# creds-matrix.tsv -- D-137 expected-state credential register (ADOPTED 2026-07-26).
#
# THE SINGLE SOURCE. creds-manifests/*.manifest are DERIVED from this file
# (D-137 ruling 2: `scripts/creds-matrix.py --render`); do not hand-edit a manifest.
#
# WHY A FORWARD REGISTER. creds-audit is DECLARATION-based, so an undeclared secret is
# structurally invisible -- and no discovery sweep can ever detect a credential that was
# never minted at all. Absence is invisible to discovery. This file states what SHOULD
# exist so absence becomes a detectable FAIL.
#
# LOGICAL KEYS ONLY (SEC-004 -- this repo is currently PUBLIC). No values, no hostnames,
# no IPs, no grants, no paths. `host-role` is a role token, never a VM name.
#
# FORMAT. Whitespace-separated positional records in the manifests' idiom (the same shape
# creds-audit.sh:49 reads). `#` comments and blank lines ignored. NO FIELD MAY CONTAIN
# WHITESPACE. `-` means not-applicable.
#
# A ROW IS ONE (credential, location) PAIR -- not one credential (12-column amendment,
# 2026-07-26). Copies of one credential share an `id`, one row per place it lives. `id` is
# therefore the IDENTITY, which is what makes ruling 5 checkable: if the rows sharing an id
# carry more than one `principal`, that identity serves two principal types -> FAIL.
#
# columns:
#   id           logical identity (rows sharing an id are copies/forms of one identity)
#   cardinality  singleton | per-site | per-DC | per-node | per-tenant
#   site-key     region-qualified (vr1-dc0), bare `dc0` REJECTED; `-` = not site-scoped
#   host-role    jumphost|headend|rack|edge|netbox|cloud|unit|client   (NEVER a VM name)
#   filename     basename at that location; `-` = no host artifact (skips existence checks)
#   access-type  gui|api|ssh|cli-profile|console|none
#   principal    human|service|-      (ruling 5 keys off this)
#   custody      consolidated|source-of-record|off-manifest-known|not-consolidated-ruled
#   mint-stage   stage2..stage6 | vr0-phaseNN | tenant-onboard | adhoc | -
#   mint-ref     script:<path>:<line> | runbook:<path>:<line> | operator-terminal | -
#   sec-ref      SEC-NNN | -
#   notes-ref    key into creds-matrix-notes.md | -
#
# EXPECTED RED. This register is deliberately not satisfiable by today's tree; the
# failures are the defects D-137 exists to surface (see the notes file, and the
# "EXPECTED RED BY DESIGN" section of docs/D-137-implementation-plan.md).
#
# id                          cardinality  site-key     host-role  filename                          access-type  principal  custody                 mint-stage      mint-ref                                                    sec-ref  notes-ref

# ---------------------------------------------------------------- vr1-office1 (headend region + jumphost)
maas-region-admin             singleton    vr1-office1  headend    admin.pass                        gui          human      source-of-record        stage2          script:scripts/site-headend-install.sh:450                  SEC-020  n-maas-region-admin
maas-region-admin             singleton    vr1-office1  jumphost   maas-admin-password               gui          human      verbatim-copy            stage2          script:scripts/site-headend-install.sh:450                  SEC-020  n-maas-region-admin
maas-region-admin             singleton    vr1-office1  headend    admin.apikey                      api          service    not-consolidated-ruled  stage2          script:scripts/site-headend-install.sh:453                  SEC-020  n-maas-admin-apikey
maas-region-admin             singleton    vr1-office1  headend    .maascli.db                  cli-profile  service    off-manifest-known      stage2          script:scripts/site-headend-install.sh:455                  SEC-020  n-maas-cli-profile
maas-region-operator          singleton    vr1-office1  jumphost   maas-operator-password            gui          human      consolidated            adhoc           operator-terminal                                           SEC-020  n-maas-region-operator
maas-region-db                singleton    vr1-office1  headend    db.pass                           none         service    not-consolidated-ruled  stage2          script:scripts/site-headend-install.sh:430                  SEC-020  n-region-infra-carveout
maas-region-lxd-trust         singleton    vr1-office1  headend    lxd-trust.pass                    none         service    not-consolidated-ruled  stage2          script:scripts/site-headend-install.sh:485                  SEC-020  n-region-infra-carveout
maas-rack-enroll-secret       singleton    vr1-office1  headend    secret                none         service    off-manifest-known      stage2          script:scripts/site-headend-install.sh:445                  -        n-rack-enroll
office1-svc-key               per-site     vr1-office1  jumphost   office1_svc_ed25519               ssh          service    consolidated            stage2          operator-terminal                                           SEC-007  n-no-mint-command
office1-svc-key               per-site     vr1-office1  jumphost   office1_svc_ed25519.pub           none         service    consolidated            stage2          operator-terminal                                           SEC-007  n-no-mint-command
office1-edge-api              per-site     vr1-office1  jumphost   opnsense-api.txt                  api          service    consolidated            stage2          script:scripts/opnsense-bootstrap-apikey.sh:115              -        n-edge-api
office1-edge-root             per-site     vr1-office1  jumphost   opnsense-root-password            gui          human      consolidated            stage2          operator-terminal                                           SEC-007  n-no-mint-command
office1-edge-root             per-site     vr1-office1  jumphost   opnsense-root-hash                none         human      consolidated            stage2          operator-terminal                                           SEC-007  n-no-mint-command
office1-tailscale-authkey     singleton    vr1-office1  jumphost   tailscale-authkey.txt             api          service    consolidated            stage2          operator-terminal                                           SEC-008  n-third-party
netbox-upstream-token         singleton    vr1-office1  jumphost   vr1-netbox.env                    api          service    consolidated            stage2          operator-terminal                                           SEC-006  n-netbox-upstream
netbox-sandbox-token          singleton    vr1-office1  netbox     api.token                         api          service    source-of-record        stage2          runbook:runbooks/dc-dc-phase1-office1-standup.md:643        SEC-009  n-netbox-sandbox
netbox-sandbox-token          singleton    vr1-office1  jumphost   vr1-netbox-sandbox.env            api          service    consolidated            stage2          runbook:runbooks/dc-dc-phase1-office1-standup.md:643        SEC-009  n-netbox-sandbox
netbox-secret-key             singleton    vr1-office1  netbox     secret_key                        none         service    off-manifest-known      stage2          operator-terminal                                           -        n-netbox-vm-secrets
netbox-admin                  singleton    vr1-office1  netbox     admin.pass                        gui          human      source-of-record        stage2          operator-terminal                                           SEC-025  n-netbox-vm-secrets
netbox-admin                  singleton    vr1-office1  jumphost   netbox-admin-password             gui          human      verbatim-copy           stage2          operator-terminal                                           SEC-025  n-netbox-vm-secrets
office1-tofu-maas-apikey      singleton    vr1-office1  jumphost   vr1-stage1.env                    api          service    consolidated            stage2          runbook:runbooks/dc-dc-phase1-office1-standup.md:464        SEC-009  n-tofu-apikey
office1-tofu-maas-apikey      singleton    vr1-office1  jumphost   terraform.tfstate                 api          service    off-manifest-known      stage2          runbook:runbooks/dc-dc-phase1-office1-standup.md:464        -        n-tfstate-plaintext
office1-env                   singleton    vr1-office1  jumphost   vr1-office1.env                   none         service    consolidated            stage2          operator-terminal                                           SEC-009  n-office1-env
creds-folder-readme           per-site     vr1-office1  jumphost   README                            none         -          consolidated            -               -                                                           -        n-readme

# ---------------------------------------------------------------- vr1-dc0
dc0-svc-key                   per-DC       vr1-dc0      jumphost   vr1-dc0_svc_ed25519               ssh          service    consolidated            stage3          operator-terminal                                           -        n-no-mint-command
dc0-svc-key                   per-DC       vr1-dc0      jumphost   vr1-dc0_svc_ed25519.pub           none         service    consolidated            stage3          operator-terminal                                           -        n-no-mint-command
