# D-137 tier-3 BEHAVIOURAL probe run -- 2026-07-26
# bash scripts/creds-probe.sh --run
# THIS RUN AUTHENTICATED. Every [ok] ssh/api line wrote an audit or login record on
# its target. Boundary operator-ruled 2026-07-26: full scope incl. OpenStack service
# credentials; per-tenant credentials REFUSED by construction (D-069 / ruling 3).
=== creds-probe: D-137 tier 3 behavioural (run) ===
NOTE: this AUTHENTICATES. Each probe writes an audit/login record on its target.
[ok] office1-svc-key: ssh key authenticates to voffice1
[skip] dc0-svc-key: declared non-probeable (dc0-rack-reachable-only-via-jumpbox-with-per-env-key-D-126) -- validity rests on V1/V2, by decision
[skip] dc1-svc-key: declared non-probeable (dc1-rack-reachable-only-via-jumpbox-with-per-env-key-D-126) -- validity rests on V1/V2, by decision
[skip] office1-edge-api: declared non-probeable (edge-API-probe-costs-an-audit-record-per-run;V1+V2-cover-it) -- validity rests on V1/V2, by decision
[skip] dc0-edge-api: declared non-probeable (ABSENT-per-SEC-021;nothing-to-probe-until-consolidated) -- validity rests on V1/V2, by decision
[skip] dc1-edge-api: declared non-probeable (edge-API-probe-costs-an-audit-record-per-run;V1+V2-cover-it) -- validity rests on V1/V2, by decision
[ok] netbox-sandbox-token: endpoint http://10.10.1.10:8000/ answers (HTTP 302) -- credential NOT spent
[skip] netbox-upstream-token: declared non-probeable (SEC-006-declares-this-BURNED;probing-a-burned-token-is-wrong) -- validity rests on V1/V2, by decision
[ok] maas-region-admin: endpoint http://10.10.0.20:5240/MAAS/ answers (HTTP 301) -- credential NOT spent
[skip] dc0-maas-apikey: mint-stage 'stage5' is pending -- not yet minted, so not probed
[skip] dc1-maas-apikey: mint-stage 'stage5' is pending -- not yet minted, so not probed
[skip] keystone-admin: mint-stage 'vr0-phase01' is pending -- not yet minted, so not probed
[skip] magnum-domain-admin: mint-stage 'vr0-phase07' is pending -- not yet minted, so not probed
creds-probe: 3 ok, 0 failed, 10 skipped
