# Legacy CIA Via Device Triage Worksheet

> For Doris: this worksheet exists so tomorrow does not devolve into vibes and guessing. Every device on Legacy CIA gets one label: migrate, quarantine, or kill.

Goal: classify every remaining device on the legacy CIA Via VLAN/SSID so we can make deliberate decisions during and after the cutover.

Rules:
- No new devices join Legacy CIA.
- If a device has a clean future home, move it.
- If a device is still useful but cannot be re-homed cleanly, quarantine it.
- If nobody knows what it is or nobody misses it, kill it.

---

## 1. Decision Criteria

### Migrate
Use `migrate` when all or most are true:
- device still matters
- app/admin control still exists
- owner is known
- function is understood
- a target VLAN/SSID is obvious
- there is a reasonable validation method after moving

### Quarantine
Use `quarantine` when all or most are true:
- device still provides value
- current owner/function is known enough
- moving it is risky, annoying, or impossible right now
- app/pairing/discovery state is fragile
- acceptable to leave it internet-only or nearly so

### Kill
Use `kill` when all or most are true:
- nobody knows what it is
- nobody can still administer it
- nobody notices when it is offline
- it duplicates something better
- it exists only because history happened

## 2. Recommended First-Pass Classification

### Migrate tomorrow if practical
- Main-Floor ecobee -> IoT VLAN 40
- Upstairs ecobee -> IoT VLAN 40
- MyQ -> IoT VLAN 40
- Samsung FamilyHub -> IoT VLAN 40
- LG dryer -> IoT VLAN 40
- doorbell -> Cameras VLAN 60
- Protect chimes -> Cameras VLAN 60

### Migrate later / careful handling
- Google Home Mini -> IoT VLAN 40 after discovery testing
- Chromecast-class devices -> IoT VLAN 40 after discovery testing
- any Google cast/speaker/display weirdness -> probably last batch

### Quarantine on Legacy CIA
- old bulbs still doing useful work
- old plugs still doing useful work
- retained mystery devices with known household function but bad migration prospects
- any device that still works but has no sane re-pair workflow tonight

### Likely kill candidates
- unknown stale MACs
- orphaned historical smart-home junk
- dead bulbs/plugs nobody notices
- duplicate or long-gone clients still mentally treated as active

## 3. Live Worksheet Table

Fill one row per client discovered on Legacy CIA.

| Device name | MAC | IP | Vendor | Physical location | What it does | Owner | Current control path | Target lane | Disposition | Why | Test after move/block | Result |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Main-Floor ecobee |  |  | ecobee | main floor | thermostat | household | ecobee app | IoT 40 | migrate | important + controllable | thermostat still controllable |  |
| Upstairs ecobee |  |  | ecobee | upstairs | thermostat | household | ecobee app | IoT 40 | migrate | important + controllable | thermostat still controllable |  |
| MyQ |  |  | Chamberlain/LiftMaster | garage | garage door | household | MyQ app | IoT 40 | migrate | meaningful device | app works after move |  |
| Samsung FamilyHub |  |  | Samsung | kitchen | fridge/display | household | Samsung app/local | IoT 40 | migrate | meaningful appliance | app works after move |  |
| LG dryer |  |  | LG | laundry | dryer telemetry/control | household | LG app | IoT 40 | migrate | low-risk appliance | app works after move |  |
| Google Home Mini |  |  | Google |  | voice/cast | household | Google Home app | IoT 40 | migrate later / quarantine | discovery pain | cast/discovery tested |  |
| Chromecast / Cast device |  |  | Google |  | casting | household | Google Home/app casting | IoT 40 | migrate later / quarantine | discovery pain | cast still works |  |
| Legacy bulb A |  |  |  |  | light |  | unknown/old app | Legacy CIA | quarantine or kill | depends if anyone misses it | light still works or nobody complains |  |
| Legacy plug A |  |  |  |  | smart plug |  | unknown/old app | Legacy CIA | quarantine or kill | depends if still useful | plug use validated or not |  |
| Unknown client 1 |  |  |  |  | unknown | unknown | none | none | kill candidate | unidentified | nobody notices after block |  |

## 4. Fast Triage Questions During The Window

Ask these for each questionable device:
1. What is it?
2. Who cares if it breaks?
3. Can we still control it?
4. Does it need local LAN access or just internet?
5. Is its correct long-term home obvious?
6. Can we test success in under 2 minutes?

If answers are bad, it does not earn migration tomorrow.

## 5. Specific Handling Guidance

### ecobees
- Move if app/control confidence is decent.
- Validate both thermostats immediately after move.
- If one gets weird, revert that one only.

### MyQ / fridge / dryer
- These are good early IoT wins.
- Minimal emotional attachment, clear owner, clear expected validation.

### Google / Chromecast ecosystem
- Treat as suspicious until proven civilized.
- Do not write broad allow rules just because casting sulks.
- Prefer leaving these in quarantine over contaminating clean policy.

### Protect chimes / doorbell
- These are not Legacy CIA end-state residents.
- Move to Cameras/Security as early cleanup.

### old bulbs / old plugs
- If still useful but irrecoverable, quarantine.
- If their purpose is forgotten, block first, then kill if nobody notices.

## 6. Quarantine Policy Reminder

Legacy CIA devices that remain should get:
- DHCP
- DNS
- NTP
- internet outbound if needed
- no Management access
- no Trusted access
- no Servers access by default
- no Cameras access
- no new joins

## 7. Post-Window Cleanup Queue

After tomorrow, every leftover Legacy CIA row should get one next action:
- retry migration
- collect pairing/reset docs
- physically inspect location
- disable/block and observe
- remove permanently

## 8. Success Condition

The Legacy CIA sheet is successful when:
- every device has a named disposition
- no unknown active clients are left unclassified
- only genuinely hard leftovers remain in quarantine
- you can explain why each remaining device is still there