D-137 phase 3: re-measure the register; SEC-024 opened ...

~21 inferred filenames corrected against their own mint-refs. The session had
owned six; those were only the rows the first sweep physically touched.
Octavia's 8 real basenames plus its THREE SUBDIRECTORIES (the bare
~/octavia-pki/* pattern matched ZERO of the 8 artifacts, two of them CA
private keys); vault's init.txt; the tenant rows' <client>- instance prefix,
with a placeholder matcher so they can match a real basename at all;
kube-config -> config; .maas.cli -> .maascli.db (measured: ~/.maas.cli does
not exist).

sec-ref mis-attribution corrected: both juju-maas-user rows cited SEC-020;
the on-subject rows are SEC-018/-019. This is the SEC-015 class recurring --
one instance was fixed by hand earlier without checking whether it was
systemic. It was.

mint-ref corrected: admin.pass cited a CONSUMER (:452), not the mint (:450);
the RGW key cites a line that takes it as INPUT, so it is operator-terminal.

Rows added: the libvirt SSH power password (standing rotation obligation from
a 2026-06-26 plaintext exposure, in neither the matrix nor the exclusions),
vault-ca-root, and the tfstate siblings. ~/as-executed/ deliberately NOT
declared, reason recorded: it holds session logs, so declaring it made every
log a false UNDECLARED.

Four further defects in my own phase-2 changes, found by RUNNING the sweep:
shlex.quote broke ~ expansion; a non-existent parent read as unreadable
rather than absent; site-key `-` needed shared-location semantics; the
tfstate siblings needed rows.

SEC-024 OPENED -- new exposure found by the fixed checker on its first clean
run: opentofu/terraform.tfstate.backup is mode 0664 and carries the MAAS API
key in plaintext (DOCFIX-175); the live state file is 0600. Invisible to
every prior control because the world-readable check was custody-gated and
the siblings were undeclared. LOGGED, NOT ACTIONED (hard rule 1).

Findings 35 -> 13, all true. Matrix 81 rows. Harness 44/44, creds-audit
15/15, gauntlet ALL GREEN (80), repo-lint 0-fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 committee audit + phase 1: correct the record ...

Six-lens read-only review found the delivered tier-1/tier-2 build has eight
reproduced false-greens and that the records overstated what was verified.
Four lenses converged independently on tier 2 being SITE-BLIND.

Record corrections only in this commit (no code, no data):

- NEW docs/audit/d137-location-listing-20260726.txt: the actual stat listing.
  CURRENT-STATE asserted remote filenames/modes citing the tier-2 capture,
  which is a VERDICT file containing none of them -- a GA-R1 rule 2 defect.
- .maas.cli was NEVER MEASURED and is wrong; the MAAS snap CLI profile is at
  ~/snap/maas/current/.maascli.db (measured). It sat inside the fix for the
  inferred-filename miss, so the corrected count is ~21, not six.
- WITHDRAWN: "ZERO undeclared files ... fully accounted for" (rested on the
  site-blind check). CORRECTED: "SEC-021 on-disk half REPRODUCED" now reads
  power-key artifacts only -- opnsense-api.txt's absence was masked.
- CURRENT-STATE's "virsh gap NOT fixed" corrected; it was fixed in 6d43619,
  whose commit did not touch the status authority because L10's trigger set
  excludes .claude/settings.json.
- Superseding figures recorded; stale "14 NOT JUDGED" -> 2; glob is *.pass.
- 12-column amendment recorded on D-137 in design-decisions.md; it previously
  lived only in a changelog (non-citable per GA-R2 rule 1) and the build spec.
- Repaired citations my own edits broke (guard moved 71-73 -> 90-92), the
  plan's 12-vs-27 operator-terminal count, the "two the ruling did not name"
  claim (it is one), and an unsupported ruling date in the notes.

Code and data remediation follows in later commits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 tier 2: privileged sweep completed; permission gap fixed; 6 inferred filenames corrected ...

The block was a PATTERN GAP, not a policy conflict. Bash(ssh * sudo *) was
already in the project ask list, but it needs a literal space before `sudo`
and the command was ssh <host> 'sudo ...' -- the quote meant no rule matched,
so it fell through to the classifier. Added the quoted variants plus a
targeted rule for the privileged invocation; all `ask`, never `allow`.

FLAGGED NOT FIXED (hard rule 1): Bash(ssh * virsh *) has the identical gap.

MEASURED (docs/audit/d137-tier2-privileged-20260726.txt): the region secrets
dir holds exactly admin.apikey/admin.pass/db.pass/lxd-trust.pass at 0600 --
precisely the SEC-020(i) carve-out list; netbox holds admin.pass/api.token/
secret_key at 0600; the SEC-022 shadow stores are confirmed and now audited.
ZERO undeclared files at any declared location: SEC-020 and SEC-022 are
accounted for.

OWNED: the first matrix draft carried SIX filenames I authored plausibly
instead of measuring -- a hard-rule-2 miss. The checker's undeclared-detection
caught every one on first contact with real hosts. Corrected to measured
values, real locations declared, and five colocated non-secret artifacts
declared so the check stays meaningful. Matrix 72 -> 77 rows.

9 findings remain, all true: SEC-021 (3 declaration + 2 on-disk), the ruling-5
conflation, and 3 S5 asymmetries -- dc0's snap power key is the generic
id_ed25519 while dc1's is the dedicated id_dc1_power, the SEC-012/SEC-016
per-DC-isolation divergence made visible.

Harness 35/35, gauntlet ALL GREEN (80), repo-lint 0-fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 tier 2: wire --privileged escalation (run BLOCKED by the auto-mode classifier) ...

--privileged retries a remote probe with `sudo -n` ONLY where the
unprivileged probe returned `unreadable`, keeping the privileged surface as
small as ruling 3 keeps the search surface. Metadata only; the T22
metadata-only guard still passes; verified inert (zero escalations) when
nothing is unreadable.

The operator approved the privileged read, but the auto-mode classifier
denied the remote-sudo shape -- the same wall the 2026-07-23 close recorded,
whose noted fix is manual permission mode. NOT worked around: reading a
root-owned directory is exactly the privilege being denied, so any
alternative would fail identically or misrepresent the result.

SEC-022 shadow-store contents and the SEC-020 region secrets stay
UNCONFIRMED; the sweep reports them as E0 UNREADABLE FAILs, which is the
correct outcome for an audit that could not look.

Also de-staled the docstring tier table (tier 2 is built).
Harness 35/35, gauntlet ALL GREEN (80), repo-lint 0-fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 tier 2: live read-only sweep + two probe false-greens it exposed ...

SEC-021's ON-DISK half REPRODUCED: vr1-dc0-maas-power_ed25519{,.pub} are
genuinely absent from the dc0 jumphost creds folder, not merely undeclared.
Capture: docs/audit/d137-tier2-sweep-20260726.txt (read-only, no sudo,
stat-over-ssh metadata only; jumphost + voffice1 + office1-netbox).

Running it against real hosts exposed two false-greens in the probe:

1. "absent" vs "could not look". /root/maas-secrets and /root/netbox-secrets
   reported "does not exist" -- they exist; SEC-020 is precisely about
   admin.pass living in the first. An unprivileged [ -d ] on a root-owned
   parent is indistinguishable from a missing directory. The probe now tests
   parent traversability and reports UNREADABLE as a FAIL, not a skip.

2. Role-level aggregation manufactured false absences: skipping one location
   let a role's other locations cover it, so credentials in the unprobed
   location reported EXPECTED-BUT-ABSENT. Absence is now asserted only over
   fully-probed roles (14 rows report NOT JUDGED). Refinement: "absent" is a
   conclusive observation and does not gate a role; only unreadable and
   unreachable do.

Harness 33 -> 35 (T33 unreadable location, T34 absent location).
Gauntlet ALL GREEN (80), repo-lint 0-fail.

OUTSTANDING: the two root-owned dirs need a privileged read, so SEC-022's
shadow-store contents and the SEC-020 region secrets stay UNCONFIRMED. That
is a remote-sudo shape and was not run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 tier 2 (EXISTENCE): declared-location bound, existence checks, widened globs ...

Tooling only -- the LIVE three-site sweep has NOT run, so SEC-021's on-disk
half, SEC-022 and SEC-023 are not yet reproduced as live findings.

creds-manifests/vm-secret-locations (ruling 3): the absolute bound on
discovery. Covers the jumphost creds folders, the SEC-022 headend shadow
stores, the SEC-020 region secrets dir, the three dirs outside the SEC-009
convention, plus two the ruling's note did not name -- the in-clone PKI
overlay and the DOCFIX-175 plaintext tfstate. Tenant dirs are LOCAL-only:
no tenant VM/project/host is reachable from this file, so D-069 holds by
construction rather than by good behaviour. `<repo>` is substituted at
runtime (D-110: the repo name is never hardcoded).

creds-matrix.py --tier2 [--remote]: E1 expected-but-absent, E2 mode, E3
undeclared-at-a-declared-location. Probes are `stat` over ssh -- metadata
only, never content. An unreachable host SKIPS with an explicit [ok],
because "could not look" must never read as "nothing there".
--pending-stage is supplied by the CALLER so a not-yet-reached mint stage
defers instead of failing; encoding which stages have run would put a
status claim in code, and GA-R1 puts status in CURRENT-STATE only.

creds-audit.sh sprawl globs widened for the SEC-023 blind spots
(admin.pass, *.apikey, *.key, *.pem, *_ed25519, *_rsa, *openrc*). The old
six patterns could not have matched the SEC-020 secret that sat undetected
12 days, any bare SSH key or PEM, or the predicted Stage-5 ~/admin-openrc.

Harnesses: creds-matrix 33/33 (8 new tier-2 cases), creds-audit 13/13
(was 7; five blind-spot fixtures plus T13 asserting the widening did NOT
become trigger-happy). Gauntlet ALL GREEN (80), repo-lint 0-fail.