dc0-svc-key                   per-DC       vr1-dc0      headend    vr1-dc0_svc_ed25519               ssh          service    off-manifest-known      stage3          operator-terminal                                           SEC-022  n-headend-shadow-store
dc0-svc-key                   per-DC       vr1-dc0      headend    vr1-dc0_svc_ed25519.pub           none         service    off-manifest-known      stage3          operator-terminal                                           SEC-022  n-headend-shadow-store
dc0-edge-key                  per-DC       vr1-dc0      jumphost   vr1-dc0-edge_ed25519              ssh          service    consolidated            stage3          operator-terminal                                           -        n-edge-key
dc0-edge-key                  per-DC       vr1-dc0      jumphost   vr1-dc0-edge_ed25519.pub          none         service    consolidated            stage3          operator-terminal                                           -        n-edge-key
dc0-edge-api                  per-DC       vr1-dc0      jumphost   opnsense-api.txt                  api          service    consolidated            stage3          script:scripts/opnsense-bootstrap-apikey.sh:115              SEC-021  n-dc0-edge-api-absent
dc0-maas-power-key            per-DC       vr1-dc0      jumphost   vr1-dc0-maas-power_ed25519        ssh          service    consolidated            stage3          operator-terminal                                           SEC-021  n-dc0-power-key-divergence
dc0-maas-power-key            per-DC       vr1-dc0      jumphost   vr1-dc0-maas-power_ed25519.pub    none         service    consolidated            stage3          operator-terminal                                           SEC-021  n-dc0-power-key-divergence
dc0-maas-power-key            per-DC       vr1-dc0      headend    maas-virsh_ed25519                ssh          service    off-manifest-known      stage3          operator-terminal                                           SEC-021  n-dc0-power-key-divergence
dc0-maas-power-key            per-DC       vr1-dc0      headend    id_ed25519                        ssh          service    off-manifest-known      stage3          runbook:runbooks/dc-dc-phase2-tofu-dc-substrate.md:770      SEC-012  n-snap-key-fragility
dc0-maas-apikey               per-DC       vr1-dc0      jumphost   maas-api-key.txt                  api          service    consolidated            stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:136     SEC-018  n-dc-maas-apikey
dc0-maas-apikey               per-DC       vr1-dc0      headend    credentials.yaml                  api          service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:141     SEC-018  n-juju-cred-store
dc0-juju-maas-user            per-DC       vr1-dc0      -          -                                 api          service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:128     SEC-018  n-juju-user-nopassword

# per-DC MAAS REGION (D-132 amendment 2026-07-30). The region VM is its OWN host-role:
# not `headend` (that is the Office1 region) and not `rack` (the controller it is
# deliberately kept separate from, so the region DB does not share fate with the
# hypervisor running every node). Minted at region install; jumphost copy is the
# SEC-009 consolidation target. mint-ref is operator-terminal because no repo script
# mints these yet -- that is real provenance debt, and writing the install into a
# runbook is what clears it.
dc0-region-db                 per-DC       vr1-dc0      region     .maas-db-pw                       none         service    source-of-record        stage5          operator-terminal                                     SEC-027   -
dc0-region-db                 per-DC       vr1-dc0      jumphost   maas-region-db-password           none         service    verbatim-copy           stage5          operator-terminal                                     SEC-027   -
dc0-region-admin              per-DC       vr1-dc0      region     .maas-admin-pw                    gui          human      source-of-record        stage5          operator-terminal                                     SEC-027   -
dc0-region-admin              per-DC       vr1-dc0      jumphost   maas-region-admin-password        gui          human      verbatim-copy           stage5          operator-terminal                                     SEC-027   -
dc0-region-apikey             per-DC       vr1-dc0      jumphost   maas-region-api-key.txt           api          service    consolidated            stage5          operator-terminal                                     SEC-027   -

# per-DC JUJU SERVICE CREDENTIAL (D-132 q1 consequence, minted 2026-07-30). Juju
# authenticates to its DC's OWN region as `juju-<site>`; the Office1 key does NOT
# authenticate against a separate database. The CLIENT copy lives on the RACK because
# D-138 moved the cloud-facing client into the DC -- a host-role that had no rows here
# before, and an unlisted location is not audited (SEC-022).
dc0-juju-apikey               per-DC       vr1-dc0      jumphost   maas-juju-api-key.txt             api          service    consolidated            stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:236 SEC-028   n-juju-region-cred
dc0-juju-apikey               per-DC       vr1-dc0      rack       maas-juju-api-key.txt             api          service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:236 SEC-028   n-juju-region-cred
dc0-juju-apikey               per-DC       vr1-dc0      rack       credentials.yaml                  api          service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:236 SEC-028   n-juju-cred-store
dc0-juju-user                 per-DC       vr1-dc0      jumphost   maas-juju-user-password           gui          human      consolidated            stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:236 SEC-028   n-juju-region-cred
dc1-juju-apikey               per-DC       vr1-dc1      jumphost   maas-juju-api-key.txt             api          service    consolidated            stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:236 SEC-028   n-juju-region-cred
dc1-juju-apikey               per-DC       vr1-dc1      rack       maas-juju-api-key.txt             api          service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:236 SEC-028   n-juju-region-cred
dc1-juju-apikey               per-DC       vr1-dc1      rack       credentials.yaml                  api          service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:236 SEC-028   n-juju-cred-store
dc1-juju-user                 per-DC       vr1-dc1      jumphost   maas-juju-user-password           gui          human      consolidated            stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:236 SEC-028   n-juju-region-cred

# ---------------------------------------------------------------- vr1-dc1
dc1-svc-key                   per-DC       vr1-dc1      jumphost   vr1-dc1_svc_ed25519               ssh          service    consolidated            stage3          operator-terminal                                           -        n-no-mint-command
dc1-svc-key                   per-DC       vr1-dc1      jumphost   vr1-dc1_svc_ed25519.pub           none         service    consolidated            stage3          operator-terminal                                           -        n-no-mint-command
dc1-svc-key                   per-DC       vr1-dc1      headend    vr1-dc1_svc_ed25519               ssh          service    off-manifest-known      stage3          operator-terminal                                           SEC-022  n-headend-shadow-store
dc1-svc-key                   per-DC       vr1-dc1      headend    vr1-dc1_svc_ed25519.pub           none         service    off-manifest-known      stage3          operator-terminal                                           SEC-022  n-headend-shadow-store
dc1-edge-key                  per-DC       vr1-dc1      jumphost   vr1-dc1-edge_ed25519              ssh          service    consolidated            stage3          operator-terminal                                           SEC-015  n-edge-key
dc1-edge-key                  per-DC       vr1-dc1      jumphost   vr1-dc1-edge_ed25519.pub          none         service    consolidated            stage3          operator-terminal                                           -        n-edge-key
dc1-edge-api                  per-DC       vr1-dc1      jumphost   opnsense-api.txt                  api          service    consolidated            stage3          script:scripts/opnsense-bootstrap-apikey.sh:115              -        n-edge-api
dc1-maas-power-key            per-DC       vr1-dc1      jumphost   vr1-dc1-maas-power_ed25519        ssh          service    consolidated            stage3          operator-terminal                                           SEC-016  n-dc1-power-key
dc1-maas-power-key            per-DC       vr1-dc1      jumphost   vr1-dc1-maas-power_ed25519.pub    none         service    consolidated            stage3          operator-terminal                                           SEC-016  n-dc1-power-key
dc1-maas-power-key            per-DC       vr1-dc1      headend    id_dc1_power                      ssh          service    off-manifest-known      stage3          runbook:runbooks/dc-dc-phase2-tofu-dc-substrate.md:770      SEC-016  n-snap-key-fragility
dc1-maas-apikey               per-DC       vr1-dc1      jumphost   maas-api-key.txt                  api          service    consolidated            stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:136     SEC-019  n-dc-maas-apikey
dc1-maas-apikey               per-DC       vr1-dc1      headend    credentials.yaml                  api          service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:141     SEC-019  n-juju-cred-store
dc1-juju-maas-user            per-DC       vr1-dc1      -          -                                 api          service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:128     SEC-019  n-juju-user-nopassword

# per-DC MAAS REGION (D-132 amendment 2026-07-30). The region VM is its OWN host-role:
# not `headend` (that is the Office1 region) and not `rack` (the controller it is
# deliberately kept separate from, so the region DB does not share fate with the
# hypervisor running every node). Minted at region install; jumphost copy is the
# SEC-009 consolidation target. mint-ref is operator-terminal because no repo script
# mints these yet -- that is real provenance debt, and writing the install into a
# runbook is what clears it.
dc1-region-db                 per-DC       vr1-dc1      region     .maas-db-pw                       none         service    source-of-record        stage5          operator-terminal                                     SEC-027   -
dc1-region-db                 per-DC       vr1-dc1      jumphost   maas-region-db-password           none         service    verbatim-copy           stage5          operator-terminal                                     SEC-027   -
dc1-region-admin              per-DC       vr1-dc1      region     .maas-admin-pw                    gui          human      source-of-record        stage5          operator-terminal                                     SEC-027   -
dc1-region-admin              per-DC       vr1-dc1      jumphost   maas-region-admin-password        gui          human      verbatim-copy           stage5          operator-terminal                                     SEC-027   -
dc1-region-apikey             per-DC       vr1-dc1      jumphost   maas-region-api-key.txt           api          service    consolidated            stage5          operator-terminal                                     SEC-027   -

# ---------------------------------------------------------------- outside the SEC-009 *-creds/ convention (research FINDING 2)
vault-unseal-shares           singleton    -            jumphost   init.txt                          none         service    off-manifest-known      vr0-phase02     runbook:runbooks/phase-02-vault-bringup.md:71               SEC-023  n-outside-convention
vault-root-token              singleton    -            jumphost   init.txt                          none         service    off-manifest-known      vr0-phase02     runbook:runbooks/phase-02-vault-bringup.md:71               SEC-023  n-outside-convention
octavia-issuing-ca-passphrase per-DC       vr1-dc0      headend    passphrase.txt                    none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:391              SEC-023  n-outside-convention
octavia-issuing-ca-key        per-DC       vr1-dc0      headend    issuing-ca.key.enc                none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:395              SEC-023  n-outside-convention
octavia-issuing-ca-cert       per-DC       vr1-dc0      headend    issuing-ca.cert.pem               none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:398              SEC-023  n-outside-convention
octavia-controller-ca-pass    per-DC       vr1-dc0      headend    passphrase.txt                    none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:414              SEC-023  n-outside-convention
octavia-controller-ca-key     per-DC       vr1-dc0      headend    controller-ca.key.enc             none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:418              SEC-023  n-outside-convention
octavia-controller-ca-cert    per-DC       vr1-dc0      headend    controller-ca.cert.pem            none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:421              SEC-023  n-outside-convention
octavia-controller-key        per-DC       vr1-dc0      headend    controller.key                    none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:460              SEC-023  n-outside-convention
octavia-controller-bundle     per-DC       vr1-dc0      headend    controller.bundle.pem             none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:584              SEC-023  n-outside-convention
octavia-controller-cert       per-DC       vr1-dc0      headend    controller.cert.pem               none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:580              SEC-023  n-outside-convention
octavia-controller-ca-serial  per-DC       vr1-dc0      headend    controller-ca.cert.srl            none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:578              SEC-023  n-outside-convention
substrate-tfstate-backup      per-DC       vr1-dc0      jumphost   vr1-dc0-substrate.tfstate.gz      none         service    consolidated            stage3          runbook:runbooks/dc-dc-phase2-tofu-dc-substrate.md:783      SEC-023  n-tfstate-backup
octavia-pki-backup            per-DC       vr1-dc0      jumphost   octavia-pki-vr1-dc0.tar.gz        none         service    consolidated            stage5          runbook:runbooks/phase-01-bundle-deploy.md:694              SEC-023  n-pki-backup
