DOCFIX-149: OPNsense config.xml template + tested renderer ...

Real design work, researched before drafting: fetched OPNsense's own actual
shipped config.xml.sample and its Route.xml static-routes model before
writing anything.

opentofu/templates/opnsense-config.xml.tmpl: {{TOKEN}}-parameterized (reuses
this repo's existing clientdocs convention), covering interfaces/gateway/
staticroutes/DNS/NTP and D-107-shaped firewall rules (default-deny WAN
egress except NTP + the per-DC mirror's upstream sync). The real sample
fetch directly confirmed last turn's audit finding with an actual example:
it ships literal placeholder device names inside each interface's own <if>
block, proving LAN/WAN role assignment really is that explicit per-block
mapping, not declaration order.

scripts/opnsense-render-config.sh: the renderer. Needs no external tool
(unlike every other opnsense-* script this session), so it's tested
END-TO-END, not just guard clauses -- 8/8, including well-formed-XML
validation. The harness caught a real bug before it shipped: the token
HOSTNAME collides with bash's own built-in $HOSTNAME variable (unset
doesn't actually clear it), silently passing a test that should have
failed. Renamed to OPNSENSE_HOSTNAME throughout.

opentofu/templates/README.md's token legend marks exactly which values are
real (NTP pool default, D-106 naming) vs. pending Stage 0 ratification
(D-100/D-101/D-107) vs. only measurable on a real boot (vtnetN assignment)
vs. a security requirement (root password hash must be freshly generated,
never the stock sample's own shipped default).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-148: OpenTofu module audit pass + provider-docs skill reference ...

Audited every "UNVERIFIED"/"inferred"/"assumed" marker across all 9 modules
built this session rather than leaving them as-is. Found and fixed a real
documentation error: opnsense-edge's comments claimed devices.interfaces
list order directly sets OPNsense's LAN/WAN role. Researching OPNsense's own
interface-assignment model showed this conflates two things -- list order
plausibly controls which vtnetN device number a NIC gets (libvirt's own
docs: auto-assigned PCI addresses "usually match" XML order for a simple
topology), but the actual LAN/WAN role is a separate, explicit mapping set
inside config.xml itself ("vtnet0=WAN" is a convention some guides choose,
not an enforced rule). Corrected main.tf's comments and both
lan_network_name/wan_network_name variable descriptions -- no config.xml
exists in this repo yet, so this fixes documentation accuracy for whoever
writes it next, not current behavior.

Confidence upgraded (not just re-hedged) on three other items: node-vm's
boot={order=N} shape (confirmed the provider 1:1-mirrors libvirt's own XML,
and libvirt's own docs confirm the single-attribute shape), create.content.url
accepting local paths (second independent source), and the genisoimage
flags (confirmed standard, cleanly separated from the still-open question of
whether OPNsense's Importer actually reads the result). Confirmed safe:
maas_vm_host's zone/pool computed-if-unset behavior.

Added .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:
indexes every provider/doc source used this session with exact URLs and
confirmed versions, plus the fetch methodology that actually worked
(Registry doc pages are JS-rendered, use GitHub instead; branch names vary,
check default_branch via the API; real example .tf files beat doc-summarized
prose for syntax questions). Wired into SKILL.md's routing table,
cross-referenced from opentofu/README.md in both directions without
duplicating content.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-147: opentofu/modules/maas-vm-host + modules/netem-link ...

Registers the vcloud host with MAAS as a virsh VM host, and applies tc netem
WAN-simulation parameters -- the two remaining unbuilt mechanisms from the
OpenTofu scope, researched before drafting per instruction.

maas-vm-host uses canonical/maas's maas_vm_host (register the chassis so
MAAS discovers already-existing VMs), deliberately not maas_vm_host_machine
(composes new VMs itself -- takes cores/memory/disks as inputs). Read both
schemas and cross-checked against D-103's explicit "MAAS does NOT compose
new ones" before picking one.

netem-link uses terraform_data (OpenTofu's own recommended replacement for
null_resource) with an SSH-wrapped local-exec provisioner -- confirmed
local-exec runs on the machine invoking tofu apply (Office1 per D-103), not
the vcloud host where the bridges live, so a bare local command would do
nothing useful.

Neither module instantiated: needs a real MAAS zone/pool, the vcloud host's
SSH target, and real netem parameters, none of which exist yet.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-146: opnsense-edge module + nano-image/config-ISO prep scripts ...

Implements the mechanism identified in today's OPNsense deployment research
(cloud-init confirmed unreliable on FreeBSD; the real native mechanism is
OPNsense's Configuration Importer, which scans an attached volume for
/conf/config.xml and gained ISO9660 support specifically for VM/cloud
automation).

scripts/opnsense-prep-image.sh: downloads the nano image, decompresses,
converts raw->qcow2, resizes -- work create.content.url almost certainly
can't do itself (a plain fetch, no decompression). No hardcoded mirror URL;
OPNSENSE_MIRROR_BASE is required explicitly.

scripts/opnsense-build-config-iso.sh: builds the ISO9660 image containing
/conf/config.xml that the Configuration Importer picks up.

opentofu/modules/opnsense-edge: wires both together, mechanically identical
to modules/cloudinit-vm's cdrom-attach shape but with no libvirt_cloudinit_disk
resource (wrong format for this). Explicit lan_network_name/wan_network_name
variables rather than an ordered list, since OPNsense's interface-1-is-LAN
convention makes list-ordering a real place for a silent mistake to hide. No
PXE boot-order attribute used -- this VM boots from its own disk, not the
network, so node-vm's flagged-unverified boot field doesn't apply here.

Both new scripts' harnesses (4/4, 3/3) exercise REAL missing-tool guards --
qemu-img/genisoimage/xorriso are all genuinely absent from this environment.
Two things flagged, not presented as fact: whether the Importer's ISO9660
behavior holds on a real boot, and whether interface list-order reliably
maps to LAN/WAN NIC enumeration for this guest. config_iso_path has no
default -- real config.xml content per site is still undesigned. Not
instantiated in root main.tf.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-145 + OPNsense deployment research ...

opentofu/modules/base-image + modules/cloudinit-vm: the cloud-init/pre-built-
image VM pattern for Office1's own service VMs (MAAS-region, NetBox,
GitBucket), verified against examples/alpine_cloudinit.tf. The base image's
.path is threaded across the module boundary as a real attribute reference
rather than reconstructed from pool+name strings. user_data/meta_data/
network_config are required inputs with no default -- the real Office1 VM
configs aren't designed yet, and a plausible DHCP default would silently
fail anyway since these planes carry no libvirt DHCP.

OPNsense research (no DOCFIX -- research delivery, not code): checked
OPNsense's own docs/forum/GitHub. Confirmed cloud-init is genuinely
unreliable on OPNsense (FreeBSD; OPNsense's own forum consensus), closing
the open question cloudinit-vm's build left. Found the real mechanism: the
Configuration Importer scans an attached volume for /conf/config.xml in a
2-3s boot window; ISO9660 support was added to it specifically for VM/cloud
automation -- mechanically identical to cloudinit-vm's cdrom-attach shape,
different payload. Use the nano image for KVM, not the installer images.
Fully sourced in opentofu/README.md. Not built yet, itemized: a decompress/
convert preprocessing script, an ISO9660 config.xml-seed builder, and the
real config.xml content.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-144: opentofu/modules/node-vm + fix real syntax bug in DOCFIX-142 ...

Built the D-103 node-VM pattern (blank disk, PXE-boot, MAAS-managed) for
Stage 3 -- this time from the provider's own real example .tf files
(examples/domain_with_network.tf, examples/alpine_cloudinit.tf), not
doc-summarization alone, since that confidence gap is exactly why the domain
module was deferred last time.

That surfaced a real bug in the already-pushed dc-planes/mesh-link/
dc-storage-pool modules (14d7382): they used classic HCL block syntax
(domain { ... }) where this provider's current schema needs attribute-style
objects (domain = { ... }) -- confirmed once real examples showed the actual
convention. All three fixed; opentofu/README.md's schema notes now state this
as a provider-wide assumption for any field not personally confirmed
otherwise.

