GitBucket
Record inventory -- grounding audit Phase 1 (deterministic)
Generated by scripts/record-audit.py at repo HEAD 148dcef (2026-07-18T08:44:44Z). Read-only extraction; zero judgment. Counting rules are in the script header: docs/audit/* and memory-surface rows are inventoried but NOT counted toward the contradiction signal; a changelog-excluded pair count is shown alongside.
Summary
- files scanned: 179
- status-claim rows: 858 (plan 27, status 231, version 175, gate 425)
- CONTRADICTION GROUPS (counted surfaces): 12
- contradiction groups excluding changelog-class files: 10
- broken path refs: 319; orphan number refs: 170; unknown commit hashes: 115; bad file:line refs: 0
1. Doc census
| file | class | bytes | lines | last commit | inbound refs |
|---|---|---|---|---|---|
| docs/D-057-DECIDED-append.md | reference | 7168 | 37 | 2026-06-29 | 3 |
| docs/D-057-REVIEW-ITEMS.md | reference | 4069 | 58 | 2026-06-29 | 2 |
| docs/D-058-renumber.md | reference | 4772 | 77 | 2026-06-29 | 5 |
| docs/D-068-openbao-assessment-DRAFT.md | reference | 7258 | 108 | 2026-07-06 | 3 |
| docs/D-068-vault-1.8-vs-1.16-analysis.md | reference | 7781 | 114 | 2026-07-05 | 7 |
| docs/DOCFIX-064-phase08-changelist.md | reference | 5224 | 81 | 2026-07-02 | 1 |
| docs/README-D057-PACK.md | reference | 6969 | 108 | 2026-06-29 | 1 |
| docs/as-executed-log-convention.md | reference | 2019 | 38 | 2026-07-06 | 9 |
| docs/audit/grounding-audit-charter.md | audit | 15625 | 247 | 2026-07-18 | 2 |
| docs/audit/skill-additions-proposed.md | audit | 2258 | 36 | 2026-07-18 | 2 |
| docs/changelog-20260703-process-hardening.md | changelog | 23078 | 371 | 2026-07-03 | 3 |
| docs/changelog-20260709-adversarial-review-fixes.md | changelog | 5729 | 110 | 2026-07-10 | 1 |
| docs/changelog-20260709-ceph-replication-tooling.md | changelog | 8444 | 144 | 2026-07-10 | 2 |
| docs/changelog-20260709-dc-dc-design.md | changelog | 2365 | 45 | 2026-07-09 | 2 |
| docs/changelog-20260709-dc-dc-phase0-runbook.md | changelog | 4385 | 75 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase1-runbook.md | changelog | 3542 | 66 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase2-runbook.md | changelog | 3350 | 63 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase3-runbook.md | changelog | 3973 | 73 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase4-runbook.md | changelog | 4070 | 73 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase5-runbook.md | changelog | 3443 | 66 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase6-runbook.md | changelog | 3651 | 69 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-repo-rename-sweep.md | changelog | 5123 | 87 | 2026-07-09 | 1 |
| docs/changelog-20260709-dc-selector-convention.md | changelog | 4637 | 78 | 2026-07-10 | 3 |
| docs/changelog-20260709-designate-cinderbackup-rbdmirror.md | changelog | 8053 | 134 | 2026-07-10 | 5 |
| docs/changelog-20260709-final-consolidation.md | changelog | 5450 | 98 | 2026-07-10 | 1 |
| docs/changelog-20260709-ipv6-family-matrix-overlay.md | changelog | 3794 | 71 | 2026-07-10 | 1 |
| docs/changelog-20260709-maas-scripts-dc-param.md | changelog | 8908 | 153 | 2026-07-10 | 3 |
| docs/changelog-20260709-mtu-ceph-budget-calculators.md | changelog | 8080 | 138 | 2026-07-10 | 2 |
| docs/changelog-20260709-netbox-dc-dc-pipeline.md | changelog | 6254 | 110 | 2026-07-10 | 2 |
| docs/changelog-20260709-netem-ula-gua-proposal.md | changelog | 2691 | 52 | 2026-07-10 | 1 |
| docs/changelog-20260709-office1-network-edge.md | changelog | 7516 | 134 | 2026-07-10 | 2 |
| docs/changelog-20260709-opentofu-audit.md | changelog | 6443 | 106 | 2026-07-09 | 1 |
| docs/changelog-20260709-opentofu-cloudinit-vm.md | changelog | 3721 | 67 | 2026-07-09 | 1 |
| docs/changelog-20260709-opentofu-maas-netem.md | changelog | 4566 | 84 | 2026-07-09 | 1 |
| docs/changelog-20260709-opentofu-node-vm.md | changelog | 4672 | 81 | 2026-07-09 | 1 |
| docs/changelog-20260709-opentofu-scaffold.md | changelog | 5132 | 86 | 2026-07-09 | 1 |
| docs/changelog-20260709-opnsense-config-design.md | changelog | 4585 | 80 | 2026-07-09 | 1 |
| docs/changelog-20260709-opnsense-edge-module.md | changelog | 5044 | 91 | 2026-07-09 | 1 |
| docs/changelog-20260709-opnsense-research.md | changelog | 3900 | 68 | 2026-07-09 | 2 |
| docs/changelog-20260709-repo-agnostic-sweep.md | changelog | 5681 | 90 | 2026-07-09 | 1 |
| docs/changelog-20260709-repo-lint-crlf-fix.md | changelog | 1711 | 31 | 2026-07-09 | 1 |
| docs/changelog-20260709-stage0-ratification.md | changelog | 4848 | 86 | 2026-07-09 | 2 |
| docs/changelog-20260710-carve-gua-hang-fix.md | changelog | 2490 | 48 | 2026-07-10 | 1 |
| docs/changelog-20260710-ledger-scan-self-inflicted-falsepositive-fix.md | changelog | 5710 | 101 | 2026-07-10 | 2 |
| docs/changelog-20260710-netbox-roles-aggregates.md | changelog | 3051 | 50 | 2026-07-10 | 1 |
| docs/changelog-20260710-opentofu-scaffold-first-validation.md | changelog | 4261 | 74 | 2026-07-10 | 1 |
| docs/changelog-20260710-opentofu-state-file-security.md | changelog | 6367 | 111 | 2026-07-10 | 1 |
| docs/changelog-20260710-phase0-runbook-as-executed.md | changelog | 2872 | 49 | 2026-07-10 | 1 |
| docs/changelog-20260710-phase01-bundle-staleness-fix.md | changelog | 3421 | 59 | 2026-07-10 | 1 |
| docs/changelog-20260710-prereq-install-scripts.md | changelog | 3635 | 60 | 2026-07-10 | 1 |
| docs/changelog-20260710-skill-vr1-awareness.md | changelog | 4304 | 74 | 2026-07-10 | 1 |
| docs/changelog-20260710-sweep-bundle-fixes.md | changelog | 4268 | 81 | 2026-07-10 | 1 |
| docs/changelog-20260710-sweep-dcdc-runbook-fixes.md | changelog | 4232 | 77 | 2026-07-10 | 1 |
| docs/changelog-20260710-sweep-script-fixes.md | changelog | 7306 | 118 | 2026-07-10 | 2 |
| docs/changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md | changelog | 5048 | 87 | 2026-07-10 | 2 |
| docs/changelog-20260710-vr1-teardown-rollback-runbook.md | changelog | 5959 | 104 | 2026-07-10 | 1 |
| docs/changelog-20260711-d111-subcarve-nn-alignment.md | changelog | 2830 | 48 | 2026-07-11 | 1 |
| docs/changelog-20260711-ula-gen-command-fix.md | changelog | 1730 | 31 | 2026-07-14 | 3 |
| docs/changelog-20260712-docfix189-max-context-session-audit.md | changelog | 5808 | 92 | 2026-07-12 | 1 |
| docs/changelog-20260712-libvirt-acpi-kernel-panic.md | changelog | 5668 | 120 | 2026-07-12 | 3 |
| docs/changelog-20260712-libvirt-memory-unit-rootcause.md | changelog | 6662 | 119 | 2026-07-12 | 4 |
| docs/changelog-20260712-office1-opnsense-edge-build.md | changelog | 3964 | 58 | 2026-07-12 | 5 |
| docs/changelog-20260712-opnsense-edge-boot-fixes.md | changelog | 3494 | 55 | 2026-07-12 | 3 |
| docs/changelog-20260712-opnsense-edge-real-isp-router.md | changelog | 2469 | 39 | 2026-07-12 | 2 |
| docs/changelog-20260712-opnsense-prep-bz2-fallback.md | changelog | 978 | 19 | 2026-07-12 | 1 |
| docs/changelog-20260713-apparmor-libvirt-prereq.md | changelog | 3351 | 60 | 2026-07-13 | 3 |
| docs/changelog-20260713-config-xml-danger-sweep.md | changelog | 3569 | 57 | 2026-07-13 | 2 |
| docs/changelog-20260713-config-xml-path-deleted.md | changelog | 4787 | 92 | 2026-07-13 | 2 |
| docs/changelog-20260713-d114-voffice1-nested-virt.md | changelog | 6601 | 110 | 2026-07-13 | 2 |
| docs/changelog-20260713-docfix194-opentofu-module-validation.md | changelog | 4618 | 103 | 2026-07-13 | 2 |
| docs/changelog-20260713-git-credential-store.md | changelog | 3385 | 65 | 2026-07-13 | 2 |
| docs/changelog-20260713-office1-dhcp-apply.md | changelog | 4996 | 97 | 2026-07-13 | 3 |
| docs/changelog-20260713-office1-headend-maas-lxd.md | changelog | 6399 | 102 | 2026-07-13 | 1 |
| docs/changelog-20260713-office1-netbox-deployed.md | changelog | 5360 | 93 | 2026-07-13 | 3 |
| docs/changelog-20260713-opnsense-api-client.md | changelog | 3350 | 63 | 2026-07-13 | 1 |
| docs/changelog-20260713-opnsense-api-proven.md | changelog | 3533 | 64 | 2026-07-13 | 4 |
| docs/changelog-20260713-opnsense-api-write-proven.md | changelog | 3059 | 64 | 2026-07-13 | 4 |
| docs/changelog-20260713-opnsense-apikey-bootstrap.md | changelog | 4404 | 83 | 2026-07-13 | 2 |
| docs/changelog-20260713-workflow-doc-status-correction.md | changelog | 3102 | 43 | 2026-07-13 | 1 |
| docs/changelog-20260714-c4-sandbox-loop-and-upstream-guard.md | changelog | 3117 | 54 | 2026-07-14 | 1 |
| docs/changelog-20260714-d119-region-qualified-dc-namespace.md | changelog | 6396 | 108 | 2026-07-14 | 2 |
| docs/changelog-20260714-d119-tofu-apply.md | changelog | 1995 | 43 | 2026-07-14 | 1 |
| docs/changelog-20260714-netbox-importers-waf-useragent.md | changelog | 2479 | 54 | 2026-07-14 | 3 |
| docs/changelog-20260714-netbox-write-path-hardening.md | changelog | 4987 | 85 | 2026-07-14 | 3 |
| docs/changelog-20260714-office1-lan-ipv6-executed.md | changelog | 7307 | 116 | 2026-07-14 | 3 |
| docs/changelog-20260714-opnsense-set-interface-v6.md | changelog | 4783 | 85 | 2026-07-14 | 2 |
| docs/changelog-20260715-creds-audit.md | changelog | 3530 | 60 | 2026-07-15 | 2 |
| docs/changelog-20260715-creds-consolidation.md | changelog | 3180 | 52 | 2026-07-15 | 2 |
| docs/changelog-20260715-d120-load-and-iprange-tooling.md | changelog | 3268 | 53 | 2026-07-15 | 3 |
| docs/changelog-20260715-d120-office1-service-reip.md | changelog | 4064 | 66 | 2026-07-15 | 1 |
| docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md | changelog | 8971 | 116 | 2026-07-16 | 2 |
| docs/changelog-20260715-docfix195-c2-netbox-of-record.md | changelog | 5225 | 75 | 2026-07-15 | 1 |
| docs/changelog-20260715-fidelity-check-scope-correctness.md | changelog | 4906 | 83 | 2026-07-15 | 4 |
| docs/changelog-20260715-stage3-prereqs-prep.md | changelog | 6334 | 88 | 2026-07-16 | 2 |
| docs/changelog-20260716-d124-addressing-pin.md | changelog | 3880 | 65 | 2026-07-16 | 3 |
| docs/changelog-20260716-d124-rack-addressing.md | changelog | 6471 | 92 | 2026-07-16 | 1 |
| docs/changelog-20260716-d126-durable-forward.md | changelog | 7703 | 111 | 2026-07-16 | 2 |
| docs/changelog-20260716-review-sweep-phaseAB.md | changelog | 4012 | 59 | 2026-07-16 | 2 |
| docs/changelog-20260716-review-sweep-phaseC.md | changelog | 4588 | 64 | 2026-07-16 | 2 |
| docs/changelog-20260716-review-sweep-phaseC2-D125.md | changelog | 5138 | 73 | 2026-07-16 | 2 |
| docs/changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md | changelog | 5684 | 75 | 2026-07-17 | 3 |
| docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md | changelog | 3579 | 60 | 2026-07-17 | 2 |
| docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md | changelog | 3580 | 54 | 2026-07-17 | 2 |
| docs/changelog-20260718-opnsense-plugins-installer.md | changelog | 2617 | 40 | 2026-07-18 | 2 |
| docs/changelog-20260718-permission-posture-ask-preempts-classifier.md | changelog | 2323 | 40 | 2026-07-18 | 2 |
| docs/clientdocs-workflow-review-20260708.md | workflow | 9694 | 190 | 2026-07-08 | 2 |
| docs/dc-dc-buildout-design.md | reference | 14449 | 239 | 2026-07-09 | 21 |
| docs/dc-dc-deployment-workflow.md | workflow | 78072 | 886 | 2026-07-17 | 54 |
| docs/dc-dc-ipv6-charm-research.md | reference | 8076 | 142 | 2026-07-10 | 3 |
| docs/dc-dc-netbox-buildout-scope.md | reference | 21942 | 310 | 2026-07-15 | 16 |
| docs/dc-dc-netem-and-ula-gua-proposal.md | reference | 8601 | 139 | 2026-07-11 | 5 |
| docs/dc-dc-replication-DR-seed.md | reference | 4200 | 75 | 2026-07-08 | 5 |
| docs/dc0-deploy-readiness.md | readiness | 12137 | 181 | 2026-07-17 | 4 |
| docs/design-decisions.md | decision | 323955 | 4108 | 2026-07-18 | 54 |
| docs/docfix-draft-20260702.md | reference | 15011 | 215 | 2026-07-03 | 2 |
| docs/finding-20260718-voffice1-cloudinit-seed-replace.md | finding | 15140 | 273 | 2026-07-18 | 2 |
| docs/handoff-20260703-open-items.md | reference | 9110 | 164 | 2026-07-03 | 3 |
| docs/handoff-20260705-open-items.md | reference | 11891 | 179 | 2026-07-06 | 2 |
| docs/incident-20260712-opnsense-edge-boot-triplefault.md | reference | 7623 | 113 | 2026-07-12 | 6 |
| docs/maas-as-built-reference.md | reference | 10331 | 191 | 2026-06-26 | 7 |
| docs/model-a-fallback-plan.md | reference | 7353 | 106 | 2026-07-16 | 10 |
| docs/netbox-vip-queue.md | reference | 6743 | 126 | 2026-07-03 | 7 |
| docs/opnsense-edge-addon-review-20260718.md | reference | 11038 | 146 | 2026-07-18 | 4 |
| docs/phase-00-maas-standup-notes.md | reference | 3018 | 52 | 2026-06-29 | 1 |
| docs/repo-lint-nextfree-bug-FINDING.md | reference | 4264 | 68 | 2026-07-06 | 3 |
| docs/script-quality-findings-20260707.md | finding | 8104 | 141 | 2026-07-07 | 3 |
| docs/security-ledger.md | ledger | 11096 | 57 | 2026-07-16 | 19 |
| docs/session-findings-2026-07-02.md | finding | 5890 | 77 | 2026-07-02 | 1 |
| docs/session-ledger.md | ledger | 98987 | 1142 | 2026-07-18 | 36 |
| docs/stage3-adversarial-review-20260716.md | reference | 27956 | 348 | 2026-07-16 | 4 |
| docs/stage3-review-base.patch | patch | 227584 | 3795 | 2026-07-16 | 3 |
| docs/tenant-cidr-overlap-correction-PLAN.md | reference | 8937 | 154 | 2026-07-06 | 2 |
| docs/tenant-onboarding-contract.md | reference | 9785 | 139 | 2026-07-07 | 10 |
| docs/upstream-bug-draft-dashboard-tls.md | reference | 2518 | 48 | 2026-07-05 | 3 |
| docs/v1-pre-deploy-fixes.md | reference | 36265 | 832 | 2026-07-03 | 5 |
| docs/v1-redeploy-changelog.md | reference | 245435 | 3453 | 2026-07-09 | 3 |
| docs/vr1-office1-as-built.md | reference | 15841 | 203 | 2026-07-18 | 14 |
| runbooks/README.md | runbook | 7224 | 95 | 2026-07-10 | 0 |
| runbooks/appendix-A-troubleshooting.md | runbook | 43905 | 660 | 2026-07-08 | 14 |
| runbooks/appendix-B-asbuilt-version-lock.md | runbook | 12146 | 155 | 2026-07-05 | 7 |
| runbooks/appendix-C-identity-rbac.md | runbook | 10393 | 142 | 2026-07-03 | 7 |
| runbooks/appendix-D-magnum-trust-model.md | runbook | 6907 | 100 | 2026-07-02 | 3 |
| runbooks/d011-batch3-window-DRAFT.md | runbook | 6572 | 121 | 2026-07-09 | 5 |
| runbooks/dc-dc-office1-service-reip.md | runbook | 6945 | 114 | 2026-07-15 | 4 |
| runbooks/dc-dc-phase0-vcloud-prep.md | runbook | 25232 | 527 | 2026-07-14 | 17 |
| runbooks/dc-dc-phase1-office1-standup.md | runbook | 48778 | 903 | 2026-07-17 | 13 |
| runbooks/dc-dc-phase2-tofu-dc-substrate.md | runbook | 43998 | 770 | 2026-07-18 | 15 |
| runbooks/dc-dc-phase3-maas-enlist-deploy.md | runbook | 29043 | 551 | 2026-07-15 | 8 |
| runbooks/dc-dc-phase4-juju-bundle-per-dc.md | runbook | 17030 | 338 | 2026-07-14 | 5 |
| runbooks/dc-dc-phase5-dr-failover-drill.md | runbook | 37810 | 687 | 2026-07-14 | 11 |
| runbooks/dc-dc-phase6-designate-cos-magnum.md | runbook | 34920 | 671 | 2026-07-18 | 8 |
| runbooks/dc-dc-teardown-rollback.md | runbook | 18612 | 377 | 2026-07-16 | 13 |
| runbooks/ops-capi-recovery.md | runbook | 13128 | 251 | 2026-06-18 | 6 |
| runbooks/ops-restart-procedure.md | runbook | 7040 | 156 | 2026-07-16 | 10 |
| runbooks/ops-update-procedure.md | runbook | 19590 | 424 | 2026-07-09 | 6 |
| runbooks/phase-00-teardown-maas-reset.md | runbook | 13317 | 252 | 2026-07-03 | 12 |
| runbooks/phase-01-bundle-deploy.md | runbook | 22714 | 422 | 2026-07-10 | 13 |
| runbooks/phase-02-vault-bringup.md | runbook | 9512 | 178 | 2026-06-18 | 5 |
| runbooks/phase-03-core-verify.md | runbook | 21284 | 361 | 2026-07-07 | 7 |
| runbooks/phase-04-network-carve.md | runbook | 11414 | 188 | 2026-06-30 | 5 |
| runbooks/phase-05-octavia-enablement.md | runbook | 13844 | 226 | 2026-06-30 | 5 |
| runbooks/phase-06-incloud-mgmt-cluster.md | runbook | 30690 | 577 | 2026-07-01 | 5 |
| runbooks/phase-07-conductor-graft.md | runbook | 29583 | 503 | 2026-07-03 | 5 |
| runbooks/phase-08-workload-cluster-acceptance.md | runbook | 21992 | 380 | 2026-07-10 | 9 |
| runbooks/tenant-onboarding-v2-DRAFT.md | runbook | 32894 | 476 | 2026-07-09 | 8 |
| README.md | reference | 6134 | 111 | 2026-06-18 | 66 |
| CLAUDE.md | reference | 2879 | 53 | 2026-07-03 | 11 |
| .claude/skills/openstack-cloud-ops/SKILL.md | skill | 13833 | 173 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/environment.md | skill | 8018 | 131 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md | skill | 9233 | 154 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/operating-discipline.md | skill | 8792 | 146 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/platform-traps.md | skill | 24853 | 456 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/script-authoring.md | skill | 12686 | 219 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/troubleshooting.md | skill | 7047 | 113 | n/a | 0 |
| memory/MEMORY.md | memory | 781 | 6 | n/a | 0 |
| memory/creds-folder-convention.md | memory | 2055 | 32 | n/a | 0 |
| memory/multi-workstation-remote-control.md | memory | 1609 | 25 | n/a | 0 |
| memory/project-posture-closed-test.md | memory | 1566 | 28 | n/a | 0 |
| memory/review-after-each-step.md | memory | 1340 | 24 | n/a | 0 |
Unreferenced changelogs (consolidation candidates by default): 0
2. Contradiction groups (mechanical)
CONTRADICTION: plan plan -> 10 distinct values: 0/1/0, 0/1/1, 11/0/11, 13/0/0, 4/32/36, 5/0-or-2/6, 5/0/0, 5/0/6, 5/2/6, 7/2/7
| value | where | line |
|---|---|---|
| 0/1/0 | docs/changelog-20260712-docfix189-max-context-session-audit.md:46 | (0 to add, 1 to change, 0 to destroy). Removing it changes no resource. |
| 0/1/0 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:76 | - tofu plan: 0 to add, 1 to change, 0 to destroy -- domain only; the 11 GiB direct-copy |
| 0/1/1 | docs/changelog-20260713-config-xml-path-deleted.md:45 | Plan: 0 to add, 1 to change, 1 to destroy. |
| 11/0/11 | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:94 | Plan: 11 to add, 0 to change, 11 to destroy. |
| 11/0/11 | docs/changelog-20260714-d119-tofu-apply.md:13 | Then a fresh tofu plan: 11 to add, 0 to change, 11 to destroy -- all must be replaced |
| 11/0/11 | docs/session-ledger.md:741 | THE tofu apply IS NOT DONE -- IT IS GATED. Plan: 11 to add, 0 to change, 11 to destroy (the |
| 13/0/0 | runbooks/dc-dc-phase0-vcloud-prep.md:439 | NetBox assigns the supernet). Expect Plan: 13 to add, 0 to change, 0 to destroy. |
| 4/32/36 | docs/D-058-renumber.md:62 | Apply the same rotate (8->12, 12->16, 16->20, 24->8, 64->60; 4/32/36 fixed). These are |
| 5/0-or-2/6 | docs/dc0-deploy-readiness.md:167 | 6. Re-run the outer plan; confirm 5-add/(0-or-2)-change/6-destroy-empty (autostart in-place collapses to 0 pos... |
| 5/0-or-2/6 | docs/dc0-deploy-readiness.md:48 | > A fresh session MUST re-run the plan and re-confirm 5-add/(0-or-2)-change/6-destroy-empty (autostart in-plac... |
| 5/0/0 | docs/changelog-20260713-d114-voffice1-nested-virt.md:57 | - tofu plan: 5 to add, 0 to change, 0 to destroy -- confirmed BEFORE applying that the running |
| 5/0/6 | docs/dc0-deploy-readiness.md:59 | keeps office1's key); tfvar set. Re-validated + re-planned -> outer plan UNCHANGED (5/0/6, create-only |
| 5/0/6 | docs/design-decisions.md:4064 | office1-opnsense and dirty the imminent DC0 outer plan (5/0/6). Set true only for NEW DC-edge |
| 5/0/6 | docs/session-ledger.md:278 | Gate before any apply: plan must read EXACTLY 5 add / 0 change / 6 destroy. Nothing applied this session. |
| 5/0/6 | docs/session-ledger.md:293 | re-plan UNCHANGED (5/0/6). netem RULED = placeholder for the rehearsal. Full remaining-prep checklist + |
| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:32 | 5 add / 2 in-place / 6 destroy; the 2 in-place collapse to 0 once the bookend sets those two autostart |
| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:45 | D-127 implementation updated (IaC layer DONE); readiness-doc plan line updated (5/2/6, collapses to 0); |
| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:52 | - tofu -chdir=opentofu plan -> 5 add / 2 in-place / 6 destroy; no forces-replacement on any existing. |
| 5/2/6 | docs/dc0-deploy-readiness.md:37 | tofu -chdir=opentofu plan => 5 add / 2 in-place / 6 destroy, decomposed and verified: |
| 5/2/6 | docs/design-decisions.md:3957 | is a new create with autostart=false baked in. Outer plan is now 5 add / 2 in-place / 6 destroy, which |
| 5/2/6 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:17 | 5 add / 2 in-place / 6 destroy. The delta is NOT in DC0 scope -- it is entirely |
| 5/2/6 | docs/session-ledger.md:156 | in-place, NOT replacement). Outer plan now 5 add / 2 in-place / 6 destroy (collapses to 0-change once the |
| 5/2/6 | docs/session-ledger.md:215 | 5 add / 2 in-place / 6 destroy in docs/dc0-deploy-readiness.md. The entire delta is voffice1, the |
| 7/2/7 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:14 | Plan: 7 to add, 2 to change, 7 to destroy. |
| 7/2/7 | docs/session-ledger.md:214 | root (read-only plan, OpenTofu v1.12.4) returns 7 add / 2 change / 7 destroy, NOT the committed |
CONTRADICTION: version juju -> 5 distinct values: 2.1, 2024.1, 3.1, 3.6, 3.6.25
| value | where | line |
|---|---|---|
| 2.1 | docs/design-decisions.md:1684 | (committed pre-change BOM), a fresh juju create-backup archive (now the STANDARD 2.1 step, |
| 2.1 | docs/v1-redeploy-changelog.md:424 | Vault's own status agrees with the Juju workload-status. Cleared for 2.1b (vault init). |
| 2024.1 | runbooks/dc-dc-phase5-dr-failover-drill.md:153 | juju deploy cinder-backup --channel 2024.1/stable --to lxd: |
| 3.1 | runbooks/phase-03-core-verify.md:10 | backends confirmed LOADED via a functional sweep, NOT juju status; Step 3.1). Troubleshooting: |
| 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki |
| 3.6 | docs/design-decisions.md:1611 | policy for either: (a) the Juju controller/agents (patch releases on the 3.6 track; |
| 3.6 | docs/design-decisions.md:1632 | The testcloud controller is SINGLE (non-HA) and Juju 3.6 ships no supported controller |
| 3.6 | docs/design-decisions.md:1677 | ## D-071 -- AMENDMENT (2026-07-05): controller backup EXISTS on juju 3.6; risk section corrected |
| 3.6 | docs/design-decisions.md:1680 | premise "no supported backup in Juju 3.6": juju create-backup / download-backup exist on |
| 3.6 | docs/design-decisions.md:2043 | - Single-unit (not HA) for VR1, with the confirmed backup posture (juju 3.6 create-backup / `download-backup... |
| 3.6 | docs/design-decisions.md:994 | remove-machine option. Juju 3.6 remove-machine reference: a machine can be removed from the |
| 3.6 | docs/handoff-20260705-open-items.md:59 | Backups are confirmed to exist (juju 3.6 create-backup); the open half is single-controller HA. |
| 3.6 | docs/session-ledger.md:989 | download-backup DO exist on juju 3.6 -- the original "removed in 3.0" premise was wrong). |
| 3.6 | docs/upstream-bug-draft-dashboard-tls.md:14 | Reactive charm generation; juju 3.6. |
| 3.6 | docs/v1-redeploy-changelog.md:1819 | explicit Risk section: single non-HA controller, no supported backup in Juju 3.6, no |
| 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped juju status keystone --format=line, and juju 3.6 line format omits workload |
| 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped juju status keystone --format=line, and juju 3.6 line format omits workload |
| 3.6 | docs/v1-redeploy-changelog.md:1953 | juju-status (units do NOT carry agent-status.version on juju 3.6); 2.1 |
| 3.6 | docs/v1-redeploy-changelog.md:1954 | REWRITTEN -- juju create-backup EXISTS on 3.6 and is now the STANDARD gated |
| 3.6 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:289 | Per D-104: scheduled controller backups, confirmed backup posture (juju 3.6 |
| 3.6 | runbooks/dc-dc-phase5-dr-failover-drill.md:448 | against this controller's actual installed juju client (3.6 per D-104) before running restore |
| 3.6 | runbooks/ops-update-procedure.md:158 | on juju 3.6 (the "removed in 3.0" authoring assumption was wrong for this |
| 3.6 | runbooks/ops-update-procedure.md:8 | controller backup EXISTS on juju 3.6). |
| 3.6.25 | docs/handoff-20260705-open-items.md:169 | > juju 3.6.25. Vault is 1.8/stable rev 714 (current in-channel). |
| 3.6.25 | docs/handoff-20260705-open-items.md:22 | in-channel revisions; controllers/agents at juju 3.6.25; appendix-B re-baselined. |
| 3.6.25 | docs/session-ledger.md:78 | - VR0 / DC0 testcloud: fleet fully current (juju 3.6.25, 91 agents); D-011 CLOSED except |
CONTRADICTION: version lxd -> 5 distinct values: 5.21, 5.21.4, 5.21.5, 6.6, 6.7
| value | where | line | |||
|---|---|---|---|---|---|
| 5.21 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | v1.12.3; LXD pinned to the 5.21 LTS track -- MAAS 3.6/3.7 cannot talk |
|||
| 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \ | LXD \ | 5.21 LTS track \ |
MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \ |
| 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:254 | makes it a decision. LXD 5.21 LTS is supported to June 2029 | |||
| 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 proven end to end | |||
| 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:62 | 3. LXD snap track changes are ONE-WAY. LXD must be installed DIRECTLY onto 5.21/stable and |
|||
| 5.21 | docs/dc-dc-deployment-workflow.md:65 | > LXD (pinned to the 5.21 LTS track) runs ON it, that LXD is registered BACK INTO MAAS as an | |||
| 5.21 | docs/dc-dc-deployment-workflow.md:84 | \ | Gate \ | Office1 OPNsense edge up (MET -- routing, NAT, egress, Kea DHCP; gap #17 closed for Office1... | |
| 5.21 | docs/dc-dc-deployment-workflow.md:85 | \ | Owns \ | D-114 (site containment VM + MAAS-composed LXD VMs, incl. the LXD 5.21 pin), D-103 as AMEND... | |
| 5.21 | docs/dc-dc-deployment-workflow.md:85 | \ | Owns \ | D-114 (site containment VM + MAAS-composed LXD VMs, incl. the LXD 5.21 pin), D-103 as AMEND... | |
| 5.21 | docs/dc-dc-deployment-workflow.md:874 | \ | D-114 site containment VM (voffice1) \ |
BUILT + RUNNING 2026-07-13. module "voffice1" (`modules... |
|
| 5.21 | docs/design-decisions.md:2591 | 4. LXD is version-pinned to the 5.21 LTS track. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: | |||
| 5.21 | docs/stage3-review-base.patch:2859 | + # createadmin/apikey/login, LXD (5.21 pin), LXD vm-host registration, compose-network DHCP. | |||
