What it does | Owner | Current control path | Target lane | Disposition | Why | Test after move/block | Result |
+|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| Main-Floor ecobee |  |  | ecobee | main floor | thermostat | household | ecobee app | IoT 40 | migrate | important + controllable | thermostat still controllable |  |
+| Upstairs ecobee |  |  | ecobee | upstairs | thermostat | household | ecobee app | IoT 40 | migrate | important + controllable | thermostat still controllable |  |
+| MyQ |  |  | Chamberlain/LiftMaster | garage | garage door | household | MyQ app | IoT 40 | migrate | meaningful device | app works after move |  |
+| Samsung FamilyHub |  |  | Samsung | kitchen | fridge/display | household | Samsung app/local | IoT 40 | migrate | meaningful appliance | app works after move |  |
+| LG dryer |  |  | LG | laundry | dryer telemetry/control | household | LG app | IoT 40 | migrate | low-risk appliance | app works after move |  |
+| Google Home Mini |  |  | Google |  | voice/cast | household | Google Home app | IoT 40 | migrate later / quarantine | discovery pain | cast/discovery tested |  |
+| Chromecast / Cast device |  |  | Google |  | casting | household | Google Home/app casting | IoT 40 | migrate later / quarantine | discovery pain | cast still works |  |
+| Legacy bulb A |  |  |  |  | light |  | unknown/old app | Legacy CIA | quarantine or kill | depends if anyone misses it | light still works or nobody complains |  |
+| Legacy plug A |  |  |  |  | smart plug |  | unknown/old app | Legacy CIA | quarantine or kill | depends if still useful | plug use validated or not |  |
+| Unknown client 1 |  |  |  |  | unknown | unknown | none | none | kill candidate | unidentified | nobody notices after block |  |
+
+## 4. Fast Triage Questions During The Window
+
+Ask these for each questionable device:
+1. What is it?
+2. Who cares if it breaks?
+3. Can we still control it?
+4. Does it need local LAN access or just internet?
+5. Is its correct long-term home obvious?
+6. Can we test success in under 2 minutes?
+
+If answers are bad, it does not earn migration tomorrow.
+
+## 5. Specific Handling Guidance
+
+### ecobees
+- Move if app/control confidence is decent.
+- Validate both thermostats immediately after move.
+- If one gets weird, revert that one only.
+
+### MyQ / fridge / dryer
+- These are good early IoT wins.
+- Minimal emotional attachment, clear owner, clear expected validation.
+
+### Google / Chromecast ecosystem
+- Treat as suspicious until proven civilized.
+- Do not write broad allow rules just because casting sulks.
+- Prefer leaving these in quarantine over contaminating clean policy.
+
+### Protect chimes / doorbell
+- These are not Legacy CIA end-state residents.
+- Move to Cameras/Security as early cleanup.
+
+### old bulbs / old plugs
+- If still useful but irrecoverable, quarantine.
+- If their purpose is forgotten, block first, then kill if nobody notices.
+
+## 6. Quarantine Policy Reminder
+
+Legacy CIA devices that remain should get:
+- DHCP
+- DNS
+- NTP
+- internet outbound if needed
+- no Management access
+- no Trusted access
+- no Servers access by default
+- no Cameras access
+- no new joins
+
+## 7. Post-Window Cleanup Queue
+
+After tomorrow, every leftover Legacy CIA row should get one next action:
+- retry migration
+- collect pairing/reset docs
+- physically inspect location
+- disable/block and observe
+- remove permanently
+
+## 8. Success Condition
+
+The Legacy CIA sheet is successful when:
+- every device has a named disposition
+- no unknown active clients are left unclassified
+- only genuinely hard leftovers remain in quarantine
+- you can explain why each remaining device is still there