docs(02-01): complete config backup primitives plan

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.planning/STATE.md

@@ -0,0 +1,81 @@
+---
+gsd_state_version: 1.0
+milestone: v9.6
+milestone_name: milestone
+status: in_progress
+stopped_at: Completed 02-01-PLAN.md
+last_updated: "2026-03-13T01:49:00Z"
+last_activity: 2026-03-13 -- Completed 02-01 config backup primitives (SSH executor, normalizer, NATS event, migration)
+progress:
+  total_phases: 10
+  completed_phases: 1
+  total_plans: 3
+  completed_plans: 2
+  percent: 100
+---
+
+# Project State
+
+## Project Reference
+
+See: .planning/PROJECT.md (updated 2026-03-12)
+
+**Core value:** Operators can see exactly what changed on a router and when, with reliable config snapshots for download
+**Current focus:** Phase 2: Poller Config Collection
+
+## Current Position
+
+Phase: 2 of 10 (Poller Config Collection)
+Plan: 1 of 2 in current phase (02-01 complete)
+Status: Phase 2 in progress
+Last activity: 2026-03-13 -- Completed 02-01 config backup primitives (SSH executor, normalizer, NATS event, migration)
+
+Progress: [███████░░░] 67%
+
+## Performance Metrics
+
+**Velocity:**
+- Total plans completed: 2
+- Average duration: 4min
+- Total execution time: 0.13 hours
+
+**By Phase:**
+
+| Phase | Plans | Total | Avg/Plan |
+|-------|-------|-------|----------|
+| 01-database-schema | 1 | 3min | 3min |
+| 02-poller-config-collection | 1 | 5min | 5min |
+
+**Recent Trend:**
+- Last 5 plans: none
+- Trend: N/A
+
+*Updated after each plan completion*
+
+## Accumulated Context
+
+### Decisions
+
+Decisions are logged in PROJECT.md Key Decisions table.
+Recent decisions affecting current work:
+
+- [01-01] Models added to existing config_backup.py (same domain, consistent pattern)
+- [01-01] config_text stores Transit ciphertext (vault:v1:...), plaintext never in DB
+- [01-01] sha256_hash is of plaintext config for deduplication without decryption
+- [02-01] TOFU fingerprint format matches ssh-keygen: SHA256:base64(sha256(pubkey))
+- [02-01] NormalizationVersion=1 constant in NATS payloads for future re-processing
+- [02-01] UpdateSSHHostKey uses COALESCE on first_seen to preserve original observation time
+
+### Pending Todos
+
+None yet.
+
+### Blockers/Concerns
+
+- OpenBao dev instance loses Transit keys on data wipe -- device creds need re-entry (from project memory, may affect snapshot encryption testing)
+
+## Session Continuity
+
+Last session: 2026-03-13T01:49:00Z
+Stopped at: Completed 02-01-PLAN.md
+Resume file: .planning/phases/02-poller-config-collection/02-02-PLAN.md