D-137 committee audit + phase 1: correct the record ...

Six-lens read-only review found the delivered tier-1/tier-2 build has eight
reproduced false-greens and that the records overstated what was verified.
Four lenses converged independently on tier 2 being SITE-BLIND.

Record corrections only in this commit (no code, no data):

- NEW docs/audit/d137-location-listing-20260726.txt: the actual stat listing.
  CURRENT-STATE asserted remote filenames/modes citing the tier-2 capture,
  which is a VERDICT file containing none of them -- a GA-R1 rule 2 defect.
- .maas.cli was NEVER MEASURED and is wrong; the MAAS snap CLI profile is at
  ~/snap/maas/current/.maascli.db (measured). It sat inside the fix for the
  inferred-filename miss, so the corrected count is ~21, not six.
- WITHDRAWN: "ZERO undeclared files ... fully accounted for" (rested on the
  site-blind check). CORRECTED: "SEC-021 on-disk half REPRODUCED" now reads
  power-key artifacts only -- opnsense-api.txt's absence was masked.
- CURRENT-STATE's "virsh gap NOT fixed" corrected; it was fixed in 6d43619,
  whose commit did not touch the status authority because L10's trigger set
  excludes .claude/settings.json.
- Superseding figures recorded; stale "14 NOT JUDGED" -> 2; glob is *.pass.
- 12-column amendment recorded on D-137 in design-decisions.md; it previously
  lived only in a changelog (non-citable per GA-R2 rule 1) and the build spec.
- Repaired citations my own edits broke (guard moved 71-73 -> 90-92), the
  plan's 12-vs-27 operator-terminal count, the "two the ruling did not name"
  claim (it is one), and an unsupported ruling date in the notes.

Code and data remediation follows in later commits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137 tier 1 (STATIC): credential matrix, checker, harness -- RED by design ...

Schema amended 10 -> 12 columns (operator-ruled 2026-07-26, "go with the
12-column amendment"): adds `custody` + `notes-ref` and re-keys a row to one
(credential, location) pair. A read-first round-trip check of the three
manifests proved the 10-column form could not carry what D-137 ruling 2
forbids dropping -- and ruling 3 puts four deliberate credential copies inside
--remote's declared locations, where creds-audit.sh:63-67 would report each as
UNDECLARED. Implements ruling 2 ("prose must become MATRIX FIELDS"); OPS under
GA-R3, the five sub-rulings untouched.

Ships: creds-matrix.tsv (72 rows), creds-matrix-notes.md (32 keys),
scripts/creds-matrix.py (S1 schema / S2 both-bounds manifest coverage / S3
render drift / S4 mint-ref resolution / S5 per-DC symmetry / S6 ruling-5
principal invariant / S7 notes integrity), tests/creds-matrix 24/24.
Gauntlet ALL GREEN (80, was 79); repo-lint 0-fail.

RED BY DESIGN, 5 findings -- do not go green by deleting rows: the ruling-5
identity conflation on maas-region-admin (the live SEC-020 defect), 3x
EXPECTED-BUT-ABSENT for SEC-021's declaration half, and the S5 asymmetry on
dc0's divergently-named headend power key. 27 operator-terminal rows are the
FINDING 1 reproducibility debt, counted not faulted.

Two self-inflicted false-greens found and closed during the build: S2
enumerated only matrix-mentioned sites (an empty matrix read CLEAN -- the
sandbox-fidelity-check.py:131-143 defect one level up; now the union of both
sides, regression-locked by T9), and the uniqueness key false-failed two
identities sharing one file (T6).

NOT done, stated so the boundary is unambiguous: tiers 2-3, vm-secret-locations,
the SEC-009 demotion, and the ruling-1 preflight Pn -- whose blocking-vs-deferred
sequencing is an OPEN operator question. No manifest rewritten; no cloud state
touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-137: repo-carried build spec for the fresh-session handoff ...

Operator directed the build to a fresh session. The design and committee review
lived in a plan file under ~/.claude/plans/ -- outside the repo -- so a session
bootstrapping via the GA-R4 path (CURRENT-STATE -> session-ledger ->
ledger-scan) would never have surfaced it. That is a real durability gap given
repo-is-authoritative, so the spec now lives at
docs/D-137-implementation-plan.md (precedent: docs/D-068-vault-migration-plan-draft.md).

Carries the five ruled decisions and their consequences, the matrix schema
(logical keys only per the SEC-004 ruling), the checker model with file:line
precedents (provider-bundle-check for structure, sandbox-fidelity-check:131-143
for both-bounds), the three tiers, inherited constraints (metadata-only
source-grep guard, gauntlet excerpt regex, preflight 0/1/2, L1/L10), the file
list, and the acceptance test.

Explicitly instructs the next session NOT to make the first run green: the
acceptance test is that the checker REPRODUCES SEC-021/-022/-023 and the
predicted admin-openrc case as NAMED failures. A checker that passes on today's
tree is wrong. Going green is a separate remediation project.

CURRENT-STATE item 9 + the ledger addendum point at it. Auto-memory pointer
updated: policy authority is D-137 per sub-ruling 4, with a verify-first caveat
that creds-audit CLEAN is not evidence of completeness.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf