================ P1: repo lint ================
[WARN] L1 docs/design-decisions.md: 239 non-ASCII byte(s) (legacy D-001..018 carve-out; NEW entries must be ASCII)
[FAIL] L10 pending change set modifies state-bearing surface(s) [docs/audit/: docs/audit/outer-plan-20260727-stage5-audit.txt, docs/audit/preflight-20260727-stage5-audit.txt] without touching docs/CURRENT-STATE.md -- GA-R1 rule 8 (C1): a status-changing commit updates CURRENT-STATE.md in the SAME commit
FAIL: repo lint (1 fail, 1 warn)
================ P2: bundle invariants ================
[ok] 11 charms bind public->provider-public; none on provider-vip
[ok] 11 clustered VIP(s) are provider-public/admin/internal triples, octet 50-60
[ok] ovn-chassis bridge-interface-mappings: 2 well-formed MAC(s) (role-sep; VR0 set N/A)
[ok] 108 relations well-formed (explicit endpoints, all apps exist)
[ok] mysql-innodb-cluster num_units=3 (D-062)
[ok] keystone policyd-override wired in-bundle; zip content matches source (DOCFIX-071)
[ok] placement: role-separated (3 control/2 compute/4 storage); anti-affinity + role placement + counts OK
PASS: Pattern A / D-052-D-053 bundle invariants (bundle.yaml)
================ P3: channel assert (charmhub) ================
[WARN] barbican: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] barbican-vault: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] ceph-mon: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify squid/stable manually
[WARN] ceph-osd: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify squid/stable manually
[WARN] ceph-radosgw: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify squid/stable manually
[WARN] ceph-rbd-mirror: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify squid/stable manually
[WARN] cinder: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] cinder-backup: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] cinder-ceph: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] designate: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] designate-bind: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] glance: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] glance-simplestreams-sync: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] hacluster: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2.4/stable manually
[WARN] keystone: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] magnum: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] magnum-dashboard: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] memcached: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify latest/stable manually
[WARN] mysql-innodb-cluster: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 8.0/stable manually
[WARN] mysql-router: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 8.0/stable manually
[WARN] neutron-api: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] neutron-api-plugin-ovn: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] nova-cloud-controller: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] nova-compute: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] octavia: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] octavia-dashboard: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] octavia-diskimage-retrofit: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] openstack-dashboard: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] ovn-central: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 24.03/stable manually
[WARN] ovn-chassis: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 24.03/stable manually
[WARN] placement: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 2024.1/stable manually
[WARN] rabbitmq-server: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 3.9/stable manually
[WARN] vault: juju info failed ([Errno 2] No such file or directory: 'juju') -- verify 1.8/stable manually
WARN: channel assert (33 pins, 0 fail, 33 warn)
================ P4: live pre-flight (MAAS/overlay/nodes) ================
=== Repo (informational) ===
NOTE: REPO=/home/jessea123/openstack-caracal-dc-dc
NOTE: HEAD: 514f0aa Stage-5 grounding audit: land the scope charter before spawning any agent
WARN: working tree has 2 modified file(s)
=== CHECK 0: octavia-pki overlay (no key material printed) ===
FAIL: MISSING overlays/octavia-pki.yaml (gitignored secret; place it or regenerate via runbook Step 1.0-GEN before deploy)
=== CHECK 1: bundle VIPs -- TRIPLE column .50-.60 (provider/admin/internal) ===
PASS: vip: line count = 11
PASS: aligned triple VIPs OK=11 bad=0
=== MAAS reachability gate (read-only) ===
FAIL: MAAS unreachable: 'maas admin subnets read' failed
Summary: 2 fatal, 1 warning
================ P5: credential matrix (D-137 tier 1 + tier 2 local) ================
=== creds-matrix: tier 1 (STATIC) ===
=== creds-matrix: tier 2 (EXISTENCE) ===
[ok] S1 schema: 82 rows, all enums valid, site-keys region-qualified, no duplicate (id,site,host-role,filename)
[ok] S3 render: 3 source field(s) SKIPPED -- rendering them needs the declared path from creds-manifests/vm-secret-locations (ruling 3); the list now EXISTS but the source-field derivation is not wired
[ok] S3 render drift: rendered row fields (mode, source) match checked-in; header prose and non-jumphost rows are OUT OF SCOPE of this compare
[ok] S4 mint-ref: every script:/runbook: reference resolves to a real location
[ok] S4 provenance debt: 30 row(s) are mint-ref=operator-terminal -- NOT reproducible from the repo (research FINDING 1). Admitted by design; converting them is remediation, not a checker fix.
