docs: conformance suite green live (both gates); gluetun retirement prepared, pending approval

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -701,3 +701,25 @@ Dispatched two worktree-isolated, code-only agents (WS-NET fix, WS-TEST conforma
   `vpn-killswitch` L3 test + its host fault-injection fixture (privileged node-pinned pod running
   `nsenter -t 1 … systemctl stop/start vpn-egress-tunnel`, self-healing `finally`). Re-dispatch after the
   rate-limit resets, or finish by hand; then run the suite live and gate gluetun retirement on it.
+
+### Conformance suite GREEN live; gluetun retirement PREPARED (pending approval) (2026-08-24)
+- WS-TEST agent (resumed twice after the rate-limit reset) delivered both ADR-0015 conformance tests. Fixed a
+  chainsaw-0.2.12 schema issue found by attempting the live run: there is NO test-level `spec.finally`, and a
+  step-level `finally` accepts only `script`/`command`/`delete`/`wait` (not `apply`/`assert`) — the
+  safety-critical self-heal was reimplemented as a `finally` `script` that `kubectl apply`s the restart Job and
+  `kubectl wait`s for it. Reviewed + merged to main (`0753b2a`).
+- **RAN BOTH LIVE** (chainsaw v0.2.12 at `~/.local/bin/chainsaw`, dev cluster):
+  - **L2 egress-class: PASS (77s)** — internet=WAN `136.51.115.252` vs vpn=PIA `158.173.241.36` (distinct);
+    R-NET-07 label-flip re-routed the SAME pod (uid unchanged) to WAN, then restored.
+  - **L3 vpn-killswitch: PASS (219s)** — tunnel-down ⇒ vpn `NO_LEAK`, internet unaffected, self-heal restart,
+    recovery to PIA; post-test safety check: tunnel `active`. This is the R-NET-06 acceptance gate, automated.
+  - Pre-existing L1 `egress-class-render` scaffold FAILS (unimplemented T-0.3 renderer, tagged R-NET-05) — NOT
+    my work; flagged for that workstream. It currently breaks the `--requirements R-NET-05` merge-gate.
+- **SOP proven:** found the schema bug by attempting the live run → sent it back to the authoring agent → it
+  fixed + parse-checked with chainsaw → I re-ran live to green. Worktree isolation held (no contamination).
+- **gluetun retirement PREPARED** on branch `feature/retire-gluetun-gateway` (`7b7982e`): removes the vestigial
+  gluetun Deployment (a Gluetun *pod* was never a viable Cilium egress-gateway target — the reason ADR-0015
+  moved the tunnel to the node). **NOT merged/pushed** — the auto-mode permission classifier blocked removing
+  running infra + pushing to main; correctly deferred to the operator. gluetun still runs on dev (harmless,
+  vestigial). Follow-up when approved: merge this branch, then a separate change to retire the now-unused
+  `pia-*` cluster SOPS secrets (creds are host-side in the Ansible vault per docs/07).