# Handoff -- open items register (2026-07-05 session close)

**Supersedes** `docs/handoff-20260703-open-items.md` (kept for history). This is the active handoff.
**Repo HEAD at close:** `f28de74` ("clearing queue"). **Next-free:** D-073, DOCFIX-091, BUNDLEFIX-012.
**Start every new session by:** reading this file + `docs/session-ledger.md`, then running
`bash scripts/ledger-scan.sh` AND `bash scripts/ledger-scan.sh --fences`, and reconciling.

---

## 0. Current state (as-built)

- Multi-tenant buildout is functionally complete through the beta tenant acceptance tests.
- `validate.sh` D-011 acceptance suite is modular and the **gauntlet is ALL GREEN (31 harnesses)**.
- **Vault decision recorded (D-068 amendment):** bundle pins vault `1.8/stable` (reactive charm,
  integration-compatible); the `1.16` operator lineage is RULED OUT (certs interface V0->V1 breaks
  the 18 `vault:certificates` relations, Raft-only drops the mysql backend, no upgrade path, BUSL,
  community-broken with Ceph). "Get off EOL vault 1.8.8" stays OPEN under D-068. Evidence:
  `docs/D-068-vault-1.8-vs-1.16-analysis.md`. Live vault is `1.8/stable` rev 714 (in-channel current).
- **Session-ledger is fenced** (delimited-section convention: machine-derived / main-chat / jumphost /
  shared), and `ledger-scan.sh --fences` validates it (4 sections, 0 errors). Stay in your lane.
- The last jumphost ops-update window (`ops-update-20260705`) is CLOSED; fleet refreshed to current
  in-channel revisions; controllers/agents at juju 3.6.25; appendix-B re-baselined.

**Minor reconcile item for the next session:** the ledger "State facts" bullet still reads
"ops-update-20260705 in flight" and "D-068 unruled" -- both stale (window closed; D-068 ruled). It's
in the append-only shared section, so append a correction rather than rewrite another stream's line.

## 1. Immediate (small, well-defined; good first tasks)

- Batch-3 live validation of the D-011 checks (see the verify-live queue below) -- the main thing
  standing between here and a clean D-011 acceptance close.
- `offboard` v2: `--sweep-magnum-orphans` mode (orphan per-cluster trustee in the magnum domain);
  stage-3 app-cred idempotency re-run guard. (Both logged-not-actioned.)
- DOCFIX candidate: sweep the repo for other `-f json ... 2>&1` stderr-merge hazards (DOCFIX-085 class).
- `host_href=None` barbican observation (exercised fine in stage 6; probably closeable after a look).

**Window runbook (2026-07-06):** the whole batch-3 + foil + D-073-apply sequence is
scripted as ONE do-document: `runbooks/d011-batch3-window-DRAFT.md` (DOCFIX-093).
B2/D-068 discussion input ready: `docs/D-068-openbao-assessment-DRAFT.md`.

## 2. Verify-live queue (read-only/gated CHECKs; run on the real cloud before trusting)

ALL CLEARED 2026-07-06 (d011-batch3 window, addendum 27):
- **d011-04** headroom parsing: fixed live (DOCFIX-096: --long for compute_id;
  display-name hypervisor keys); OK path confirmed, disruptive half PASS under
  the A2 conditional pre-approval. OCCM LB-name + agnhost RR assumptions held.
- **d011-05** foil satisfied by the foil1 tenant (onboarded in-window); PASS
  incl. P3 isolation.
- tenant-assert `keypair list --user` confirmed under admin; admin-side
  app-cred list measured always-403 -> check reworked (DOCFIX-095).
- H3 CANARY_SSH_USER confirmed (ubuntu).
STILL OPEN here: Horizon manual checks (onboarding contract 5.1/5.3) on a
live tenant -- operator, browser; non-blocking.