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:116 | REGION CONTROLLER runs ON it. LXD (5.21 LTS) also runs ON it, and that LXD is | |||
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:186 | D-114's hard LXD 5.21-LTS-track constraint, which IS decided). Each install | |||
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:46 | including the LXD 5.21 LTS pin), D-103 as AMENDED by D-114 (OpenTofu owns | |||
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:488 | ssh 'sudo snap install lxd --channel=5.21/stable' | |||
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the 5.21 LTS track (D-114). MAAS 3.6/3.7 is | |||
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:887 | - [ ] runbooks/appendix-B-asbuilt-version-lock.md updated with the LXD 5.21-LTS |
|||
| 5.21.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:253 | VR0 runs LXD 5.21.4 and is therefore safe by accident of timing; D-114 | |||
| 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \ | Reuse vs new \ | NEW infra (Office1 didn't exist for VR0 DC0), but LESS new than it looks: the MAAS-comp... | |
| 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \ | Reuse vs new \ | NEW infra (Office1 didn't exist for VR0 DC0), but LESS new than it looks: the MAAS-comp... | |
| 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project default, LXD 5.21.4; |
|||
| 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project default, LXD 5.21.4; |
|||
| 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project default, LXD 5.21.4. |
|||
| 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project default, LXD 5.21.4. |
|||
| 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \ | - voffice1 (L2) MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea reservation) | ||
| 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:6 | LXD 5.21.5 are installed on it, that LXD is registered back into MAAS as an LXD VM host, and | |||
| 5.21.5 | docs/dc-dc-deployment-workflow.md:114 | - DONE (site) -- D-114 IS PROVEN END TO END: MAAS 3.7.2 region+rack ON voffice1; LXD 5.21.5 |
|||
| 5.21.5 | docs/session-ledger.md:603 | and LXD 5.21.5, with that LXD registered into MAAS as an LXD VM host. MAAS then | |||
| 5.21.5 | docs/vr1-office1-as-built.md:43 | \ | voffice1 \ | 10.10.0.20 (Kea reservation) \ |
MAAS 3.7.2 region+rack + PostgreSQL 16.14; **LXD 5.21... |
| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:249 | not yet in a MAAS release). Verbatim guidance: "We recommend using LXD <=6.6 | |||
| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \ | MAAS cannot talk to an LXD VM host after an LXD update \ | LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... | |
| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \ | MAAS cannot talk to an LXD VM host after an LXD update \ | LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... | |
| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \ | MAAS cannot talk to an LXD VM host after an LXD update \ | LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... | |
| 6.6 | docs/design-decisions.md:2593 | pylxd >= 2.3.9, not yet in a MAAS release). Canonical's own guidance is "use LXD <= 6.6 or the | |||
| 6.7 | .claude/skills/openstack-cloud-ops/SKILL.md:100 | \ | Creating/changing a libvirt_domain; anything about nested KVM, a libvirt storage pool, LXD versions, an O... |
||
| 6.7 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud | |||
| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \ | LXD \ | 5.21 LTS track \ |
MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \ |
| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) | |||
| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:247 | Canonical's own announcement: LXD 6.7 "consolidates some API endpoints" that | |||
| 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on latest first, because MAAS 3.6/3.7 is incompatible with LXD >= 6.7 |
|||
| 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:64 | (pinned pylxd 2.3.5 vs LXD 6.7's consolidated endpoints). Bonus discovered in research: | |||
| 6.7 | docs/design-decisions.md:2591 | 4. LXD is version-pinned to the 5.21 LTS track. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: | |||
| 6.7 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to them (fixed in | |||
| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:491 | cannot talk to LXD >= 6.7 (pylxd 2.3.5 vs LXD's consolidated API endpoints). | |||
| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's | |||
| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's |
CONTRADICTION: version maas -> 6 distinct values: 10.12.8, 2.3.5, 2.7.2, 3.6, 3.7, 3.7.2
| value | where | line | |||
|---|---|---|---|---|---|
| 10.12.8 | docs/D-058-renumber.md:67 | - scripts/phase-00-maas-carve.sh (METAL_CIDR default 10.12.8 -> 10.12.12; ranges) | |||
| 2.3.5 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:248 | MAAS's pinned pylxd 2.3.5 cannot speak to (fixed in pylxd >= 2.3.9, | |||
| 2.3.5 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to them (fixed in | |||
| 2.7.2 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:82 | ### canonical/maas (pinned 2.7.2, confirmed 2026-07-09) |
|||
| 2.7.2 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:54 | hashes: dmacvicar/libvirt 0.9.8, canonical/maas 2.7.2). |
|||
| 2.7.2 | runbooks/dc-dc-phase0-vcloud-prep.md:339 | fetch dmacvicar/libvirt 0.9.8 and canonical/maas 2.7.2) |
|||
| 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | v1.12.3; LXD pinned to the 5.21 LTS track -- MAAS 3.6/3.7 cannot talk |
|||
| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \ | LXD \ | 5.21 LTS track \ |
MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \ |
| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \ | MAAS \ | 3.7.2 (VR0) \ | the LXD ceiling above is a property of MAAS 3.6/3.7 \ |
| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) | |||
| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \ | MAAS cannot talk to an LXD VM host after an LXD update \ | LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... | |
| 3.6 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on latest first, because MAAS 3.6/3.7 is incompatible with LXD >= 6.7 |
|||
| 3.6 | docs/design-decisions.md:2591 | 4. LXD is version-pinned to the 5.21 LTS track. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: | |||
| 3.6 | runbooks/dc-dc-phase1-office1-standup.md:442 | ssh 'sudo snap install maas --channel=<PENDING VERIFICATION: the current MAAS LTS/stable channel pe... | |||
| 3.6 | runbooks/dc-dc-phase1-office1-standup.md:490 | The 5.21 track is a HARD D-114 constraint, not a preference: MAAS 3.6/3.7 |
|||
| 3.6 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the 5.21 LTS track (D-114). MAAS 3.6/3.7 is | |||
| 3.7 | docs/changelog-20260716-d124-rack-addressing.md:39 | (D-123): disable timesyncd -> install the maas snap (3.7/stable) -> `maas init rack --maas-url |
|||
| 3.7 | docs/stage3-review-base.patch:261 | +(D-123): disable timesyncd -> install the maas snap (3.7/stable) -> `maas init rack --maas-url |
|||
| 3.7 | docs/stage3-review-base.patch:2786 | MAAS_CHANNEL="3.7/stable" | |||
| 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): | |||
| 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): | |||
| 3.7.2 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki | |||
| 3.7.2 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \ | MAAS \ | 3.7.2 (VR0) \ | the LXD ceiling above is a property of MAAS 3.6/3.7 \ |
| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 proven end to end | |||
| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \ | - voffice1 (L2) MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea reservation) | ||
| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:5 | voffice1 is a working VR1 site headend. MAAS 3.7.2 (region+rack, PostgreSQL 16.14) and |
|||
| 3.7.2 | docs/dc-dc-deployment-workflow.md:114 | - DONE (site) -- D-114 IS PROVEN END TO END: MAAS 3.7.2 region+rack ON voffice1; LXD 5.21.5 |
|||
| 3.7.2 | docs/design-decisions.md:2553 | **Measured as-built evidence (VR0 / openstack-caracal-ipv4 MAAS 3.7.2, operator screenshots |
|||
| 3.7.2 | docs/maas-as-built-reference.md:169 | - MAAS 3.7.2; controller maas.maas, Region+Rack, Non-HA(3 VLANs). |
|||
| 3.7.2 | docs/session-ledger.md:602 | the pool), egress through the OPNsense edge. On it: MAAS 3.7.2 region+rack (PostgreSQL 16.14) | |||
| 3.7.2 | docs/vr1-office1-as-built.md:43 | \ | voffice1 \ | 10.10.0.20 (Kea reservation) \ |
MAAS 3.7.2 region+rack + PostgreSQL 16.14; **LXD 5.21... |
CONTRADICTION: version netbox -> 5 distinct values: 10.1, 172.31, 4.5.8, 4.6, 4.6.4
| value | where | line | |||
|---|---|---|---|---|---|
| 10.1 | docs/changelog-20260716-d124-addressing-pin.md:21 | - netbox/dc-rack-mgmt-import.py: CONTAINER = "10.12.0.0/16" -> "172.31.0.0/24" (+ header |
|||
| 172.31 | docs/changelog-20260716-d124-addressing-pin.md:44 | python3 netbox/dc-rack-mgmt-import.py --transit-cidr 172.31.0.0/30 --rack-ip 10.12.8.2 # dry-run; add --comm... | |||
| 4.5.8 | docs/changelog-20260710-netbox-roles-aggregates.md:42 | Script previewed (read-only) against live NetBox 4.5.8: correctly reports 12 objects to create | |||
| 4.5.8 | docs/dc-dc-netbox-buildout-scope.md:45 | netbox.baldurkeep.com v4.5.8. Regions: US West -> Eugene (prod); Virtual Regions -> VR0, VR1. |
|||
| 4.5.8 | docs/design-decisions.md:2893 | The collision, measured live against netbox.baldurkeep.com (4.5.8) on 2026-07-13: |
|||
| 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:25 | ### 2. NetBox 4.6 v2 API tokens: the wire format is nbt_<key>.<plaintext> -- NOT the token field |
|||
| 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:29 | NetBox 4.6 hashes API tokens. The Token model has key (a 12-char PREFIX), plaintext (40), |
|||
| 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the netbox-docker stack (NetBox 4.6, /opt/netbox-docker) had cleanly exited (0) ~3h earlier and was |
|||
| 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the netbox-docker stack (NetBox 4.6, /opt/netbox-docker) had cleanly exited (0) ~3h earlier and was |
|||
| 4.6 | docs/stage3-review-base.patch:1120 | + die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v2 token " | |||
| 4.6 | docs/stage3-review-base.patch:897 | + die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v2 token " | |||
| 4.6 | docs/vr1-office1-as-built.md:141 | NetBox API token format (4.6): the wire form is nbt_<key>.<plaintext>. The API's token field |
|||
| 4.6 | docs/vr1-office1-as-built.md:44 | \ | office1-netbox \ | 10.10.1.10 \ |
NetBox 4.6 (netbox-docker; /opt/netbox-docker, `docker compose ... |
| 4.6 | runbooks/dc-dc-phase1-office1-standup.md:725 | --draft draft/vr1-draft.json`. It STRUCTURALLY cannot reach upstream. NetBox 4.6 | |||
| 4.6.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:453 | Note: this is an UPSTREAM-only trap so far. The Office1 sandbox NetBox (4.6.4, no proxy in | |||
| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Office1 headend | |||
| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Office1 headend | |||
| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:6 | laid down by MAAS) and runs NetBox 4.6.4 (netbox-docker, Django 6.0.6). Its API authenticates. | |||
| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:74 | - NetBox 4.6.4 on Django 6.0.6, containers netbox + netbox-worker + postgres + redis + |
|||
| 4.6.4 | docs/dc-dc-deployment-workflow.md:116 | machines COMPOSED BY MAAS and deployed -- office1-netbox (10.10.1.10, NetBox 4.6.4) and |
|||
| 4.6.4 | docs/dc-dc-netbox-buildout-scope.md:198 | (10.10.1.10:8000, NetBox 4.6.4 on the Office1 VM, docs/changelog-20260713-office1-netbox-deployed.md): |
CONTRADICTION: version opnsense -> 3 distinct values: 14.3, 26.1, 26.7
| value | where | line | |||
|---|---|---|---|---|---|
| 14.3 | docs/session-ledger.md:189 | security pkgs) THEN reboot; (b) office1-opnsense itself is still on 14.3-RELEASE-p16 (guest OS not patched, | |||
| 26.1 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud | |||
| 26.1 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:130 | https://docs.opnsense.org/releases/CE_26.1.html | |||
| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:22 | \ | OPNsense \ | 26.1 "Witty Woodpecker" \ | ISC-DHCP left core in 26.1 -- Kea/dnsmasq only (see below) \ |
| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:322 | ## 4. OPNsense 26.1 edge | |||
| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:351 | https://docs.opnsense.org/releases/CE_26.1.html | |||
| 26.1 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:108 | sizing question, not a regression of this fix -- check OPNsense 26.1's documented | |||
| 26.1 | docs/changelog-20260712-office1-opnsense-edge-build.md:33 | (opnsense-26.1-nano.qcow2), so there is no target-path collision. Same conclusion, |
|||
| 26.1 | docs/changelog-20260712-opnsense-prep-bz2-fallback.md:15 | opnsense-26.1-nano.qcow2 (qcow2, 11 GiB virtual) via the python path. |
|||
| 26.1 | docs/changelog-20260713-opnsense-api-proven.md:24 | GET core/firmware/status -> HTTP 200, OPNsense 26.1 (auth works) | |||
| 26.1 | docs/changelog-20260713-opnsense-api-proven.md:8 | An API key was minted for root in the GUI. In OPNsense 26.1 this is NOT in the user-edit |
|||
| 26.1 | docs/changelog-20260714-opnsense-set-interface-v6.md:10 | among the API-covered surfaces. **Measured on the live Office1 edge (OPNsense 26.1): that is | |||
| 26.1 | docs/design-decisions.md:2498 | MEASURED on the live Office1 edge (2026-07-14), OPNsense 26.1: | |||
| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense 26.1 nano amd64 (scripts/opnsense-prep-image.sh 26.1), prepped to |
|||
| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense 26.1 nano amd64 (scripts/opnsense-prep-image.sh 26.1), prepped to |
|||
| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:60 | /var/lib/libvirt/vr1/office1/opnsense-26.1-nano.qcow2 (11 GiB virtual). |
|||
| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:92 | the real fix, check OPNsense 26.1's documented minimum before picking a number. | |||
| 26.1 | docs/session-ledger.md:649 | CANNOT be done via the REST API. Measured on the live edge (OPNsense 26.1): Interfaces > [LAN] is |
|||
| 26.1 | docs/stage3-review-base.patch:1373 | + base_volume_path = "/var/lib/libvirt/vr1/vr1-dc0/opnsense-26.1-nano.qcow2" | |||
| 26.7 | docs/design-decisions.md:4074 | Problem. office1-opnsense was updated to OPNsense 26.7 and is a near-stock install (only |
|||
| 26.7 | docs/design-decisions.md:4074 | Problem. office1-opnsense was updated to OPNsense 26.7 and is a near-stock install (only |
|||
| 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | Subject. office1-opnsense, OPNsense 26.7 (amd64), reviewed for plugin/add-on |
|||
| 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | Subject. office1-opnsense, OPNsense 26.7 (amd64), reviewed for plugin/add-on |
|||
| 26.7 | docs/session-ledger.md:830 | OPNsense EDGE 26.7 UPDATE + PLUGIN/ADD-ON REVIEW (2026-07-18). Operator updated office1-opnsense |
|||
| 26.7 | docs/vr1-office1-as-built.md:42 | \ | office1-opnsense \ | LAN 10.10.0.1 / WAN 172.30.1.2 \ |
OPNsense 26.7 (FreeBSD base 15.1-RELE... |
CONTRADICTION: version tofu -> 5 distinct values: 0.9.8, 1.1, 1.12.3, 1.12.4, 1.6.0
| value | where | line | |||
|---|---|---|---|---|---|
| 0.9.8 | .claude/skills/openstack-cloud-ops/references/environment.md:33 | libvirt/KVM via the dmacvicar/libvirt OpenTofu provider 0.9.8 on OpenTofu |
|||
| 1.1 | docs/dc-dc-deployment-workflow.md:360 | - A tofu binary EXISTS on the jumphost: OpenTofu v1.12.3. The tree can |
|||
| 1.12.3 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:19 | \ | OpenTofu \ | v1.12.3 (as-run) \ |
the binary that actually executed Stage 1 \ |
| 1.12.3 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:4 | binary (OpenTofu v1.12.3), on the vcloud host, executing | |||
| 1.12.3 | docs/changelog-20260713-docfix194-opentofu-module-validation.md:19 | This was only findable because a tofu binary now exists on the jumphost (OpenTofu v1.12.3) -- |
|||
| 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \ | gap #2: "UNVALIDATED -- no tofu binary available" \ |
OpenTofu v1.12.3 IS installed. The tree validate... | |
| 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \ | gap #2: "UNVALIDATED -- no tofu binary available" \ |
OpenTofu v1.12.3 IS installed. The tree validate... | |
| 1.12.3 | docs/dc-dc-deployment-workflow.md:360 | - A tofu binary EXISTS on the jumphost: OpenTofu v1.12.3. The tree can |
|||
| 1.12.3 | docs/dc-dc-deployment-workflow.md:47 | infrastructure; vcloud host, OpenTofu v1.12.3). As-built: nested KVM already-on; | |||
| 1.12.3 | docs/dc-dc-deployment-workflow.md:875 | \ | opentofu/ (networks/pools/node-VM PXE/cloud-init-VM patterns) \ |
VALIDATED 2026-07-13 (OpenTofu v1.12... | |
| 1.12.3 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:27 | > The OpenTofu 1.12.3 -> 1.12.4 bump is COINCIDENTAL, not causal. The binary is now | |||
| 1.12.3 | docs/session-ledger.md:277 | 5/0/6-vs-5/2/6, DOCFIX-196 stale Stage-3 NetBox blocker, README tofu 1.12.3->1.12.4, phase-2 runbook). | |||
| 1.12.3 | docs/session-ledger.md:77 | tofu v1.12.3; tree validates (10/10 modules); lock committed. | |||
| 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \ | L1-06 \ | tofu validate: Success (OpenTofu v1.12.3, 11/11 modules). \ |
|
| 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \ | L1-06 \ | tofu validate: Success (OpenTofu v1.12.3, 11/11 modules). \ |
|
| 1.12.3 | runbooks/dc-dc-phase0-vcloud-prep.md:3 | > FIRST EXECUTED 2026-07-10 (vcloud host, OpenTofu v1.12.3) -- run | |||
| 1.12.4 | docs/session-ledger.md:214 | root (read-only plan, OpenTofu v1.12.4) returns 7 add / 2 change / 7 destroy, NOT the committed | |||
| 1.12.4 | docs/session-ledger.md:260 | Version drift to log: OpenTofu on the jumphost is now v1.12.4; README.md:41 and the readiness |
|||
| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - install-opentofu.sh -- OpenTofu tofu >= 1.6.0 via the official deb |
|||
| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - install-opentofu.sh -- OpenTofu tofu >= 1.6.0 via the official deb |
|||
| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - install-opentofu.sh -- OpenTofu tofu >= 1.6.0 via the official deb |
|||
| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:42 | bash scripts/prereqs/install-opentofu.sh pointer + the >=1.6.0 floor. |
|||
| 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \ | OpenTofu tofu >= 1.6.0 (installs as /usr/bin/tofu, not the opentofu snap) \ |
Steps 8-10 \ | `scripts/p... |
| 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \ | OpenTofu tofu >= 1.6.0 (installs as /usr/bin/tofu, not the opentofu snap) \ |
Steps 8-10 \ | `scripts/p... |
CONTRADICTION: status stage-1 -> 2 distinct values: CLOSED, COMPLETE
| value | where | line | |||
|---|---|---|---|---|---|
| CLOSED | docs/dc-dc-deployment-workflow.md:570 | 9. Runbook debt -- CLOSED 2026-07-09. All seven Stage 1-7 runbooks are now | |||
| CLOSED | docs/security-ledger.md:20 | \ | SEC-009 \ | 2026-07-15 \ | Credential/env SPRAWL + world-readable exposure on vcloud: three env files sat loo... |
| CLOSED | docs/stage3-review-base.patch:658 | \ | SEC-009 \ | 2026-07-15 \ | Credential/env SPRAWL + world-readable exposure on vcloud: three env files sat loo... |
| COMPLETE | docs/changelog-20260709-office1-network-edge.md:42 | Stage 1/2 runbooks) implicitly assume that command is a COMPLETE inventory | |||
| COMPLETE | docs/session-ledger.md:91 | VR1 Stage 1 COMPLETE; Stage 2 was in CLOSE-OUT -- now superseded by the merge above. |
CONTRADICTION: status stage-2 -> 2 distinct values: CLOSED, COMPLETE
| value | where | line | ||
|---|---|---|---|---|
| CLOSED | docs/dc-dc-deployment-workflow.md:141 | \ | C2 \ | office1-netbox (10.10.1.10) is the VR1 IPAM apex -- a working draft (DOCFIX-195) -- and holds the C... |
| CLOSED | docs/dc-dc-deployment-workflow.md:384 | which is what forced Stage 2's old Option A / Option B fork -- is **CLOSED | ||
| COMPLETE | docs/changelog-20260715-d120-load-and-iprange-tooling.md:45 | - Stage 2 close-out (C1..C5) is COMPLETE -> the branch->main merge point is reached | ||
| COMPLETE | docs/dc-dc-deployment-workflow.md:141 | \ | C2 \ | office1-netbox (10.10.1.10) is the VR1 IPAM apex -- a working draft (DOCFIX-195) -- and holds the C... |
CONTRADICTION: status stage-3 -> 2 distinct values: BLOCKED, HELD
| value | where | line |
|---|---|---|
| BLOCKED | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:3 | Closes the collision that BLOCKED Stage 3. D-119 COMPLETES D-117; it does not reverse it. |
| HELD | docs/session-ledger.md:205 | docs/dc-dc-deployment-workflow.md's Stage 3 section still reads "Blocking to EXECUTE: the HELD NetBox |
CONTRADICTION: status stage-4 -> 2 distinct values: CLOSED, HELD
| value | where | line | ||
|---|---|---|---|---|
| CLOSED | docs/dc-dc-deployment-workflow.md:884 | \ | lib-net.sh / lib-hosts.sh \ |
$DC selector mechanism ADDED 2026-07-09 (DOCFIX-151, gap #1 CLOSED) -- `... |
| HELD | docs/session-ledger.md:51 | Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned.) |
CONTRADICTION: status stage-5 -> 2 distinct values: BLOCKED, CLOSED
| value | where | line |
|---|---|---|
| BLOCKED | docs/changelog-20260709-dc-selector-convention.md:5 | which explicitly BLOCKED the Stage 5 "high reuse" claim (phase-01..08 |
| CLOSED | docs/changelog-20260709-dc-selector-convention.md:72 | Tooling gap register item #1 CLOSED. Stage 5's runbook (Juju controller + |
3. Status-claim rows (full table)
| kind | key | value | where | line | ||||
|---|---|---|---|---|---|---|---|---|
| plan | plan | 4/32/36 | docs/D-058-renumber.md:62 | Apply the same rotate (8->12, 12->16, 16->20, 24->8, 64->60; 4/32/36 fixed). The... | ||||
| plan (not counted) | plan | 5/0/6 | docs/audit/grounding-audit-charter.md:193 | 5 add / 0 change / 6 destroy AND the fresh-agent test question 7 passes. Prose | ||||
| plan (not counted) | plan | 5/0/6 | docs/audit/grounding-audit-charter.md:228 | 4. The captured outer plan reads exactly 5 add / 0 change / 6 destroy (the stand... | ||||
| plan | plan | 0/1/0 | docs/changelog-20260712-docfix189-max-context-session-audit.md:46 | (0 to add, 1 to change, 0 to destroy). Removing it changes no resource. |
||||
| plan | plan | 0/1/0 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:76 | - tofu plan: 0 to add, 1 to change, 0 to destroy -- domain only; the 11 GiB ... |
||||
| plan | plan | 0/1/1 | docs/changelog-20260713-config-xml-path-deleted.md:45 | Plan: 0 to add, 1 to change, 1 to destroy. | ||||
| plan | plan | 5/0/0 | docs/changelog-20260713-d114-voffice1-nested-virt.md:57 | - tofu plan: 5 to add, 0 to change, 0 to destroy -- confirmed BEFORE apply... |
||||
| plan | plan | 11/0/11 | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:94 | Plan: 11 to add, 0 to change, 11 to destroy. | ||||
| plan | plan | 11/0/11 | docs/changelog-20260714-d119-tofu-apply.md:13 | Then a fresh tofu plan: 11 to add, 0 to change, 11 to destroy -- all `must... |
||||
| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:32 | 5 add / 2 in-place / 6 destroy; the 2 in-place collapse to 0 once the bookend ... |
||||
| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:45 | D-127 implementation updated (IaC layer DONE); readiness-doc plan line updated (... | ||||
| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:52 | - tofu -chdir=opentofu plan -> 5 add / 2 in-place / 6 destroy; no forces-rep... |
||||
| plan | plan | 5/0-or-2/6 | docs/dc0-deploy-readiness.md:167 | 6. Re-run the outer plan; confirm 5-add/(0-or-2)-change/6-destroy-empty (autosta... | ||||
| plan | plan | 5/2/6 | docs/dc0-deploy-readiness.md:37 | tofu -chdir=opentofu plan => 5 add / 2 in-place / 6 destroy, decomposed an... |
||||
| plan | plan | 5/0-or-2/6 | docs/dc0-deploy-readiness.md:48 | > A fresh session MUST re-run the plan and re-confirm 5-add/(0-or-2)-change/6-de... | ||||
| plan | plan | 5/0/6 | docs/dc0-deploy-readiness.md:59 | keeps office1's key); tfvar set. Re-validated + re-planned -> outer plan UNCHANG... | ||||
| plan | plan | 5/2/6 | docs/design-decisions.md:3957 | is a new create with autostart=false baked in. Outer plan is now `5 add / 2 in-p... | ||||
| plan | plan | 5/0/6 | docs/design-decisions.md:4064 | office1-opnsense and dirty the imminent DC0 outer plan (5/0/6). Set true only ... |
||||
| plan | plan | 7/2/7 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:14 | Plan: 7 to add, 2 to change, 7 to destroy. | ||||
| plan | plan | 5/2/6 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:17 | 5 add / 2 in-place / 6 destroy. The delta is NOT in DC0 scope -- it is entir... | ||||
| plan | plan | 5/2/6 | docs/session-ledger.md:156 | in-place, NOT replacement). Outer plan now 5 add / 2 in-place / 6 destroy (colla... | ||||
| plan | plan | 7/2/7 | docs/session-ledger.md:214 | root (read-only plan, OpenTofu v1.12.4) returns **7 add / 2 change / 7 destr... | ||||
| plan | plan | 5/2/6 | docs/session-ledger.md:215 | 5 add / 2 in-place / 6 destroy in docs/dc0-deploy-readiness.md. The entire... |
||||
| plan | plan | 5/0/6 | docs/session-ledger.md:278 | Gate before any apply: plan must read EXACTLY 5 add / 0 change / 6 destroy. Noth... | ||||
| plan | plan | 5/0/6 | docs/session-ledger.md:293 | re-plan UNCHANGED (5/0/6). netem RULED = placeholder for the rehearsal. Full rem... | ||||
| plan | plan | 11/0/11 | docs/session-ledger.md:741 | THE tofu apply IS NOT DONE -- IT IS GATED. Plan: 11 to add, 0 to change, 1... |
||||
| plan | plan | 13/0/0 | runbooks/dc-dc-phase0-vcloud-prep.md:439 | NetBox assigns the supernet). Expect `Plan: 13 to add, 0 to change, 0 to destroy... | ||||
| status | - | CLOSED | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:109 | The narrative ledger must not claim CLOSED what the scan shows OPEN, nor omit wh... | ||||
| status | - | CLOSED | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:127 | report PASS_PENDING_MANUAL while the row is OPEN, PASS only when it is attested ... | ||||