One inference flagged, not presented as fact: the per-device boot-order
attribute's exact internal shape ({ order = N }) -- the field's existence is
confirmed, its shape is not. Not instantiated in root main.tf: node
count/sizing is a pending Phase-0 decision, not invented here. Still
deferred: the cloud-init/base-image VM pattern (Office1 services + OPNsense),
DC2 planes, netem application.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-143: repo_lint.py no longer relies on git to clean up its own CRLF ...

The --record-clientdocs-sweep/--record-guide-skill-coupling writers used
write_text(), which translates \n to the platform newline (CRLF on Windows)
before writing. .gitattributes' eol=lf silently cleaned this up at every
`git add`, so no CRLF ever reached a commit, but the script was depending on
git to fix its own sloppy output -- flagged during the DOCFIX-141 commit.
Both writers now build the string, .encode("ascii") it, and write_bytes() it
directly. ascii (not utf-8) deliberately: this repo's own rule is ASCII-only,
so a future non-ASCII path/hash now raises loudly here instead of writing
content L1 would fail on anyway.

Verified live: re-ran --record-clientdocs-sweep, byte-inspected the receipt
(0 CR, was 41/41 CR/LF before). tests/repo-lint harness 34/34 unchanged.
repo-lint 0 fail / 1 documented warn.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-142: opentofu/ network + storage-pool scaffold (VR1 IaC, gap #2) ...

First OpenTofu content in the repo. Network/pool layer only: modules/dc-planes
(the six per-DC planes, D-052/D-100), modules/mesh-link (the D-100 dark-fiber
triangle), modules/dc-storage-pool, wired for DC1 (inherits DC0's CIDRs per
D-101) and Office1. DC2 deliberately not wired -- its CIDRs aren't assigned
yet (D-101 open sub-item).

Provider schema (dmacvicar/libvirt v0.9.8) verified against its actual current
docs this session, not memory -- it has diverged materially from older common
examples (network isolation is a nested forward.mode, not top-level mode;
libvirt_domain restructured to ~40 args mirroring raw libvirt XML). Node-VM/
volume resources, OPNsense config, and tc netem application are deliberately
deferred: that schema is too large/unfamiliar to author safely without a real
`tofu providers schema` pass on a connected machine -- see opentofu/README.md
for the full account and the concrete next step.

Added scripts/opentofu-validate.sh (fmt/init/validate wrapper) + a harness
testing what's actually exercisable without a tofu binary (none is available
anywhere this repo has been worked in this session -- logged, not hidden).
Extended repo_lint.py's L1 check to cover .tf files (uncovered before since
none existed). repo-lint 0 fail / 1 documented warn; both harnesses green.
Workflow doc + its companion visual tracker updated to match.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-139..141: repo-rename sweep (ipv4->dc-dc) + repo-lint L9 self-reference guard ...

New repo openstack-caracal-dc-dc still had stale operational references to the
source repo it was seeded from (openstack-caracal-ipv4), plus, after the
mechanical fix, hardcoded references to its own new name -- both break on any
future fork/rename. Fixes:

- DOCFIX-139/140: repaired 8 stale clone-path/URL references across the skill
  and 4 runbook RUN blocks; fixed a repo_lint.py Windows path-separator bug
  that silently turned a documented WARN into a FAIL (rel comparison used
  str() instead of as_posix()).
- DOCFIX-141: new repo-lint check L9 fails any script/RUN-block/skill file
  that hardcodes the current repo's own directory name. Narrowed the
  .claude exclusion in repo_lint.py to .claude/worktrees/ only (it was
  blanket-hiding checked-in .claude/skills and .claude/hooks from all
  lint checks). Established a $REPO session-variable convention
  (runbooks/README.md Conventions) and converted the 8 hardcoded paths to
  require it explicitly, fail loud if unset.

repo-lint: 0 fail / 1 documented legacy WARN. tests/repo-lint harness 34/34.
Full details + per-item revert instructions in the two changelogs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

ledger: re-seed machine-derived block from 2026-07-09 scan (DOCFIX next-free 130->139) ...

