=== MAAS admin-account recovery -- measured evidence, 2026-07-25 ===
Host: vcloud (jumphost). Region: http://10.10.0.20:5240/MAAS (measured from `maas --help`).
Scope RULED by operator: "New account + consolidate only" -- no existing password rotated.
NO secret VALUES appear in this capture (format/hash/status only).

--- 1. MAAS users AFTER the change (cmd: maas admin users read) ---
  MAAS             superuser=True  email=maas@localhost
  admin            superuser=True  email=admin@office1.local
  juju-vr1-dc0     superuser=True  email=juju-vr1-dc0@vr1.local
  juju-vr1-dc1     superuser=True  email=juju-vr1-dc1@vr1.local
  maas-init-node   superuser=False email=node-init-user@localhost
  operator         superuser=True  email=jesse.austin@neumatrix.com

--- 2. Django password state (cmd: maas-region shell; booleans only) ---
  MAAS             super=True  active=True  usable_pw=True 
  admin            super=True  active=True  usable_pw=True 
  juju-vr1-dc0     super=True  active=True  usable_pw=True 
  juju-vr1-dc1     super=True  active=True  usable_pw=True 
  maas-init-node   super=False active=False usable_pw=True 
  operator         super=True  active=True  usable_pw=True 

--- 3. GUI login probes, each with a wrong-password CONTROL (204=auth, 400=reject) ---
  admin     stored_password=204  wrong_password_control=400
  operator  stored_password=204  wrong_password_control=400

--- 4. admin password consolidation fidelity (sha256, first 16 hex) ---
  source voffice1:/root/maas-secrets/admin.pass = be9d791d108d9b44
  copy   ~/vr1-office1-creds/maas-admin-password = be9d791d108d9b44
  verdict=BYTE-IDENTICAL

--- 5. stored file metadata (mode/bytes; no values) ---
  maas-admin-password      mode=600 bytes=28
  maas-operator-password   mode=600 bytes=32

--- 6. creds-audit all three sites (cmd: bash scripts/creds-audit.sh <site>) ---
  creds-audit vr1-office1: CLEAN
  creds-audit vr1-dc0: CLEAN
  creds-audit vr1-dc1: CLEAN
  harness: creds-audit: 7/7 PASS

--- 7. automation unaffected (admin CLI profile / 19 `maas admin` call sites) ---
  maas admin users read -> 6 users returned, profile functional
