Changelog 2026-07-09 -- Stage 7 runbook: Designate, COS, Magnum/CAPI (DOCFIX-159)

No live infrastructure touched -- new runbook document only. Authored by a delegated subagent (general-purpose, briefed with this repo's discipline, D-106/D-008/D-019/D-021/D-105/D-046, bundle.yaml, phase-01-bundle- deploy.md, and phase-06/07/08 as primary sources), reviewed before this commit -- repo-lint was clean on the first pass.

Item

1. DOCFIX-159 -- runbooks/dc-dc-phase6-designate-cos-magnum.md

FILES: runbooks/dc-dc-phase6-designate-cos-magnum.md (new), docs/dc-dc- deployment-workflow.md (Stage 7 row updated).

WHAT: per-DC Designate reactivation (D-106, superseding D-019/reactivating D-008), COS observability, and Magnum/CAPI, reusing phase-06/07/08 by filename rather than duplicating their content.

Quotes, rather than paraphrases, the exact current repo state being reversed: bundle.yaml's own D-019 comment line and phase-01-bundle- deploy.md's "NO designate (D-019)" gate text are both reproduced verbatim before describing the reversal, so the diff is traceable to real text, not a vague "add designate" gloss.

Correctly identifies the reversal is bigger than one application: D-106's own reactivated bootstrap order includes os-public-hostname per API charm as its second step -- directly reversing bundle.yaml's separate B5 posture ("IP-ONLY -- os-public-hostname dropped on all API charms... No control-plane DNS dependency"). The runbook treats this as two coupled changes under one D-106 umbrella (add designate; re-add os-public-hostname fleet-wide) rather than quietly bundling it into a one-line description, and proposes -- without silently adopting -- pushing the new per-DC FQDN literals into new overlays/dc1-hostnames.yaml /dc2-hostnames.yaml files (mirroring the existing octavia-pki.yaml overlay pattern) so bundle.yaml itself stays DC-agnostic.

D-046's domain-setup trap is quoted verbatim twice (a top-of-file !!! callout and again inline at the Magnum step) -- "magnum reports active / 'Unit is ready' regardless of whether it has run" -- with an explicit instruction that this re-run/re-assertion applies even when this whole Stage 7 pass is itself a redo after an earlier Stage 4-6 rebuild.

COS deployment mechanism explicitly NOT invented: D-105 rules only the SCOPE (per-DC, in-scope, no Office1 roll-up); no decision in this repo specifies whether COS means the cos-lite k8s bundle or machine-charm- native observability. The runbook presents both real options with their tradeoffs and defers the choice to the operator at execution time, logged as a real architectural decision rather than picked for them.

DC-parameterization notes are traced, not assumed: confirmed by reading which phase-06/07/08 scripts actually source scripts/lib-net.sh (phase-06-k8s-bootstrap.sh, phase-06-kubeconfig-gate.sh, both via KEYSTONE_VIP_DEFAULT) and require lib_net_select_dc "$DC" first, versus which literals those runbooks already resolve dynamically per-run and need no further changes.

VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn (no fixes needed). NOT YET EXECUTED.

REVERT: rm runbooks/dc-dc-phase6-designate-cos-magnum.md && git checkout HEAD~ -- docs/dc-dc-deployment-workflow.md (safe).

Next actionable step

This is the last of the seven Stage 1-7 runbooks (tooling gap register item #9 now CLOSED for authoring). Remaining work is the adversarial review pass across everything built this session and the final consolidation of the workflow doc, gap register, companion Artifact, changelogs, and session ledger.