octavia-reissue-backup        per-DC       vr1-dc0      jumphost   vr1-dc0-octavia-pki-<stamp>.tar.gz none        service    consolidated            stage5          runbook:runbooks/phase-01-bundle-deploy.md:853              SEC-023  n-reissue-backup
octavia-pki-overlay           per-DC       vr1-dc0      headend    vr1-dc0-octavia-pki.yaml          none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:645              SEC-004  n-overlay-in-clone
octavia-pki-overlay           per-DC       vr1-dc0      rack       vr1-dc0-octavia-pki.yaml          none         service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:376 SEC-029   n-overlay-on-rack
octavia-issuing-ca-passphrase per-DC       vr1-dc1      headend    passphrase.txt                    none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:391              SEC-023  n-outside-convention
octavia-issuing-ca-key        per-DC       vr1-dc1      headend    issuing-ca.key.enc                none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:395              SEC-023  n-outside-convention
octavia-issuing-ca-cert       per-DC       vr1-dc1      headend    issuing-ca.cert.pem               none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:398              SEC-023  n-outside-convention
octavia-controller-ca-pass    per-DC       vr1-dc1      headend    passphrase.txt                    none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:414              SEC-023  n-outside-convention
octavia-controller-ca-key     per-DC       vr1-dc1      headend    controller-ca.key.enc             none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:418              SEC-023  n-outside-convention
octavia-controller-ca-cert    per-DC       vr1-dc1      headend    controller-ca.cert.pem            none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:421              SEC-023  n-outside-convention
octavia-controller-key        per-DC       vr1-dc1      headend    controller.key                    none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:460              SEC-023  n-outside-convention
octavia-controller-bundle     per-DC       vr1-dc1      headend    controller.bundle.pem             none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:584              SEC-023  n-outside-convention
octavia-controller-cert       per-DC       vr1-dc1      headend    controller.cert.pem               none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:580              SEC-023  n-outside-convention
octavia-controller-ca-serial  per-DC       vr1-dc1      headend    controller-ca.cert.srl            none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:578              SEC-023  n-outside-convention
substrate-tfstate-backup      per-DC       vr1-dc1      jumphost   vr1-dc1-substrate.tfstate.gz      none         service    consolidated            stage3          runbook:runbooks/dc-dc-phase2-tofu-dc-substrate.md:783      SEC-023  n-tfstate-backup
octavia-pki-backup            per-DC       vr1-dc1      jumphost   octavia-pki-vr1-dc1.tar.gz        none         service    consolidated            stage5          runbook:runbooks/phase-01-bundle-deploy.md:694              SEC-023  n-pki-backup
octavia-reissue-backup        per-DC       vr1-dc1      jumphost   vr1-dc1-octavia-pki-<stamp>.tar.gz none        service    consolidated            stage5          runbook:runbooks/phase-01-bundle-deploy.md:853              SEC-023  n-reissue-backup
octavia-pki-overlay           per-DC       vr1-dc1      headend    vr1-dc1-octavia-pki.yaml          none         service    off-manifest-known      stage5          runbook:runbooks/phase-01-bundle-deploy.md:645              SEC-004  n-overlay-in-clone
octavia-pki-overlay           per-DC       vr1-dc1      rack       vr1-dc1-octavia-pki.yaml          none         service    off-manifest-known      stage5          runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:376 SEC-029   n-overlay-on-rack
tenant-domain-admin           per-tenant   -            jumphost   <client>-domain-admin-cred.txt    gui          human      off-manifest-known      tenant-onboard  script:scripts/tenant-onboard.sh:64                         SEC-023  n-tenant-dir
tenant-cluster-user           per-tenant   -            jumphost   <client>-cluster-cred.txt         api          human      off-manifest-known      tenant-onboard  script:scripts/tenant-onboard.sh:90                         SEC-023  n-tenant-dir
tenant-svc-user               per-tenant   -            jumphost   <client>-svc-cred.txt             api          service    off-manifest-known      tenant-onboard  script:scripts/tenant-onboard.sh:90                         SEC-023  n-tenant-dir
tenant-svc-appcred            per-tenant   -            jumphost   <client>-svc-appcred.txt          api          service    off-manifest-known      tenant-onboard  script:scripts/tenant-onboard.sh:141                        SEC-023  n-tenant-dir