## 3. Operator rulings pending (nothing proceeds without these)

- **D-071** (controller update cadence / patch policy) -- stays **PROPOSED**; ratification is GATED on
  the pre-DC-DC controller HA/backup planning session (see section 6). Do NOT ratify without it.
  Backups are confirmed to exist (juju 3.6 `create-backup`); the open half is single-controller HA.
- **D-068 item 1** vault modernization -- `1.16` is ruled out; the OPEN question is HOW to get off EOL
  vault 1.8.8 for production. Candidate paths (none adopted): wait for the OpenStack service charms to
  gain tls-certificates V1 support, evaluate OpenBao (MPL fork), or explicit EOL risk-acceptance for
  VR0 with a production remediation deadline. Plus D-068 items 2 (Vault listener TLS for Roosevelt --
  vault_url is cleartext http today) and 3 (AppRole secret_id TTL audit + proactive auth health probe).
- ~~D-050 / list_trusts hardening~~ RESOLVED: D-050 CLOSED via D-051 (ruling
  2026-07-06); the list_trusts hardening was adopted as D-073 and APPLIED live
  2026-07-06 (addendum 27; behavioral verify green).

## 4. Open security-ledger rows

- **SEC-001** OPEN -- rotate credentials after the current rebuild completes.
- **SEC-003** OPEN -- assign unseal-key custodians + rehearse the second-person unseal (D-069).
- **SEC-004** OPEN -- flip repo visibility to PRIVATE at v1 close (currently public for web_fetch).

## 5. The deploy path (the reason for all of the above)

Execute the Roosevelt bare-metal multi-datacenter deployment using the Omega Cloud v1 runbooks as the
template; the guiding constraint remains minimizing delta to Roosevelt. D-011 (amended per D-019)
acceptance validation is the near-term gate -- confirm all criteria post multi-tenant work, which is
what the batch-3 verify-live queue closes out.

## 6. v1-close / project-completion checklist (execute after D-011 passes)

- Consolidate the 10 per-phase do-documents into a single `docs/v1-deploy-runbook.md`; drop the
  per-phase files; preserve the 10-doc structure in git history via the consolidation commit.
- Set repo visibility PRIVATE (SEC-004).
- Hold the pre-DC-DC controller HA/backup planning session -> then rule D-071.
- **Onboarding completion package (operator-ruled 2026-07-06; complete BEFORE closing this
  deployment test env).** A written, tested, and validated end-to-end onboarding workflow:
  scripts + internal docs + drafted client-facing docs (drafts/living, no final polish needed).
  Items (H-numbers per docs/tenant-onboarding-contract.md section 6):
  - H1 `tenant-assert.sh` post-onboard verifier, with harness (also offboard preflight +
    periodic drift sweep). DELIVERED addendum 22; live validation pending (foil onboarding).
  - H2 stage-3 app-cred idempotency re-run guard in tenant-onboard.sh.
    DELIVERED addendum 23 (also covers the keypair; harness 12/12).
  - H3 canary access-proof stage (boot canary + FIP + SSH via tenant keypair + teardown) --
    the ruled meaning of "confirm tenant SSH access into their domain" (A1.4 confirmed).
    DELIVERED addendum 23 as stage7 (explicit-only); live validation pending (foil).
  - H4 `keystone-policy-drift.sh` (script backlog item 6) wired as a periodic check.
    (Only H-item not yet built; also the main-chat backlog owner -- coordinate.)
  - H5 no-ad-hoc rule embedded in the onboarding runbook. DONE addendum 25.
  - Horizon manager-role GUI identity probe (contract section 5.3) validated live.
  - Client-facing draft package (intake form, welcome/engagement doc, self-service guide)
    -- RULED: top-level clientdocs/; drafts DELIVERED addendum 22 (living docs, sweep on
    contract-doc changes).
  - Full workflow validated on a live onboarding end-to-end (the d011-05 foil tenant is the
    natural first candidate).

## 7. Deferred, with explicit revisit triggers

- **GitBucket SSH** (System Settings -> Integrations; bind 0.0.0.0:29418, public git.baldurkeep.com:29418)
  -- verify the deployment topology (Docker port map vs systemd vs firewall) before declaring it works.
  v1 uses HTTPS basic auth. Trigger: v2 / DC-DC phase.
- **IPv6 dual-stack** integration + **NetBox restructure/import** -- deferred to DC-DC / v2.
- **Roosevelt hardware sheets** needed to resolve the four-NIC collapse path (D-059, parked).
- **SpryLogin / identity platform** decision (FreeIPA vs Keycloak vs Authentik).