The machine-derived block lagged at the 2026-07-08 pre-sweep seed (DOCFIX 130)
while ledger-scan reports 139 post-DOCFIX-138 -- a stale next-free pointer that
would mis-seed the forthcoming DC-DC fork. Re-seeded from today's scan; no
identifier consumed (ledger regen, not a DOCFIX). Changelog entry + REVERT added.
repo-lint 0 fail; scan reconciles.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DOCFIX-138: S8b -- centralize KEYSTONE_VIP default into lib-net.sh (single source of truth) ...

The keystone endpoint literal 10.12.4.50 was the default in 6 scripts (3 forms); now
all reference lib-net.sh KEYSTONE_VIP_DEFAULT (hard-rule #3). Sourced lib-net where
absent (verified source-safe). Each stays env-overridable. Resolve-checked; gauntlet
39/39, lint 0 fail (L7 re-recorded). S8 fully done (S8a+S8b); S8c won't-do.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ledger: D-076 PINNED (defer while devteam testing) + test1 orphan scheduled for removal ...

Operator rulings: no D-076 work while devteam run tests in the env; test1 role-less
orphan approved for deletion, staged (openstack user delete 9a62f88e...), run at
next window.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ledger: operator rulings (S8b do / S8c won't-do / quota accept) + StorageClass RESOLVED + D-076 assessment ...

#7 StorageClass: devteam TestCluster has default cinder-CSI class -- PV works out of
the box, no template change. #6 D-076: rev2 partially works (panels render) but
create-user GUI flow strands a role-less user; rework TODOs + ruling + window needed;
orphaned test1 user still present. S8b approved (next), S8c won't-do, quota accepted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DOCFIX-137: repo-lint L8 -- enforceable guide<->skill coupling guard ...

Make 'sweep the skill when the guide changes' a hard gate, not a note (skill-lag hit
twice: DOCFIX-135/136). L8 pins the Jenkins+K8s guide's sha256 in
clientdocs/guide-skill-coupling.txt; any guide change FAILS repo-lint (naming the
skill files to review) until re-recorded with --record-guide-skill-coupling. Mirrors
the L7 sweep-receipt pattern. Harness +5 (28/28), gauntlet 39/39, lint 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DOCFIX-136: full tenant-skill sweep -- close remaining DOCFIX-130 skill-lag ...

Grep-audit of the skill vs the DOCFIX-130 guide found 6 more absent topics; added
concise (pointer to guide for detail): resize command, kubeconfig cert-expiry,
dashboard-vs-CLI split, no-DNS, new Persistent storage section, ServiceAccount
pointer; + PVC-Pending and cert-expired troubleshooting signatures. Skill now covers
the full DOCFIX-130 topic set. Harness 8/8, gauntlet 39/39, package re-instantiated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DOCFIX-135: align tenant AI skill to DOCFIX-130 registry guidance ...

devteam asked (via the assistant) whether there is a registry setup step; the skill
had zero registry content. Add 'Images: bring your own registry' to kubernetes.md
(no platform registry; public pulls work; private-registry imagePullSecret) and an
ImagePullBackOff signature to troubleshooting.md. Skill harness 8/8, gauntlet 39/39,
L7 re-recorded. devteam-package skill files re-instantiated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DOCFIX-134: S8a -- FIP pool literals to lib-net.sh (single source of truth) ...

D-003 FIP pool (10.12.5.0-10.12.7.254) was hardcoded in phase-04-network-create
(env-overridable) and -verify (pinned). Both already source lib-net.sh; added
FIP_POOL_START/END there and referenced them. Gauntlet 39/39. S8b (KEYSTONE_VIP,
needs sourcing into client-critical scripts) + S8c (python cross-source) deferred
for operator decision -- bigger than the S estimate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DOCFIX-132/133: S-class cleanups -- S7 dead code + S4 trust_filter.py consolidation ...

S7: remove unused CF (d011-04) + subsumed vr_is_ipv4 guard (d011-03), no behavior change.
S4: three inline python trust filters -> one fixture-tested scripts/trust_filter.py
(--fields/--trustor-in/--first/--error-token); SDIR added to offboard + acceptance;
new tests/trust_filter/ 9/9. Gauntlet 39 ALL GREEN, offboard 22/22, acceptance 16/16.
S8 re-scoped (bigger than estimate) -- operator decision logged in ledger.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DOCFIX-131: tenant-offboard.sh Phase A cluster captures stdout-only ...