| status (not counted) | - | CLOSED | docs/audit/grounding-audit-charter.md:190 | - GA-R6: Executable definition of done. A stage is CLOSED only when a named | ||||
| status (not counted) | - | READY | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | ||||
| status (not counted) | - | BLOCKED | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | ||||
| status (not counted) | - | CLOSED | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | ||||
| status (not counted) | - | COMPLETE | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | ||||
| status (not counted) | - | HELD | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | ||||
| status | - | HELD | docs/changelog-20260703-process-hardening.md:127 | 403, conductor LIVE args). Missing admin scope = HELD exit 2, never a silent | ||||
| status | - | CLOSED | docs/changelog-20260709-ceph-replication-tooling.md:135 | Tooling gap register item #5's MECHANISM is CLOSED; its DATA half (a real | ||||
| status | - | CLOSED | docs/changelog-20260709-ceph-replication-tooling.md:143 | workflow.md` tooling gap register item #5 updated to CLOSED (mechanism), | ||||
| status | - | CLOSED | docs/changelog-20260709-dc-dc-phase6-runbook.md:66 | item #9 now CLOSED for authoring). Remaining work is the adversarial | ||||
| status | - | CLOSED | docs/changelog-20260709-mtu-ceph-budget-calculators.md:124 | Tooling gap register item #7 CLOSED (mechanism). Both calculators are | ||||
| status | - | CLOSED | docs/changelog-20260709-netbox-dc-dc-pipeline.md:104 | Tooling gap register #3 CLOSED (mechanism). Before a real run: the operator | ||||
| status | - | CLOSED | docs/changelog-20260709-office1-network-edge.md:126 | Tooling gap register items #12 and #16 CLOSED. Gap #17 (NEW) is now the | ||||
| status | - | HELD | docs/changelog-20260710-netbox-roles-aggregates.md:34 | 2602:f3e2::/36 (the HELD allocation = region-0 of the planned /32; NOT /32... |
||||
| status | - | CLOSED | docs/changelog-20260710-opentofu-state-file-security.md:81 | (this gap, CLOSED) and #19 (a related, still-OPEN gap found in the same | ||||
| status | - | CLOSED | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:68 | CLOSED). | ||||
| status | - | COMPLETE | docs/changelog-20260712-office1-opnsense-edge-build.md:50 | - Edge build COMPLETE except the boot: image, office1-wan, creds, config, ISO,... |
||||
| status | - | COMPLETE | docs/changelog-20260713-config-xml-path-deleted.md:1 | # 2026-07-13 -- D-113(a2) COMPLETE: the config.xml path is DELETED | ||||
| status | - | CLOSED | docs/changelog-20260713-workflow-doc-status-correction.md:14 | \ | gap #17: "no per-site ISP-uplink network exists anywhere, for ANY site" \ | **... | ||
| status | - | CLOSED | docs/changelog-20260715-d120-load-and-iprange-tooling.md:41 | - C2 sub-task (ii) CLOSED; C2 fully closed. office1-netbox now holds the com... | ||||
| status | - | CLOSED | docs/changelog-20260715-d120-load-and-iprange-tooling.md:43 | - D-120 Step 6 CLOSED -- the band layout is now recorded in NetBox, no apex ... | ||||
| status | - | COMPLETE | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:35 | C2 redefined: office1-netbox holds the COMPLETE validated dataset (carve + roles... | ||||
| status | - | CLOSED | docs/changelog-20260715-fidelity-check-scope-correctness.md:61 | - C2 sub-task (i) is CLOSED -- the sandbox is faithful, established by a che... | ||||
| status | - | HELD | docs/changelog-20260715-stage3-prereqs-prep.md:35 | netem HELD as a comment (Step 11, runtime SSH target + unruled params; the vr1-d... | ||||
| status | - | HELD | docs/changelog-20260715-stage3-prereqs-prep.md:36 | bridge is virbr7, measured). HELD pending D-123: the vvr1-dc0 headend + ... |
||||
| status | - | CLOSED | docs/changelog-20260716-review-sweep-phaseAB.md:33 | - SEC-011: CLOSED (operator ruling -- keep uniform 6-NIC; A2's Roosevelt-del... | ||||
| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:25 | WAN (bridge-in is single-NAT; RULED, not HELD). [CORRECTED 2026-07-16: an earlie... | ||||
| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:25 | WAN (bridge-in is single-NAT; RULED, not HELD). [CORRECTED 2026-07-16: an earlie... | ||||
| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:47 | (commit 5175365 + OBS-3 RESOLVED-by-D-125 + new HELD gates); `references/platf... |
||||
| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:63 | (No new HELD addressing: the /24 is the ruled 172.30.2.0/24 and the OPNsense... |
||||
| status | - | COMPLETE | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:29 | ## Block B (D-124 rack transit + rack IP) -- COMPLETE (operator chose: write the... | ||||
| status | - | COMPLETE | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:44 | So the full NetBox D-124/edge-WAN import is COMPLETE in the apex. Copied importe... | ||||
| status | - | CLOSED | docs/clientdocs-workflow-review-20260708.md:77 | no steer away from flannel. CLOSED 2026-07-08 in kubernetes.md + the Jenkins | ||||
| status | - | CLOSED | docs/clientdocs-workflow-review-20260708.md:83 | host" -- the exact failure devteam hit. CLOSED in the Jenkins guide; NOT yet | ||||
| status | - | COMPLETE | docs/dc-dc-deployment-workflow.md:132 | the COMPLETE validated dataset, NOT by any upstream write. See C2 for what "comp... | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:142 | \ | C3 \ | The $DC shell-selector collision resolved. \ |
**DONE 2026-07-14 (D-11... | |
| status | - | COMPLETE | docs/dc-dc-deployment-workflow.md:160 | WRITTEN + RESHAPED to Model B, NOT YET EXECUTED. Authoring for this stage is eff... | ||||
| status | - | HELD | docs/dc-dc-deployment-workflow.md:161 | remains is operator-gated (HELD NetBox addressing) + deploy-time gates. | ||||
| status | - | HELD | docs/dc-dc-deployment-workflow.md:187 | Blocking to EXECUTE (all operator-gated): the HELD NetBox addressing -- **D-... | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:344 | 1. $DC selector convention -- CLOSED 2026-07-09 (DOCFIX-151). |
||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:438 | 3. **NetBox multi-DC/dual-stack import pipeline -- MECHANISM CLOSED | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:500 | CLOSED 2026-07-09 (DOCFIX-165), data half still open.** `runbooks/dc- | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:526 | 6. **Designate reactivation is a bundle change -- CLOSED 2026-07-10 | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:538 | 7. **MTU/geneve budget + Ceph disk-budget calculators -- CLOSED 2026-07-09 | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:580 | 10. Harness debt -- LARGELY CLOSED 2026-07-09/10. This repo's own delivery | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:597 | CLOSED 2026-07-09.** main.tf previously wired only office1_pool_path |
||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:643 | 14. **Three real bundle.yaml gaps for D-108's DR mechanism -- CLOSED |
||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:662 | section). **Sub-item 2 (script $DC-parameterization) CLOSED |
||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:682 | CLOSED 2026-07-09.** The topology (buildout design Section 1) is | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:702 | now also CLOSED) -- that gap was the service VMs' own attach point; | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:714 | 17. **PARTIALLY CLOSED 2026-07-13 -- the DECISION is made and PROVEN for | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:716 | - Office1: CLOSED. The answer was the one this gap proposed -- a | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:761 | 18. **OpenTofu state file had no documented protection -- CLOSED 2026-07-10 | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:783 | infrastructure itself -- CLOSED 2026-07-10 (DOCFIX-176).** | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:835 | tool -- CLOSED for Office1; DC path templated.** | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:84 | \ | Gate \ | Office1 OPNsense edge up (MET -- routing, NAT, egress, Kea DH... | ||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:845 | CLOSED for Office1 (D-126 amendment): scripts/site-baseleg.sh + |
||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:862 | *Status: Office1 CLOSED; DC rows DEFERRED-until-measured (mechanism in place).... | ||||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:87 | \ | Authoring status \ | **Runbook REWRITTEN 2026-07-13 to the D-114 model: `r... | ||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:881 | \ | Office1-local network (modules/office1-network) \ |
BUILT + INSTANTIATED 202... | ||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:882 | \ | Office1 OPNsense edge ownership \ | BUILT AND LIVE 2026-07-12/13. `module ... | ||
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:885 | \ | NetBox DC-DC pipeline (netbox/dc-dc-prefixes-import.py) \ |
MECHANISM BUILT ... | ||
| status | - | COMPLETE | docs/dc-dc-netbox-buildout-scope.md:288 | IPAM apex) holds the COMPLETE validated dataset AND it is VERIFIED. Two sub-task... | ||||
| status | - | CLOSED | docs/dc-dc-netbox-buildout-scope.md:58 | \ | G5 \ | DC naming \ |
vr1-dc0/vr1-dc1; tool = DC1/DC2 |
**... |
| status | - | HELD | docs/dc0-deploy-readiness.md:100 | ### C6. vr1-dc1 -- HELD (do not attempt) |
||||
| status | - | CLOSED | docs/dc0-deploy-readiness.md:156 | After this lands the host is on -136 (matching the guests) and the bookend is CL... | ||||
| status | - | HELD | docs/dc0-deploy-readiness.md:6 | and is operator-gated. vr1-dc1 is HELD (no ruled addressing; see below), DC0 o... |
||||
| status | - | COMPLETE | docs/dc0-deploy-readiness.md:8 | > STATUS 2026-07-17: PREP COMPLETE -- DC0 IS DEPLOY-READY. Final gate re-che... | ||||
| status | - | READY | docs/dc0-deploy-readiness.md:8 | > STATUS 2026-07-17: PREP COMPLETE -- DC0 IS DEPLOY-READY. Final gate re-che... | ||||
| status | - | CLOSED | docs/design-decisions.md:1061 | ## D-063: RESOLVED / CLOSED (2026-07-03) -- tighten the capi-mgmt-cluster securi... | ||||
| status | - | CLOSED | docs/design-decisions.md:1063 | Status: PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... | ||||
| status | - | CLOSED | docs/design-decisions.md:1063 | Status: PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... | ||||
| status | - | CLOSED | docs/design-decisions.md:1124 | ### D-063 -- RESOLVED / CLOSED (2026-07-03): applied and functionally verified | ||||
| status | - | CLOSED | docs/design-decisions.md:1172 | Status: RESOLVED / CLOSED (applied + functionally verified 2026-07-03). Supe... | ||||
| status | - | CLOSED | docs/design-decisions.md:1411 | ### D-067 -- AMENDMENT (2026-07-02, post-fix): corrected mechanism; FIXED live; ... | ||||
| status | - | CLOSED | docs/design-decisions.md:1449 | Status: CLOSED for v1 (fixed + validated live 2026-07-02). Adds: BUNDLEF... | ||||
| status | - | CLOSED | docs/design-decisions.md:1536 | FAIL-CLOSED deploy-gate check in provider-bundle-check.py (content compare). A... |
||||
| status | - | CLOSED | docs/design-decisions.md:1726 | Operator ruled 2026-07-06: D-050 is CLOSED as resolved by D-051's option (b) -- ... | ||||
| status | - | CLOSED | docs/design-decisions.md:1729 | FAIL-CLOSED zip-vs-yaml drift check in the deploy gate and behavioral acceptance... | ||||
| status | - | CLOSED | docs/design-decisions.md:1811 | therefore CLOSED-except-item-6. The v1-close checklist (handoff section 6) | ||||
| status | - | HELD | docs/design-decisions.md:2148 | - Vault pinned 1.8/stable (the only viable charm lineage for this stack; the 1.1... | ||||
| status | - | CLOSED | docs/design-decisions.md:3512 | uplink, and LAN role are CLOSED by this entry (build vr1-dc0-wan, wire the edg... |
||||
| status | - | HELD | docs/design-decisions.md:3568 | HELD until it lands (assigning IPs by guess would violate hard rule 2). Everythi... | ||||
| status | - | HELD | docs/design-decisions.md:3770 | Addressing: RULED, not HELD (corrected 2026-07-16). The vcloud ISP /24 is ... |
||||
| status | - | HELD | docs/design-decisions.md:3773 | module "vr1_dc0_uplink" (cidr 172.30.2.0/24), NOT a NetBox-assigned HELD tfv... |
||||
| status | - | HELD | docs/design-decisions.md:3776 | loaded, D-115-ruled value not invented), and it introduces NO new HELD gate. (An... | ||||
| status | - | HELD | docs/design-decisions.md:3777 | draft of this entry wrongly modeled a var.vr1_dc0_uplink_cidr HELD value + an ... |
||||
| status | - | CLOSED | docs/design-decisions.md:730 | The D-042 cosmetic health_status = UNHEALTHY false-negative is a property of d... |
||||
| status | - | CLOSED | docs/design-decisions.md:732 | ## D-050: RESOLVED / CLOSED (2026-07-06) -- keystone use-policyd-override=true... |
||||
| status | - | CLOSED | docs/design-decisions.md:734 | Status: RESOLVED / CLOSED 2026-07-06 (recorded 2026-06-17 as an unruled find... | ||||
| status | - | CLOSED | docs/handoff-20260705-open-items.md:168 | > Current state: last ops-update window (ops-update-20260705) is CLOSED; fle... | ||||
| status | - | CLOSED | docs/handoff-20260705-open-items.md:21 | - The last jumphost ops-update window (ops-update-20260705) is CLOSED; fleet r... |
||||
| status | - | CLOSED | docs/handoff-20260705-open-items.md:65 | -
|
||||
| status | - | HELD | docs/model-a-fallback-plan.md:75 | (No HELD gate here: the /24 is a ruled literal, not a tfvar.) | ||||
| status | - | CLOSED | docs/script-quality-findings-20260707.md:133 | direction is CLOSED (safe), but a benign stderr warning on a noisy CLI would | ||||
| status | - | CLOSED | docs/security-ledger.md:22 | \ | SEC-011 \ | 2026-07-16 \ | Node least-connectivity gap (not an L2 breach). ... | |
| status | - | CLOSED | docs/session-ledger.md:1001 | - quota-vs-capacity: CLOSED -- operator ACCEPTS as-documented (no quota trim... | ||||
| status | - | BLOCKED | docs/session-ledger.md:1064 | ## NetBox import -- DONE for Office1; DC import BLOCKED on one operator ruling (... | ||||
| status | - | BLOCKED | docs/session-ledger.md:1088 | ###
|
||||
| status | - | STOPPED | docs/session-ledger.md:1124 | Using it anyway would violate hard rule 2 (never use an inferred value), so the ... | ||||
| status | - | CLOSED | docs/session-ledger.md:119 | tooling gap is CLOSED (dumper + checker now cover both classes). NO apex write -... | ||||
| status | - | CLOSED | docs/session-ledger.md:12 | This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what... | ||||
| status | - | CLOSED | docs/session-ledger.md:192 | **BOOKEND ITEM (a) CLOSED 2026-07-18 -- MEASURED, and the autostart chain PROVED... | ||||
| status | - | CLOSED | docs/session-ledger.md:20 | session narratives. Those streams are CLOSED and reconciled into the one list be... | ||||
| status | - | BLOCKED | docs/session-ledger.md:212 | **!! DC0 OUTER APPLY IS BLOCKED ON NEW DRIFT -- do NOT apply. See | ||||
| status | - | BLOCKED | docs/session-ledger.md:240 | Options (a)-(d) are in the finding. **DC0 IS NOT BLOCKED on the unresolved provi... | ||||
| status | - | COMPLETE | docs/session-ledger.md:281 | **DC0 DEPLOY READINESS -- PREP COMPLETE 2026-07-17 (deploy-ready). See `docs/dc0... | ||||
| status | - | BLOCKED | docs/session-ledger.md:319 | rack transit/30 + rack IP in office1-netbox, feed the 4 tfvars (tofu plan BLOCKE... | ||||
| status | - | CLOSED | docs/session-ledger.md:374 | - [R-4] SEC-011 CLOSED (operator ruling 2026-07-16, "Keep uniform 6-NIC"). A... | ||||
| status | - | CLOSED | docs/session-ledger.md:377 | local.vr1_dc0_node_nics); amend the SEC-011 ledger row to CLOSED / accepted-no... |
||||
| status | - | COMPLETE | docs/session-ledger.md:423 | items COMPLETE. NOTHING applied/committed since 114d392; Phase C/D edits present... | ||||
| status | - | HELD | docs/session-ledger.md:442 | - No new HELD gate (CORRECTED 2026-07-16): the vcloud ISP /24 is the SAME `1... | ||||
| status | - | HELD | docs/session-ledger.md:445 | no re-address. D-125 adds NO NetBox object. (An earlier draft's `vr1_dc0uplink... | ||||
| status | - | HELD | docs/session-ledger.md:469 | (operator-ratified 2026-07-16): the vcloud ISP /24 is the ruled 172.30.2.0/24 ... |
||||
| status | - | HELD | docs/session-ledger.md:554 | netem HELD (Step 11; mesh bridge = virbr7 measured), stale vr1_dc1_planes comm... |
||||
| status | - | HELD | docs/session-ledger.md:554 | netem HELD (Step 11; mesh bridge = virbr7 measured), stale vr1_dc1_planes comm... |
||||
| status | - | READY | docs/session-ledger.md:557 | (172.30.2/3.0/24, role edge, site-scoped), DRY-BY-DEFAULT with whole-plan prefli... | ||||
| status | - | COMPLETE | docs/session-ledger.md:612 | OFFICE1 IS ESSENTIALLY COMPLETE (2026-07-13). office1-netbox (10.10.1.10) ... |
||||
| status | - | CLOSED | docs/session-ledger.md:627 | 1a. **DONE 2026-07-14 -- Office1's LAN IPv6 is LIVE and PROVEN ON THE WIRE. C1 i... | ||||
| status | - | COMPLETE | docs/session-ledger.md:687 | runbook, and ensure office1-netbox holds the COMPLETE validated dataset (c... |
||||
| status | - | CLOSED | docs/session-ledger.md:699 | **C2 sub-task (ii) DONE 2026-07-15 -> C2 FULLY CLOSED -> STAGE 2 CLOSE-OUT COMPL... | ||||
| status | - | COMPLETE | docs/session-ledger.md:699 | **C2 sub-task (ii) DONE 2026-07-15 -> C2 FULLY CLOSED -> STAGE 2 CLOSE-OUT COMPL... | ||||
| status | - | CLOSED | docs/session-ledger.md:704 | delta (D-115/D-117/D-118/D-120)." Gauntlet ALL GREEN (60). D-120 Step 6 CLOSED (... | ||||
| status | - | CLOSED | docs/session-ledger.md:707 | 3. pynetbox -- CLOSED 2026-07-13. Installed (7.0.0) on office1-netbox, w... |
||||
| status | - | CLOSED | docs/session-ledger.md:713 | 4. The apparmor rule is now IN THE REPO -- CLOSED 2026-07-13. | ||||
| status | - | CLOSED | docs/session-ledger.md:721 | 5. The DEFERRED literals are now ALL ASSIGNED -- item CLOSED 2026-07-14. The... | ||||
| status | - | CLOSED | docs/session-ledger.md:730 | 6. **D-119 (ADOPTED 2026-07-14) -- THE DC NAMESPACE IS REGION-QUALIFIED. C3/gap ... | ||||
| status | - | CLOSED | docs/session-ledger.md:747 | 6a. **(historical) G5 NetBox site rename -- CLOSED as D-117 (ADOPTED, Option B).... | ||||
| status | - | CLOSED | docs/session-ledger.md:755 | G2 (aggregates) and G3 (ULA /48) are both CLOSED by the same work. | ||||
| status | - | CLOSED | docs/session-ledger.md:761 | 9. DHCP PROVEN END TO END -- CLOSED 2026-07-13. voffice1 (the first client... |
||||
| status | - | CLOSED | docs/session-ledger.md:776 | **VCLOUD POST-RESTART SWEEP + D-126 BASE-LEG + D-128 OPERATING MODEL (2026-07-17... | ||||
| status | - | CLOSED | docs/session-ledger.md:78 | - VR0 / DC0 testcloud: fleet fully current (juju 3.6.25, 91 agents); D-011 C... | ||||
| status | - | CLOSED | docs/session-ledger.md:795 | item 20 CLOSED for Office1 + the skill's per-DC discipline). Gauntlet ALL GR... | ||||
| status | - | CLOSED | docs/session-ledger.md:81 | - STAGE 2 CLOSED AND MERGED (2026-07-15). All close-out gates C1..C5 met; br... | ||||
| status | - | HELD | docs/session-ledger.md:905 | offboard) are HELD** by the operator until the DOCFIX-126/127 live-verify lands. | ||||
| status | - | CLOSED | docs/session-ledger.md:913 | PROPOSED/OPEN. D-063 is RESOLVED / CLOSED in design-decisions.md (verified).... |
||||
| status | - | HELD | docs/stage3-adversarial-review-20260716.md:319 | \ | L5 (exit gate "conditionally met at best") \ | **CONFIRMED -- still condit... | ||
| status | - | BLOCKED | docs/stage3-adversarial-review-20260716.md:319 | \ | L5 (exit gate "conditionally met at best") \ | **CONFIRMED -- still condit... | ||
| status | - | BLOCKED | docs/stage3-adversarial-review-20260716.md:61 | \ | L1-07 \ | tofu plan: BLOCKED -- 4 required vars unset/no-default (`vr1_d... |
||
| status | - | HELD | docs/stage3-review-base.patch:1415 | +# netem (runbook Step 11) -- HELD as a comment. It is a POST-apply step that ru... | ||||
| status | - | HELD | docs/stage3-review-base.patch:163 | + netem HELD as a comment (Step 11, runtime SSH target + unruled params; the vr... | ||||
| status | - | HELD | docs/stage3-review-base.patch:164 | + bridge is virbr7, measured). HELD pending D-123: the vvr1-dc0 headend... |
||||
| status | - | BLOCKED | docs/stage3-review-base.patch:2063 | + scope is BLOCKED and this pass's real reach is Steps 1-8 (see the GATE | ||||
| status | - | CLOSED | docs/stage3-review-base.patch:537 | +uplink, and LAN role are CLOSED by this entry (build vr1-dc0-wan, wire the ed... |
||||
| status | - | HELD | docs/stage3-review-base.patch:564 | +HELD until it lands (assigning IPs by guess would violate hard rule 2). Everyth... | ||||
| status | - | HELD | docs/stage3-review-base.patch:687 | + HELD until it lands.) | ||||
| status | - | HELD | docs/stage3-review-base.patch:763 | + netem HELD (Step 11; mesh bridge = virbr7 measured), stale vr1_dc1_planes... |
||||
| status | - | HELD | docs/stage3-review-base.patch:763 | + netem HELD (Step 11; mesh bridge = virbr7 measured), stale vr1_dc1_planes... |
||||
| status | - | READY | docs/stage3-review-base.patch:766 | + (172.30.2/3.0/24, role edge, site-scoped), DRY-BY-DEFAULT with whole-plan p... | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1365 | ## 2026-07-02 (session 2) -- D-067 FIXED live + CLOSED; root cause corrected to ... | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1564 | First live run of d063-apply.sh --audit failed CLOSED at exit 20 with zero mutat... | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1585 | ### 2026-07-03 (addendum 7) -- D-063 RESOLVED/CLOSED: applied + functionally ver... | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1667 | row in docs/security-ledger.md. OPEN/PENDING -> PASS_PENDING_MANUAL(3); CLOSED/R... | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1704 | D-063 header/first-status reconciled to RESOLVED/CLOSED (the closure had been ap... | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:1758 | gauntlet 31. The full-d011 profile is now COMPLETE (all six items exist). REQUIR... | ||||
| status | - | HELD | docs/v1-redeploy-changelog.md:1873 | re-gate on a true PASS) -- the update window is HELD at Section 1.4 until this l... | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1924 | ### 2026-07-05 (addendum 16, jumphost stream) -- ops-update-20260705 WINDOW CLOS... | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:1929 | WINDOW RESULT: COMPLETE, all gates green. Controller 3.6.24 -> 3.6.25 (single, | ||||
| status | - | HELD | docs/v1-redeploy-changelog.md:1945 | EXCLUSIONS HELD: vault untouched (1.8/stable rev 372; its in-channel 372->714 | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2023 | DOCFIX-089: phase-03 3.3 https/cookie check rewritten FAIL-CLOSED (transport, HT... | ||||
| status | - | HELD | docs/v1-redeploy-changelog.md:2257 | probe.** First live run HELD on the queued VERIFY-LIVE item: admin-side | ||||
| status | - | HELD | docs/v1-redeploy-changelog.md:2271 | half correctly self-HELD (headroom UNKNOWN, fail-closed as designed) on the | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2308 | DOCFIX candidate, not actioned. (2) barbican host_href observation CLOSED | ||||
| status | - | HELD | docs/v1-redeploy-changelog.md:2327 | devteam PINNED next (onboarding HELD on operator snapshot ruling). | ||||
| status | - | HELD | docs/v1-redeploy-changelog.md:2346 | 1 DRIFT / 2 HELD. Harness 10/10 (mock leader deliberately keystone/1; ssh | ||||
| status | - | HELD | docs/v1-redeploy-changelog.md:2378 | instantiation = devteam tenant (HELD on snapshot). Intake questions for the | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2463 | the capi-mgmt net (resolved live by stable name, FAIL-CLOSED on lookup | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:2499 | ### 2026-07-06 (addendum 30, jumphost stream) -- client handover package COMPLET... | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2638 | found-not-fixed since addendum 28, now CLOSED); (d) LB-gone wait counts | ||||
| status | - | HELD | docs/v1-redeploy-changelog.md:2700 | of intake answers (pack instantiation HELD on them); capi-test-1 | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2842 | 5.3 FAILS-as-anticipated, CLOSED via its own CLI-path clause (API | ||||
| status | - | BLOCKED | docs/v1-redeploy-changelog.md:2946 | -- BLOCKED on the cross-stream ruling that its resize-acceptance role | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:298 | - DOCFIX-040 COMPLETE. pre-flight-checks.sh and osd-blank-check.sh both ... |
||||
| status | - | HELD | docs/v1-redeploy-changelog.md:3001 | - HELD for operator (morning): the broad ease-of-use review across ALL | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:318 | ## Phase-02 vault bring-up (as-executed -- COMPLETE 2026-06-27) | ||||
| status | - | CLOSED | docs/v1-redeploy-changelog.md:477 | principals -- reconciles with the handoff's original 31. **PHASE-02 EXIT GATE CL... | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:487 | PHASE-02 COMPLETE -- discrete vault mutations done. Cascade-settle + the post-in... | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:661 | ### Phase-04 EXECUTED -- network carve COMPLETE (2026-06-27) | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:739 | ### Step 5.1 EXECUTED -- configure-resources COMPLETE (2026-06-27) | ||||
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:747 | ### Step 5.2 EXECUTED -- amphora pipeline COMPLETE; PHASE-05 EXIT GATE MET (2026... | ||||
| status | - | BLOCKED | docs/v1-redeploy-changelog.md:932 | ### Phase-06 6.3 BLOCKED -- provider FIP range dark cloud-wide; root-caused as D... | ||||
| status | - | BLOCKED | docs/v1-redeploy-changelog.md:983 | Supersedes the framing of the 2026-06-27 "Phase-06 6.3 BLOCKED ... D-057" entry | ||||
| status (not counted) | - | CLOSED | memory/project-posture-closed-test.md:10 | VR1 (the DC-DC buildout) is a CLOSED IN-HOUSE TEST cloud, not a live/shared/prod... | ||||
| status | - | BLOCKED | runbooks/appendix-A-troubleshooting.md:329 | - Symptom: after authorize-charm, vault stays BLOCKED "Missing CA cert". | ||||