---

## 8. Startup prompt -- NEW MAIN CHAT (claude.ai stream)

> You are resuming the Omega Cloud v1 / Baldurkeep project (commercial multi-tenant Charmed OpenStack
> Caracal 2024.1). You are the **main claude.ai chat stream**. A parallel **Claude Code (jumphost)**
> stream runs concurrently -- coordinate, do not collide.
>
> **First, orient (do this before anything else):** pull the repo; read
> `docs/handoff-20260705-open-items.md`, `docs/session-ledger.md`, and `docs/design-decisions.md`;
> run `bash scripts/ledger-scan.sh` and `bash scripts/ledger-scan.sh --fences`; reconcile the ledger
> narrative against the scan. The repo is authoritative over your memory of it.
>
> **Your lane / discipline:** you work a sandbox clone via gated copy-paste; the operator (Jesse) runs
> blocks on the jumphost and pastes output back. Deliver multi-file changes as **repo-relative ZIPs**
> (never loose files). Committed files are **pure ASCII + LF**. In the session-ledger, edit only the
> `main-chat` fenced section; the machine-derived block is regenerated by `ledger-scan` (never
> hand-typed); the shared section is append-only. When you consume a D-/DOCFIX-/BUNDLEFIX- number,
> grep for next-free first and coordinate with Code. **Harness-first**: run test harnesses before
> executing live; own mistakes plainly and immediately.
>
> **Current state:** multi-tenant buildout complete through beta acceptance; validate.sh D-011 suite
> modular, gauntlet ALL GREEN (31). Vault is settled on `1.8/stable` (D-068: 1.16 ruled out; EOL is
> the open item). Reconciliation is done and clean.
>
> **Likely next work (confirm with Jesse):** batch-3 live validation of the D-011 checks (verify-live
> queue in the handoff) -> D-011 acceptance close; then project-completion (consolidate do-docs, flip
> repo private). D-068 EOL-vault modernization research is available when Jesse wants it. Do NOT ratify
> D-071 or move vault to 1.16 -- both are operator/decision-gated.
>
> Standing meta-instruction from Jesse: before answering, state what you need to know and any
> assumptions you'd otherwise make. Debate best-practice deviations with sourced rationale.

## 9. Startup prompt -- CLAUDE CODE (jumphost stream)

> You are resuming the Omega Cloud v1 / Baldurkeep project as the **Claude Code (jumphost) stream**,
> executing live on the cloud. A parallel **main claude.ai chat** stream runs concurrently --
> coordinate, do not collide.
>
> **First, orient:** read `docs/handoff-20260705-open-items.md`, `docs/session-ledger.md`, and
> `docs/design-decisions.md`; run `bash scripts/ledger-scan.sh` and `bash scripts/ledger-scan.sh
> --fences`; reconcile. Repo is authoritative over memory.
>
> **Your lane / discipline:** in the session-ledger, edit only the `jumphost` fenced section; the
> shared section is append-only; do not touch the `main-chat` section. When you consume a
> D-/DOCFIX-/BUNDLEFIX- number, record it in its canonical home (design-decisions / changelog) FIRST,
> then regenerate the machine-derived block by running `ledger-scan` and pasting its output -- never
> hand-type numbers. Keep the `<!-- SECTION -->`/`<!-- END -->` fences intact; pull before you edit.
> Committed files ASCII + LF. Gate destructive/irreversible steps individually; verify before mutate.
>
> **Current state:** last ops-update window (ops-update-20260705) is CLOSED; fleet current in-channel;
> juju 3.6.25. Vault is `1.8/stable` rev 714 (current in-channel).
>
> **Hard constraints:**
> - **Vault stays `1.8/stable`.** Do NOT move it to `1.16` (D-068: fundamentally different,
>   incompatible charm). In-channel currency only.
> - **D-071 stays PROPOSED.** Do NOT ratify it -- that is operator authority, gated on the pre-DC-DC
>   controller HA/backup planning session. Controller backups exist (create-backup on 3.6); the open
>   half is single-controller HA.
>
> **Likely next work (confirm with Jesse):** support batch-3 live validation of the D-011 checks
> (verify-live queue in the handoff); controller update cadence per D-071 ONCE it is adopted (not yet).