[ok] S7 notes: 34 note key(s) referenced, all resolve, none orphaned
[ok] E0 jumphost location '~/vault-init/*' does not exist -- SKIPPED (typically a mint stage this deployment has not reached)
[ok] E0 jumphost location '~/octavia-pki/*' does not exist -- SKIPPED (typically a mint stage this deployment has not reached)
[ok] E0 jumphost location '~/octavia-pki/issuing-ca/*' does not exist -- SKIPPED (typically a mint stage this deployment has not reached)
[ok] E0 jumphost location '~/octavia-pki/controller-ca/*' does not exist -- SKIPPED (typically a mint stage this deployment has not reached)
[ok] E0 jumphost location '~/octavia-pki/controller/*' does not exist -- SKIPPED (typically a mint stage this deployment has not reached)
[ok] E0 8 remote location(s) SKIPPED -- rerun with --remote to include the headend shadow stores (SEC-022) and the region secrets dir (SEC-020)
[ok] E1 18 expected artifact(s) deferred as not-yet-minted per creds-manifests/stages-reached
[ok] E1 23 expected artifact(s) NOT JUDGED -- their role (headend/-, headend/vr1-dc0, headend/vr1-dc1, headend/vr1-office1, netbox/vr1-office1) has at least one location that could not be probed, so absence cannot be asserted over it
[ok] tier 3 (VALIDITY) NOT RUN -- pass --tier3 (with --tier2) to compare cross-copy sha256 provenance
[FAIL] S2 vr1-dc0 EXPECTED-BUT-ABSENT: 'opnsense-api.txt' (id dc0-edge-api, SEC-021) is expected by the matrix but NOT declared in the manifest -- the credential is either missing or undeclared
[FAIL] S5 ASYMMETRY: vr1-dc0 declares id=dcN-maas-power-key file=id_ed25519 on headend (custody=off-manifest-known) with no counterpart in vr1-dc1 -- a per-DC credential must exist at BOTH DCs in the same shape
[FAIL] S5 ASYMMETRY: vr1-dc0 declares id=dcN-maas-power-key file=maas-virsh_ed25519 on headend (custody=off-manifest-known) with no counterpart in vr1-dc1 -- a per-DC credential must exist at BOTH DCs in the same shape
[FAIL] S5 ASYMMETRY: vr1-dc1 declares id=dcN-maas-power-key file=id_dcN_power on headend (custody=off-manifest-known) with no counterpart in vr1-dc0 -- a per-DC credential must exist at BOTH DCs in the same shape
[FAIL] S6 IDENTITY CONFLATION: id 'maas-region-admin' serves 2 principal types (human via gui; service via api, cli-profile) -- ruling 5 requires one identity to serve one principal type
[FAIL] E1 EXPECTED-BUT-ABSENT: dc0-edge-api 'opnsense-api.txt' expected at jumphost/vr1-dc0, not found (mint-stage stage3, SEC-021)
[FAIL] E4 UNCHECKABLE: 2 row(s) have no declared location for their (role, site) and can never be verified -- add a location row or correct the matrix: capi-mgmt-kubeconfig 'config' (cloud/-); rbd-mirror-peer-token 'rbd-mirror-bootstrap-token' (unit/-)
FAIL: creds-matrix tier 1 -- 82 row(s), 15 check group(s) clean, 7 finding(s)
================ P6: stage-2 reminders (NOT run here) ================
- after 'juju add-model': bash scripts/juju-spaces-check.sh
- with sudo: bash scripts/osd-blank-check.sh
- phase-01 Step 1.2: juju deploy --dry-run (plan: 50 apps / 97 relations)
PREFLIGHT: FAIL -- do NOT deploy
preflight rc=1
