=== MAAS admin-account recovery -- measured evidence, 2026-07-25 ===
Host: vcloud (jumphost). Region: http://10.10.0.20:5240/MAAS (measured from `maas --help`).
Scope RULED by operator: "New account + consolidate only" -- no existing password rotated.
NO secret VALUES appear in this capture (format/hash/status only).
--- 1. MAAS users AFTER the change (cmd: maas admin users read) ---
MAAS superuser=True email=maas@localhost
admin superuser=True email=admin@office1.local
juju-vr1-dc0 superuser=True email=juju-vr1-dc0@vr1.local
juju-vr1-dc1 superuser=True email=juju-vr1-dc1@vr1.local
maas-init-node superuser=False email=node-init-user@localhost
operator superuser=True email=jesse.austin@neumatrix.com
--- 2. Django password state (cmd: maas-region shell; booleans only) ---
MAAS super=True active=True usable_pw=True
admin super=True active=True usable_pw=True
juju-vr1-dc0 super=True active=True usable_pw=True
juju-vr1-dc1 super=True active=True usable_pw=True
maas-init-node super=False active=False usable_pw=True
operator super=True active=True usable_pw=True
--- 3. GUI login probes, each with a wrong-password CONTROL (204=auth, 400=reject) ---
admin stored_password=204 wrong_password_control=400
operator stored_password=204 wrong_password_control=400
--- 4. admin password consolidation fidelity (sha256, first 16 hex) ---
source voffice1:/root/maas-secrets/admin.pass = be9d791d108d9b44
copy ~/vr1-office1-creds/maas-admin-password = be9d791d108d9b44
verdict=BYTE-IDENTICAL
--- 5. stored file metadata (mode/bytes; no values) ---
maas-admin-password mode=600 bytes=28
maas-operator-password mode=600 bytes=32
--- 6. creds-audit all three sites (cmd: bash scripts/creds-audit.sh <site>) ---
creds-audit vr1-office1: CLEAN
creds-audit vr1-dc0: CLEAN
creds-audit vr1-dc1: CLEAN
harness: creds-audit: 7/7 PASS
--- 7. automation unaffected (admin CLI profile / 19 `maas admin` call sites) ---
maas admin users read -> 6 users returned, profile functional