FLAGGED DIVERGENCE from the plan's Files list: --remote is implemented in
creds-matrix.py, not creds-audit.sh. Tier 2 IS the preflight Pn and the
matrix plus locations list both live there; splitting it would mean two
implementations of one bounded walk. Ruling 3 names a bound, not a script.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 tier 1 (STATIC): credential matrix, checker, harness -- RED by design ...

Schema amended 10 -> 12 columns (operator-ruled 2026-07-26, "go with the
12-column amendment"): adds `custody` + `notes-ref` and re-keys a row to one
(credential, location) pair. A read-first round-trip check of the three
manifests proved the 10-column form could not carry what D-137 ruling 2
forbids dropping -- and ruling 3 puts four deliberate credential copies inside
--remote's declared locations, where creds-audit.sh:63-67 would report each as
UNDECLARED. Implements ruling 2 ("prose must become MATRIX FIELDS"); OPS under
GA-R3, the five sub-rulings untouched.

Ships: creds-matrix.tsv (72 rows), creds-matrix-notes.md (32 keys),
scripts/creds-matrix.py (S1 schema / S2 both-bounds manifest coverage / S3
render drift / S4 mint-ref resolution / S5 per-DC symmetry / S6 ruling-5
principal invariant / S7 notes integrity), tests/creds-matrix 24/24.
Gauntlet ALL GREEN (80, was 79); repo-lint 0-fail.

RED BY DESIGN, 5 findings -- do not go green by deleting rows: the ruling-5
identity conflation on maas-region-admin (the live SEC-020 defect), 3x
EXPECTED-BUT-ABSENT for SEC-021's declaration half, and the S5 asymmetry on
dc0's divergently-named headend power key. 27 operator-terminal rows are the
FINDING 1 reproducibility debt, counted not faulted.

Two self-inflicted false-greens found and closed during the build: S2
enumerated only matrix-mentioned sites (an empty matrix read CLEAN -- the
sandbox-fidelity-check.py:131-143 defect one level up; now the union of both
sides, regression-locked by T9), and the uniqueness key false-failed two
identities sharing one file (T6).

NOT done, stated so the boundary is unambiguous: tiers 2-3, vm-secret-locations,
the SEC-009 demotion, and the ruling-1 preflight Pn -- whose blocking-vs-deferred
sequencing is an OPEN operator question. No manifest rewritten; no cloud state
touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

audit: transcribe the full 55-row credential inventory in-repo (matrix seed) ...

The capture's body previously said the per-row tables lived in the session
transcript. The operator is clearing that session to start the build, so the
matrix SEED would have been lost and would have cost another full inventory
run to re-derive.

Appendix now carries all of it: section A (25 scripted MINT rows), section B
(30 runbook/prose MINT rows), section D (charm-minted, with the keystone admin
password called out as in-scope per the materialization ruling), section E
(MATERIALIZE/UPLOAD checked and excluded, with file:line so the exclusions are
auditable), and section G (coverage boundary, incl. what was deliberately not
opened). Corrected the body pointer that referenced the transcript.

Notable rows the build will need: A6 the MAAS rack-enrollment secret (a mint
nothing else records), B5-B12 the eight Octavia PKI artifacts, B13 the overlay
that lands a CA key + plaintext passphrase inside the repo clone, B14 the
juju-<dc> superusers stored nowhere, B22 the per-DC power key whose dc0 copy is
missing (SEC-021), and A21-A25 which DUPLICATE A11-A14 -- one credential set,
two creation locations, do not double-count.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137: repo-carried build spec for the fresh-session handoff ...

Operator directed the build to a fresh session. The design and committee review
lived in a plan file under ~/.claude/plans/ -- outside the repo -- so a session
bootstrapping via the GA-R4 path (CURRENT-STATE -> session-ledger ->
ledger-scan) would never have surfaced it. That is a real durability gap given
repo-is-authoritative, so the spec now lives at
docs/D-137-implementation-plan.md (precedent: docs/D-068-vault-migration-plan-draft.md).

Carries the five ruled decisions and their consequences, the matrix schema
(logical keys only per the SEC-004 ruling), the checker model with file:line
precedents (provider-bundle-check for structure, sandbox-fidelity-check:131-143
for both-bounds), the three tiers, inherited constraints (metadata-only
source-grep guard, gauntlet excerpt regex, preflight 0/1/2, L1/L10), the file
list, and the acceptance test.

Explicitly instructs the next session NOT to make the first run green: the
acceptance test is that the checker REPRODUCES SEC-021/-022/-023 and the
predicted admin-openrc case as NAMED failures. A checker that passes on today's
tree is wrong. Going green is a separate remediation project.

CURRENT-STATE item 9 + the ledger addendum point at it. Auto-memory pointer
updated: policy authority is D-137 per sub-ruling 4, with a verify-first caveat
that creds-audit CLEAN is not evidence of completeness.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 sub-ruling 5 RULED + D-137 ADOPTED: implementation unblocked ...

Question as presented: "D-137 ruling 5 of 5 -- identity fold-in ... the matrix
has a principal column, which would make the conflation machine-detectable.
Fold it in, or keep it separate?" Operator selection, exact: "Fold in as a
D-137 invariant (Recommended)".