| status | - | HELD | runbooks/d011-batch3-window-DRAFT.md:9 | - Section 3: first --include-disruptive run self-HELD (headroom UNKNOWN) on | ||||
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:100 | ISP uplink -- gap #17 CLOSED for Office1), and the dc1/office1/dc2 |
||||
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:144 | CLOSED.** The old fork ("OpenTofu cloudinit-vm, blocked pending user_data |
||||
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:167 | 4. GitBucket: CLOSED, NOT DEFERRED (D-116). There is NO Office1-local GitBuc... | ||||
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:308 | CLOSED for Office1 via the dedicated office1-wan ISP-uplink network. DC1/DC2 |
||||
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:834 | - Office1-local + office1-wan networks created: MET (gaps #12 and #17-fo... | ||||
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:901 | gap #12 CLOSED). | ||||
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:902 | - [x] Office1 OPNsense edge RESOLVED and BUILT 2026-07-12/13 (gap #16 CLOSED for | ||||
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:903 | ownership; gap #17 CLOSED for Office1 via office1-wan). |
||||
| status | - | HELD | runbooks/dc-dc-phase2-tofu-dc-substrate.md:192 | ruled for vr1-dc0's edge WAN -- a ruled literal, NOT a HELD tfvar; no new NetBox... | ||||
| status | - | BLOCKED | runbooks/dc-dc-phase2-tofu-dc-substrate.md:294 | scope is BLOCKED and this pass's real reach is Steps 1-8 (see the GATE | ||||
| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:334 | **The script now accepts a $DC env var (gap #2's CLI half CLOSED |
||||
| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:436 | Gap #2's CLI half is CLOSED (2026-07-10, DOCFIX-166): the script now | ||||
| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:530 | - [x] Gap #2's CLI half CLOSED 2026-07-10 (DOCFIX-166): | ||||
| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:72 | 2. CLOSED 2026-07-10 (DOCFIX-166), CLI half only. | ||||
| status | - | BLOCKED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:162 | - DC2: BLOCKED until its VIP band exists (see above). Once NetBox | ||||
| status | - | CLOSED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:20 | selector convention, CLOSED 2026-07-09 DOCFIX-151 -- this is the stage that | ||||
| status | - | BLOCKED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:64 | bundle deploy is BLOCKED on this** -- you cannot pick DC2's VIP band, the | ||||
| status | - | CLOSED | runbooks/dc-dc-phase6-designate-cos-magnum.md:244 | This step is CLOSED, not a template anymore. bundle.yaml now carries |
||||
| status | - | CLOSED | runbooks/dc-dc-phase6-designate-cos-magnum.md:630 | cert) is CLOSED for this DC. | ||||
| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:211 | * vault/0 BLOCKED "Vault needs to be initialized" (the phase-02 trigger, not a f... | ||||
| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:214 | * octavia BLOCKED "Awaiting configure-resources" (D-021); gss unknown (pre-run). | ||||
| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:224 | * magnum/0 BLOCKED "Ports which should be open, but are not: 9501" -- pre-vault ... | ||||
| status | - | BLOCKED | runbooks/phase-02-vault-bringup.md:26 | - vault/0 sits BLOCKED needing initialization (a fresh, uninitialized vault). | ||||
| status | - | BLOCKED | runbooks/phase-03-core-verify.md:7 | Decisions: B5 (IP-only endpoints; no FQDN), D-021 (octavia stays BLOCKED awaitin... | ||||
| status | - | BLOCKED | runbooks/phase-03-core-verify.md:72 | GATE: expected non-active/idle = 1 (octavia/0 BLOCKED "Awaiting configur... | ||||
| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:23 | is satisfied. octavia/0 sits BLOCKED "Awaiting ... configure-resources" (the | ||||
| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:3 | Bring Octavia from its post-deploy BLOCKED state to fully enabled: run the | ||||
| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:62 | juju status octavia -m openstack \ | grep -E 'octavia/0' \ | \ | true # expect BLO... | |
| status | stage-0 | CLOSED | docs/dc-dc-deployment-workflow.md:873 | \ | Stage 0-7 runbooks \ | Stage 0 DONE (ratification). **Stages 1-7 ALL WRITTEN 2... | ||
| status | stage-1 | COMPLETE | docs/changelog-20260709-office1-network-edge.md:42 | Stage 1/2 runbooks) implicitly assume that command is a COMPLETE inventory | ||||
| status | stage-1 | CLOSED | docs/dc-dc-deployment-workflow.md:570 | 9. Runbook debt -- CLOSED 2026-07-09. All seven Stage 1-7 runbooks are now | ||||
| status | stage-1 | CLOSED | docs/security-ledger.md:20 | \ | SEC-009 \ | 2026-07-15 \ | Credential/env SPRAWL + world-readable exposure on v... | |
| status | stage-1 | COMPLETE | docs/session-ledger.md:91 | VR1 Stage 1 COMPLETE; Stage 2 was in CLOSE-OUT -- now superseded by the merge ab... | ||||
| status | stage-1 | CLOSED | docs/stage3-review-base.patch:658 | \ | SEC-009 \ | 2026-07-15 \ | Credential/env SPRAWL + world-readable exposure on v... | |
| status | stage-2 | COMPLETE | docs/changelog-20260715-d120-load-and-iprange-tooling.md:45 | - Stage 2 close-out (C1..C5) is COMPLETE -> the branch->main merge point is reac... | ||||
| status | stage-2 | COMPLETE | docs/dc-dc-deployment-workflow.md:141 | \ | C2 \ | office1-netbox (10.10.1.10) is the VR1 IPAM apex -- a working draft (... |
||
| status | stage-2 | CLOSED | docs/dc-dc-deployment-workflow.md:141 | \ | C2 \ | office1-netbox (10.10.1.10) is the VR1 IPAM apex -- a working draft (... |
||
| status | stage-2 | CLOSED | docs/dc-dc-deployment-workflow.md:384 | which is what forced Stage 2's old Option A / Option B fork -- is **CLOSED | ||||
| status | stage-3 | BLOCKED | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:3 | Closes the collision that BLOCKED Stage 3. **D-119 COMPLETES D-117; it does not ... | ||||
| status | stage-3 | HELD | docs/session-ledger.md:205 | docs/dc-dc-deployment-workflow.md's Stage 3 section still reads "**Blocking to... |
||||
| status | stage-4 | CLOSED | docs/dc-dc-deployment-workflow.md:884 | \ | lib-net.sh / lib-hosts.sh \ |
$DC selector mechanism ADDED 2026-07-09 (D... |
||
| status | stage-4 | HELD | docs/session-ledger.md:51 | Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned... | ||||
| status | stage-5 | BLOCKED | docs/changelog-20260709-dc-selector-convention.md:5 | which explicitly BLOCKED the Stage 5 "high reuse" claim (phase-01..08 |
||||
| status | stage-5 | CLOSED | docs/changelog-20260709-dc-selector-convention.md:72 | Tooling gap register item #1 CLOSED. Stage 5's runbook (Juju controller + | ||||
| version | juju | 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki | ||||
| version | juju | 3.6 | docs/design-decisions.md:1611 | policy for either: (a) the Juju controller/agents (patch releases on the 3.6 tra... | ||||
| version | juju | 3.6 | docs/design-decisions.md:1632 | The testcloud controller is SINGLE (non-HA) and Juju 3.6 ships no supported cont... | ||||
| version | juju | 3.6 | docs/design-decisions.md:1677 | ## D-071 -- AMENDMENT (2026-07-05): controller backup EXISTS on juju 3.6; risk s... | ||||
| version | juju | 3.6 | docs/design-decisions.md:1680 | premise "no supported backup in Juju 3.6": juju create-backup / `download-back... |
||||
| version | juju | 2.1 | docs/design-decisions.md:1684 | (committed pre-change BOM), a fresh juju create-backup archive (now the STANDA... |
||||
| version | juju | 3.6 | docs/design-decisions.md:2043 | - Single-unit (not HA) for VR1, with the confirmed backup posture (juju 3.6 `cre... | ||||
| version | juju | 3.6 | docs/design-decisions.md:994 | remove-machine option. Juju 3.6 remove-machine reference: a machine can be r... |
||||
| version | juju | 3.6.25 | docs/handoff-20260705-open-items.md:169 | > juju 3.6.25. Vault is 1.8/stable rev 714 (current in-channel). |
||||
| version | juju | 3.6.25 | docs/handoff-20260705-open-items.md:22 | in-channel revisions; controllers/agents at juju 3.6.25; appendix-B re-baselined... | ||||
| version | juju | 3.6 | docs/handoff-20260705-open-items.md:59 | Backups are confirmed to exist (juju 3.6 create-backup); the open half is sing... |
||||
| version | juju | 3.6.25 | docs/session-ledger.md:78 | - VR0 / DC0 testcloud: fleet fully current (juju 3.6.25, 91 agents); D-011 C... | ||||
| version | juju | 3.6 | docs/session-ledger.md:989 | download-backup DO exist on juju 3.6 -- the original "removed in 3.0" premise ... |
||||
| version | juju | 3.6 | docs/upstream-bug-draft-dashboard-tls.md:14 | Reactive charm generation; juju 3.6. | ||||
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1819 | explicit Risk section: single non-HA controller, no supported backup in Juju 3.6... | ||||
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped juju status keystone --format=line, and juju 3.6 line format omits wor... |
||||
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped juju status keystone --format=line, and juju 3.6 line format omits wor... |
||||
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1953 | juju-status (units do NOT carry agent-status.version on juju 3.6); 2.1 |
||||
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1954 | REWRITTEN -- juju create-backup EXISTS on 3.6 and is now the STANDARD gated |
||||
| version | juju | 2.1 | docs/v1-redeploy-changelog.md:424 | Vault's own status agrees with the Juju workload-status. Cleared for 2.1b (vault... | ||||
| version | juju | 3.6 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:289 | Per D-104: scheduled controller backups, confirmed backup posture (juju 3.6 | ||||
| version | juju | 2024.1 | runbooks/dc-dc-phase5-dr-failover-drill.md:153 | juju deploy cinder-backup --channel 2024.1/stable --to lxd: | ||||
| version | juju | 3.6 | runbooks/dc-dc-phase5-dr-failover-drill.md:448 | against this controller's actual installed juju client (3.6 per D-104) before ru... | ||||
| version | juju | 3.6 | runbooks/ops-update-procedure.md:158 | on juju 3.6 (the "removed in 3.0" authoring assumption was wrong for this | ||||
| version | juju | 3.6 | runbooks/ops-update-procedure.md:8 | controller backup EXISTS on juju 3.6). | ||||
| version | juju | 3.1 | runbooks/phase-03-core-verify.md:10 | backends confirmed LOADED via a functional sweep, NOT juju status; Step 3.1). Tr... | ||||
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/SKILL.md:100 | \ | Creating/changing a libvirt_domain; anything about nested KVM, a libvirt st... |
|||
| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | v1.12.3; LXD pinned to the 5.21 LTS track -- MAAS 3.6/3.7 cannot talk |
||||
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud | ||||
| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \ | LXD \ | 5.21 LTS track \ |
MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... | |
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \ | LXD \ | 5.21 LTS track \ |
MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... | |
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) | ||||
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:247 | Canonical's own announcement: LXD 6.7 "consolidates some API endpoints" that | ||||
| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:249 | not yet in a MAAS release). Verbatim guidance: "We recommend using LXD <=6.6 | ||||
| version | lxd | 5.21.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:253 | VR0 runs LXD 5.21.4 and is therefore safe by accident of timing; D-114 | ||||
| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:254 | makes it a decision. LXD 5.21 LTS is supported to June 2029 | ||||
| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \ | MAAS cannot talk to an LXD VM host after an LXD update \ | LXD auto-refreshed ... | ||
| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \ | MAAS cannot talk to an LXD VM host after an LXD update \ | LXD auto-refreshed ... | ||
| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \ | MAAS cannot talk to an LXD VM host after an LXD update \ | LXD auto-refreshed ... | ||
| version | lxd | 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 pro... | ||||
| version | lxd | 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \ | - voffice1 (L2) MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea r... | |||
| version | lxd | 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:6 | LXD 5.21.5 are installed on it, that LXD is **registered back into MAAS as a... | ||||
| version | lxd | 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:62 | 3. LXD snap track changes are ONE-WAY. LXD must be installed DIRECTLY onto `... | ||||
| version | lxd | 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on latest first, because MAAS 3.6/3.7 is incompatible wi... |
||||
| version | lxd | 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:64 | (pinned pylxd 2.3.5 vs LXD 6.7's consolidated endpoints). Bonus discovered in re... | ||||
| version | lxd | 5.21.5 | docs/dc-dc-deployment-workflow.md:114 | - DONE (site) -- D-114 IS PROVEN END TO END: MAAS 3.7.2 region+rack ON `voff... | ||||
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:65 | > LXD (pinned to the 5.21 LTS track) runs ON it, that LXD is registered BACK... | ||||
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:84 | \ | Gate \ | Office1 OPNsense edge up (MET -- routing, NAT, egress, Kea DH... | ||
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:85 | \ | Owns \ | D-114 (site containment VM + MAAS-composed LXD VMs, incl. the... | ||
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:85 | \ | Owns \ | D-114 (site containment VM + MAAS-composed LXD VMs, incl. the... | ||
| version | lxd | 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \ | Reuse vs new \ | NEW infra (Office1 didn't exist for VR0 DC0), but LESS ne... | ||
| version | lxd | 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \ | Reuse vs new \ | NEW infra (Office1 didn't exist for VR0 DC0), but LESS ne... | ||
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:874 | \ | D-114 site containment VM (voffice1) \ |
BUILT + RUNNING 2026-07-13.... | ||
| version | lxd | 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project default,... |
||||
| version | lxd | 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project default,... |
||||
| version | lxd | 5.21 | docs/design-decisions.md:2591 | 4. LXD is version-pinned to the 5.21 LTS track. MAAS 3.6/3.7 is INCOMPATIBLE... | ||||
| version | lxd | 6.7 | docs/design-decisions.md:2591 | 4. LXD is version-pinned to the 5.21 LTS track. MAAS 3.6/3.7 is INCOMPATIBLE... | ||||
| version | lxd | 6.7 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to... | ||||
| version | lxd | 6.6 | docs/design-decisions.md:2593 | pylxd >= 2.3.9, not yet in a MAAS release). Canonical's own guidance is "use LXD... | ||||
| version | lxd | 5.21.5 | docs/session-ledger.md:603 | and LXD 5.21.5, with that LXD registered into MAAS as an LXD VM host. MA... | ||||
| version | lxd | 5.21 | docs/stage3-review-base.patch:2859 | + # createadmin/apikey/login, LXD (5.21 pin), LXD vm-host registration, compose... | ||||
| version | lxd | 5.21.5 | docs/vr1-office1-as-built.md:43 | \ | voffice1 \ | 10.10.0.20 (Kea reservation) \ |
MAAS 3.7.2 region+rack ... | |
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:116 | REGION CONTROLLER runs ON it. LXD (5.21 LTS) also runs ON it, and that LXD is | ||||
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:186 | D-114's hard LXD 5.21-LTS-track constraint, which IS decided). Each install | ||||
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:46 | including the LXD 5.21 LTS pin), D-103 as AMENDED by D-114 (OpenTofu owns | ||||
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:488 | ssh 'sudo snap install lxd --channel=5.21/stable' | ||||
| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:491 | cannot talk to LXD >= 6.7 (pylxd 2.3.5 vs LXD's consolidated API endpoints). | ||||
| version | lxd | 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project default, LXD 5.21.4. |
||||
| version | lxd | 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project default, LXD 5.21.4. |
||||
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the 5.21 LTS track (D-114). MAAS 3.6/3.7 is | ||||
| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's | ||||
| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's | ||||
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:887 | - [ ] runbooks/appendix-B-asbuilt-version-lock.md updated with the LXD 5.21-LT... |
||||
| version | maas | 3.7.2 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki | ||||
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | v1.12.3; LXD pinned to the 5.21 LTS track -- MAAS 3.6/3.7 cannot talk |
||||
| version | maas | 2.7.2 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:82 | ### canonical/maas (pinned 2.7.2, confirmed 2026-07-09) |
||||
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \ | LXD \ | 5.21 LTS track \ |
MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... | |
| version | maas | 3.7.2 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \ | MAAS \ | 3.7.2 (VR0) \ | the LXD ceiling above is a property of MAAS 3.6/3.7 \ | |
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \ | MAAS \ | 3.7.2 (VR0) \ | the LXD ceiling above is a property of MAAS 3.6/3.7 \ | |
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) | ||||
| version | maas | 2.3.5 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:248 | MAAS's pinned pylxd 2.3.5 cannot speak to (fixed in pylxd >= 2.3.9, | ||||
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \ | MAAS cannot talk to an LXD VM host after an LXD update \ | LXD auto-refreshed ... | ||
| version | maas | 10.12.8 | docs/D-058-renumber.md:67 | - scripts/phase-00-maas-carve.sh (METAL_CIDR default 10.12.8 -> 10.12.12; rang... | ||||
| version | maas | 2.7.2 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:54 | hashes: dmacvicar/libvirt 0.9.8, canonical/maas 2.7.2). |
||||
| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 pro... | ||||
| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \ | - voffice1 (L2) MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea r... | |||
| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:5 | voffice1 is a working VR1 site headend. MAAS 3.7.2 (region+rack, PostgreSQ... |
||||
| version | maas | 3.6 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on latest first, because MAAS 3.6/3.7 is incompatible wi... |
||||
| version | maas | 3.7 | docs/changelog-20260716-d124-rack-addressing.md:39 | (D-123): disable timesyncd -> install the maas snap (3.7/stable) -> `maas init... |
||||
| version | maas | 3.7.2 | docs/dc-dc-deployment-workflow.md:114 | - DONE (site) -- D-114 IS PROVEN END TO END: MAAS 3.7.2 region+rack ON `voff... | ||||
| version | maas | 3.7.2 | docs/design-decisions.md:2553 | **Measured as-built evidence (VR0 / openstack-caracal-ipv4 MAAS 3.7.2, operato... |
||||
| version | maas | 3.6 | docs/design-decisions.md:2591 | 4. LXD is version-pinned to the 5.21 LTS track. MAAS 3.6/3.7 is INCOMPATIBLE... | ||||
| version | maas | 2.3.5 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to... | ||||
| version | maas | 3.7.2 | docs/maas-as-built-reference.md:169 | - MAAS 3.7.2; controller maas.maas, Region+Rack, Non-HA(3 VLANs). |
||||
| version | maas | 3.7.2 | docs/session-ledger.md:602 | the pool), egress through the OPNsense edge. On it: MAAS 3.7.2 region+rack (... | ||||
| version | maas | 3.7 | docs/stage3-review-base.patch:261 | +(D-123): disable timesyncd -> install the maas snap (3.7/stable) -> `maas ini... |
||||
| version | maas | 3.7 | docs/stage3-review-base.patch:2786 | MAAS_CHANNEL="3.7/stable" | ||||
| version | maas | 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): | ||||
| version | maas | 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): | ||||
| version | maas | 3.7.2 | docs/vr1-office1-as-built.md:43 | \ | voffice1 \ | 10.10.0.20 (Kea reservation) \ |
MAAS 3.7.2 region+rack ... | |
| version | maas | 2.7.2 | runbooks/dc-dc-phase0-vcloud-prep.md:339 | fetch dmacvicar/libvirt 0.9.8 and canonical/maas 2.7.2) |
||||
| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:442 | ssh 'sudo snap install maas --channel=<PENDING VERIFICATION: the curr... | ||||
| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:490 | The 5.21 track is a HARD D-114 constraint, not a preference: MAAS 3.6/3.7 |
||||
| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the 5.21 LTS track (D-114). MAAS 3.6/3.7 is | ||||
| version | netbox | 4.6.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:453 | Note: this is an UPSTREAM-only trap so far. The Office1 sandbox NetBox (4.6.... | ||||
| version | netbox | 4.5.8 | docs/changelog-20260710-netbox-roles-aggregates.md:42 | Script previewed (read-only) against live NetBox 4.5.8: correctly reports 12 obj... | ||||
| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Offi... | ||||
| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Offi... | ||||
| version | netbox | 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:25 | ### 2. NetBox 4.6 v2 API tokens: the wire format is nbt_<key>.<plaintext> -- N... |
||||
| version | netbox | 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:29 | NetBox 4.6 hashes API tokens. The Token model has key (a 12-char PREFIX)... |
||||
| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:6 | laid down by MAAS) and runs NetBox 4.6.4 (netbox-docker, Django 6.0.6). Its ... | ||||
| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:74 | - NetBox 4.6.4 on Django 6.0.6, containers netbox + netbox-worker + `pos... |
||||
| version | netbox | 10.1 | docs/changelog-20260716-d124-addressing-pin.md:21 | - netbox/dc-rack-mgmt-import.py: CONTAINER = "10.12.0.0/16" -> **`"172.3... |
||||
| version | netbox | 172.31 | docs/changelog-20260716-d124-addressing-pin.md:44 | python3 netbox/dc-rack-mgmt-import.py --transit-cidr 172.31.0.0/30 --rack-ip 10.... | ||||
| version | netbox | 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the netbox-docker stack (NetBox 4.6, /opt/netbox-docker) had cleanly exited ... |
||||
| version | netbox | 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the netbox-docker stack (NetBox 4.6, /opt/netbox-docker) had cleanly exited ... |
||||
| version | netbox | 4.6.4 | docs/dc-dc-deployment-workflow.md:116 | machines COMPOSED BY MAAS and deployed -- office1-netbox (10.10.1.10, NetB... |
||||
| version | netbox | 4.6.4 | docs/dc-dc-netbox-buildout-scope.md:198 | (10.10.1.10:8000, NetBox 4.6.4 on the Office1 VM, `docs/changelog-20260713-off... |
||||
| version | netbox | 4.5.8 | docs/dc-dc-netbox-buildout-scope.md:45 | netbox.baldurkeep.com v4.5.8. Regions: US West -> Eugene (prod); **Virtual Reg... |
||||
| version | netbox | 4.5.8 | docs/design-decisions.md:2893 | **The collision, measured live against netbox.baldurkeep.com (4.5.8) on 2026-0... |
||||
| version | netbox | 4.6 | docs/stage3-review-base.patch:1120 | + die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v... | ||||
| version | netbox | 4.6 | docs/stage3-review-base.patch:897 | + die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v... | ||||
| version | netbox | 4.6 | docs/vr1-office1-as-built.md:141 | NetBox API token format (4.6): the wire form is nbt_<key>.<plaintext>. The... |
||||
| version | netbox | 4.6 | docs/vr1-office1-as-built.md:44 | \ | office1-netbox \ | 10.10.1.10 \ |
NetBox 4.6 (netbox-docker; `/opt/ne... | |
| version | netbox | 4.6 | runbooks/dc-dc-phase1-office1-standup.md:725 | --draft draft/vr1-draft.json`. It STRUCTURALLY cannot reach upstream. NetBox 4.6 | ||||
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud | ||||
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:130 | https://docs.opnsense.org/releases/CE_26.1.html | ||||
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:22 | \ | OPNsense \ | 26.1 "Witty Woodpecker" \ | ISC-DHCP left core in 26.1 -- Kea/dnsm... | |
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:322 | ## 4. OPNsense 26.1 edge | ||||
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:351 | https://docs.opnsense.org/releases/CE_26.1.html | ||||
| version | opnsense | 26.1 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:108 | sizing question, not a regression of this fix -- check OPNsense 26.1's docum... | ||||
| version | opnsense | 26.1 | docs/changelog-20260712-office1-opnsense-edge-build.md:33 | (opnsense-26.1-nano.qcow2), so there is no target-path collision. Same conclus... |
||||
| version | opnsense | 26.1 | docs/changelog-20260712-opnsense-prep-bz2-fallback.md:15 | opnsense-26.1-nano.qcow2 (qcow2, 11 GiB virtual) via the python path. |
||||
| version | opnsense | 26.1 | docs/changelog-20260713-opnsense-api-proven.md:24 | GET core/firmware/status -> HTTP 200, OPNsense 26.1 (auth works) | ||||
| version | opnsense | 26.1 | docs/changelog-20260713-opnsense-api-proven.md:8 | An API key was minted for root in the GUI. In OPNsense 26.1 this is NOT in... |
||||
| version | opnsense | 26.1 | docs/changelog-20260714-opnsense-set-interface-v6.md:10 | among the API-covered surfaces. **Measured on the live Office1 edge (OPNsense 26... | ||||
| version | opnsense | 26.1 | docs/design-decisions.md:2498 | MEASURED on the live Office1 edge (2026-07-14), OPNsense 26.1: | ||||
| version | opnsense | 26.7 | docs/design-decisions.md:4074 | Problem. office1-opnsense was updated to OPNsense 26.7 and is a near-stock... |
||||
| version | opnsense | 26.7 | docs/design-decisions.md:4074 | Problem. office1-opnsense was updated to OPNsense 26.7 and is a near-stock... |
||||
| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense 26.1 nano amd64 (scripts/opnsense-prep-image.sh 26.1), p... |
||||
| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense 26.1 nano amd64 (scripts/opnsense-prep-image.sh 26.1), p... |
||||
| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:60 | /var/lib/libvirt/vr1/office1/opnsense-26.1-nano.qcow2 (11 GiB virtual). |
||||
| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:92 | the real fix, check OPNsense 26.1's documented minimum before picking a number. | ||||
| version | opnsense | 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | Subject. office1-opnsense, OPNsense 26.7 (amd64), reviewed for plugin/... |
||||
| version | opnsense | 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | Subject. office1-opnsense, OPNsense 26.7 (amd64), reviewed for plugin/... |
||||
| version | opnsense | 14.3 | docs/session-ledger.md:189 | security pkgs) THEN reboot; (b) office1-opnsense itself is still on 14.3-RELEASE... | ||||
| version | opnsense | 26.1 | docs/session-ledger.md:649 | CANNOT be done via the REST API. Measured on the live edge (OPNsense 26.1): `Int... | ||||
| version | opnsense | 26.7 | docs/session-ledger.md:830 | OPNsense EDGE 26.7 UPDATE + PLUGIN/ADD-ON REVIEW (2026-07-18). Operator upda... | ||||
| version | opnsense | 26.1 | docs/stage3-review-base.patch:1373 | + base_volume_path = "/var/lib/libvirt/vr1/vr1-dc0/opnsense-26.1-nano.qcow2" | ||||
| version | opnsense | 26.7 | docs/vr1-office1-as-built.md:42 | \ | office1-opnsense \ | LAN 10.10.0.1 / WAN 172.30.1.2 \ |
**OPNsense 26.7... | |
| version | tofu | 0.9.8 | .claude/skills/openstack-cloud-ops/references/environment.md:33 | libvirt/KVM via the dmacvicar/libvirt OpenTofu provider 0.9.8 on OpenTofu |
||||
| version | tofu | 1.12.3 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:19 | \ | OpenTofu \ | v1.12.3 (as-run) \ |
the binary that actually executed Stage 1 ... | |
| version (not counted) | tofu | 1.12.3 | docs/audit/grounding-audit-charter.md:25 | 2026-07-18 session's own findings). README pins tofu 1.12.3; the binary is 1.12.... | ||||
| version | tofu | 1.12.3 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:4 | binary (OpenTofu v1.12.3), on the vcloud host, executing | ||||
| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - install-opentofu.sh -- OpenTofu tofu >= 1.6.0 via the official deb |
||||
| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - install-opentofu.sh -- OpenTofu tofu >= 1.6.0 via the official deb |
||||
| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - install-opentofu.sh -- OpenTofu tofu >= 1.6.0 via the official deb |
||||
| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:42 | bash scripts/prereqs/install-opentofu.sh pointer + the >=1.6.0 floor. |
||||
| version | tofu | 1.12.3 | docs/changelog-20260713-docfix194-opentofu-module-validation.md:19 | This was only findable because a tofu binary now exists on the jumphost (OpenT... |
||||
| version | tofu | 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \ | gap #2: "UNVALIDATED -- no tofu binary available" \ |
**OpenTofu v1.12.3 IS ... | ||
| version | tofu | 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \ | gap #2: "UNVALIDATED -- no tofu binary available" \ |
**OpenTofu v1.12.3 IS ... | ||
| version | tofu | 1.1 | docs/dc-dc-deployment-workflow.md:360 | - A tofu binary EXISTS on the jumphost: OpenTofu v1.12.3. The tree can |
||||
| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:360 | - A tofu binary EXISTS on the jumphost: OpenTofu v1.12.3. The tree can |
||||
| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:47 | infrastructure; vcloud host, OpenTofu v1.12.3). As-built: nested KVM already-on; | ||||
| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:875 | \ | opentofu/ (networks/pools/node-VM PXE/cloud-init-VM patterns) \ |
**VALIDATE... | ||
| version | tofu | 1.12.3 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:27 | > The OpenTofu 1.12.3 -> 1.12.4 bump is COINCIDENTAL, not causal. The binary... | ||||
| version | tofu | 1.12.4 | docs/session-ledger.md:214 | root (read-only plan, OpenTofu v1.12.4) returns **7 add / 2 change / 7 destr... | ||||
| version | tofu | 1.12.4 | docs/session-ledger.md:260 | Version drift to log: OpenTofu on the jumphost is now v1.12.4; `README.m... | ||||
| version | tofu | 1.12.3 | docs/session-ledger.md:277 | 5/0/6-vs-5/2/6, DOCFIX-196 stale Stage-3 NetBox blocker, README tofu 1.12.3->1.1... | ||||
| version | tofu | 1.12.3 | docs/session-ledger.md:77 | tofu v1.12.3; tree validates (10/10 modules); lock committed. | ||||
| version | tofu | 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \ | L1-06 \ | tofu validate: Success (OpenTofu v1.12.3, 11/11 modules). \ |
||
| version | tofu | 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \ | L1-06 \ | tofu validate: Success (OpenTofu v1.12.3, 11/11 modules). \ |
||
| version | tofu | 1.12.3 | runbooks/dc-dc-phase0-vcloud-prep.md:3 | > FIRST EXECUTED 2026-07-10 (vcloud host, OpenTofu v1.12.3) -- run | ||||
| version | tofu | 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \ | OpenTofu tofu >= 1.6.0 (installs as /usr/bin/tofu, not the opentofu sna... |
|||
| version | tofu | 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \ | OpenTofu tofu >= 1.6.0 (installs as /usr/bin/tofu, not the opentofu sna... |
4. Gate-assertion rows
| word | where | line | |||
|---|---|---|---|---|---|
| blocking | .claude/skills/openstack-cloud-ops/SKILL.md:142 | whether the stage you're about to run has any open blocking item -> Stage 1 | |||
| unexercised | .claude/skills/openstack-cloud-ops/SKILL.md:149 | available, and treat every OpenTofu step as reviewed-but-unexercised. **At STAGE | |||
| verified | .claude/skills/openstack-cloud-ops/SKILL.md:172 | sin - if you have not verified an option name or version, say so and verify. | |||
| unexercised | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:110 | surfaces. A ledger without this check rots (cf. D-070's unexercised-snapshot cri... | |||
| unverified | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:133 | practice over the quick fix and will push back hard on unverified claims. | |||
| verified | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:58 | collisions have happened. State "next-free verified" when you assign. | |||
| unverified | .claude/skills/openstack-cloud-ops/references/platform-traps.md:181 | - UNVERIFIED: the 0.9.4 notes name a destroy.shutdown.timeout option |
|||
| verified | .claude/skills/openstack-cloud-ops/references/platform-traps.md:426 | \ | a MAAS-composed VM gets a lease MAAS did not issue, or PXEs on the wrong L2 ... | ||
| imported | README.md:17 | or as a separate repository (TBD when v2 begins). IPv6 prefixes already imported... | |||
| imported | README.md:56 | \ | \ | -- README.md what is imported vs. deferred to v2 | |
| unverified | docs/D-068-openbao-assessment-DRAFT.md:32 | privileged plugin-catalog access; per-CVE 1.8.8 applicability UNVERIFIED). | |||
| verified | docs/D-068-openbao-assessment-DRAFT.md:5 | discussion starts from verified facts. Items that could not be confirmed are mar... | |||
| unverified | docs/D-068-openbao-assessment-DRAFT.md:6 | UNVERIFIED. Companion: docs/D-068-vault-1.8-vs-1.16-analysis.md (the 1.16 ruling... | |||
| unverified | docs/D-068-openbao-assessment-DRAFT.md:63 | 1.15.6+ (BUSL -- licensing review required). Remaining UNVERIFIED before any | |||
| verified | docs/D-068-openbao-assessment-DRAFT.md:70 | vault swap. Also verified live 2026-07-06: the charm's Vault-listener TLS | |||
| blocking | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: | |||
| unblocked | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: | |||
| imported | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: | |||
| verified | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: | |||
| verified | docs/audit/grounding-audit-charter.md:128 | verified evidence needed to answer it attached. | |||
| verified | docs/audit/grounding-audit-charter.md:13 | Measured evidence (verified 2026-07-18 against the pushed repo at 43b29d7): |
|||
| verified | docs/audit/grounding-audit-charter.md:43 | not a work queue. It gets re-verified and folded into the findings register. | |||
| verified | docs/changelog-20260703-process-hardening.md:241 | ### 21. Harness-estate findings (pre-existing at HEAD; verified against pristine... | |||
| verified | docs/changelog-20260703-process-hardening.md:263 | Runbook paste blocks: every exit verified nested in a subshell or a remote- |
|||
| verified | docs/changelog-20260703-process-hardening.md:309 | Runbook->script contract cross-check: CLEAN (both automated hits verified | |||
| verified | docs/changelog-20260703-process-hardening.md:320 | dir -- a live shell with real cloud credentials. Mechanics verified against | |||
| verified | docs/changelog-20260703-process-hardening.md:37 | points at lib-net.sh / lib-hosts.sh; only verified-current literals remain. | |||
| verified | docs/changelog-20260703-process-hardening.md:8 | harnesses 33/33 cases, all python compiles. Identifier numbering verified | |||
| verified | docs/changelog-20260709-adversarial-review-fixes.md:23 | succeeds. Verified empirically (python3 -c reproduction): the else |
|||
| verified | docs/changelog-20260709-adversarial-review-fixes.md:31 | actually verified: the safety property (rejecting bad input) was still | |||
| unverified | docs/changelog-20260709-adversarial-review-fixes.md:33 | but "valid input is accepted, not spuriously rejected" was unverified and | |||
| verified | docs/changelog-20260709-adversarial-review-fixes.md:52 | VERIFIED: re-ran the harness -- the three previously-silent labels now | |||
| verified | docs/changelog-20260709-adversarial-review-fixes.md:86 | VERIFIED (all three items): bash scripts/repo-lint.sh 0 fail, 1 |
|||
| verified | docs/changelog-20260709-adversarial-review-fixes.md:94 | every file that mentions it); the ULA/GUA carve arithmetic (hand-verified | |||
| verified | docs/changelog-20260709-ceph-replication-tooling.md:106 | ## VERIFIED | |||
| verified | docs/changelog-20260709-ceph-replication-tooling.md:114 | 11.4b(promote RECOVERING), verified by grepping actual line numbers in | |||
| blocking | docs/changelog-20260709-ceph-replication-tooling.md:119 | dry-run-informational/apply-blocking split, the --apply/typed- |
|||
| blocking | docs/changelog-20260709-ceph-replication-tooling.md:82 | BLOCKING immediately before any --apply execution (refuses to mutate an |
|||
| verified | docs/changelog-20260709-dc-dc-design.md:4 | openstack-caracal-dc-dc HEAD 8813efc (seed-verified). All decisions PROPOSED -... |
|||
| verified | docs/changelog-20260709-dc-dc-phase0-runbook.md:58 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn |
|||
| verified | docs/changelog-20260709-dc-dc-phase1-runbook.md:45 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn. |
|||
| verified | docs/changelog-20260709-dc-dc-phase2-runbook.md:52 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn (no |
|||
| verified | docs/changelog-20260709-dc-dc-phase3-runbook.md:62 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn (no |
|||
| blocking | docs/changelog-20260709-dc-dc-phase4-runbook.md:47 | plausible-looking option names, Step 6 names this as blocking work with | |||
| unverified | docs/changelog-20260709-dc-dc-phase4-runbook.md:50 | 2. **D-109's IPv6-SAN cert-issuance requirement is an unverified charm- | |||
| verified | docs/changelog-20260709-dc-dc-phase4-runbook.md:61 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn. |
|||
| verified | docs/changelog-20260709-dc-dc-phase4-runbook.md:71 | stage's own "Ceph-over-v6 and geneve-over-v6 verified" gate criterion and | |||
| verified | docs/changelog-20260709-dc-dc-phase5-runbook.md:53 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn (no |
|||
| verified | docs/changelog-20260709-dc-dc-phase6-runbook.md:57 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn (no |
|||
| verified | docs/changelog-20260709-dc-selector-convention.md:38 | VERIFIED: | |||
| blocking | docs/changelog-20260709-dc-selector-convention.md:43 | messages cite the correct blocking reason (NetBox gap vs. no-enrollment), | |||
| verified | docs/changelog-20260709-final-consolidation.md:54 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn. |
|||
| blocking | docs/changelog-20260709-final-consolidation.md:90 | Genuinely open items still blocking real progress, in rough execution | |||
| verified | docs/changelog-20260709-ipv6-family-matrix-overlay.md:58 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn. |
|||
| verified | docs/changelog-20260709-ipv6-family-matrix-overlay.md:69 | over-v6 verified" gate: (a) confirm the 8 inferred-by-pattern charms' | |||
| verified | docs/changelog-20260709-maas-scripts-dc-param.md:48 | maas-reset.md` (see VERIFIED below). | |||
| verified | docs/changelog-20260709-maas-scripts-dc-param.md:56 | VERIFIED (this workstation; no jq installed, no live jumphost/MAAS/juju | |||
| verified | docs/changelog-20260709-maas-scripts-dc-param.md:84 | this delivery's. Instead, correctness was verified directly (the | |||
| verified | docs/changelog-20260709-maas-scripts-dc-param.md:98 | bypassing the harness's own jq gate, per the VERIFIED bullet above). | |||
| verified | docs/changelog-20260709-mtu-ceph-budget-calculators.md:41 | VERIFIED: | |||
| blocking | docs/changelog-20260709-mtu-ceph-budget-calculators.md:7 | arithmetic in prose today, not a script -- blocking the Stage 1 Phase-0 | |||
| verified | docs/changelog-20260709-mtu-ceph-budget-calculators.md:98 | VERIFIED: | |||
| verified | docs/changelog-20260709-netbox-dc-dc-pipeline.md:68 | VERIFIED, not just asserted: | |||
| verified | docs/changelog-20260709-netem-ula-gua-proposal.md:39 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn. |
|||
| blocking | docs/changelog-20260709-office1-network-edge.md:127 | blocking dependency for instantiating ANY of the three sites' | |||
| verified | docs/changelog-20260709-office1-network-edge.md:52 | VERIFIED: | |||
| verified | docs/changelog-20260709-office1-network-edge.md:97 | VERIFIED: bash scripts/repo-lint.sh: 0 fail (module block is commented |
|||
| unverified | docs/changelog-20260709-opentofu-audit.md:10 | ### 1. DOCFIX-148 -- audited every flagged UNVERIFIED/inferred/assumed note | |||
| unverified | docs/changelog-20260709-opentofu-audit.md:15 | METHOD: grepped the entire opentofu/ tree for every "UNVERIFIED"/"NOT |
|||
| unverified | docs/changelog-20260709-opentofu-audit.md:57 | remains unverified. | |||
| unverified | docs/changelog-20260709-opentofu-cloudinit-vm.md:64 | then tofu providers schema -json to confirm the remaining unverified |
|||
| verified | docs/changelog-20260709-opentofu-scaffold.md:48 | interfaces, filesystems, graphics, etc.) could not be verified with enough | |||
| verified | docs/changelog-20260709-opentofu-scaffold.md:62 | all before this, since none existed) -- verified this introduces no new | |||
| verified | docs/changelog-20260709-opnsense-config-design.md:44 | real behavior -- happy path, well-formed-XML output (verified with | |||
| verified | docs/changelog-20260709-opnsense-edge-module.md:38 | path -- not independently verified. | |||
| unverified | docs/changelog-20260709-opnsense-edge-module.md:53 | disk, not over the network, so the field flagged UNVERIFIED in | |||
| unverified | docs/changelog-20260709-opnsense-edge-module.md:91 | against a real OPNsense instance rather than sourced-but-unverified research. | |||
| verified | docs/changelog-20260709-opnsense-research.md:54 | (genisoimage/xorriso -- exact tool/flags not yet verified against a |
|||
| verified | docs/changelog-20260709-repo-agnostic-sweep.md:38 | entirely. Verified no new L1 findings from widening scope (checked non-ASCII/ | |||
| verified | docs/changelog-20260709-repo-lint-crlf-fix.md:24 | VERIFIED: re-ran --record-clientdocs-sweep after the fix; sweep-receipt.txt |
|||
| blocking | docs/changelog-20260709-stage0-ratification.md:4 | of docs/dc-dc-deployment-workflow.md, the gate blocking real Phase-0/1/2 |
|||
| verified | docs/changelog-20260709-stage0-ratification.md:64 | VERIFIED, not just asserted: bash scripts/ledger-scan.sh's "PROPOSED / OPEN |
|||
| blocking | docs/changelog-20260710-carve-gua-hang-fix.md:29 | any FUTURE blocking regression in this Python test self-aborts after 30s with a | |||
| verified | docs/changelog-20260710-opentofu-state-file-security.md:31 | OUTPUT -- verified against HashiCorp's own current documentation (not | |||
| verified | docs/changelog-20260710-phase01-bundle-staleness-fix.md:48 | VERIFIED: bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn. |
|||
| verified | docs/changelog-20260710-sweep-bundle-fixes.md:7 | DOCFIX-167 edit, since that edit only added/verified the 5 new charms. | |||
| verified | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:42 | those step BODIES (verified by reading them) still showed only raw | |||
| verified | docs/changelog-20260710-sweep-script-fixes.md:20 | instead, verified via the same reproduction technique before committing. | |||
| verified | docs/changelog-20260710-sweep-script-fixes.md:45 | Fixed with the verified if pipeline; then :; fi idiom (see the process |
|||
| verified | docs/changelog-20260710-sweep-script-fixes.md:82 | convention. Re-verified bash scripts/ledger-scan.sh still reports the |
|||
| verified | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:62 | targeting-risk warning text) was verified against HashiCorp's own current | |||
| verified | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:97 | verified clean of the self-inflicted false positive before this number was | |||
| verified | docs/changelog-20260711-ula-gen-command-fix.md:12 | s/\(..\)\(....\)\(....\)/\1:\2:\3/ -> fdXX:XXXX:XXXX::/48. Verified: the |
|||
| unverified | docs/changelog-20260712-docfix189-max-context-session-audit.md:56 | - "OPNsense's 3 GB min" is UNVERIFIED (incident report, ranked step 3). No s... | |||
| verified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:110 | Proposed durable fix (NOT yet implemented/verified): have the runbook/module pre... | |||
| verified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:85 | 172.30.1.2 / LAN 10.10.0.1. The config ISO is verified well-formed -- it... |
|||
| unverified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:90 | This is the mechanism modules/opnsense-edge's own header has always flagged UN... |
|||
| unverified | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:109 | minimum RAM (the incident report's "3 GB" is UNVERIFIED) and bump to 4096 if war... | |||
| unexercised | docs/changelog-20260712-office1-opnsense-edge-build.md:5 | this repo -- reviewed-but-unexercised module + image chain. This records the rep... | |||
| verified | docs/changelog-20260713-docfix194-opentofu-module-validation.md:29 | Verified against the provider's own schema (tofu providers schema -json, dmacv... |
|||
| verified | docs/changelog-20260713-office1-dhcp-apply.md:30 | NOT yet verified end-to-end: an actual client DHCPDISCOVER->lease. No client exi... | |||
| verified | docs/changelog-20260713-office1-headend-maas-lxd.md:56 | raw.dnsmasq="port=0". Verified after the fact: dnsmasq runs but holds zero... |
|||
| imported | docs/changelog-20260713-office1-netbox-deployed.md:88 | - The D-115 carve is NOT yet imported into this NetBox (it is the next step). | |||
| blocking | docs/changelog-20260713-opnsense-api-client.md:39 | ## Not done yet -- the blocking step | |||
| verified | docs/changelog-20260713-opnsense-apikey-bootstrap.md:18 | OPNsense stores API secrets as crypt(secret, '$6$') -- SHA-512 with an EMPTY s... |
|||
| verified | docs/changelog-20260713-opnsense-apikey-bootstrap.md:33 | ## VERIFIED END TO END on the live edge (2026-07-12/13) | |||
| verified | docs/changelog-20260713-workflow-doc-status-correction.md:14 | \ | gap #17: "no per-site ISP-uplink network exists anywhere, for ANY site" \ | **... | |
| verified | docs/changelog-20260714-d119-tofu-apply.md:21 | Verified ON THE HOST, not just in state: | |||
| verified | docs/changelog-20260715-creds-audit.md:32 | *-creds/). Reads NO secret values -- metadata only (stat/size), verified b... |
|||
| verified | docs/changelog-20260715-creds-audit.md:49 | the SEC-009 sandbox-token gap is now closed and tool-verified. | |||
| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:1 | # 2026-07-15 -- C2 sub-task (ii): D-120 bands loaded + verified; sandbox loop ex... | |||
| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:16 | Verified live: the endpoints dump (0/0 before the load). | |||
| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:42 | validated VR1 dataset, verified by a fidelity check that covers every object cla... | |||
| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:9 | fidelity check. This closes that gap and then does the load, verified. | |||
| verified | docs/changelog-20260715-d120-office1-service-reip.md:12 | No wipe. Both services verified on the wire: | |||
| blocking | docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md:6 | runbooks/dc-dc-phase2-tofu-dc-substrate.md to surface its blocking decisions b... |
|||
| imported | docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md:77 | assigned (D-115 10.12.64.0/19, imported to office1-netbox); it stays out of sc... |
|||
| verified | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:36 | D-120 child ranges + service IPs), verified by (i) a hardened-fidelity-check re-... | |||
| verified | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:58 | D-120 load cannot be machine-verified until they are extended (each with its har... | |||
| verified | docs/changelog-20260715-fidelity-check-scope-correctness.md:1 | # 2026-07-15 -- C2 sub-task (i): sandbox re-verified faithful; fidelity checker ... | |||
| unverified | docs/changelog-20260715-stage3-prereqs-prep.md:77 | (the to: list-replace merge is the one unverified overlay mechanism). |
|||
| unexercised | docs/changelog-20260716-d126-durable-forward.md:63 | ## Forward layer -- reviewed-but-UNEXERCISED (operator completes if/when wanted) | |||
| verified | docs/changelog-20260716-review-sweep-phaseAB.md:32 | reads the ADOPTED token cleanly (R3-F09; verified -- D-115 no longer flagged PRO... | |||
| blocking | docs/changelog-20260716-review-sweep-phaseAB.md:6 | ruled the review's blocking decisions step-by-step (R-1..R-4, logged in `docs/se... | |||
| blocking | docs/changelog-20260716-review-sweep-phaseC.md:57 | - Agent cross-check of the two-root reshape: FAITHFUL, no BLOCKING. | |||
| blocking | docs/changelog-20260716-review-sweep-phaseC.md:8 | the two-root implementation was cross-checked by a second agent (verdict: FAITHF... | |||
| verified | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:29 | HARD GATE verified: tofu plan shows the two EXISTING Office1 domains (voff... |
|||
| verified | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:15 | services (netbox, netbox-worker, postgres, redis, redis-cache) -- verified via `... | |||
| verified | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:20 | ## Apex writes (Block A -- gated, dry-run-verified then committed) | |||
| verified | docs/dc-dc-buildout-design.md:129 | controller backup taken and stored; Ceph-over-v6 and geneve-over-v6 verified. | |||
| verified | docs/dc-dc-buildout-design.md:13 | openstack-caracal-dc-dc (verified). Six-plane values are scripts/lib-net.sh |
|||
| verified | docs/dc-dc-buildout-design.md:92 | Gate: nested KVM verified; disk budget computed and the Ceph size decision recor... | |||
| verified | docs/dc-dc-deployment-workflow.md:132 | the COMPLETE validated dataset, NOT by any upstream write. See C2 for what "comp... | |||
| verified | docs/dc-dc-deployment-workflow.md:141 | \ | C2 \ | office1-netbox (10.10.1.10) is the VR1 IPAM apex -- a working draft (... |
|
| blocking | docs/dc-dc-deployment-workflow.md:163 | **Rulings landed (through 2026-07-16; supersedes the earlier "two blocking rulin... | |||
| blocking | docs/dc-dc-deployment-workflow.md:187 | Blocking to EXECUTE (all operator-gated): the HELD NetBox addressing -- **D-... | |||
| verified | docs/dc-dc-deployment-workflow.md:216 | \ | Gate \ | preflight.sh PASS before add-model; post-deploy `cloud-assert.s... |
|
| blocking | docs/dc-dc-deployment-workflow.md:219 | \ | Authoring status \ | **Runbook WRITTEN 2026-07-09: `runbooks/dc-dc-phase4-... | |
| unverified | docs/dc-dc-deployment-workflow.md:219 | \ | Authoring status \ | **Runbook WRITTEN 2026-07-09: `runbooks/dc-dc-phase4-... | |
| verified | docs/dc-dc-deployment-workflow.md:27 | per-DC. Verified via bash scripts/ledger-scan.sh: none of D-100..D-110 |
|||
| verified | docs/dc-dc-deployment-workflow.md:331 | > longer takes config_iso_path (verified -- no config_seed/config_iso_path... |
|||
| verified | docs/dc-dc-deployment-workflow.md:41 | \ | Gate \ | Nested KVM verified; disk budget computed + Ceph size decision re... | |
| unverified | docs/dc-dc-deployment-workflow.md:432 | UNVERIFIED in node-vm/main.tf, an inference by pattern not a confirmed |
|||
| blocking | docs/dc-dc-deployment-workflow.md:542 | that were manual arithmetic in prose, not a script, blocking the Stage 1 | |||
| verified | docs/dc-dc-deployment-workflow.md:721 | is verified (0.0% loss). So the topology question is ANSWERED and the | |||
| verified | docs/dc-dc-deployment-workflow.md:767 | var.maas_api_key in plaintext (verified against HashiCorp's own docs, |
|||
| unexercised | docs/dc-dc-deployment-workflow.md:875 | \ | opentofu/ (networks/pools/node-VM PXE/cloud-init-VM patterns) \ |
**VALIDATE... | |
| verified | docs/dc-dc-netbox-buildout-scope.md:288 | IPAM apex) holds the COMPLETE validated dataset AND it is VERIFIED. Two sub-task... | |||
| verified | docs/dc0-deploy-readiness.md:117 | - voffice1 + office1-opnsense are BOTH autostart=enable (set 2026-07-17, e... |
|||
| verified | docs/dc0-deploy-readiness.md:120 | virsh shutdowns the guests first so the reboot exercises the verified **cold-b... |
|||
| verified | docs/dc0-deploy-readiness.md:21 | ## A. Readiness ESTABLISHED (done, verified this session) | |||
| blocking | docs/dc0-deploy-readiness.md:32 | - Blocking design rulings LANDED -- D-121/122/123/124 ADOPTED; R-1 Model B, ... | |||
| verified | docs/dc0-deploy-readiness.md:35 | ## B. The outer-root plan -- VERIFIED SAFE (this is the apply gate) | |||
| verified | docs/dc0-deploy-readiness.md:37 | tofu -chdir=opentofu plan => 5 add / 2 in-place / 6 destroy, decomposed an... |
|||
| verified | docs/dc0-deploy-readiness.md:39 | -- an update-in-place (verified: NOT replacement; replacement would destroy ... | |||
| non-blocking | docs/dc0-deploy-readiness.md:75 | (D-100 gap #11) is DEFERRED. Non-blocking for the outer apply. | |||
| non-blocking | docs/dc0-deploy-readiness.md:86 | ### C4. IPAM record hygiene (parallel, NON-blocking -- now runnable via `ssh off... | |||
| non-blocking | docs/dc0-deploy-readiness.md:93 | ### C5. Record-hygiene sweep (NON-blocking; queued from the Stage-3 adversarial ... | |||
| verified | docs/design-decisions.md:1063 | Status: PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... | |||
| verified | docs/design-decisions.md:1124 | ### D-063 -- RESOLVED / CLOSED (2026-07-03): applied and functionally verified | |||
| verified | docs/design-decisions.md:1172 | Status: RESOLVED / CLOSED (applied + functionally verified 2026-07-03). Supe... | |||
| unblocked | docs/design-decisions.md:1262 | create_trust with identity:create_trust 403 -- AFTER D-064 unblocked create_user... | |||
| verified | docs/design-decisions.md:1504 | D-011 item 6 read "Vault unseal + auto-unseal-after-reboot pattern verified". Th... | |||
| verified | docs/design-decisions.md:1508 | verified (sealed-on-restart is BY DESIGN, not a fault)". The acceptance bar and ... | |||
| unexercised | docs/design-decisions.md:1584 | mentions in the repo are dated as-built value captures. An adopted-but-unexercis... | |||
| verified | docs/design-decisions.md:1710 | https 200 on 10.12.4.58 and 10.12.8.58 (vault-CA-verified, csrftoken cookie pres... | |||
| verified | docs/design-decisions.md:1769 | (evidence-gated per D-064: code-guarded, and no verified shipped-default strings... | |||
| imported | docs/design-decisions.md:209 | Deferred to v2 (per Q2): VR0 DC0-VLANs group additions beyond VID 240 (alrea... | |||
| verified | docs/design-decisions.md:2162 | - The DC-DC decision series starts at D-100 in the repo `openstack-caracal-dc-dc... | |||
| verified | docs/design-decisions.md:223 | 6. Vault unseal + auto-unseal-after-reboot pattern verified | |||
| verified | docs/design-decisions.md:2279 | but comes up on FACTORY DEFAULTS. The config ISO is well-formed and correctly at... | |||
| unverified | docs/design-decisions.md:2310 | nano image -- and it does not. The module header has always flagged this exact m... | |||
| unverified | docs/design-decisions.md:2317 | importer, no ISO, no boot-time interactivity. RISK/UNVERIFIED: writing FreeBSD U... | |||
| verified | docs/design-decisions.md:2349 | 2. VyOS LTS binaries are subscription-gated (verified 2026-07-13, vyos.net/g... | |||
| verified | docs/design-decisions.md:2468 | the internet, serves DHCP, managed over SSH with a verified push pipeline). Edge... | |||
| verified | docs/design-decisions.md:3069 | CSPRNG-generated. That claim originates in an earlier session and **cannot be re... | |||
| imported | docs/design-decisions.md:3170 | break the already-imported sandbox prefixes. | |||
| verified | docs/design-decisions.md:3260 | Re-IP executed on the two running services, no wipe, verified on the wire: | |||
| blocking | docs/design-decisions.md:3306 | Stage 3's modules/node-vm sizing/count (was blocking phase2 runbook Step 6 -- ... |
|||
| unblocked | docs/design-decisions.md:3306 | Stage 3's modules/node-vm sizing/count (was blocking phase2 runbook Step 6 -- ... |
|||
| verified | docs/design-decisions.md:3376 | leans on the already-3-unit mysql-innodb-cluster. Must be verified against the d... | |||
| verified | docs/design-decisions.md:361 | What is lost vs. graceful path: verified-clean release path for CAPI workloa... | |||
| unexercised | docs/design-decisions.md:3794 | continue that"). Tooling delivered (scripts/site-forward.sh + harness, reviewe... |
|||
| unexercised | docs/design-decisions.md:3850 | met. The systemd FORWARD layer (site-forward.sh) remains reviewed-but-unexerci... |
|||
| verified | docs/design-decisions.md:3918 | settings are applied AFTER a verified clean cold boot (operator sequencing). | |||
| verified | docs/design-decisions.md:3931 | - **office1-opnsense -> AUTOSTART, but enable only AFTER one verified post-fix c... | |||
| unverified | docs/design-decisions.md:3934 | boot post-fix is unverified ("live boot verification is the remaining gated step... | |||
| verified | docs/design-decisions.md:3947 | office1-opnsense after its verified cold boot); runs as jessea123 via the libv... |
|||
| verified | docs/design-decisions.md:3954 | matrix against drift (auto-booting the 416 GiB container / MAAS nodes is the exa... | |||
| verified | docs/design-decisions.md:428 | Finding (verified 2026-06-05): k8s-keystone-auth 1.5.1 exposes no keystone-C... | |||
| verified | docs/design-decisions.md:45 | Verification source: Caracal channel matrix per Canonical Charmed OpenStack ... | |||
| blocking | docs/design-decisions.md:565 | - magnum-shared-db missing colon ? causes a relation endpoint syntax error, de... |
|||
| verified | docs/design-decisions.md:584 | \ | 2026-05-22 \ | D-002 hacluster row added (channel 2.4/stable) per Canonical ... |
|
| verified | docs/design-decisions.md:666 | Status: Adopted + APPLIED 2026-06-11; re-verified 2026-06-16 post phase-05. | |||
| verified | docs/design-decisions.md:712 | Rationale: (1) FINDING-3 -- glance's web-download plugin fetches with urllib... | |||
| verified | docs/design-decisions.md:755 | Why this approach (and NOT enforce_scope): Charmed OpenStack deliberately do... | |||
| non-blocking | docs/design-decisions.md:761 | base_* alignment (open verification, non-blocking): the base_* rules in `dom... | |||
| verified | docs/design-decisions.md:769 | Status: ADOPTED 2026-06-25 (operator-approved). AUTHORITATIVE; SUPERSEDES th... | |||
| verified | docs/design-decisions.md:789 | - Ceph control relations (ceph-mon client/mon/osd/mds/radosgw/rbd-mirror/bootstr... | |||
| verified | docs/design-decisions.md:928 | No re-CIDR. The live MAAS is already on D-052/D-053 (verified 2026-06-29: ju... | |||
| verified | docs/design-decisions.md:947 | restored). The bundle diff bf7de5a..HEAD was verified to be PURELY D-057/D-058... |
|||
| verified | docs/design-decisions.md:957 | scripts/d057-bundle-check.py. Verified PASS against the reverted bundle. |
|||
| verified | docs/docfix-draft-20260702.md:177 | pattern verified"; phase-08 D-011.6 rules MANUAL unseal is the v1 standard (auto... | |||
| verified | docs/docfix-draft-20260702.md:192 | IMPLEMENTED in the delivered ZIP (numbers verified next-free at HEAD 690779a; | |||
| verified | docs/docfix-draft-20260702.md:4 | Numbers are PROVISIONAL from next-free DOCFIX-066 (verified against HEAD | |||
| verified | docs/docfix-draft-20260702.md:64 | scripts/lib-hosts.sh (host identity); retain only verified-current literals. | |||
| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:124 | each DC containment VM, so it scales badly. Mechanism -- partially verified:... | |||
| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:125 | is NO provider-level knob for the staging path (VERIFIED via | |||
| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:129 | os.TempDir(), i.e. $TMPDIR for the tofu process -- **UNVERIFIED by |
|||
| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:138 | verified empirically against live state: | |||
| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:147 | VERIFIED AGAINST PRIMARY SOURCE (provider v0.9.8, | |||
| blocking | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:3 | Class: deploy-blocking drift, discovered during pre-apply re-verification. | |||
| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:58 | ## The seed-volume replacement (root cause; danger UNVERIFIED) | |||
| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:86 | UNVERIFIED -- do not treat as established: what provider 0.9.8 actually does... | |||
| non-blocking | docs/handoff-20260705-open-items.md:53 | live tenant -- operator, browser; non-blocking. | |||
| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:66 | ## What was tried -- ALL applied and verified in the domain XML, NONE resolved i... | |||
| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:69 | 2. machine q35 -> i440fx (pc-i440fx-noble, verified). No change. (Note: ... |
|||
| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:72 | 3. Disk: COW overlay -> direct per-VM copy of the nano (verified 11 GiB / 2.... | |||
| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:74 | 4. CPU host-passthrough (verified). No change. |
|||
| unverified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:91 | UNVERIFIED (no source given); do not propagate it. If 2 GiB proves insufficient ... | |||
| imported | docs/netbox-vip-queue.md:3 | Status: Queued. To be imported after successful cloud deployment + validatio... | |||
| unblocked | docs/netbox-vip-queue.md:81 | ## Execution path (when unblocked) | |||
| blocking | docs/netbox-vip-queue.md:9 | under workstream 2 (2026-05-22) to avoid blocking the rebuild on the engineer | |||
| verified | docs/phase-00-maas-standup-notes.md:14 | script refuses to build onto a CIDR the wrong plane occupies. Verified idempoten... | |||
| verified | docs/security-ledger.md:21 | \ | SEC-010 \ | 2026-07-16 \ | **metal-admin DC-LOCAL invariant (D-052/D-100) is PR... |
| unblocked | docs/session-findings-2026-07-02.md:11 | 1. D-064 (prior): create_user template fix unblocked trustee-user creation. | |||
| verified | docs/session-ledger.md:1053 | is jumbo, underlay_mtu=9000 (operator ruling; verified on all 10 nets). | |||
| verified | docs/session-ledger.md:1070 | Idempotent, and verified FIELD-BY-FIELD against the upstream draft | |||
| unblocked | docs/session-ledger.md:1088 | ###
|
|||
| imported | docs/session-ledger.md:1088 | ###
|
|||
| imported | docs/session-ledger.md:1096 | Imported into the sandbox: six-plane roles + 2 RIRs + 5 aggregates, then **V... | |||
| blocking | docs/session-ledger.md:1136 | ### Also open (recorded, not blocking) | |||
| verified | docs/session-ledger.md:118 | --commitand VERIFIED by the (now-extended) fidelity check -> exit 0. Theip-r... |
|||
| verified | docs/session-ledger.md:128 | 10.10.1.0/24 via 10.10.0.20 dev virbr2` in a real terminal; verified HTTP 302 at... | |||
| unexercised | docs/session-ledger.md:138 | the guard/classifier). The systemd FORWARD layer stays reviewed-but-unexercised ... | |||
| verified | docs/session-ledger.md:142 | Both blocks COMMITTED (gated, dry-run-verified; token server-side, sandbox-only)... | |||
| verified | docs/session-ledger.md:155 | vvr1-dc0/nodes=FALSE); opentofu T11-T15 pin it; HARD GATE verified (voffice1/off... | |||
| verified | docs/session-ledger.md:162 | build). D-127 RULED: voffice1 autostarts; office1-opnsense autostarts AFTER one ... | |||
| verified | docs/session-ledger.md:176 | (graceful ACPI virsh shutdown -> confirmed shut off -> virsh start) and VE... |
|||
| verified | docs/session-ledger.md:178 | gw + egress 0% loss, netbox 302 + tailscale reachable behind it. That satisfies ... | |||
| verified | docs/session-ledger.md:181 | stay MANUAL and do not exist yet). **LXD service-VM autostart VERIFIED (2026-07-... | |||
| blocking | docs/session-ledger.md:205 | docs/dc-dc-deployment-workflow.md's Stage 3 section still reads "**Blocking to... |
|||
| blocking | docs/session-ledger.md:210 | blocker; the workflow doc's Stage-3 "Blocking to EXECUTE" line needs a DOCFIX (n... | |||
| unverified | docs/session-ledger.md:222 | state drift, not a config change (the volume-replace CONSEQUENCE on a running do... | |||
| verified | docs/session-ledger.md:252 | Mechanism correction: there is NO provider knob for this (VERIFIED via `... | |||
| unverified | docs/session-ledger.md:254 | almost certainly $TMPDIR for the tofu process (Go os.TempDir()), UNVERIF... |
|||
| verified | docs/session-ledger.md:261 | evidence say v1.12.3. Presumed to have arrived with the host patch (not veri... | |||
| verified | docs/session-ledger.md:265 | ESTABLISHED: (1) An autostart-ONLY diff bounces the guest -- VERIFIED FROM P... | |||
| verified | docs/session-ledger.md:287 | clean). Outer-root tofu plan RUN + VERIFIED SAFE: 5 add (vvr1-dc0 416GiB/108... |
|||
| verified | docs/session-ledger.md:288 | 0 change / 6 destroy (the six EMPTY vr1-dc0 planes relocating to the inner root ... | |||
| blocking | docs/session-ledger.md:312 | hard-gate grounds (substrate design is sound). BLOCKING headline: **2 decisions ... | |||
| unverified | docs/session-ledger.md:347 | vault-hacluster VIP. Still 3x manual unseal (SEC-003). **HARD FEASIBILITY GATE... |
|||
| verified | docs/session-ledger.md:352 | - [R-2 FEASIBILITY GATE FAILED -- verified 2026-07-16.] `bundle.yaml:133-138... | |||
| verified | docs/session-ledger.md:414 | applied+verified on vvr1-dc0. | |||
| blocking | docs/session-ledger.md:426 | - Model B cross-check (agent) = FAITHFUL, no BLOCKING; fixes applied: 32-GiB... | |||
| verified | docs/session-ledger.md:43 | but stays OPEN until applied + verified on vvr1-dc0. SEC-008 -- the vcloud re-en... | |||
| imported | docs/session-ledger.md:49 | record. Also: D-124 transit addressing PINNED (172.31.0.0/24) + imported to offi... | |||
| blocking | docs/session-ledger.md:512 | Walked the phase2 runbook and surfaced its blocking decisions; the operator rule... | |||
| imported | docs/session-ledger.md:592 | supernet" -- D-115 ALREADY assigned it (10.12.64.0/19, imported to office1-net... |
|||
| imported | docs/session-ledger.md:622 | upstream draft and PROVEN faithful field-by-field; carve + six-plane roles + BOT... | |||
| verified | docs/session-ledger.md:628 | Address 2602:f3e2:f01:100::1/64 on the edge LAN (kernel-verified) + radvd adve... |
|||
| verified | docs/session-ledger.md:703 | (--commit, operator-approved) and VERIFIED: re-dump + fidelity check -> exit 0... |
|||
| verified | docs/session-ledger.md:72 | tofu apply: 11 added, 0 changed, 11 destroyed; tofu plan now reports "No... |
|||
| verified | docs/session-ledger.md:723 | ORG_ULA_48 = fd50:840e:74e2::/48 (D-118 ADOPTED -- RFC 4193 valid, and... |
|||
| imported | docs/session-ledger.md:727 | All are IMPORTED and fidelity-checked in the sandbox. | |||
| verified | docs/session-ledger.md:818 | ABSENT on all three), idempotent grep-guarded append, verified 2 keys each. This... | |||
| verified | docs/session-ledger.md:835 | only os-git-backup installed, and UNCONFIGURED (php-verified no config nod... |
|||
| verified | docs/session-ledger.md:852 | INSTALL VERIFIED 2026-07-18 (operator ran the firmware POSTs via !): `os-q... |
|||
| verified | docs/session-ledger.md:897 | -- VERIFIED still open), then use the combined gate to regenerate the stale rest... | |||
| verified | docs/session-ledger.md:900 | watch + D-066-evidence wrapper. NOT STARTED (verified absent). | |||
| verified | docs/session-ledger.md:913 | PROPOSED/OPEN. D-063 is RESOLVED / CLOSED in design-decisions.md (verified).... |
|||
| blocking | docs/stage3-adversarial-review-20260716.md:111 | - Contested (severity): A1 argues MAJOR-not-BLOCKING for D-123 -- a status L... | |||
| blocking | docs/stage3-adversarial-review-20260716.md:113 | (L1-07). Adjudication: kept BLOCKING because (i) the prompt frames C2 as BLOCKIN... | |||
| blocking | docs/stage3-adversarial-review-20260716.md:113 | (L1-07). Adjudication: kept BLOCKING because (i) the prompt frames C2 as BLOCKIN... | |||
| blocking | docs/stage3-adversarial-review-20260716.md:262 | deploy-BLOCKING: a status label is not a value "entering a command" (hard-rule-2... | |||
| blocking | docs/stage3-adversarial-review-20260716.md:265 | specific inference. Code's adjudication keeps R3-F01 BLOCKING on decision-record... | |||
| verified | docs/stage3-adversarial-review-20260716.md:294 | run). Integration -- with one A4 claim verified-and-rejected (I check agent cita... | |||
| verified | docs/stage3-adversarial-review-20260716.md:300 | Verified: the runbook does NOT -- at :507 it cites "D-123 (PROPOSED, recommend... |
|||
| blocking | docs/stage3-adversarial-review-20260716.md:329 | Blocking conditions to clear (each operator-gated, applied in a post-acceptance ... | |||
| verified | docs/stage3-adversarial-review-20260716.md:50 | claims hold independently, but specific benchmark/control identifiers should be ... | |||
| blocking | docs/stage3-adversarial-review-20260716.md:73 | ### R3-F01 -- BLOCKING -- Two ADOPTED rulings rest on inferred/agent-authored op... | |||
| verified | docs/stage3-adversarial-review-20260716.md:79 | sub-ruling. Code verified the second case directly against the transcript (L1-13... | |||
| blocking | docs/stage3-review-base.patch:12 | +runbooks/dc-dc-phase2-tofu-dc-substrate.md to surface its blocking decisions ... |
|||
| imported | docs/stage3-review-base.patch:1320 | +# imported to office1-netbox), superseding the old "wait for NetBox" premise. I... | |||
| imported | docs/stage3-review-base.patch:1897 | + that carve is imported to office1-netbox. So the blocker is no longer a |
|||
| unblocked | docs/stage3-review-base.patch:1928 | + used to block Step 6; it is now UNBLOCKED. Still open (one sub-ruling | |||
| unverified | docs/stage3-review-base.patch:205 | + (the to: list-replace merge is the one unverified overlay mechanism). |
|||
| unblocked | docs/stage3-review-base.patch:2187 | -GATE: base image path and (if unblocked) config ISO path recorded as real | |||
| unblocked | docs/stage3-review-base.patch:2285 | -ends at whatever the last unblocked step was (Step 5 or wherever Step 4 left | |||
| verified | docs/stage3-review-base.patch:2544 | -honestly rather than declaring edge routing verified when it is not. | |||
| verified | docs/stage3-review-base.patch:2547 | +record that honestly rather than declaring edge routing verified when it is | |||
| blocking | docs/stage3-review-base.patch:325 | +Two blocking rulings landed 2026-07-15 (from a walk of the runbook's decisi... | |||
| blocking | docs/stage3-review-base.patch:364 | +Stage 3's modules/node-vm sizing/count (was blocking phase2 runbook Step 6 --... |
|||
| unblocked | docs/stage3-review-base.patch:364 | +Stage 3's modules/node-vm sizing/count (was blocking phase2 runbook Step 6 --... |
|||
| verified | docs/stage3-review-base.patch:434 | + leans on the already-3-unit mysql-innodb-cluster. Must be verified against... | |||
| blocking | docs/stage3-review-base.patch:660 | +\ | SEC-011 \ | 2026-07-16 \ | Node least-connectivity gap (not an L2 breach).... |
| blocking | docs/stage3-review-base.patch:721 | +Walked the phase2 runbook and surfaced its blocking decisions; the operator rul... | |||
| imported | docs/stage3-review-base.patch:801 | + supernet" -- D-115 ALREADY assigned it (10.12.64.0/19, imported to office1-... |
|||
| imported | docs/stage3-review-base.patch:83 | + assigned (D-115 10.12.64.0/19, imported to office1-netbox); it stays out of... |
|||
| verified | docs/tenant-onboarding-contract.md:94 | VERIFIED LIVE 2026-07-07 (devteam, full three-account walkthrough): login | |||
| verified | docs/upstream-bug-draft-dashboard-tls.md:29 | (verified: plain-HTTP GET to :433 answers 200). TLS clients fail handshake | |||
| verified | docs/upstream-bug-draft-dashboard-tls.md:41 | Bind cluster to the same space as the application default binding. Verified: |
|||
| imported | docs/v1-pre-deploy-fixes.md:654 | The IPv6 prefixes already imported into NetBox (and marked Reservation status) i... | |||
| verified | docs/v1-redeploy-changelog.md:1028 | core-verified cloud -- mysql clustered, Vault PKI up, cert cascade settled, 31/3... | |||
| verified | docs/v1-redeploy-changelog.md:117 | practice (D-054): tested scripts committed to the repo, verified by sha256 on th... | |||
| verified | docs/v1-redeploy-changelog.md:13 | (Verified by grep of design-decisions.md: max D-053, max DOCFIX-038.) | |||
| unblocked | docs/v1-redeploy-changelog.md:1312 | identity:create_trust 403 -- AFTER D-064 unblocked create_user (trustee user cre... | |||
| verified | docs/v1-redeploy-changelog.md:1371 | remote_binding (LP#1895185, verified at vendored commit 6f7848c), so the externa... | |||
| verified | docs/v1-redeploy-changelog.md:1382 | Also this session: handoff commit 22a1eef verified 7/8 (bundle.yaml was DELETED ... | |||
| verified | docs/v1-redeploy-changelog.md:1383 | commit pattern; restored + verified in 10e9186 -- diff vs pre-delete is exactly ... | |||
| verified | docs/v1-redeploy-changelog.md:1400 | template create (stage5) drops --keypair (keypair_id optional, default=None -- v... | |||
| verified | docs/v1-redeploy-changelog.md:1456 | tests/*/run-tests.sh; both harnesses in this package were verified under it pre-... | |||
| verified | docs/v1-redeploy-changelog.md:1511 | ### 2026-07-03 (addendum 4) -- 8d verified; V-1 ruled; D-063 measured + adopted ... | |||
| verified | docs/v1-redeploy-changelog.md:1585 | ### 2026-07-03 (addendum 7) -- D-063 RESOLVED/CLOSED: applied + functionally ver... | |||
| verified | docs/v1-redeploy-changelog.md:1589 | /32 on 22. VERIFIED through the tightened SG: (R1) TCP handshake magnum/0 -> mgm... | |||
| verified | docs/v1-redeploy-changelog.md:17 | ## Verified-state checkpoint (measured this session -- authoritative as-built) | |||
| verified | docs/v1-redeploy-changelog.md:1880 | Identifier consumed: BUNDLEFIX-010 (vault bundle revert; scan-verified next-free... | |||
| verified | docs/v1-redeploy-changelog.md:2016 | provider-public). VERIFIED: https 200 on 10.12.4.58 + 10.12.8.58 for the FIRST | |||
| verified | docs/v1-redeploy-changelog.md:2017 | TIME on this build, vault-CA-verified with csrftoken cookie present; http leg | |||
| verified | docs/v1-redeploy-changelog.md:2037 | readback grep (juju-ssh quoting); the render had in fact succeeded -- verified | |||
| verified | docs/v1-redeploy-changelog.md:2171 | abort discipline. Check ids verified against validate.sh (--checks, --list). | |||
| unverified | docs/v1-redeploy-changelog.md:2178 | snap-channel-headroom measurement + Sunbeam parity watch. UNVERIFIED items | |||
| verified | docs/v1-redeploy-changelog.md:2217 | is 1.12.11, not 1.14.x. Listener TLS options verified present and empty: | |||
| verified | docs/v1-redeploy-changelog.md:2253 | teardown verified server/FIP/SG removed). CANARY_SSH_USER verify-live item | |||
| non-blocking | docs/v1-redeploy-changelog.md:2255 | logged as open, non-blocking per the do-doc. | |||
| verified | docs/v1-redeploy-changelog.md:2262 | application_credential rules -- verified both sides). Fix (operator-ruled): | |||
| verified | docs/v1-redeploy-changelog.md:2326 | node_count=2 deliberate), foil1 complete/verified, acme absent (offboarded), | |||
| verified | docs/v1-redeploy-changelog.md:2355 | orphans only (trusts first, post-delete verified) behind a typed | |||
| unverified | docs/v1-redeploy-changelog.md:2377 | radosgw tenant enablement UNVERIFIED). {{PLACEHOLDER}}-driven; first | |||
| verified | docs/v1-redeploy-changelog.md:2384 | (WARN rc 2 + count; benign-placeholder whitelist; scrub re-verified by | |||
| verified | docs/v1-redeploy-changelog.md:2431 | numbering authority is correct again (verified: highest=104 -> next-free=105 | |||
| verified | docs/v1-redeploy-changelog.md:2489 | in place with a note (the standing identifier-pollution rule; scan verified | |||
| verified | docs/v1-redeploy-changelog.md:2573 | Verified-correct non-changes logged by the pass: -svc-appcred.txt | |||
| verified | docs/v1-redeploy-changelog.md:2580 | it had only read); it re-based onto main and verified its reads against | |||
| unverified | docs/v1-redeploy-changelog.md:2664 | warns UNVERIFIED on the HOLD path. Harness 8->10. REVERT: git checkout | |||
| verified | docs/v1-redeploy-changelog.md:2677 | deferred-findings register -- R5/R6/R7/R9/R11 verified with locations, | |||
| verified | docs/v1-redeploy-changelog.md:268 | the no-DHCP planes never produced a self-lease. Verified: mock self-release path... | |||
| verified | docs/v1-redeploy-changelog.md:2734 | --ram 51200` applied + re-read verified. Values equal the nova class | |||
| verified | docs/v1-redeploy-changelog.md:2766 | delivered occurrences in ~/devteam-package corrected by sed + re-verified | |||
| verified | docs/v1-redeploy-changelog.md:2841 | - DOCFIX-120 -- contract section 5 live verdicts: 5.1 VERIFIED (devteam); | |||
| verified | docs/v1-redeploy-changelog.md:2913 | delivered copies, zero tokens verified); operator pushes tonight. | |||
| verified | docs/v1-redeploy-changelog.md:3000 | verified); operator pushes with the rest tonight. | |||
| verified | docs/v1-redeploy-changelog.md:302 | added its sourced-library shellcheck directive. osd-blank verified via mock | |||
| verified | docs/v1-redeploy-changelog.md:3020 | operator-side; net state verified clean, so no agent delete was needed. | |||
| verified | docs/v1-redeploy-changelog.md:3022 | created in devteam-prod as devteam-svc app-cred. Verified attributes: | |||
| verified | docs/v1-redeploy-changelog.md:3123 | both verified name-based). | |||
| verified | docs/v1-redeploy-changelog.md:3219 | (VERIFIED -- catalog has only glance + product-streams, no registry service); | |||
| verified | docs/v1-redeploy-changelog.md:322 | Next free numbers at section open: design decision D-056; doc fix DOCFIX-042 (ve... | |||
| verified | docs/v1-redeploy-changelog.md:3226 | 3. Scaling (2.5 new): openstack coe cluster resize <cluster> <count> (VERIFIED |
|||
| unverified | docs/v1-redeploy-changelog.md:3232 | UNVERIFIED, see operator follow-up). | |||
| verified | docs/v1-redeploy-changelog.md:3418 | (hard-rule #3; Roosevelt = 1 edit not 6). lib-net verified source-safe before wi... | |||
