# stages-reached -- which mint stages THIS deployment has completed (D-137 tier 2).
#
# WHY THIS FILE EXISTS. Tier 2 must distinguish "this credential is MISSING" from "this
# credential has not been minted YET". That distinction is a STATUS fact, and GA-R1 puts
# status in docs/CURRENT-STATE.md and nowhere else -- so the checker carries no stage list
# of its own, and until now the caller typed one on the command line with --pending-stage.
# A gate whose verdict depends on a hand-typed parameter can be widened silently, so the
# declaration moved here: config-as-data with a drift gate, the pattern the repo already
# uses for state-bearing surfaces.
#
# THIS FILE IS A DERIVED STATUS CLAIM. docs/CURRENT-STATE.md remains the authority; this is
# a machine-readable projection of it, and repo-lint L12 FAILS if it is edited without
# CURRENT-STATE being touched in the same change set (the L10 pattern). If the two ever
# disagree, CURRENT-STATE wins and this file is the defect.
#
# EXHAUSTIVE BY CONSTRUCTION. Every `mint-stage` token used in creds-matrix.tsv must appear
# here exactly once. The checker FAILS on an unclassified token rather than defaulting it,
# because either default is wrong in a dangerous direction: defaulting to `reached` floods
# the run with false absences, and defaulting to `pending` silently defers real ones -- a
# false green, which is the failure class this whole control exists to prevent.
#
# FORMAT. Whitespace-separated: <mint-stage-token> <reached|pending>
# reached the stage has RUN in this deployment; its credentials are expected NOW and a
# missing one is a real finding.
# pending the stage has NOT run; its credentials are deferred, reported as an explicit
# [ok] skip, never as a silent pass.
# `#` comments and blank lines ignored.
#
# EVIDENCE for the current values (docs/CURRENT-STATE.md section 1): Stage 3 / Phase 2 is
# CLOSED for both DCs; Stage 4 / Phase 3 is OPEN and executing; "stages 5-7 are authored,
# not executed". The VR0 `phase-NN` track is the SEPARATE single-DC testcloud lineage -- do
# NOT conflate the two numbering tracks (the operating skill warns on exactly this) -- and
# none of its credential artifacts exist on this jumphost (measured 2026-07-26: the Vault
# init and Octavia PKI directories are absent).
# --- VR1 DC-DC track -------------------------------------------------------------------
stage2 reached # Office1 headend standup: region MAAS, LXD, NetBox
stage3 reached # per-DC substrate: rack, edge, node VMs, power + service keys
# stage4 is deliberately ABSENT: Stage 4 (MAAS enlist/commission/deploy) is OPEN and
# executing, but it MINTS NO CREDENTIAL -- no matrix row carries it. The exhaustiveness
# check flags a classified-but-unused token as a stale declaration, which is how this was
# caught; a stage only belongs here once a credential is attributed to it.
stage5 pending # Juju bootstrap + per-DC bundle deploy -- authored, not executed
stage6 pending # DR / rbd-mirror / radosgw multisite -- authored, not executed
# --- VR0 single-DC testcloud track (separate lineage; artifacts absent here) ------------
vr0-phase01 pending # bundle deploy + Octavia PKI generation
vr0-phase02 pending # Vault bring-up (unseal shares, root token, charm-pki-local)
vr0-phase03 pending # admin-openrc materialization
vr0-phase06 pending # CAPI stack / mgmt cluster kubeconfig
vr0-phase07 pending # Magnum conductor graft
# --- not stage-scoped ------------------------------------------------------------------
tenant-onboard pending # per-tenant credential set; no tenant onboarded on this cloud
adhoc reached # one-off mints (the 2026-07-25 `operator` MAAS superuser)
- reached # rows with no stage: present-or-absent judged on their own
