# creds-matrix.tsv -- D-137 expected-state credential register (ADOPTED 2026-07-26).
#
# THE SINGLE SOURCE. creds-manifests/*.manifest are DERIVED from this file
# (D-137 ruling 2: `scripts/creds-matrix.py --render`); do not hand-edit a manifest.
#
# WHY A FORWARD REGISTER. creds-audit is DECLARATION-based, so an undeclared secret is
# structurally invisible -- and no discovery sweep can ever detect a credential that was
# never minted at all. Absence is invisible to discovery. This file states what SHOULD
# exist so absence becomes a detectable FAIL.
#
# LOGICAL KEYS ONLY (SEC-004 -- this repo is currently PUBLIC). No values, no hostnames,
# no IPs, no grants, no paths. `host-role` is a role token, never a VM name.
#
# FORMAT. Whitespace-separated positional records in the manifests' idiom (the same shape
# creds-audit.sh:49 reads). `#` comments and blank lines ignored. NO FIELD MAY CONTAIN
# WHITESPACE. `-` means not-applicable.
#
# A ROW IS ONE (credential, location) PAIR -- not one credential (12-column amendment,
# 2026-07-26). Copies of one credential share an `id`, one row per place it lives. `id` is
# therefore the IDENTITY, which is what makes ruling 5 checkable: if the rows sharing an id
# carry more than one `principal`, that identity serves two principal types -> FAIL.
#
# columns:
# id logical identity (rows sharing an id are copies/forms of one identity)
# cardinality singleton | per-site | per-DC | per-node | per-tenant
# site-key region-qualified (vr1-dc0), bare `dc0` REJECTED; `-` = not site-scoped
# host-role jumphost|headend|rack|edge|netbox|cloud|unit|client (NEVER a VM name)
# filename basename at that location; `-` = no host artifact (skips existence checks)
# access-type gui|api|ssh|cli-profile|console|none
# principal human|service|- (ruling 5 keys off this)
# custody consolidated|source-of-record|off-manifest-known|not-consolidated-ruled
# mint-stage stage2..stage6 | vr0-phaseNN | tenant-onboard | adhoc | -
# mint-ref script:<path>:<line> | runbook:<path>:<line> | operator-terminal | -
# sec-ref SEC-NNN | -
# notes-ref key into creds-matrix-notes.md | -
#
# EXPECTED RED. This register is deliberately not satisfiable by today's tree; the
# failures are the defects D-137 exists to surface (see the notes file, and the
# "EXPECTED RED BY DESIGN" section of docs/D-137-implementation-plan.md).
#
# id cardinality site-key host-role filename access-type principal custody mint-stage mint-ref sec-ref notes-ref
# ---------------------------------------------------------------- vr1-office1 (headend region + jumphost)
maas-region-admin singleton vr1-office1 headend admin.pass gui human source-of-record stage2 script:scripts/site-headend-install.sh:452 SEC-020 n-maas-region-admin
maas-region-admin singleton vr1-office1 jumphost maas-admin-password gui human consolidated stage2 script:scripts/site-headend-install.sh:452 SEC-020 n-maas-region-admin
maas-region-admin singleton vr1-office1 headend admin.apikey api service not-consolidated-ruled stage2 script:scripts/site-headend-install.sh:453 SEC-020 n-maas-admin-apikey
maas-region-admin singleton vr1-office1 headend .maas.cli cli-profile service off-manifest-known stage2 script:scripts/site-headend-install.sh:455 SEC-020 n-maas-cli-profile
maas-region-operator singleton vr1-office1 jumphost maas-operator-password gui human consolidated adhoc operator-terminal SEC-020 n-maas-region-operator
maas-region-db singleton vr1-office1 headend db.pass none service not-consolidated-ruled stage2 script:scripts/site-headend-install.sh:430 SEC-020 n-region-infra-carveout
maas-region-lxd-trust singleton vr1-office1 headend lxd-trust.pass none service not-consolidated-ruled stage2 script:scripts/site-headend-install.sh:485 SEC-020 n-region-infra-carveout