D-137 gains the invariant ONE IDENTITY SERVES ONE PRINCIPAL TYPE, enforced by
the matrix principal column: a credential serving both human and service is a
FAIL, not an observation. The SEC-020 conflation becomes machine-detectable and
needs no separate D-number -- the question SEC-020 left proposable-but-unassigned
is absorbed here. First run is expected RED by design: admin serves a human GUI
row and a service API row simultaneously, which is the defect.

ALL FIVE SUB-RULINGS RULED -> Status flips to ADOPTED 2026-07-26. Each was its
own operator exchange, committed and pushed before the next was asked (GA-R5).
Also fixes the Status LINE to lead with ADOPTED so ledger-scan attributes it
correctly (it keys on the last **Status:** line, and the entry was still being
counted as an open decision); scan now shows 4 open decisions. Ledger machine
block re-seeded, POST-CLOSE ADDENDUM added per the 07-18/07-21 precedent.

Implementation is UNBLOCKED but NOT STARTED.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 sub-ruling 4 RULED (GA-R5): D-137 is the credential-lifecycle authority ...

Question as presented: "D-137 ruling 4 of 5 -- policy home. Where does the
credential-lifecycle RULE live as authority?" Operator selection, exact:
"D-137 is the authority (Recommended)".

D-137 becomes the policy authority; the SEC-009 standing-convention block in
docs/security-ledger.md demotes to a pointer, and the ledger returns to being
purely a register of exposures and rotation obligations -- its stated purpose
and the GA-R4/F3 intent. Gates can then cite a D-number rather than an exposure
register. Satisfies the GA-R3 A1 test: a Roosevelt session greps
design-decisions before touching a built surface, so the rule must live there.

Implementation care recorded: the demotion MOVES the convention text, it does
not delete it. SEC-009's block carries the founding history (the NetBox-token
miss) which stays in the ledger as history while the RULE moves to D-137.

D-137 stays PROPOSED; sub-ruling 5 OPEN; nothing built until all five.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 sub-ruling 3 RULED (GA-R5): remote discovery = declared locations only ...

Question as presented: "D-137 ruling 3 of 5 -- remote discovery scope ... The
tension is tenant isolation on a commercial multi-tenant cloud." Operator
selection, exact: "Declared locations only (Recommended)". Dated 2026-07-26 --
this session crossed the date boundary; sub-rulings 1-2 were pushed 2026-07-25.

A declared list (creds-manifests/vm-secret-locations, <host-role> <path>) bounds
--remote absolutely; it never walks outside the list. No tenant surface touched,
D-069 custody boundary and hard-isolation posture preserved, fast on a live
region.

Records a faithful-implementation note (NOT an override): the list must be
populated with everything already known to hold credential material or the
ruling leaves measured defects uncovered -- per-site creds folders on the
headend as well as the jumphost (SEC-022 shadow stores), the region secrets
dir (SEC-020), and the three directories outside the SEC-009 convention found
by the creation-point inventory. Accepted residual: a secret minted at an
undeclared location stays invisible, so adding a row is part of DoD for any new
mint site.

D-137 stays PROPOSED; sub-rulings 4-5 OPEN; nothing built until all five.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 sub-ruling 2 RULED (GA-R5): derive manifests from the matrix ...

Question as presented: "D-137 ruling 2 of 5 -- derivation ... How do the
matrix and the manifests relate?" Operator selection, exact: "Derive
manifests from matrix (Recommended)".

Matrix becomes SINGLE SOURCE; --render regenerates creds-manifests/*.manifest
and the gauntlet fails on rendered-vs-checked-in drift. Kills the dual
maintenance the committee flagged as the GA-F06 staleness risk.

Accepted cost recorded at ruling time: manifests become generated artifacts,
so their governance prose (SEC linkage, mint dates, off-manifest carve-outs,
un-consolidated findings) must become matrix FIELDS or be regenerated into the
rendered header -- not silently dropped. That prose is load-bearing: it is what
recorded the dc0 edge-keypair backfill debt.

D-137 stays PROPOSED; sub-rulings 3-5 OPEN; nothing built until all five.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 sub-ruling 1 RULED (GA-R5): enforcement = blocking in preflight ...

Question as presented: "D-137 ruling 1 of 5 -- enforcement strength. This
decides whether the rule binds or merely advises, and it gates rulings 2-5."
Operator selection, exact: "Blocking in preflight".

Consequence: the credential check lands as a new Pn in scripts/preflight.sh
and HARD-FAILS on any expected-but-absent, undeclared, or per-DC-asymmetric
credential -- no deploy proceeds past a credential gap. Not adopted: the
PreToolUse guard (an agent is constrained at the deploy gate, not at write
time) and advisory-only, which is precisely the posture that failed -- the
phase-3 prose rule was advisory and never fired at either DC standup.

D-137 stays PROPOSED. Sub-rulings 2-5 (derivation, --remote scope, policy
home, identity fold-in) are OPEN and NOTHING is built until all five are
ruled, one exchange each per GA-R5.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

audit: credential creation-point inventory -- 12 declared secrets have NO mint command ...

