# host-identity -- which physical host each host-ROLE's `local` locations live on (D-137 tier 2).
#
# WHY THIS FILE EXISTS. `creds-manifests/vm-secret-locations` declares a location as
# `<host-role> <site-key> <ssh-target> <path>`, and an ssh-target of `local` means "probe the
# filesystem of the machine this checker is running on". That is correct ONLY when the checker
# happens to be running on the host the role denotes. It is not self-checking, and the failure
# is silent and severe:
#
#   MEASURED 2026-07-29. Running P5 on the Office1 headend reported 34 findings against the
#   7 the same tree produces on the jumphost. The 26 extra were pure artefact: every
#   `jumphost ... local ... ~/vr1-dcN-creds/*` location was probed against voffice1's
#   filesystem, which has its OWN `~/vr1-dcN-creds/` directories -- the SEC-022 headend shadow
#   stores. So the checker compared the jumphost's expected credential set against a
#   DIFFERENT host's directories and called the mismatches findings.
#
# That is the "could not look is never nothing there" rule inverted into something worse:
# it looked in the wrong place and reported the result as fact. Combined with P3/P4 being
# runnable ONLY on the headend (vcloud has no juju/maas/openstack binaries), the consequence
# was that NO SINGLE HOST produced a correct full preflight verdict.
#
# WHAT THE CHECKER DOES WITH THIS. For every location whose ssh-target is `local`, it compares
# this file's declared host for that role against the machine's own hostname. On a mismatch it
# does NOT probe: the scope is marked NOT JUDGED, exactly like an unreachable remote, so
# absence can never be asserted over it. On a match it probes as before.
#
# EXHAUSTIVE BY CONSTRUCTION. Every host-role that uses a `local` target in
# vm-secret-locations must appear here exactly once, and a role declared here but never used
# locally is a stale declaration. The checker FAILS on either rather than defaulting -- the
# same discipline as `stages-reached`, and for the same reason: both defaults are wrong in a
# dangerous direction.
#
# FORMAT. Whitespace-separated: <host-role> <hostname>
#   hostname is compared against the machine's own `hostname` (socket.gethostname()), short
#   form, case-insensitive. It is an IDENTITY, never a path or an ssh target.
# `#` comments and blank lines ignored.

jumphost   vcloud
# RULED 2026-07-29 (D-109 ruling note (b)): the per-DC Octavia PKI is GENERATED on the Plane-2
# headend, because juju lives there and the deploy reads the overlay from the same host. Its
# locations are declared `local`, so this binding is what makes a vcloud run report them NOT
# PROBED instead of absent.
headend    voffice1