maas-rack-enroll-secret singleton vr1-office1 headend secret none service off-manifest-known stage2 script:scripts/site-headend-install.sh:445 - n-rack-enroll
office1-svc-key per-site vr1-office1 jumphost office1_svc_ed25519 ssh service consolidated stage2 operator-terminal SEC-007 n-no-mint-command
office1-svc-key per-site vr1-office1 jumphost office1_svc_ed25519.pub none service consolidated stage2 operator-terminal SEC-007 n-no-mint-command
office1-edge-api per-site vr1-office1 jumphost opnsense-api.txt api service consolidated stage2 script:scripts/opnsense-bootstrap-apikey.sh:89 - n-edge-api
office1-edge-root per-site vr1-office1 jumphost opnsense-root-password gui human consolidated stage2 operator-terminal SEC-007 n-no-mint-command
office1-edge-root per-site vr1-office1 jumphost opnsense-root-hash none human consolidated stage2 operator-terminal SEC-007 n-no-mint-command
office1-tailscale-authkey singleton vr1-office1 jumphost tailscale-authkey.txt api service consolidated stage2 operator-terminal SEC-008 n-third-party
netbox-upstream-token singleton vr1-office1 jumphost vr1-netbox.env api service consolidated stage2 operator-terminal SEC-006 n-netbox-upstream
netbox-sandbox-token singleton vr1-office1 netbox api.token api service source-of-record stage2 runbook:runbooks/dc-dc-phase1-office1-standup.md:643 SEC-009 n-netbox-sandbox
netbox-sandbox-token singleton vr1-office1 jumphost vr1-netbox-sandbox.env api service consolidated stage2 runbook:runbooks/dc-dc-phase1-office1-standup.md:643 SEC-009 n-netbox-sandbox
netbox-secret-key singleton vr1-office1 netbox secret_key none service off-manifest-known stage2 operator-terminal - n-netbox-vm-secrets
netbox-admin singleton vr1-office1 netbox admin.pass gui human off-manifest-known stage2 operator-terminal - n-netbox-vm-secrets
office1-tofu-maas-apikey singleton vr1-office1 jumphost vr1-stage1.env api service consolidated stage2 runbook:runbooks/dc-dc-phase1-office1-standup.md:464 SEC-009 n-tofu-apikey
office1-tofu-maas-apikey singleton vr1-office1 jumphost terraform.tfstate api service off-manifest-known stage2 runbook:runbooks/dc-dc-phase1-office1-standup.md:464 SEC-009 n-tfstate-plaintext
office1-env singleton vr1-office1 jumphost vr1-office1.env none service consolidated stage2 operator-terminal SEC-009 n-office1-env
creds-folder-readme per-site vr1-office1 jumphost README none - consolidated - - - n-readme
# ---------------------------------------------------------------- vr1-dc0
dc0-svc-key per-DC vr1-dc0 jumphost vr1-dc0_svc_ed25519 ssh service consolidated stage3 operator-terminal - n-no-mint-command
dc0-svc-key per-DC vr1-dc0 jumphost vr1-dc0_svc_ed25519.pub none service consolidated stage3 operator-terminal - n-no-mint-command
dc0-svc-key per-DC vr1-dc0 headend vr1-dc0_svc_ed25519 ssh service off-manifest-known stage3 operator-terminal SEC-022 n-headend-shadow-store
dc0-svc-key per-DC vr1-dc0 headend vr1-dc0_svc_ed25519.pub none service off-manifest-known stage3 operator-terminal SEC-022 n-headend-shadow-store
dc0-edge-key per-DC vr1-dc0 jumphost vr1-dc0-edge_ed25519 ssh service consolidated stage3 operator-terminal - n-edge-key
dc0-edge-key per-DC vr1-dc0 jumphost vr1-dc0-edge_ed25519.pub none service consolidated stage3 operator-terminal - n-edge-key
dc0-edge-api per-DC vr1-dc0 jumphost opnsense-api.txt api service consolidated stage3 script:scripts/opnsense-bootstrap-apikey.sh:89 SEC-021 n-dc0-edge-api-absent
dc0-maas-power-key per-DC vr1-dc0 jumphost vr1-dc0-maas-power_ed25519 ssh service consolidated stage3 operator-terminal SEC-021 n-dc0-power-key-divergence
dc0-maas-power-key per-DC vr1-dc0 jumphost vr1-dc0-maas-power_ed25519.pub none service consolidated stage3 operator-terminal SEC-021 n-dc0-power-key-divergence
dc0-maas-power-key per-DC vr1-dc0 headend maas-virsh_ed25519 ssh service off-manifest-known stage3 operator-terminal SEC-021 n-dc0-power-key-divergence
dc0-maas-power-key per-DC vr1-dc0 headend id_ed25519 ssh service off-manifest-known stage3 runbook:runbooks/dc-dc-phase2-tofu-dc-substrate.md:770 SEC-012 n-snap-key-fragility
dc0-maas-apikey per-DC vr1-dc0 jumphost maas-api-key.txt api service consolidated stage5 runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:136 SEC-018 n-dc-maas-apikey
dc0-maas-apikey per-DC vr1-dc0 headend credentials.yaml api service off-manifest-known stage5 runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:141 SEC-018 n-juju-cred-store
dc0-juju-maas-user per-DC vr1-dc0 - - api service off-manifest-known stage5 runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:128 SEC-020 n-juju-user-nopassword
# ---------------------------------------------------------------- vr1-dc1
dc1-svc-key per-DC vr1-dc1 jumphost vr1-dc1_svc_ed25519 ssh service consolidated stage3 operator-terminal - n-no-mint-command
dc1-svc-key per-DC vr1-dc1 jumphost vr1-dc1_svc_ed25519.pub none service consolidated stage3 operator-terminal - n-no-mint-command
dc1-svc-key per-DC vr1-dc1 headend vr1-dc1_svc_ed25519 ssh service off-manifest-known stage3 operator-terminal SEC-022 n-headend-shadow-store
dc1-svc-key per-DC vr1-dc1 headend vr1-dc1_svc_ed25519.pub none service off-manifest-known stage3 operator-terminal SEC-022 n-headend-shadow-store
dc1-edge-key per-DC vr1-dc1 jumphost vr1-dc1-edge_ed25519 ssh service consolidated stage3 operator-terminal SEC-015 n-edge-key
dc1-edge-key per-DC vr1-dc1 jumphost vr1-dc1-edge_ed25519.pub none service consolidated stage3 operator-terminal - n-edge-key
dc1-edge-api per-DC vr1-dc1 jumphost opnsense-api.txt api service consolidated stage3 script:scripts/opnsense-bootstrap-apikey.sh:89 - n-edge-api
dc1-maas-power-key per-DC vr1-dc1 jumphost vr1-dc1-maas-power_ed25519 ssh service consolidated stage3 operator-terminal SEC-016 n-dc1-power-key
dc1-maas-power-key per-DC vr1-dc1 jumphost vr1-dc1-maas-power_ed25519.pub none service consolidated stage3 operator-terminal SEC-016 n-dc1-power-key
dc1-maas-power-key per-DC vr1-dc1 headend id_dc1_power ssh service off-manifest-known stage3 runbook:runbooks/dc-dc-phase2-tofu-dc-substrate.md:770 SEC-016 n-snap-key-fragility
dc1-maas-apikey per-DC vr1-dc1 jumphost maas-api-key.txt api service consolidated stage5 runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:136 SEC-019 n-dc-maas-apikey
dc1-maas-apikey per-DC vr1-dc1 headend credentials.yaml api service off-manifest-known stage5 runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:141 SEC-019 n-juju-cred-store
dc1-juju-maas-user per-DC vr1-dc1 - - api service off-manifest-known stage5 runbook:runbooks/dc-dc-phase4-juju-bundle-per-dc.md:128 SEC-020 n-juju-user-nopassword
# ---------------------------------------------------------------- outside the SEC-009 *-creds/ convention (research FINDING 2)
vault-unseal-shares singleton - jumphost vault-init none service off-manifest-known vr0-phase02 runbook:runbooks/phase-02-vault-bringup.md:71 SEC-023 n-outside-convention
vault-root-token singleton - jumphost vault-init none service off-manifest-known vr0-phase02 runbook:runbooks/phase-02-vault-bringup.md:71 SEC-023 n-outside-convention
octavia-issuing-ca-passphrase singleton - jumphost octavia-issuing-ca-passphrase none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:299 SEC-023 n-outside-convention
octavia-issuing-ca-key singleton - jumphost octavia-issuing-ca-key none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:302 SEC-023 n-outside-convention
octavia-issuing-ca-cert singleton - jumphost octavia-issuing-ca-cert none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:305 SEC-023 n-outside-convention
octavia-controller-ca-pass singleton - jumphost octavia-controller-ca-passphrase none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:321 SEC-023 n-outside-convention
octavia-controller-ca-key singleton - jumphost octavia-controller-ca-key none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:324 SEC-023 n-outside-convention
octavia-controller-ca-cert singleton - jumphost octavia-controller-ca-cert none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:327 SEC-023 n-outside-convention
octavia-controller-key singleton - jumphost octavia-controller-key none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:343 SEC-023 n-outside-convention
octavia-controller-bundle singleton - jumphost octavia-controller-bundle none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:375 SEC-023 n-outside-convention
octavia-pki-overlay singleton - jumphost octavia-pki.yaml none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:391 SEC-004 n-overlay-in-clone
tenant-domain-admin per-tenant - jumphost domain-admin-cred.txt gui human off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:64 SEC-023 n-tenant-dir
tenant-cluster-user per-tenant - jumphost cluster-cred.txt api human off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:90 SEC-023 n-tenant-dir
tenant-svc-user per-tenant - jumphost svc-cred.txt api service off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:90 SEC-023 n-tenant-dir
tenant-svc-appcred per-tenant - jumphost svc-appcred.txt api service off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:141 SEC-023 n-tenant-dir
tenant-nova-key per-tenant - jumphost tenant-key.pem ssh service off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:167 SEC-023 n-tenant-dir
# ---------------------------------------------------------------- in scope by the materialization ruling (charm/platform-minted, then materialized)
keystone-admin singleton - cloud - api service off-manifest-known vr0-phase01 - - n-charm-minted
keystone-admin singleton - jumphost admin-openrc none service off-manifest-known vr0-phase03 script:scripts/phase-03-admin-openrc.sh:52 SEC-023 n-predicted-openrc
magnum-domain-admin singleton - cloud - api service off-manifest-known vr0-phase07 script:scripts/phase-07-conductor-graft.sh:90 - n-cloud-only
capi-mgmt-kubeconfig singleton - cloud kube-config none service off-manifest-known vr0-phase06 script:scripts/phase-06-capi-stack.sh:91 - n-cloud-only
rbd-mirror-peer-token per-DC - unit rbd-mirror-bootstrap-token none service off-manifest-known stage6 script:scripts/dc-dc-rbd-mirror.sh:88 - n-ephemeral-unit
rgw-multisite-system-key singleton - unit - api service off-manifest-known stage6 script:scripts/dc-dc-radosgw-multisite.sh:172 - n-cloud-only
# ---------------------------------------------------------------- non-secret artifacts colocated at declared locations
juju-client-clouds singleton - headend clouds.yaml none - off-manifest-known stage5 - - n-colocated-nonsecret
juju-client-public-clouds singleton - headend public-clouds.yaml none - off-manifest-known stage5 - - n-colocated-nonsecret
maas-snap-ssh-config singleton - headend config none - off-manifest-known stage3 - - n-colocated-nonsecret
maas-snap-known-hosts singleton - headend known_hosts none - off-manifest-known stage3 - - n-colocated-nonsecret
maas-snap-known-hosts-old singleton - headend known_hosts.old none - off-manifest-known stage3 - - n-colocated-nonsecret