Fixes the last merged-stderr sites in the offboard (Phase C/D were DOCFIX-113).
A benign 'coe cluster list' stderr warning could word-split into the delete loop
and keep the wait loop from ever seeing empty -- a false 'not gone' exit 21 on an
already-clean tenant. New tenant-scoped tinv() (stdout-only, stderr surfaced as
NOTE); wait loop retries on list-error, final check fails closed. Harness un-excludes
coe from warnstderr + new coe-stderr-not-argv assertion (22/22). Gauntlet 38/38.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ledger: reconcile cleanup queue vs live -- foil1/capi-test-1/beta all already gone ...

Read-only audit: orphan sweep clean (ORPHAN=0), no stray LBs/FIPs. Only devteam
TestCluster remains. Sole remaining addendum-40 item: quota-vs-capacity doc (operator).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ledger: DOCFIX-130 committed (f0f11ae) + devteam-package guide re-instantiated ...

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DOCFIX-130: jenkins-kubernetes-guide.md -- close 7 workflow gaps + make dashboard/CLI paths explicit ...

Additive guide pass prompted by devteam's first self-service cluster (GUI-driven).
New Section 0 dashboard-vs-CLI selector + per-step **On the command line** /
**In the dashboard** markers; dashboard equivalents for create/resize/teardown.
Gaps closed: registry+imagePullSecret (no platform registry, verified), ingress-nginx
how-to + no-DNS, cluster resize (verified syntax), persistent-storage self-verify,
cert-expiry one-liner, tooling install/version-skew; + ImagePullBackOff/PVC-Pending
troubleshooting. Leak harness caught + fixed two client-doc term leaks. Storage
StorageClass default logged as operator follow-up (template volume_driver unset).
Leak 8/0, gauntlet 38/38, repo-lint 0 fail, L7 receipt re-recorded.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ledger: devteam self-created first cluster (TestCluster, HEALTHY, via Horizon) ...

Read-only audit, no cloud change. 1+1 calico cluster in devteam-prod, keypair
devteam-key, DOCFIX-121 dashboard symptom resolved in practice. Built via Horizon
off a GUI-made TestTemplate (not the delivered CLI devteam-k8s). Logged Horizon-vs-
CLI implications: explains the keypair-on-template confusion + a CLI-centric doc-gap
in jenkins-kubernetes-guide.md kubeconfig step (DOCFIX candidate, no number consumed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ledger: devteam handover READY -- both flags (custodian placeholders, cred-file dashboard_url) operator-accepted for the first internal test; only operator-manual in-person delivery remains ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 47: DOCFIX-129 -- tenant AI skill aligned to consolidated handover package (phase 2): 3 missing failure signatures (Public/Hidden, flannel-stuck, NoValidHost) + capacity caveat + Jenkins-guide integration; harness 8/8; package re-instantiated ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 46: DOCFIX-128 -- handover package consolidation phase 1 (glossary folded into handover-pack, glossary.md removed, account-table hard de-dup, no extra files); skill rewrite phase 2 next ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 45: gated script fixes -- DOCFIX-126 offboard E0 always-403 no longer FATALs before Phase F (harness 21/21) + DOCFIX-127 onboard cred files carry dashboard_url (env-overridable); live verify gated ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 44: DOCFIX-125 -- day2 {{THIS}}-in-prose reword (survived instantiation; logged sweep candidate closed) + full devteam package re-instantiation (staging-first, caught missing flannel line; glossary added; zero tokens bar flagged custodians) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 43: DOCFIX-124 -- clientdocs consolidation (operator ruled all M1-M7): M5 error-holes in self-service, M3 entry-point+goal-map in welcome, M1/M2 single-source-of-truth pointers, M6 Jenkinsfile fixes, M4 new shared glossary.md; gauntlet 38/38 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 42: devteam cluster unblock -- stuck flannel TestCluster2 confirmed gone + devteam-k8s calico template DELIVERED (stage5); operator rulings recorded (M1-M7 all approved, both gated script fixes approved, DOCFIX list closed) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>