| non-blocking | docs/v1-redeploy-changelog.md:579 | ALSO (value drift, non-blocking): gss image-stream endpoint is HTTP on metal 10.... | |||
| non-blocking | docs/v1-redeploy-changelog.md:689 | live + D-052. Non-blocking. | |||
| non-blocking | docs/v1-redeploy-changelog.md:724 | confirm it reaches internal glance. Non-blocking. | |||
| verified | docs/v1-redeploy-changelog.md:750 | ec332b438a87c3cc1e38318ced110568392484cc2f33e29c8f4eaf9ecc9de297 verified vs pub... | |||
| verified | docs/v1-redeploy-changelog.md:883 | ### Phase-06 6.0-BOOT verified + 6.0/6.1 scripted (2026-06-27) | |||
| imported | docs/v1-redeploy-changelog.md:885 | ubuntu-24.04-noble imported + active, disk_format=raw, checksum 5fa5b05e...1a44 ... | |||
| verified | docs/v1-redeploy-changelog.md:954 | verified this session. carve-host-interfaces.sh is correct per the as-built | |||
| blocking | docs/v1-redeploy-changelog.md:963 | ex-lbaas enp11s0 to be REMOVED). OPEN blocking question: the interaction with | |||
| imported | docs/vr1-office1-as-built.md:11 | and the divergence gets fixed here. The D-115 carve IS now imported into the... | |||
| verified | docs/vr1-office1-as-built.md:110 | self-hosted control server and verified from the workstation -- the OPNsense... | |||
| imported | docs/vr1-office1-as-built.md:167 | ## 6. IPAM -- what NetBox now says about this site (D-115 carve, imported 2026-0... | |||
| verified | runbooks/appendix-A-troubleshooting.md:253 | - Fix: the four host system_ids are fixed and eyeball-verified | |||
| non-blocking | runbooks/appendix-A-troubleshooting.md:298 | - Impact: NON-BLOCKING -- systemd-resolved deprioritizes .10 and falls through t... | |||
| verified | runbooks/appendix-A-troubleshooting.md:442 | provenance-verified path cloud-wide. | |||
| verified | runbooks/appendix-A-troubleshooting.md:484 | verified blocks: runbooks/ops-capi-recovery.md. | |||
| verified | runbooks/appendix-A-troubleshooting.md:514 | ~15 seconds on NoValidHost. Verified to the megabyte 2026-06-10. Roosevelt | |||
| verified | runbooks/appendix-C-identity-rbac.md:122 | - CORRECTION (verified live 2026-07-01): on THIS deployment a domain manager's `... | |||
| unblocked | runbooks/appendix-D-magnum-trust-model.md:19 | the magnum domain). Unblocked by D-064. PROVEN live. | |||
| unblocked | runbooks/appendix-D-magnum-trust-model.md:21 | user; impersonation=True; roles = the creator's token roles). Unblocked by D-065... | |||
| non-blocking | runbooks/d011-batch3-window-DRAFT.md:15 | open, non-blocking per this doc's own clause. | |||
| blocking | runbooks/dc-dc-office1-service-reip.md:24 | ## Step 0 -- Confirm the recovery backstop FIRST (READ-ONLY, blocking) | |||
| verified | runbooks/dc-dc-office1-service-reip.md:3 | EXECUTED 2026-07-15 (D-120 ADOPTED, option (a)). Both services re-IP'd, no w... | |||
| blocking | runbooks/dc-dc-phase0-vcloud-prep.md:168 | own nested libvirt/OpenStack) is not viable on it. That is a blocking finding | |||
| unexercised | runbooks/dc-dc-phase0-vcloud-prep.md:406 | STAGE-1-VALIDATED (the Stage 2/3 modules remain unexercised). | |||
| unverified | runbooks/dc-dc-phase0-vcloud-prep.md:408 | If validate surfaces a schema mismatch against the flagged UNVERIFIED |
|||
| verified | runbooks/dc-dc-phase0-vcloud-prep.md:464 | storage (verified against HashiCorp's own docs; see opentofu/README.md |
|||
| verified | runbooks/dc-dc-phase0-vcloud-prep.md:500 | GATE (buildout-design Section 4, Phase 0): nested KVM verified (Step 2/4); | |||
| verified | runbooks/dc-dc-phase1-office1-standup.md:157 | command lines are NOT yet verified.** See the PENDING VERIFICATION banner | |||
| blocking | runbooks/dc-dc-phase1-office1-standup.md:679 | this runbook. Record that as the blocking condition rather than inventing | |||
| verified | runbooks/dc-dc-phase1-office1-standup.md:835 | - OpenTofu reaches vcloud host libvirt: MET (Stage 1; re-verified in Ste... | |||
| imported | runbooks/dc-dc-phase1-office1-standup.md:892 | the D-101 literals were genuinely assigned and imported this run. | |||
| verified | runbooks/dc-dc-phase1-office1-standup.md:896 | inherits a verified procedure rather than repeating the verification. | |||
| verified | runbooks/dc-dc-phase2-tofu-dc-substrate.md:176 | the org.qemu.guest_agent.0 virtio-serial channel** (verified ABSENT 2026-07-18... |
|||
| imported | runbooks/dc-dc-phase2-tofu-dc-substrate.md:57 | that carve is imported to office1-netbox. So the blocker is no longer a |
|||
| verified | runbooks/dc-dc-phase2-tofu-dc-substrate.md:674 | record that honestly rather than declaring edge routing verified when it is | |||
| unblocked | runbooks/dc-dc-phase2-tofu-dc-substrate.md:85 | used to block Step 6; it is now UNBLOCKED. Still open (one sub-ruling | |||
| unblocked | runbooks/dc-dc-phase3-maas-enlist-deploy.md:104 | is unblocked at this layer (D-101: DC1 inherits DC0's v4 layout | |||
| imported | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:163 | assigns DC2's real supernet and it's imported via `netbox/dc-dc-prefixes- | |||
| unverified | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:190 | UNVERIFIED -- check the actual charm config/relation-data schema (e.g. | |||
| verified | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:315 | Ceph-over-v6 and geneve-over-v6 verified (Step 12, contingent on Step 6). | |||
| unblocked | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:318 | since only DC1 is unblocked by real address literals today) -> proceed to | |||
| verified | runbooks/dc-dc-phase5-dr-failover-drill.md:13 | and geneve-over-v6 verified. Do not start this runbook against a DC that hasn't ... | |||
| verified | runbooks/dc-dc-phase5-dr-failover-drill.md:465 | restore-verified-working as this drill's own RTO data point (control-plane, dist... | |||
| blocking | runbooks/dc-dc-phase5-dr-failover-drill.md:614 | passed; partial otherwise, with the specific blocking item named). | |||
| verified | runbooks/dc-dc-teardown-rollback.md:16 | (verified against HashiCorp's own current docs where cited), not invented -- | |||
| verified | runbooks/dc-dc-teardown-rollback.md:374 | verified: this runbook's commands have never been run against a real tofu |
|||
| unexercised | runbooks/dc-dc-teardown-rollback.md:376 | opentofu/) -- treat every command here as reviewed-but-unexercised until |
|||
| verified | runbooks/ops-capi-recovery.md:113 | GATE: cluster status: ready. Verified convergence on gp.mid: ~20-21 min from |
|||
| verified | runbooks/ops-capi-recovery.md:218 | Verified timing: ~108 s to ACTIVE; op holds ONLINE; VIP+FIP preserved (VIP port | |||
| verified | runbooks/ops-capi-recovery.md:3 | Status: blocks below are AS-EXECUTED-VERIFIED 2026-06-10 (this is their first | |||
| verified | runbooks/ops-capi-recovery.md:50 | # (no wtmp shutdown entry; verified 2026-06-10). Accepted for this VM class. | |||
| verified | runbooks/ops-capi-recovery.md:91 | GATE: SSH-PORT-OK. Timing (verified, gp.mid): ACTIVE ~20 s; sshd ~3.5 min. | |||
| verified | runbooks/ops-restart-procedure.md:51 | the cloud guests above. FOUNDATIONAL service VMs autostart (voffice1; `office1... |
|||
| unverified | runbooks/ops-update-procedure.md:123 | unhealthy or unverified cloud. Commit the asbuilt/<ts>/ BOM as the |
|||
| verified | runbooks/ops-update-procedure.md:187 | RUN -- jumphost (flags per 1.6; form verified as-executed 2026-07-05) | |||
| verified | runbooks/ops-update-procedure.md:216 | RUN -- jumphost (form verified as-executed 2026-07-05) | |||
| verified | runbooks/ops-update-procedure.md:222 | already brought machine 0's agent to target (verified live; check with | |||
| verified | runbooks/ops-update-procedure.md:88 | version under juju-status, NOT agent-status -- verified 2026-07-05; |
|||
| non-blocking | runbooks/phase-01-bundle-deploy.md:199 | clean). FINDING (non-blocking, R15): the unreachable region resolver `10.12.8.10... | |||
| non-blocking | runbooks/phase-03-core-verify.md:187 | keystone admin on :35357). Two non-blocking notes for later: s3/swift is regis... |
|||
| verified | runbooks/phase-05-octavia-enablement.md:102 | This is the verified canonical block (06-03). One ( set -e ) |
|||
| verified | runbooks/phase-05-octavia-enablement.md:161 | echo "[OK] checksum verified ($GOT)" | |||
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:113 | PROJ_DOMAIN="capi" # as-built, verified live 2... | |||
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:143 | echo "=== flavors (as-built specs; public -- verified live 2026-06-10 pre-teardo... | |||
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:173 | echo "[OK] checksum verified ($GOT)" | |||
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:180 | # as-built (verified live 2026-06-10): visibility=public, os_distro=ubuntu, os_v... | |||
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:24 | - Charmed OpenStack live and verified (phase-03 done); Keystone reachable on the | |||
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:77 | Flavor specs are as-built ground truth (2026-06-08 verified-state checkpoint): | |||
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:94 | AS-BUILT FACTS (verified live 2026-06-10 pre-teardown; supersede the rebuild | |||
| verified | runbooks/phase-07-conductor-graft.md:246 | # AND symlink /usr/bin/helm -> it (/usr/bin IS on the restricted init PATH). Che... | |||
| verified | runbooks/phase-07-conductor-graft.md:493 | /etc/magnum/magnum.conf.d"; verified live viapsand the init scriptshow-ar... |
|||
| verified | runbooks/phase-08-workload-cluster-acceptance.md:138 | echo "[OK] sha512 verified against the azimuth-images 0.28.0 manifest" | |||
| verified | runbooks/tenant-onboarding-v2-DRAFT.md:34 | [PROCEDURE-PENDING] design-derived (appendix-D from magnum source); NOT yet... | |||
| verified | runbooks/tenant-onboarding-v2-DRAFT.md:422 | STATUS: NOT YET LIVE-VERIFIED on the multi-tenant path as of this draft. D-064 f... |
5. Reference integrity
Broken path references
| ref | where |
|---|---|
| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3061 |
| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3072 |
| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3158 |
| creds-manifests/vr1-dc | docs/dc0-deploy-readiness.md:27 |
| docs/3.7 | docs/v1-redeploy-changelog.md:226 |
| docs/CURRENT-STATE.md | docs/audit/grounding-audit-charter.md:119 |
| docs/CURRENT-STATE.md | docs/audit/skill-additions-proposed.md:11 |
| docs/archive | docs/audit/grounding-audit-charter.md:184 |
| docs/changelog | docs/session-ledger.md:24 |
| docs/changelog-20260709-ceph-replication | runbooks/dc-dc-phase5-dr-failover-drill.md:674 |
| docs/changelog-20260709-designate | docs/dc-dc-deployment-workflow.md:658 |
| docs/changelog-20260710 | runbooks/dc-dc-phase0-vcloud-prep.md:7 |
| docs/changelog-20260716-review | docs/session-ledger.md:407 |
| docs/cli/how-to-use-lxd.html | .claude/skills/openstack-cloud-ops/references/platform-traps.md:310 |
| docs/code | docs/session-ledger.md:407 |
| docs/configuration/storage | docs/D-068-openbao-assessment-DRAFT.md:85 |
| docs/data-sources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:67 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase1-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase2-runbook.md:13 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase3-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase4-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase5-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase6-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-netem-ula-gua-proposal.md:10 |
| docs/dc-dc | runbooks/dc-dc-phase6-designate-cos-magnum.md:113 |
| docs/dc-dc-D100-D110.append.md | docs/changelog-20260709-dc-dc-design.md:16 |
| docs/dc-dc-D100-D110.append.md | docs/dc-dc-buildout-design.md:230 |
| docs/dc-dc-buildout | .claude/skills/openstack-cloud-ops/references/environment.md:112 |
| docs/dc-dc-buildout | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:4 |
| docs/dc-dc-deployment | docs/changelog-20260709-adversarial-review-fixes.md:34 |
| docs/dc-dc-deployment | docs/changelog-20260709-ceph-replication-tooling.md:142 |
| docs/dc-dc-deployment | docs/changelog-20260709-ceph-replication-tooling.md:4 |
| docs/dc-dc-deployment | docs/changelog-20260709-dc-dc-phase0-runbook.md:13 |
| docs/dc-dc-deployment | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:144 |
| docs/dc-dc-deployment | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:16 |
| docs/dc-dc-deployment | runbooks/dc-dc-phase6-designate-cos-magnum.md:623 |
| docs/dc-dc-ipv6 | docs/changelog-20260709-ipv6-family-matrix-overlay.md:11 |
| docs/dc-dc-ipv6-charm | docs/changelog-20260709-ipv6-family-matrix-overlay.md:61 |
| docs/dc-dc-ipv6-charm | docs/dc-dc-deployment-workflow.md:625 |
| docs/dc-dc-netem-and-ula-gua | docs/dc-dc-deployment-workflow.md:494 |
| docs/design-decisions | docs/v1-pre-deploy-fixes.md:130 |
| docs/design-decisions | docs/v1-pre-deploy-fixes.md:170 |
| docs/design-decisions | docs/v1-pre-deploy-fixes.md:660 |
| docs/discourse | docs/changelog-20260716-d124-rack-addressing.md:46 |
| docs/discourse | docs/stage3-review-base.patch:268 |
| docs/fip-edge-diagnosis-checkpoint-20260627.md | docs/v1-redeploy-changelog.md:968 |
| docs/forum/GitHub | docs/changelog-20260709-opentofu-audit.md:84 |
| docs/forum/GitHub | docs/changelog-20260709-opnsense-research.md:9 |
| docs/guides/migration | docs/D-068-openbao-assessment-DRAFT.md:85 |
| docs/how-to-manage-machines | .claude/skills/openstack-cloud-ops/references/platform-traps.md:283 |
| docs/how-to/virtualisation/enable-nested-virtualisation | .claude/skills/openstack-cloud-ops/references/platform-traps.md:117 |
| docs/index.md | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:88 |
| docs/language/resources/provisioners/local-exec | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:99 |
| docs/language/resources/tf-data | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:101 |
| docs/latest/reference/network_bridge | .claude/skills/openstack-cloud-ops/references/platform-traps.md:274 |
| docs/latest/reference/releases-snap | .claude/skills/openstack-cloud-ops/references/platform-traps.md:263 |
| docs/ledger | memory/review-after-each-step.md:21 |
| docs/netbox-vip-queue | docs/v1-pre-deploy-fixes.md:740 |
| docs/r | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:42 |
| docs/r | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:68 |
| docs/repro-example.md | docs/changelog-20260710-ledger-scan-self-inflicted-falsepositive-fix.md:50 |
| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:42 |
| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:67 |
| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:88 |
| docs/resources | .claude/skills/openstack-cloud-ops/references/platform-traps.md:47 |
| docs/resources | docs/changelog-20260709-opentofu-maas-netem.md:23 |
| docs/resources | docs/changelog-20260709-opentofu-scaffold.md:34 |
| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:182 |
| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:78 |
| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:92 |
| docs/stage3-adversarial-review | docs/session-ledger.md:309 |
| docs/tenant-cidr-overlap | docs/v1-redeploy-changelog.md:2439 |
| docs/v1-deploy-runbook.md | docs/handoff-20260703-open-items.md:139 |
| docs/v1-deploy-runbook.md | docs/handoff-20260705-open-items.md:84 |
| docs/v1-deploy-runbook.md | docs/session-ledger.md:1060 |
| docs/v1-deploy-runbook.md | runbooks/phase-08-workload-cluster-acceptance.md:357 |
| docs/v1-deploy-runbook.md | runbooks/phase-08-workload-cluster-acceptance.md:379 |
| netbox/MAAS | docs/dc0-deploy-readiness.md:13 |
| netbox/api/authentication.py | docs/changelog-20260713-office1-netbox-deployed.md:30 |
| netbox/dc-dc | docs/dc-dc-netem-and-ula-gua-proposal.md:109 |
| netbox/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:439 |
| netbox/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:806 |
| netbox/dc-dc-prefixes | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:163 |
| netbox/ipv4-prefixes | docs/v1-pre-deploy-fixes.md:694 |
| netbox/ipv4-prefixes | docs/v1-pre-deploy-fixes.md:712 |
| netbox/ipv4-vips-import.py | docs/netbox-vip-queue.md:89 |
| netbox/tailscale | docs/design-decisions.md:3929 |
| netbox/tailscale | docs/design-decisions.md:3959 |
| netbox/tailscale | docs/session-ledger.md:185 |
| netbox/tailscale | docs/vr1-office1-as-built.md:59 |
| opentofu/templates/opnsense-config.xml.tmpl | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:116 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260709-opnsense-config-design.md:10 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260709-opnsense-config-design.md:9 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260712-opnsense-edge-real-isp-router.md:15 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260712-opnsense-edge-real-isp-router.md:38 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260713-config-xml-path-deleted.md:29 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260713-opnsense-apikey-bootstrap.md:70 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/dc-dc-deployment-workflow.md:332 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/dc-dc-deployment-workflow.md:474 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/design-decisions.md:2386 |
| references/ci-automation.md | docs/clientdocs-workflow-review-20260708.md:57 |
| references/day2-operations.md | docs/clientdocs-workflow-review-20260708.md:115 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:2987 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:3179 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:3346 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:3366 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:3400 |
| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:225 |
| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:303 |
| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:327 |
| runbooks/01-destroy-model.md | docs/design-decisions.md:367 |
| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:226 |
| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:318 |
| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:339 |
| runbooks/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:304 |
| runbooks/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:328 |
| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:227 |
| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:305 |
| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:329 |
| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:228 |
| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:306 |
| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:330 |
| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:229 |
| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:307 |
| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:331 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:147 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:328 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:332 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:583 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:230 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:308 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:332 |
| runbooks/05-magnum-capi-driver.md | docs/design-decisions.md:138 |
| runbooks/05-magnum-capi-driver.md | docs/design-decisions.md:149 |
| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:231 |
| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:309 |
| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:333 |
| runbooks/06-tenant-setup.md | docs/netbox-vip-queue.md:76 |
| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:232 |
| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:310 |
| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:334 |
| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:233 |
| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:311 |
| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:335 |
| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:234 |
| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:312 |
| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:336 |
| runbooks/appendix-B | .claude/skills/openstack-cloud-ops/references/environment.md:89 |
| runbooks/appendix-B | docs/v1-redeploy-changelog.md:2051 |
| runbooks/dc | docs/dc-dc-deployment-workflow.md:500 |
| runbooks/dc-dc-phase0..6 | .claude/skills/openstack-cloud-ops/references/environment.md:114 |
| runbooks/dc-dc-phase1-office1 | docs/changelog-20260715-creds-consolidation.md:30 |
| runbooks/dc-dc-phase2 | docs/changelog-20260713-config-xml-danger-sweep.md:17 |
| runbooks/dc-dc-phase3 | docs/changelog-20260709-maas-scripts-dc-param.md:145 |
| runbooks/dc-dc-phase4-juju | docs/changelog-20260709-ipv6-family-matrix-overlay.md:12 |
| runbooks/dc-dc-phase4-juju-bundle | docs/changelog-20260709-ipv6-family-matrix-overlay.md:62 |
| runbooks/dc-dc-phase5-dr | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:76 |
| runbooks/dc-dc-phase6-designate | docs/changelog-20260709-designate-cinderbackup-rbdmirror.md:55 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:213 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:289 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:293 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:297 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:325 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:327 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:328 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:329 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:330 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:331 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:332 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:333 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:334 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:335 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:336 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:345 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:402 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:803 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:804 |
| runbooks/deprecated/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:303 |
| runbooks/deprecated/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:304 |
| runbooks/deprecated/02-deploy.md | docs/v1-pre-deploy-fixes.md:305 |
| runbooks/deprecated/03-vault-init.md | docs/v1-pre-deploy-fixes.md:306 |
| runbooks/deprecated/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:307 |
| runbooks/deprecated/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:308 |
| runbooks/deprecated/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:309 |
| runbooks/deprecated/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:310 |
| runbooks/deprecated/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:311 |
| runbooks/deprecated/08-validate.md | docs/v1-pre-deploy-fixes.md:312 |
| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:293 |
| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:360 |
| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:364 |
| runbooks/hardening | memory/project-posture-closed-test.md:3 |
| runbooks/jumphost-provider-vip-gateway.md | docs/README-D057-PACK.md:104 |
| runbooks/jumphost-provider-vip-gateway.md | docs/README-D057-PACK.md:54 |
| runbooks/jumphost-provider-vip-gateway.md | docs/design-decisions.md:971 |
| runbooks/opentofu/scripts | docs/changelog-20260710-skill-vr1-awareness.md:35 |
| runbooks/phase-00 | docs/changelog-20260709-dc-dc-phase0-runbook.md:18 |
| runbooks/phase-00-maas-reconfigure.md | docs/design-decisions.md:972 |
| runbooks/phase-00-maas-reconfigure.md | docs/v1-redeploy-changelog.md:1013 |
| runbooks/phase-00-teardown | docs/changelog-20260709-maas-scripts-dc-param.md:47 |
| runbooks/phase-00-teardown | docs/dc-dc-deployment-workflow.md:784 |
| runbooks/phase-00-teardown-release.sh | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:11 |
| runbooks/phase-00-teardown-release.sh | runbooks/dc-dc-teardown-rollback.md:8 |
| runbooks/phase-00..08 | .claude/skills/openstack-cloud-ops/references/environment.md:85 |
| runbooks/phase-00b-host-reenrollment.md | docs/v1-redeploy-changelog.md:193 |
| runbooks/phase-01..08 | docs/dc-dc-deployment-workflow.md:218 |
| runbooks/phase-01..08 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:6 |
| runbooks/phase-04-network | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:258 |
| runbooks/phase-06 | docs/design-decisions.md:149 |
| runbooks/phase-06 | docs/design-decisions.md:332 |
| runbooks/provider-vip-maas-standup.md | docs/README-D057-PACK.md:49 |
| runbooks/provider-vip-maas-standup.md | docs/design-decisions.md:972 |
| runbooks/tenant-onboarding-runbook.md | docs/tenant-cidr-overlap-correction-PLAN.md:112 |
| scripts/RUN-blocks/skill | .claude/skills/openstack-cloud-ops/references/environment.md:55 |
| scripts/X.sh | docs/v1-redeploy-changelog.md:51 |
| scripts/X.sh | docs/v1-redeploy-changelog.md:692 |
| scripts/X.sh | docs/v1-redeploy-changelog.md:693 |
| scripts/X.sh | docs/v1-redeploy-changelog.md:826 |
| scripts/carve | docs/changelog-20260709-maas-scripts-dc-param.md:110 |
| scripts/carve-host | docs/changelog-20260709-maas-scripts-dc-param.md:8 |
| scripts/clouds.yaml.template | docs/clientdocs-workflow-review-20260708.md:112 |
| scripts/clouds.yaml.template | docs/clientdocs-workflow-review-20260708.md:54 |
| scripts/d057-bundle-check.py | docs/D-057-REVIEW-ITEMS.md:27 |
| scripts/d057-bundle-check.py | docs/D-058-renumber.md:57 |
| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:37 |
| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:39 |
| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:98 |
| scripts/d057-bundle-check.py | docs/design-decisions.md:957 |
| scripts/d057-bundle-check.py | docs/design-decisions.md:970 |
| scripts/dc-dc | .claude/skills/openstack-cloud-ops/references/environment.md:116 |
| scripts/dc-dc | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:19 |
| scripts/dc-dc | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:46 |
| scripts/dc-dc | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:65 |
| scripts/dc-dc | runbooks/dc-dc-phase5-dr-failover-drill.md:652 |
| scripts/harnesses | docs/changelog-20260709-ceph-replication-tooling.md:126 |
| scripts/lib | docs/changelog-20260709-dc-dc-phase3-runbook.md:70 |
| scripts/opentofu | docs/dc-dc-deployment-workflow.md:588 |
| scripts/opnsense-apply-config.sh | docs/changelog-20260713-office1-dhcp-apply.md:86 |
| scripts/opnsense-apply-config.sh | docs/session-ledger.md:1026 |
| scripts/opnsense-build-config-iso.sh | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:117 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-ceph-replication-tooling.md:17 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opentofu-audit.md:105 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opentofu-audit.md:13 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-config-design.md:23 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:25 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:26 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:80 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260713-config-xml-danger-sweep.md:36 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260713-config-xml-path-deleted.md:31 |
| scripts/opnsense-build-config-iso.sh | docs/dc-dc-deployment-workflow.md:472 |
| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2274 |
| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2330 |
| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2387 |
| scripts/opnsense-prep | docs/changelog-20260709-ceph-replication-tooling.md:16 |
| scripts/opnsense-render-config.sh | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:117 |
| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:11 |
| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:19 |
| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:70 |
| scripts/opnsense-render-config.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:20 |
| scripts/opnsense-render-config.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:38 |
| scripts/opnsense-render-config.sh | docs/changelog-20260713-config-xml-danger-sweep.md:35 |
| scripts/opnsense-render-config.sh | docs/changelog-20260713-config-xml-path-deleted.md:30 |
| scripts/opnsense-render-config.sh | docs/changelog-20260713-office1-dhcp-apply.md:13 |
| scripts/opnsense-render-config.sh | docs/dc-dc-deployment-workflow.md:477 |
| scripts/opnsense-render-config.sh | docs/design-decisions.md:2386 |
| scripts/phase-00 | docs/changelog-20260709-ceph-replication-tooling.md:72 |
| scripts/phase-00-maas-carve.sh | docs/D-058-renumber.md:67 |
| scripts/phase-00-maas-carve.sh | docs/v1-redeploy-changelog.md:817 |
| scripts/phase-00-maas-recidr.sh | docs/design-decisions.md:969 |
| scripts/phase-00-maas-recidr.sh | docs/v1-redeploy-changelog.md:1012 |
| scripts/phase-00-teardown.sh | docs/changelog-20260703-process-hardening.md:172 |
| scripts/phase-00-teardown.sh | docs/design-decisions.md:961 |
| scripts/phase-00-teardown.sh | docs/docfix-draft-20260702.md:24 |
| scripts/provider | docs/dc-dc-deployment-workflow.md:657 |
| scripts/provider-bundle | docs/dc-dc-deployment-workflow.md:534 |
| scripts/provider-vip-standup.sh | docs/D-057-REVIEW-ITEMS.md:52 |
| scripts/provider-vip-standup.sh | docs/D-057-REVIEW-ITEMS.md:9 |
| scripts/provider-vip-standup.sh | docs/D-058-renumber.md:56 |
| scripts/provider-vip-standup.sh | docs/README-D057-PACK.md:23 |
| scripts/provider-vip-standup.sh | docs/README-D057-PACK.md:99 |
| scripts/provider-vip-standup.sh | docs/design-decisions.md:970 |
| scripts/review-bundle.py | docs/D-057-REVIEW-ITEMS.md:18 |
| scripts/review-bundle.py | docs/D-058-renumber.md:69 |
| scripts/review-bundle.py | docs/changelog-20260703-process-hardening.md:171 |
| scripts/review-bundle.py | docs/changelog-20260703-process-hardening.md:50 |
| scripts/review-bundle.py | docs/docfix-draft-20260702.md:76 |
| scripts/runbooks | docs/design-decisions.md:860 |
| scripts/runbooks/skill | docs/changelog-20260709-repo-agnostic-sweep.md:10 |
| scripts/tenant | docs/v1-redeploy-changelog.md:2406 |
| scripts/tenant-cluster-create.sh | docs/session-ledger.md:899 |
| scripts/tenant-cluster-create.sh | docs/v1-redeploy-changelog.md:1449 |
| scripts/x.sh | docs/docfix-draft-20260702.md:72 |
| tests/-fixture | docs/v1-redeploy-changelog.md:2481 |
| tests/carve-host-interfaces/run | docs/changelog-20260709-maas-scripts-dc-param.md:18 |
| tests/dc-dc | docs/changelog-20260709-ceph-replication-tooling.md:129 |
| tests/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:445 |
| tests/dc-dc-rbd-mirror/run | docs/changelog-20260709-ceph-replication-tooling.md:40 |
| tests/dc-selector/run | docs/changelog-20260709-adversarial-review-fixes.md:88 |
| tests/opnsense-build-config-iso | docs/changelog-20260709-opnsense-edge-module.md:81 |
| tests/opnsense-build-config-iso | docs/changelog-20260713-config-xml-path-deleted.md:31 |
| tests/opnsense-build-config-iso/run-tests.sh | docs/changelog-20260709-opnsense-edge-module.md:26 |
| tests/opnsense-render-config | docs/changelog-20260709-opnsense-config-design.md:71 |
| tests/opnsense-render-config | docs/changelog-20260713-config-xml-path-deleted.md:30 |
| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260709-opnsense-config-design.md:12 |
| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:21 |
| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:26 |
| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:39 |
| tests/phase-00-carve | docs/v1-redeploy-changelog.md:822 |
| tests/phase-00-carve/run-tests.sh | docs/D-058-renumber.md:75 |
| tests/phase-00-maas-recidr | docs/changelog-20260703-process-hardening.md:246 |
| tests/phase-00-teardown | docs/changelog-20260703-process-hardening.md:243 |
| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:814 |
| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:835 |
| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:838 |
| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:844 |
| tests/provider-vip-standup | docs/README-D057-PACK.md:42 |
| tests/provider-vip-standup | docs/changelog-20260703-process-hardening.md:245 |
| tests/provider-vip-standup/run-tests.sh | docs/README-D057-PACK.md:107 |
| tests/reenroll | docs/changelog-20260709-maas-scripts-dc-param.md:19 |
| tests/tenant | docs/v1-redeploy-changelog.md:2673 |
Orphan / unregistered number references
| ref | where | why |
|---|---|---|
| BUNDLEFIX-013 | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:96 | referenced nowhere else |
| BUNDLEFIX-051 | docs/repo-lint-nextfree-bug-FINDING.md:20 | referenced nowhere else |
| D-054 | docs/D-057-DECIDED-append.md:9 | not in design-decisions.md |
| D-054 | docs/D-058-renumber.md:5 | not in design-decisions.md |
| D-054 | docs/v1-redeploy-changelog.md:117 | not in design-decisions.md |
| D-054 | docs/v1-redeploy-changelog.md:12 | not in design-decisions.md |
| D-054 | docs/v1-redeploy-changelog.md:42 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:1119 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:1196 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:1213 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:322 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:491 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:500 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:546 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:775 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:791 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:800 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:801 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:864 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:890 | not in design-decisions.md |
| D-056 | runbooks/phase-04-network-carve.md:79 | not in design-decisions.md |
| D-056 | runbooks/phase-06-incloud-mgmt-cluster.md:13 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:126 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:201 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:216 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:41 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:72 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:81 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:83 | not in design-decisions.md |
| D-130 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:131 | not in design-decisions.md |
| D-130 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:235 | not in design-decisions.md |
| D-130 | docs/session-ledger.md:255 | not in design-decisions.md |
| D-130 | docs/session-ledger.md:273 | not in design-decisions.md |
| D-130 | docs/session-ledger.md:275 | not in design-decisions.md |
| D-2 | docs/handoff-20260703-open-items.md:123 | referenced nowhere else |
| DOCFIX-017 | runbooks/appendix-A-troubleshooting.md:250 | referenced nowhere else |
| DOCFIX-028 | runbooks/phase-02-vault-bringup.md:160 | referenced nowhere else |
| DOCFIX-029 | runbooks/phase-02-vault-bringup.md:117 | referenced nowhere else |
| DOCFIX-029 | runbooks/phase-02-vault-bringup.md:57 | referenced nowhere else |
| DOCFIX-037 | runbooks/phase-08-workload-cluster-acceptance.md:217 | referenced nowhere else |
| DOCFIX-041 | docs/v1-redeploy-changelog.md:195 | referenced nowhere else |
| DOCFIX-041 | docs/v1-redeploy-changelog.md:323 | referenced nowhere else |
| DOCFIX-043 | docs/v1-redeploy-changelog.md:346 | referenced nowhere else |
| DOCFIX-043 | docs/v1-redeploy-changelog.md:481 | referenced nowhere else |
| DOCFIX-043 | docs/v1-redeploy-changelog.md:493 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:491 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:500 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:502 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:547 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:556 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:732 | referenced nowhere else |
| DOCFIX-045 | docs/v1-redeploy-changelog.md:546 | referenced nowhere else |
| DOCFIX-045 | docs/v1-redeploy-changelog.md:573 | referenced nowhere else |
| DOCFIX-045 | docs/v1-redeploy-changelog.md:720 | referenced nowhere else |
| DOCFIX-046 | docs/v1-redeploy-changelog.md:1084 | referenced nowhere else |
| DOCFIX-046 | docs/v1-redeploy-changelog.md:608 | referenced nowhere else |
| DOCFIX-046 | docs/v1-redeploy-changelog.md:616 | referenced nowhere else |
| DOCFIX-048 | docs/v1-redeploy-changelog.md:682 | referenced nowhere else |
| DOCFIX-049 | docs/v1-redeploy-changelog.md:697 | referenced nowhere else |
| DOCFIX-049 | docs/v1-redeploy-changelog.md:716 | referenced nowhere else |
| DOCFIX-049 | docs/v1-redeploy-changelog.md:754 | referenced nowhere else |
| DOCFIX-049 | docs/v1-redeploy-changelog.md:757 | referenced nowhere else |
| DOCFIX-050 | docs/v1-redeploy-changelog.md:821 | referenced nowhere else |
| DOCFIX-050 | docs/v1-redeploy-changelog.md:828 | referenced nowhere else |
| DOCFIX-051 | docs/v1-redeploy-changelog.md:831 | referenced nowhere else |
| DOCFIX-052 | docs/v1-redeploy-changelog.md:835 | referenced nowhere else |
| DOCFIX-052 | docs/v1-redeploy-changelog.md:843 | referenced nowhere else |
| DOCFIX-053 | docs/v1-redeploy-changelog.md:873 | referenced nowhere else |
| DOCFIX-056 | docs/v1-redeploy-changelog.md:1023 | referenced nowhere else |
| DOCFIX-058 | docs/v1-redeploy-changelog.md:1083 | referenced nowhere else |
| DOCFIX-079 | docs/changelog-20260703-process-hardening.md:199 | referenced nowhere else |
| DOCFIX-080 | docs/changelog-20260703-process-hardening.md:213 | referenced nowhere else |
| DOCFIX-081 | docs/changelog-20260703-process-hardening.md:222 | referenced nowhere else |
| DOCFIX-090 | docs/v1-redeploy-changelog.md:2040 | referenced nowhere else |
| DOCFIX-092 | docs/v1-redeploy-changelog.md:2093 | referenced nowhere else |
| DOCFIX-092 | docs/v1-redeploy-changelog.md:2095 | referenced nowhere else |
| DOCFIX-092 | docs/v1-redeploy-changelog.md:2116 | referenced nowhere else |
| DOCFIX-103 | docs/v1-redeploy-changelog.md:2392 | referenced nowhere else |
| DOCFIX-108 | docs/v1-redeploy-changelog.md:2497 | referenced nowhere else |
| DOCFIX-108 | docs/v1-redeploy-changelog.md:2499 | referenced nowhere else |
| DOCFIX-108 | docs/v1-redeploy-changelog.md:2506 | referenced nowhere else |
| DOCFIX-108 | docs/v1-redeploy-changelog.md:2544 | referenced nowhere else |
| DOCFIX-109 | docs/v1-redeploy-changelog.md:2499 | referenced nowhere else |
| DOCFIX-109 | docs/v1-redeploy-changelog.md:2525 | referenced nowhere else |
| DOCFIX-109 | docs/v1-redeploy-changelog.md:2546 | referenced nowhere else |
| DOCFIX-109 | docs/v1-redeploy-changelog.md:3168 | referenced nowhere else |
| DOCFIX-110 | docs/v1-redeploy-changelog.md:2555 | referenced nowhere else |
| DOCFIX-110 | docs/v1-redeploy-changelog.md:2557 | referenced nowhere else |
| DOCFIX-110 | docs/v1-redeploy-changelog.md:2559 | referenced nowhere else |
| DOCFIX-117 | docs/v1-redeploy-changelog.md:2670 | referenced nowhere else |
| DOCFIX-119 | docs/v1-redeploy-changelog.md:2814 | referenced nowhere else |
| DOCFIX-119 | docs/v1-redeploy-changelog.md:2816 | referenced nowhere else |
| DOCFIX-119 | docs/v1-redeploy-changelog.md:2831 | referenced nowhere else |
| DOCFIX-119 | docs/v1-redeploy-changelog.md:2859 | referenced nowhere else |
| DOCFIX-124 | docs/v1-redeploy-changelog.md:3031 | referenced nowhere else |
| DOCFIX-124 | docs/v1-redeploy-changelog.md:3071 | referenced nowhere else |
| DOCFIX-125 | docs/v1-redeploy-changelog.md:3074 | referenced nowhere else |
| DOCFIX-125 | docs/v1-redeploy-changelog.md:3078 | referenced nowhere else |
| DOCFIX-125 | docs/v1-redeploy-changelog.md:3093 | referenced nowhere else |
| DOCFIX-127 | docs/v1-redeploy-changelog.md:3096 | referenced nowhere else |
| DOCFIX-127 | docs/v1-redeploy-changelog.md:3113 | referenced nowhere else |
| DOCFIX-127 | docs/v1-redeploy-changelog.md:3129 | referenced nowhere else |
| DOCFIX-128 | docs/v1-redeploy-changelog.md:3132 | referenced nowhere else |
| DOCFIX-128 | docs/v1-redeploy-changelog.md:3157 | referenced nowhere else |
| DOCFIX-129 | docs/v1-redeploy-changelog.md:3160 | referenced nowhere else |
| DOCFIX-129 | docs/v1-redeploy-changelog.md:3193 | referenced nowhere else |
| DOCFIX-129 | docs/v1-redeploy-changelog.md:3345 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3196 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3256 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3339 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3342 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3360 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3362 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3385 | referenced nowhere else |
| DOCFIX-131 | docs/v1-redeploy-changelog.md:3259 | referenced nowhere else |
| DOCFIX-131 | docs/v1-redeploy-changelog.md:3284 | referenced nowhere else |
| DOCFIX-132 | docs/v1-redeploy-changelog.md:3287 | referenced nowhere else |
| DOCFIX-132 | docs/v1-redeploy-changelog.md:3297 | referenced nowhere else |
| DOCFIX-133 | docs/v1-redeploy-changelog.md:3300 | referenced nowhere else |
| DOCFIX-133 | docs/v1-redeploy-changelog.md:3316 | referenced nowhere else |
| DOCFIX-133 | docs/v1-redeploy-changelog.md:3427 | referenced nowhere else |
| DOCFIX-134 | docs/v1-redeploy-changelog.md:3319 | referenced nowhere else |
| DOCFIX-134 | docs/v1-redeploy-changelog.md:3331 | referenced nowhere else |
| DOCFIX-134 | docs/v1-redeploy-changelog.md:3437 | referenced nowhere else |
| DOCFIX-136 | docs/v1-redeploy-changelog.md:3360 | referenced nowhere else |
| DOCFIX-136 | docs/v1-redeploy-changelog.md:3387 | referenced nowhere else |
| DOCFIX-136 | docs/v1-redeploy-changelog.md:3393 | referenced nowhere else |
| DOCFIX-143 | docs/changelog-20260709-repo-lint-crlf-fix.md:1 | referenced nowhere else |
| DOCFIX-143 | docs/changelog-20260709-repo-lint-crlf-fix.md:5 | referenced nowhere else |
| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:1 | referenced nowhere else |
| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:25 | referenced nowhere else |
| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:40 | referenced nowhere else |
| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:9 | referenced nowhere else |
| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:1 | referenced nowhere else |
| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:41 | referenced nowhere else |
| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:9 | referenced nowhere else |
| DOCFIX-149 | docs/changelog-20260709-opnsense-config-design.md:1 | referenced nowhere else |
| DOCFIX-149 | docs/changelog-20260709-opnsense-config-design.md:9 | referenced nowhere else |
| DOCFIX-150 | docs/changelog-20260709-stage0-ratification.md:1 | referenced nowhere else |
| DOCFIX-150 | docs/changelog-20260709-stage0-ratification.md:9 | referenced nowhere else |
| DOCFIX-153 | docs/changelog-20260709-dc-dc-phase0-runbook.md:1 | referenced nowhere else |
| DOCFIX-153 | docs/changelog-20260709-dc-dc-phase0-runbook.md:12 | referenced nowhere else |
| DOCFIX-154 | docs/changelog-20260709-dc-dc-phase1-runbook.md:1 | referenced nowhere else |
| DOCFIX-154 | docs/changelog-20260709-dc-dc-phase1-runbook.md:11 | referenced nowhere else |
| DOCFIX-155 | docs/changelog-20260709-dc-dc-phase2-runbook.md:1 | referenced nowhere else |
| DOCFIX-155 | docs/changelog-20260709-dc-dc-phase2-runbook.md:12 | referenced nowhere else |
| DOCFIX-156 | docs/changelog-20260709-dc-dc-phase4-runbook.md:1 | referenced nowhere else |
| DOCFIX-156 | docs/changelog-20260709-dc-dc-phase4-runbook.md:11 | referenced nowhere else |
| DOCFIX-157 | docs/changelog-20260709-dc-dc-phase3-runbook.md:1 | referenced nowhere else |
| DOCFIX-157 | docs/changelog-20260709-dc-dc-phase3-runbook.md:11 | referenced nowhere else |
| DOCFIX-158 | docs/changelog-20260709-dc-dc-phase5-runbook.md:1 | referenced nowhere else |
| DOCFIX-158 | docs/changelog-20260709-dc-dc-phase5-runbook.md:11 | referenced nowhere else |
| DOCFIX-159 | docs/changelog-20260709-dc-dc-phase6-runbook.md:1 | referenced nowhere else |
| DOCFIX-159 | docs/changelog-20260709-dc-dc-phase6-runbook.md:11 | referenced nowhere else |
| DOCFIX-161 | docs/changelog-20260709-final-consolidation.md:1 | referenced nowhere else |
| DOCFIX-161 | docs/changelog-20260709-final-consolidation.md:71 | referenced nowhere else |
| DOCFIX-177 | docs/changelog-20260710-skill-vr1-awareness.md:1 | referenced nowhere else |
| GA-F01 | docs/audit/grounding-audit-charter.md:199 | referenced nowhere else |
| GA-R1 | docs/audit/grounding-audit-charter.md:165 | referenced nowhere else |
| GA-R3 | docs/audit/grounding-audit-charter.md:175 | referenced nowhere else |
| GA-R3 | docs/audit/grounding-audit-charter.md:68 | referenced nowhere else |
| GA-R4 | docs/audit/grounding-audit-charter.md:182 | referenced nowhere else |
| GA-R5 | docs/audit/grounding-audit-charter.md:186 | referenced nowhere else |
| GA-R5 | docs/audit/grounding-audit-charter.md:68 | referenced nowhere else |
| R3-F05 | docs/stage3-adversarial-review-20260716.md:170 | referenced nowhere else |
| R3-F05 | docs/stage3-adversarial-review-20260716.md:306 | referenced nowhere else |
| R3-F07 | docs/stage3-adversarial-review-20260716.md:193 | referenced nowhere else |
| R3-F11 | docs/stage3-adversarial-review-20260716.md:230 | referenced nowhere else |
| R3-F11 | docs/stage3-adversarial-review-20260716.md:317 | referenced nowhere else |
| R3-F13 | docs/stage3-adversarial-review-20260716.md:246 | referenced nowhere else |
Unknown commit hashes
| hash | where |
|---|---|
| 01ac01a | docs/stage3-review-base.patch:3005 |
| 04d3175865f4 | memory/creds-folder-convention.md:7 |
| 04d3175865f4 | memory/project-posture-closed-test.md:7 |
| 070de108 | docs/v1-redeploy-changelog.md:1142 |
| 070de108 | runbooks/phase-05-octavia-enablement.md:208 |
| 0885dca3 | docs/v1-redeploy-changelog.md:1230 |
| 09199e8 | docs/stage3-review-base.patch:3256 |
| 097e972 | docs/stage3-review-base.patch:1502 |
| 0d00ddc1 | runbooks/phase-06-incloud-mgmt-cluster.md:42 |
| 0d00ddc1 | runbooks/phase-08-workload-cluster-acceptance.md:47 |
| 0dc65fb | docs/stage3-review-base.patch:2874 |
| 0f968008 | runbooks/ops-capi-recovery.md:19 |
| 0f968008 | runbooks/phase-08-workload-cluster-acceptance.md:366 |
| 14c07d77f167 | runbooks/phase-06-incloud-mgmt-cluster.md:42 |
| 14c07d77f167 | runbooks/phase-08-workload-cluster-acceptance.md:47 |
| 15a14c5a | runbooks/phase-05-octavia-enablement.md:208 |
| 193a8915 | runbooks/tenant-onboarding-v2-DRAFT.md:98 |
| 1dedb917e5ea | docs/changelog-20260709-final-consolidation.md:43 |
| 1f260c0 | docs/stage3-review-base.patch:1561 |
| 25e0aa3 | docs/stage3-review-base.patch:1624 |
| 25e6971 | docs/stage3-review-base.patch:316 |
| 26ed1091 | docs/v1-redeploy-changelog.md:1235 |
| 26ed1091 | runbooks/phase-07-conductor-graft.md:487 |
| 2b8e36983072 | docs/v1-redeploy-changelog.md:665 |
| 2cc95d507e2a | memory/review-after-each-step.md:7 |
| 36582e857d7c | runbooks/phase-04-network-carve.md:171 |
| 4262fb9 | docs/stage3-review-base.patch:1658 |
| 438e59088c6c | docs/changelog-20260713-opnsense-api-write-proven.md:9 |
| 452e126982cf | runbooks/phase-08-workload-cluster-acceptance.md:366 |
| 4586faa7 | docs/v1-redeploy-changelog.md:957 |
| 46e7dd7 | docs/stage3-review-base.patch:2666 |
| 48eb444 | docs/stage3-review-base.patch:1306 |
| 4aa5c18 | docs/stage3-review-base.patch:3756 |
| 544afa6a | docs/v1-redeploy-changelog.md:665 |
| 550f5c691bfb | docs/v1-redeploy-changelog.md:664 |
| 550f5c691bfb | docs/v1-redeploy-changelog.md:860 |
| 581022d | docs/stage3-review-base.patch:652 |
| 5fa5b05e | docs/v1-redeploy-changelog.md:885 |
| 627e3f12 | docs/changelog-20260714-office1-lan-ipv6-executed.md:107 |
| 62f7c00 | runbooks/appendix-B-asbuilt-version-lock.md:97 |
| 62f7c00 | runbooks/phase-06-incloud-mgmt-cluster.md:571 |
| 674171fd | runbooks/ops-capi-recovery.md:19 |
| 6de15cf4 | runbooks/phase-08-workload-cluster-acceptance.md:364 |
| 6ed034f7 | docs/v1-redeploy-changelog.md:749 |
| 6f7848c | docs/design-decisions.md:1422 |
| 6f7848c | docs/v1-redeploy-changelog.md:1371 |
| 7072d66e | docs/v1-redeploy-changelog.md:914 |
| 70b34bb2 | runbooks/phase-04-network-carve.md:171 |
| 75c0e0cb | memory/creds-folder-convention.md:7 |
| 75c0e0cb | memory/project-posture-closed-test.md:7 |
| 760bdb3 | docs/design-decisions.md:722 |
| 76aea330 | docs/v1-redeploy-changelog.md:1461 |
| 7efde485 | docs/design-decisions.md:722 |
| 807e3f5b | docs/v1-redeploy-changelog.md:1143 |
| 807e3f5b | runbooks/phase-05-octavia-enablement.md:210 |
| 839ad1a8 | memory/review-after-each-step.md:7 |
| 8592ee35 | docs/v1-redeploy-changelog.md:1463 |
| 8592ee35 | docs/v1-redeploy-changelog.md:1513 |
| 872a43d1 | runbooks/phase-02-vault-bringup.md:173 |
| 899b4b5c | runbooks/phase-05-octavia-enablement.md:213 |
| 899b4b5c | runbooks/phase-06-incloud-mgmt-cluster.md:43 |
| 89e36ff79901 | docs/v1-redeploy-changelog.md:749 |
| 8a11535 | docs/stage3-review-base.patch:1571 |
| 8b7c3c0 | docs/stage3-review-base.patch:1519 |
| 8de2c48d92cf | runbooks/phase-08-workload-cluster-acceptance.md:364 |
| 8ec679e | docs/stage3-review-base.patch:3406 |
| 8f7329f | docs/stage3-review-base.patch:652 |
| 9005515f23a8 | runbooks/phase-04-network-carve.md:173 |
| 91f8bcc | docs/stage3-review-base.patch:1502 |
| 948e7ee | docs/stage3-review-base.patch:316 |
| 979503c | docs/stage3-review-base.patch:2666 |
| 9a08253 | docs/stage3-review-base.patch:3 |
| 9e141708dd6f | docs/v1-redeploy-changelog.md:752 |
| a08a471 | docs/stage3-review-base.patch:344 |
| a11cf69 | docs/v1-redeploy-changelog.md:912 |
| a275f2a0a6fc | docs/changelog-20260714-office1-lan-ipv6-executed.md:107 |
| a360df32 | docs/v1-redeploy-changelog.md:1407 |
| a360df32 | docs/v1-redeploy-changelog.md:1409 |
| a4e1a7fa | docs/v1-redeploy-changelog.md:1095 |
| a4e1a7fa | runbooks/phase-04-network-carve.md:171 |
| a57aa64 | docs/stage3-review-base.patch:1846 |
| a5aa1e1 | docs/stage3-review-base.patch:2923 |
| a9210d0eefe8 | runbooks/phase-06-incloud-mgmt-cluster.md:43 |
| ae90b82f | docs/v1-redeploy-changelog.md:3024 |
| b0d41d1 | docs/stage3-review-base.patch:1001 |
| b4d6c72e8fe9 | memory/multi-workstation-remote-control.md:7 |
| b87023b | docs/stage3-review-base.patch:665 |
| bb386c86 | docs/v1-redeploy-changelog.md:664 |
| bb386c86 | docs/v1-redeploy-changelog.md:860 |
| c53184b | docs/stage3-review-base.patch:665 |
| c8f9f53a | docs/v1-redeploy-changelog.md:752 |
| c954a6a | docs/stage3-review-base.patch:3756 |
| ca5552a5 | runbooks/phase-05-octavia-enablement.md:211 |
| d527847 | runbooks/appendix-B-asbuilt-version-lock.md:98 |
| d527847 | runbooks/phase-06-incloud-mgmt-cluster.md:571 |
| d878c13 | docs/stage3-review-base.patch:219 |
| d8c4033 | docs/stage3-review-base.patch:811 |
| d8ca624 | docs/stage3-review-base.patch:3307 |
| d9d0a4a8 | docs/v1-redeploy-changelog.md:1229 |
| da0d7b8c89b2 | docs/v1-redeploy-changelog.md:2716 |
| da757cb1 | runbooks/phase-05-octavia-enablement.md:208 |
| df0c9a6 | docs/stage3-review-base.patch:125 |
| e3afcbae | runbooks/phase-04-network-carve.md:173 |
| e4bb2db | docs/stage3-review-base.patch:344 |
| e5fa05aa | memory/multi-workstation-remote-control.md:7 |
| e752f6dd | docs/changelog-20260709-final-consolidation.md:43 |
| ed25519 | docs/design-decisions.md:2227 |
| ed25519 | docs/design-decisions.md:2264 |
| ed25519 | docs/session-ledger.md:814 |
| f50888b | docs/stage3-review-base.patch:1608 |
| f66e5bc5 | docs/v1-redeploy-changelog.md:1096 |
| f66e5bc5 | runbooks/phase-04-network-carve.md:173 |
| f75981d | docs/stage3-review-base.patch:1306 |
| fa61feb | docs/stage3-review-base.patch:1846 |
| fae7ec70 | docs/v1-redeploy-changelog.md:2716 |
file:line references out of range or absent
| ref | line | where | why |
|---|---|---|---|