Read-only research capture seeding the D-137 credential matrix. Nothing built;
the five D-137 forks remain unruled.

FINDING 1 (qualifies the premise that creation points are already known):
`grep -rnI "ssh-keygen" .` returns ZERO hits repo-wide -- no mkpasswd, pwgen,
uuidgen, random_password or tls_private_key either. Yet the manifests declare
six SSH keypairs plus the OPNsense root password/hash, whose only provenance
record is a manifest COMMENT. Twelve standing credentials therefore have no
reproducible mint. If the jumphost is rebuilt, no repo artifact says how to
recreate them -- a Roosevelt-transfer defect, not merely hygiene. Consequence
for the design: mint-ref must admit three provenance kinds (script:line,
runbook:step, operator-terminal), and the operator-terminal rows are the debt
the matrix exists to surface, not parse errors.

FINDING 2: three credential DIRECTORIES sit outside the SEC-009 per-site creds
convention and outside creds-audit entirely -- the Vault init directory (5
unseal shares + root token), the Octavia PKI directory (8 artifacts including
two CA private keys), and the per-tenant directories. All are named in
CLAUDE.md, so they are known; they are simply uncontrolled. Materially extends
SEC-023. Also flags overlays/octavia-pki.yaml, which lands a CA key blob plus a
plaintext passphrase inside the repo clone, gitignored -- with SEC-004 the repo
still PUBLIC.

FINDING 4 corroborates SEC-020 independently: phase-4 runbook:128 mints the
juju-<dc> superusers with no --password (stored nowhere), and
site-headend-install.sh:452 uses --password in argv.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

SEC-021/-022/-023: live credential defects found during D-137 matrix research ...

Recorded, NOT actioned (hard rule 1). Open SEC rows 16 -> 19. These surfaced
while gathering inputs for the credential matrix and are live defects
independent of any D-137 ruling.

SEC-021 dc0 custody defects. (a) changelog-20260719-dc0-deploy-stepB.md:263
records the dc0 edge REST API credential consolidated to
~/vr1-dc0-creds/opnsense-api.txt; that file exists for office1 and dc1 only --
no dc0 copy -- and creds-audit vr1-dc0 says CLEAN because it was never
manifested. A changelog asserting consolidation is not evidence it survived.
Not a lockout: the dc0 edge SSH key is present, D-112(c) SSH is the primary
path. (b) dc0 power key = maas-virsh_ed25519 on voffice1 vs dc1's declared
vr1-dc1-maas-power_ed25519{,.pub} on vcloud -- name/host/custody divergence.

SEC-022 two UNAUDITED shadow *-creds/ stores on voffice1 holding real key
material. creds-audit.sh:29-31 resolves under $HOME on the host it runs on
(vcloud) and has no ssh, so an entire parallel store is structurally
invisible. A scope gap in the control, not a one-off: D-128 puts Plane-2
execution on voffice1.

SEC-023 sprawl globs (creds-audit.sh:72-73) miss admin.pass, *.apikey, *.key,
*.pem, *_ed25519, maas-api-key.txt. Plus a PREDICTED exposure recorded before
it exists: phase-03-admin-openrc.sh:32,72 writes OS_PASSWORD into
$HOME/admin-openrc at Stage 5, home root, matching no glob.

Also reconciles the CURRENT-STATE G14 evidence cell to a measured 19 (it read
12 from 07-23) since this commit adds three of them, and re-seeds the ledger
machine block.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 PROPOSED: credential mint-and-consolidate pipeline -- make consolidation structural [ARCH] ...

Operator ask: a better method for minting/saving credentials, plus "a durable
rule to make sure when accounts are created there is a consolidation that
happens every time so credentials aren't misplaced or lost."

PROPOSED only -- no tooling built, no enforcement wired, no SEC-009 demotion.
Three forks are presented for ruling, one exchange each (GA-R5).

Measured diagnosis: the existing SEC-009 control CANNOT DETECT THE FAILURE
CLASS IT WAS BUILT FOR, because creds-audit is DECLARATION-based -- the
manifest IS the declaration, so an undeclared secret is structurally
invisible and a green CLEAN is not evidence nothing was missed.
- creds-audit vr1-office1 read CLEAN on 2026-07-15 while four secrets minted
  on the region VM on 2026-07-13 (site-headend-install.sh:416-455) sat
  undeclared; admin.pass surfaced only 2026-07-25 (SEC-020), 12 days later,
  and only because a task went looking.
- No --all (creds-audit.sh:25 takes one mandatory site).
- Enforcement is PROSE in exactly one place (phase-3 runbook:498), absent from
  preflight/cloud-assert/repo-lint/gauntlet -- and it did not fire at EITHER
  DC standup (dc0 3 + dc1 1 undeclared at this session's open).
- No D governs credential mint/custody generally (D-069 = Vault unseal keys,
  D-126 = per-env key isolation), so the rule lives only in the security
  ledger -- a register of exposures, which no gate can cite as authority.