tenant-nova-key               per-tenant   -            jumphost   <client>-key.pem                  ssh          service    off-manifest-known      tenant-onboard  script:scripts/tenant-onboard.sh:167                        SEC-023  n-tenant-dir

# ---------------------------------------------------------------- in scope by the materialization ruling (charm/platform-minted, then materialized)
keystone-admin                singleton    -            cloud      -                                 api          service    off-manifest-known      vr0-phase01     -                                                           -        n-charm-minted
keystone-admin                singleton    -            jumphost   admin-openrc                      none         service    off-manifest-known      vr0-phase03     script:scripts/phase-03-admin-openrc.sh:52                  SEC-023  n-predicted-openrc
magnum-domain-admin           singleton    -            cloud      -                                 api          service    off-manifest-known      vr0-phase07     script:scripts/phase-07-conductor-graft.sh:90               -        n-cloud-only
capi-mgmt-kubeconfig          singleton    -            cloud      config                            none         service    off-manifest-known      vr0-phase06     script:scripts/phase-06-capi-stack.sh:91                    -        n-cloud-only
rbd-mirror-peer-token         per-DC       -            unit       rbd-mirror-bootstrap-token        none         service    off-manifest-known      stage6          script:scripts/dc-dc-rbd-mirror.sh:88                       -        n-ephemeral-unit
rgw-multisite-system-key      singleton    -            unit       -                                 api          service    off-manifest-known      stage6          operator-terminal                                           -        n-cloud-only

# ---------------------------------------------------------------- non-secret artifacts colocated at declared locations
juju-client-clouds            singleton    -            headend    clouds.yaml                       none         -          off-manifest-known      stage5          -                                                           -        n-colocated-nonsecret
juju-client-public-clouds     singleton    -            headend    public-clouds.yaml                none         -          off-manifest-known      stage5          -                                                           -        n-colocated-nonsecret
maas-snap-ssh-config          singleton    -            headend    config                            none         -          off-manifest-known      stage3          -                                                           -        n-colocated-nonsecret
maas-snap-known-hosts         singleton    -            headend    known_hosts                       none         -          off-manifest-known      stage3          -                                                           -        n-colocated-nonsecret
maas-snap-known-hosts-old     singleton    -            headend    known_hosts.old                   none         -          off-manifest-known      stage3          -                                                           -        n-colocated-nonsecret

# ---------------------------------------------------------------- added 2026-07-26 (committee coverage findings)
# Read from a human and injected into MAAS power_pass; reenroll-hosts.sh:22-25 records a
# STANDING rotation obligation after a 2026-06-26 plaintext exposure. Passes the
# materialization test verbatim and was absent from both the matrix and the exclusions.
libvirt-power-password        singleton    -            -          -                                 console      human      off-manifest-known      -               script:scripts/reenroll-hosts.sh:122                        -        n-libvirt-power-pw
# The tfstate SIBLINGS carry the same DOCFIX-175 plaintext key as the live state file.
# They are real secret-at-rest copies, so they are ROWS, not merely declared locations.
office1-tofu-maas-apikey      singleton    vr1-office1  jumphost   terraform.tfstate.backup          api          service    off-manifest-known      stage2          runbook:runbooks/dc-dc-phase1-office1-standup.md:464        -        n-tfstate-plaintext
office1-tofu-maas-apikey      singleton    vr1-office1  jumphost   terraform.tfstate.pre-<tag>       api          service    off-manifest-known      stage2          runbook:runbooks/dc-dc-phase1-office1-standup.md:464        -        n-tfstate-plaintext
vault-ca-root                 singleton    -            jumphost   vault-ca-root.pem                 none         service    off-manifest-known      vr0-phase02     operator-terminal                                           SEC-023  n-outside-convention
