truenas-stacks/home/doris-dashboard/docs/legacy-cia-triage-worksheet.md

Legacy CIA Via Device Triage Worksheet

For Doris: this worksheet exists so tomorrow does not devolve into vibes and guessing. Every device on Legacy CIA gets one label: migrate, quarantine, or kill.

Historical status note:

• this is a 2026-05-22 migration worksheet, not the current remaining-work checklist
• do not treat its "tomorrow" language as active backlog without checking later result docs
• current truth for Protect accessories lives in unifi-protect-doorbell-chime-current-state-2026-05-26.md

Goal: classify every remaining device on the legacy CIA Via VLAN/SSID so we can make deliberate decisions during and after the cutover.

Rules:

• No new devices join Legacy CIA.
• If a device has a clean future home, move it.
• If a device is still useful but cannot be re-homed cleanly, quarantine it.
• If nobody knows what it is or nobody misses it, kill it.

---

1. Decision Criteria

Migrate

Use migrate when all or most are true:

• device still matters
• app/admin control still exists
• owner is known
• function is understood
• a target VLAN/SSID is obvious
• there is a reasonable validation method after moving

Quarantine

Use quarantine when all or most are true:

• device still provides value
• current owner/function is known enough
• moving it is risky, annoying, or impossible right now
• app/pairing/discovery state is fragile
• acceptable to leave it internet-only or nearly so

Kill

Use kill when all or most are true:

• nobody knows what it is
• nobody can still administer it
• nobody notices when it is offline
• it duplicates something better
• it exists only because history happened

2. Recommended First-Pass Classification

Migrate tomorrow if practical

• Main-Floor ecobee -> IoT VLAN 40
• Upstairs ecobee -> IoT VLAN 40
• MyQ -> IoT VLAN 40
• Samsung FamilyHub -> IoT VLAN 40
• LG dryer -> IoT VLAN 40
• doorbell -> Cameras VLAN 60 only if immediate validation is available
• Protect chimes -> Cameras VLAN 60 only after explicit Protect-path validation; current known-good live state keeps them on Management/default UniFi Wireless

Migrate later / careful handling

• Google Home Mini -> IoT VLAN 40 after discovery testing
• Chromecast-class devices -> IoT VLAN 40 after discovery testing
• any Google cast/speaker/display weirdness -> probably last batch

Quarantine on Legacy CIA

• old bulbs still doing useful work
• old plugs still doing useful work
• retained mystery devices with known household function but bad migration prospects
• any device that still works but has no sane re-pair workflow tonight

Likely kill candidates

• unknown stale MACs
• orphaned historical smart-home junk
• dead bulbs/plugs nobody notices
• duplicate or long-gone clients still mentally treated as active

3. Live Worksheet Table

Fill one row per client discovered on Legacy CIA.

Device name	MAC	IP	Vendor	Physical location	What it does	Owner	Current control path	Target lane	Disposition	Why	Test after move/block	Result
Main-Floor ecobee			ecobee	main floor	thermostat	household	ecobee app	IoT 40	migrate	important + controllable	thermostat still controllable
Upstairs ecobee			ecobee	upstairs	thermostat	household	ecobee app	IoT 40	migrate	important + controllable	thermostat still controllable
MyQ			Chamberlain/LiftMaster	garage	garage door	household	MyQ app	IoT 40	migrate	meaningful device	app works after move
Samsung FamilyHub			Samsung	kitchen	fridge/display	household	Samsung app/local	IoT 40	migrate	meaningful appliance	app works after move
LG dryer			LG	laundry	dryer telemetry/control	household	LG app	IoT 40	migrate	low-risk appliance	app works after move
Google Home Mini			Google		voice/cast	household	Google Home app	IoT 40	migrate later / quarantine	discovery pain	cast/discovery tested
Chromecast / Cast device			Google		casting	household	Google Home/app casting	IoT 40	migrate later / quarantine	discovery pain	cast still works
Legacy bulb A					light		unknown/old app	Legacy CIA	quarantine or kill	depends if anyone misses it	light still works or nobody complains
Legacy plug A					smart plug		unknown/old app	Legacy CIA	quarantine or kill	depends if still useful	plug use validated or not
Unknown client 1					unknown	unknown	none	none	kill candidate	unidentified	nobody notices after block

4. Fast Triage Questions During The Window

Ask these for each questionable device:

1. What is it?
2. Who cares if it breaks?
3. Can we still control it?
4. Does it need local LAN access or just internet?
5. Is its correct long-term home obvious?
6. Can we test success in under 2 minutes?

If answers are bad, it does not earn migration tomorrow.

5. Specific Handling Guidance

ecobees

• Move if app/control confidence is decent.
• Validate both thermostats immediately after move.
• If one gets weird, revert that one only.

MyQ / fridge / dryer

• These are good early IoT wins.
• Minimal emotional attachment, clear owner, clear expected validation.

Google / Chromecast ecosystem

• Treat as suspicious until proven civilized.
• Do not write broad allow rules just because casting sulks.
• Prefer leaving these in quarantine over contaminating clean policy.

Protect chimes / doorbell

• These are not Legacy CIA end-state residents.
• Treat Cameras/Security as the target design, not an automatic next action. The Wi-Fi chimes currently have a documented Management/default-SSID exception because the Camera override broke Protect health.

old bulbs / old plugs

• If still useful but irrecoverable, quarantine.
• If their purpose is forgotten, block first, then kill if nobody notices.

6. Quarantine Policy Reminder

Legacy CIA devices that remain should get:

• DHCP
• DNS
• NTP
• internet outbound if needed
• no Management access
• no Trusted access
• no Servers access by default
• no Cameras access
• no new joins

7. Post-Window Cleanup Queue

After tomorrow, every leftover Legacy CIA row should get one next action:

• retry migration
• collect pairing/reset docs
• physically inspect location
• disable/block and observe
• remove permanently

8. Success Condition

The Legacy CIA sheet is successful when:

• every device has a named disposition
• no unknown active clients are left unclassified
• only genuinely hard leftovers remain in quarantine
• you can explain why each remaining device is still there