Proposal: mint-and-consolidate as ONE operation (creds-mint.sh), plus the
DISCOVERY inversion (creds-audit --all/--remote against declared VM secret
locations -- the only piece that would have caught admin.pass), plus gate
wiring, plus a site-headend-install.sh amendment at the source.

The SEC-020 identity-conflation question stays SEPARATE (not batched, GA-R5)
and remains D-unassigned.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

SEC-020: MAAS admin-account recovery -- consolidate `admin`, mint `operator`, creds-audit CLEAN x3 ...

Operator task: recover the MAAS admin accounts and save the creds retrievably.
The task premise was FALSIFIED by measurement before any mutation: the ledger's
2026-07-25 "MAAS web-GUI login does NOT exist / never minted" was wrong. The
`admin` password was minted 2026-07-13 by site-headend-install.sh:452 and is
MEASURED working (login 204 vs 400 wrong-password control). It was merely
root-only on voffice1 and un-consolidated -- the SEC-009 miss class, not a
missing account. Scope re-ruled by the operator after that finding:
"New account + consolidate only" -- no existing password rotated.

- NEW MAAS superuser `operator` for human GUI login; password generated on
  vcloud, set via stdin (never argv -- SEC-018 discipline; changepassword has
  no --password and createadmin --password would expose it).
- `admin` password CONSOLIDATED byte-identical (sha256-verified) to
  ~/vr1-office1-creds/. NOT rotated, so the VM copy REMAINS source-of-record;
  a future rotation must update both or the VM copy becomes a stale trap.
- juju-vr1-dc0/dc1 untouched BY RULING: their SEC-018/019 API keys are
  load-bearing for the blocked Stage-5 bootstrap.
- Manifest backfill -> creds-audit CLEAN on all three sites (was RED: dc0 3 +
  dc1 1 undeclared), closing the dc0 edge-keypair queued finding named in
  vr1-dc1.manifest:18-20.
- Root cause recorded: `admin` doubles as the automation identity (19 `maas
  admin` call sites in 4 scripts), so automation never needed the password and
  nothing forced it into the folder. Proposable as the next-free D-number
  [ARCH]; NOT assigned (GA-R3 doubt-resolves-DOWN).
- Falsified ledger claim struck+corrected; machine-derived block re-seeded
  (was stale on every line: SEC 12->16, next-free D 133->137, DOCFIX 200->204).

Evidence: docs/audit/maas-admin-recovery-20260725.txt (generated, no secret
values; scanned for password bytes = 0 hits with a planted-control check).
repo-lint 0 fail; gauntlet ALL GREEN (79).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-136 PROPOSED (NetBox-coupled render pipeline) + Ruling 3 + DOCFIX-201 ...

Register append + CURRENT-STATE same commit (GA-R1/C1); DOCFIX-201's docs/audit
edits ride the same CURRENT-STATE touch (L10).

- D-136 PROPOSED [ARCH]: NetBox-coupled per-DC render pipeline; option (C)
  recommended (values-file back half now for both DCs, NetBox front half for
  Roosevelt); non-gating for dc1; prerequisite = extend sandbox-fidelity-check.py.
- Ruling 3 (GA-R5) recorded INLINE in D-136 with the verbatim question + utterance
  ("Your question about 1 or 2, go with 1. Base bundle and everything else is
  applied via overlay") -- committee BLOCKER-1 fix (durable home, not the
  delete-after-use pack file).
- CURRENT-STATE Stage-4: bullet (a) vault-VIP D-020 fix + per-DC widen, bullet (c)
  artifact-shape RULED, coupling bullet -> PROPOSED as D-136, FOLLOW-UP gate
  blockers (pre-flight-checks CHECK 1, provider-bundle-check vault VIP, VIP_OCTET_MAX).
- DOCFIX-201: dual-VIP decision is D-020 not D-036, SEVEN sites (7th caught by the
  pack-review committee; verify -> 0 VIP-context D-036 remain).
- Chat correction (2026-07-25): D-136 open Q5 rewritten -- Jenkins IS the runner
  (gap void); real requirements webhooks + status-back; placement OPEN.

repo-lint 0 fail. No cloud state mutated. D-136 PROPOSED -- operator rules the
mechanism (GA-R5).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Ruling 2 recorded (GA-R5): keystone policy-override VERIFY-LIVE gate ...

Operator ruling 2026-07-25. Question: add a VERIFY-LIVE gate that policyd-override
lands on every keystone unit after dc-ha-scaleup scales keystone to 3 (a broken
override is atomic -- whole policy discarded, silently reverting every tenant
domain-manager to a plain user). Utterance (verbatim): "dc-ha-scaleup: Yes to the
verify-live".

CURRENT-STATE Stage-4 VERIFY-LIVE gate added: juju status shows PO: on EVERY
keystone unit after scale-up, never PO (broken):. Protects D-051/D-064 (SCS Domain
Manager). Verbatim also in changelog item 13 (durable home). GA-R5: recorded before
the deploy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Ruling 1 recorded (GA-R5): address-family policy (D-101 confirmed, no amendment) ...

Operator ruling 2026-07-25. Question: v4-only vs dual-stack for dc1 phase-4.
Utterance (verbatim): "Dual stack to be used where IPv4 is required, IPv6 where
IPv6 only makes sense." Clarifying: "Dual stack deployment for DC0 and DC1. This
is the deployment when the dual-stack is added".

- docs/design-decisions.md: dated RULING NOTE under ## D-101 with the verbatim
  question + utterance (confirms D-101's matrix; changes nothing).
- docs/CURRENT-STATE.md: resolve-before-deploy bullet (b) RESOLVED -- v4-only
  phasing CLOSED for both DCs; VIP-overlay reconciliation now non-deferrable.
- changelog item 12.

The verbatim is transcribed into durable committed homes (D-101 note + changelog),
NOT left in the delete-after-use _handoff-not-committed/ pack (committee BLOCKER-1).
GA-R5: this ruling lands before the dependent VIP-reconciliation / deploy work.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

audit: full decision reconciliation record (IP/VLAN/node/decision-status) ...

4-lens read-only recon of every ruled decision vs the authoritative surfaces
(office1-netbox apex snapshot, lib-net/lib-hosts, bundle/overlays, MAAS carve).

Headline: IP prefix-layer COMPLETE + drift-free; VLANs correctly absent
(untagged-per-fabric, D-133 -- MAAS construct, not NetBox); the GAP is sub-prefix
-- the D-134 per-DC bands + the 33 VIP addresses live only in prose/overlays, not
the apex (blocks the NetBox->deploy coupling). Node/MAC/power config drift-free;
Fork-3 role tags + 10th controller VM pending gated (deploy-blocking).

Decision-status integrity flagged STALE surfaces (fixes QUEUED, operator-deferred):
CURRENT-STATE section 4 comprehensively stale (HIGH), G14 SEC count 12->15,
phase-4 runbook designate line. Reconciliation backlog (P0-P2) + the "what else to
queue" answer in the record; extend sandbox-fidelity-check.py first (gates the
apex recons).

CURRENT-STATE updated same change set (GA-R1/C1) with a pointer + a section-4-stale
warning. No cloud state mutated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

vr1-dc1 bundle render (9-node role-separated) + expansion review record ...

Render (committee Fork-2 hand-render), validated by the extended checker:
- bundle.yaml: machines "8"-"11" (tags=openstack) -> "0"-"8" role+DC tags (block
  style); every `to:` re-homed (quorum trio -> control 0/1/2; nova-compute 3->2 on
  compute 3/4; ceph-osd -> storage 5-8; scaled apps + utilities -> control);
  ovn-chassis -> the 2 dc1 compute provider MACs (52:54:01:d1:04:02/05:02).
- overlays/vr1-dc1-machines.yaml (NEW): per-DC retag (machines-overlay merge is
  VERIFY-LIVE at `juju deploy --dry-run`).
- overlays/dc-ha-scaleup.yaml: tokens rendered to logical control ids 0/1/2
  (DC-neutral); header updated; stale ceph-osd-3 comment -> 4.
- provider-bundle-check.py: ovn-chassis MAC check skips the VR0 Pattern-A set on a
  role-separated bundle (the validator CAUGHT a real YAML flow-comma render bug).

Validated: base + FULL dc1 deploy input (3 overlays, --dc vr1-dc1) PASS; harness
15/15; gauntlet ALL GREEN (78); repo-lint 0-fail.

Expansion review (3 read-only reviewers) recorded in
docs/audit/stage5-expansion-review-20260724.md: relations/bindings/subordinates
HOLD under role-sep (uniform 6-NIC, SEC-011); no channel/pin change; open
resolve-before-deploy items (vault VIP, v4-vs-dual-stack phasing) + deploy-gate
script gaps + VERIFY-LIVE gates. NetBox->deploy coupling routed to Chat as a new
PROPOSED D-number (Fork-2 escalation). No cloud state mutated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Stage-5 dc1: committee review + Fork-1 ruling (D-104 amendment) + BUNDLEFIX-052 ...

Track-2 bundle-render blocker, committee-adjudicated (4 read-only lenses:
Roosevelt-delta / HA-DR / operational-risk / Juju-MAAS-mechanism). Every
load-bearing claim re-verified against the repo before adoption.

- Committee record: docs/audit/committee-20260724-track2-bundle-render.md
- Fork 1 RULED (operator, GA-R5): dedicated 10th per-DC controller VM ->
  D-104 amendment. Capacity gate PASS (measured): 10-node x 2-DC =
  854/1024 GiB (83%, FIT, 170 GiB headroom);
  docs/audit/stage5-controller-capacity-20260724.txt
- BUNDLEFIX-052: removed an orphaned `bindings:` block absorbed into
  ceph-rbd-mirror (clobbered its D-108 replication bindings + injected a
  phantom `dashboard` endpoint -> juju deploy reject). provider-bundle-check PASS.
- CURRENT-STATE Stage-4 bullet updated same change set (GA-R1/C1).

No cloud state mutated. Fork 2/3 = OPS committee-unanimous, executed under gating.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend 2026-07-24: DC1 proxy-build started, BLOCKED on bundle rework ...

CURRENT-STATE + ledger handoff for a fresh session (context exhausted). DC1
Stage-5 deploy setup done (MAAS creds SEC-018/-019, Juju on voffice1, vr1-maas
cloud + credentials, VIP overlay, phase-4 Step 2.0). Committee-reviewed BLOCKER:
committed bundle.yaml is still VR0 4-node hyperconverged; VR1 dc1 needs 9-node
role-separated HA (D-121 Option C) -- architecture decided, deploy artifacts
(bundle/overlays/runbook) never rendered to it. DNS confirmed green for bootstrap
(D-131 forwarder resolves external; hang can't recur) with a hard egress-OPEN
ordering caveat. Owned: fabricated "D-193" in analysis (corrected to D-121; not
persisted). NEXT SESSION: render the vr1-dc1 role-separated HA bundle + wire
overlays + de-stale phase-4, then bootstrap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

DC1 cache proxy INSTALLED + verified (check PASS 8/8) ...

dc-cache-proxy.sh install dc1 executed on the DC1 rack (gated): apt-cacher-ng
3.7.4 active on the utility .4:3142, proxy serves archive + UCA (200/200). DC1
apt path is now unblocked for the build. CURRENT-STATE + changelog updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

D-135 amendment: DC1 interim apt caching proxy (dc-cache-proxy.sh) ...

Operator-ruled 2026-07-24 (GA-R5, utterance quoted in D-135): DC1 gets an
interim apt caching proxy (apt-cacher-ng) to unblock its build without waiting
on the full ~950 GiB debmirror; DC0 stays the full-mirror deployment under test;
DC1 proxy is replaced by a full mirror afterward. Both artifact-delivery models
thus get exercised this rehearsal (Roosevelt input, D-132/D-133).

- scripts/dc-cache-proxy.sh: site-keyed check/install; apt-cacher-ng proxy mode
  at the D-134 utility .4:3142; reuses the <site>-mirror-net layer (fails loud if
  absent); caches archive/security/UCA, consumed via juju apt-http-proxy.
- tests/dc-cache-proxy/run-tests.sh: 15 static cases, 15/15 PASS.
- D-135 AMENDED (design-decisions.md) + CURRENT-STATE Stage-4 DC0/DC1 split.
- DC1 debmirror PAUSED at ~330 GiB (kept dormant as fallback); measured that the
  vcloud uplink was NOT the shared bottleneck (pausing dc1 did not speed dc0).

Feasibility recon'd read-only first (apt-cacher-ng installable, upstreams 200 via
edge, port free). Live install on the DC1 rack is the separately-gated mutation.
repo-lint 0 fail; gauntlet ALL GREEN (78).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Delivery batch: lib-hosts VR1 arms, D-133 guards, appendix-A pf entry, DoD 8-9 (gauntlet 77 GREEN) ...

lib-hosts vr1-dc0/vr1-dc1 populated from the measured identity table
(tofu-name keys, pinned boot MACs, D-134 octets, per-DC power URIs +
tags) + host_sysid_by_bootmac (the VR1 resolver) + one-selection guard;
dc-selector rewritten, 48 PASS. reenroll-hosts + carve-host-interfaces
gain explicit vr1-* refusals (VR0 flows superseded by D-133 -- populated
arms must not enable them). lib-net vr1-dc0 VID caveat. Appendix-A:
edge pf-never-regenerated symptom (masking trap named). Phase-2 DoD:
items 8 (filter reload + LAN egress probe) + 9 (dc-mirror), item 4
range corrected to D-134 .201-.254. CURRENT-STATE same-commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Mirrors installed both racks, syncs RUNNING; dc1 edge pf incident resolved; HOME fix (harness 19) ...

Item 9: fresh dc1 edge passed no LAN traffic -- pf ruleset never
regenerated after v4 addressing (set-interface reloads the interface,
not the filter; dc0 masked by 07-20 plugin work). configctl filter
reload -> egress 0%/301. Appendix-A + standup-DoD + script amendment
queued to stage close. Item 10: installs PASS 15/15 both racks, first
sync HOME-under-systemd failure fixed in the unit (T19), reinstalls +
syncs running (dc0 400M/dc1 343M in the first minute). Ledger in-flight
entry added; CURRENT-STATE same-commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

dc-mirror.sh shipped (D-135 item 1): per-DC apt+UCA mirror, harness 18/18, gauntlet 77 ALL GREEN ...

Site-keyed (dc0/dc1 MEASURED rows), check/install/sync; net layer = D-134
utility .4 alias + default route via the DC edge (egress path MEASURED
working; edge DNS answers). debmirror GPG-verified jammy triple + UCA
caracal, nginx on the utility address, daily timer, niced/idle-IO. Install
fails loud on missing packages with the exact apt line (net-first ordering
resolves the no-egress chicken-and-egg). Gauntlet capture + CURRENT-STATE
same-commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw