DOCFIX-166: $DC parameterization for reenroll-hosts/carve-host-interfaces/phase-00-maas-standup (gap #15, CLI half) ...

Each script gained an opt-in $DC env var, calling lib_net_select_dc/
lib_hosts_select_dc immediately after sourcing (unset $DC is byte-for-byte
unchanged VR0/DC0 behavior -- verified directly, no fixtures needed since
the selector calls sit before any MAAS call). DC=dc1 bash
scripts/phase-00-maas-standup.sh is now a real, correct, gated call
(D-101 makes dc1's target identical to dc0's); DC=dc1/dc2 for the other
two scripts still fails loud at the host selector until real per-DC host
data exists. New/extended test cases across three harnesses. Six of gap
#15's seven sub-findings remain open -- said plainly, not overclaimed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-164: D-101 IPv6 family-matrix overlay, researched against real charm source (gap #13) ...

overlays/dc-dc-ipv6-family-matrix.yaml + docs/dc-dc-ipv6-charm-research.md.
Fetched real charm config/source (not memory): prefer-ipv6 is a real,
shared charms.openstack option, confirmed genuinely additive dual-stack
(not either/or) via charm-nova-cloud-controller's actual "Dual Stack VIPs"
commit; ceph-mon's own prefer-ipv6 is a straight switch, correct for the
ULA-only planes; OVN has no such option at all (confirmed by reading its
full config.yaml) and needs no overlay entry; vault's cert code has no
v4/v6 distinction, confirming D-109's SAN requirement is code-supported.

Found and deliberately did not paper over a real open risk: Octavia's
lb-mgmt-net has two real, still-referenced upstream IPv6 bug reports.
Excluded from the overlay pending an explicit operator decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-163: Office1-local network module + OPNsense edge ownership (gaps #12+16) ...

New opentofu/modules/office1-network (dc-planes-shaped, one shared network
instead of six), instantiated for real in main.tf -- deliberately not a
reused host bridge, since that would live outside OpenTofu's D-103
inventory and break the virsh net-list --all completeness check used
throughout the runbooks. Decided gap #16: Office1 gets its own OPNsense
edge (a fourth site), owned by Stage 2's runbook (new Step 4b). Found a
deeper cross-site gap while wiring the edge's WAN side (no per-site
ISP-uplink network exists for ANY site yet, DC1/DC2 included) -- logged as
new gap #17 rather than defaulted to a mesh-link, which would contradict
D-100's management-only ruling for those legs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-160: adversarial review pass finds and fixes 3 real issues ...

Ran a fresh-eyes review subagent across tonight's full deliverable set
(lib-net.sh/lib-hosts.sh selectors, the NetBox DC-DC pipeline, all seven
Stage 1-7 runbooks). Found and fixed:

- A real Python control-flow bug in tests/dc-dc-prefixes-import/
  test_logic.py: a `return` inside `try` made the `else` clause
  unreachable, silently leaving 3 happy-path assertions uncounted.
  37/37 -> 40/40 after the fix (independently reproduced before trusting
  the finding).
- A self-contradictory pair of comments in dc-dc-prefixes-import.py about
  /19-vs-/22 subnet arithmetic (no functional bug, wrong prose).
- Stale self-referential text in the Stage 4 runbook, written before
  Stage 3 existed and never reconciled once it did.

Corrected the 40/40 count in the workflow tracker and session ledger.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-157/158/159: Stage 4/6/7 runbooks -- MAAS deploy, DR drill, Designate/COS/Magnum ...

Completes all seven Stage 1-7 DC-DC runbooks (tooling gap register item #9
CLOSED):
- Stage 4 (MAAS enlist/commission/deploy, per DC): adapts phase-00's
  validated single-rack sequence per DC. Mandates the $DC selector
  convention (DOCFIX-151) and honestly documents that lib_hosts_select_dc
  will keep failing until this stage's own enrollment populates real host
  data. Names 7 real multi-rack gaps rather than working around them.
- Stage 6 (DR wiring and failover drill): implements Section 8's
  failover/failback skeleton, one-way-then-two-way per D-108. Found three
  real bundle.yaml gaps (missing cinder-backup/ceph-rbd-mirror charms,
  wrong-plane rbd-mirror binding) and makes fixing them the runbook's own
  first gated step. Includes a negative-control drill before the real one.
- Stage 7 (Designate, COS, Magnum/CAPI): quotes the bundle's actual
  current "NO designate" text before describing the D-106 reversal;
  identifies the reversal also affects the bundle's separate
  os-public-hostname posture; leaves COS's mechanism as an operator
  decision rather than inventing one.

Four new tooling-gap-register items (#12-15) added for cross-cutting
findings this runbook-authoring pass surfaced. None of the seven runbooks
have been executed against real infrastructure yet -- prep-only session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-154/155/156: Stage 2/3/5 runbooks -- Office1 standup, DC substrate, per-DC bundle ...

Three DC-DC runbooks authored in parallel this evening:
- Stage 2 (Office1 headend standup): MAAS-region/NetBox/GitBucket/Tailscale,
  each VM-creation step forking an explicit OpenTofu-blocked vs manual-debt
  path rather than picking one silently. Flags a real gap: no Office1-local
  network is modeled in opentofu/.
- Stage 3 (OpenTofu builds each DC substrate): DC1-first, DC2 hard-gated on
  NetBox literals. Walks every open decision (node sizing, MAAS zone/pool,
  config.xml tokens, netem params) and stops rather than inventing values.
- Stage 5 (Juju controller + bundle, per DC): describes adapting the
  existing phase-01..08 loop to run twice, not duplicating it. Mandates the
  $DC selector convention (DOCFIX-151) before every adapted command block.
  Surfaces the undesigned IPv6 family-matrix overlay as blocking work.

All three: not yet executed (prep-only session, no live infrastructure
reachable tonight); repo-lint 0 fail/1 documented warn.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-153: Stage 1 runbook -- Phase 0 vcloud host preparation ...

Command-level runbook for turning the bare vcloud host into a VR1 substrate:
measure CPU/RAM/disk/nested-KVM/MTU, enable nested KVM, prepare storage pool
paths, install/confirm OpenTofu, write tfvars from measured values, init/
validate/plan/apply the DC1 planes + Office1 pool + mesh links, verify
against the Phase-0 gate. Flags a real open question (unconditional MAAS
provider block possibly demanding credentials before Stage 2 stands up
MAAS) rather than silently working around it. Not yet executed -- this is
the hand-off artifact for tomorrow morning's switch to the vcloud host.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-139..141: repo-rename sweep (ipv4->dc-dc) + repo-lint L9 self-reference guard ...

New repo openstack-caracal-dc-dc still had stale operational references to the
source repo it was seeded from (openstack-caracal-ipv4), plus, after the
mechanical fix, hardcoded references to its own new name -- both break on any
future fork/rename. Fixes:

- DOCFIX-139/140: repaired 8 stale clone-path/URL references across the skill
  and 4 runbook RUN blocks; fixed a repo_lint.py Windows path-separator bug
  that silently turned a documented WARN into a FAIL (rel comparison used
  str() instead of as_posix()).
- DOCFIX-141: new repo-lint check L9 fails any script/RUN-block/skill file
  that hardcodes the current repo's own directory name. Narrowed the
  .claude exclusion in repo_lint.py to .claude/worktrees/ only (it was
  blanket-hiding checked-in .claude/skills and .claude/hooks from all
  lint checks). Established a $REPO session-variable convention
  (runbooks/README.md Conventions) and converted the 8 hardcoded paths to
  require it explicitly, fail loud if unset.

repo-lint: 0 fail / 1 documented legacy WARN. tests/repo-lint harness 34/34.
Full details + per-item revert instructions in the two changelogs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

addendum 39: devteam cluster-template 403 diagnosed (Public/Hidden flag -> clustertemplate:publish admin_api, BY DESIGN, no cloud change) -- DOCFIX-121 clientdocs template-creation guidance + DOCFIX-122 appendix-A symptom entry; L7 receipt re-recorded; ~/devteam-package re-rendered; stage5-for-devteam option logged (unruled) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 37: D-075 ADOPTED+EXECUTED -- dashboard VIP root redirect(/->302 /horizon)+no-autoindex via conf-enabled override (RedirectMatch backend-port leak caught in verify, replaced with per-dir rewrite); DOCFIX-118 phase-03 PER-REBUILD block + appendix-A "Index of /" entry ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 29: D-074 ADOPTED+EXECUTED -- overlap-allowed tenant CIDRs (Phase 0 gates proven live: exact-overlap subnet + Magnum cluster via API-LB), stage-4 guard rewritten with real overlap math (DOCFIX-106), repo_lint L5 numbering print removed (DOCFIX-107), D-016 amended, contract/runbook/intake aligned ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 27: d011-batch3 window EXECUTED -- D-073 APPLIED, foil1 onboarded, d011-04/05 PASS, D-011 closed-except-item-6; DOCFIX-095/096/097 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 26: DOCFIX-094 stderr-separation fixes (cloud-assert fail-open closed) + vault snap-track measurements + juju auth-expiry blocker ...

Gauntlet ALL GREEN (32 harnesses; cloud-assert 12/12 incl. new fail-open
proof cases). Read-only vault measurements landed before the juju macaroon
expired; operator needs interactive 'juju login' for the remaining reads.

Revert: per addendum-26 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 25: DOCFIX-093 batch-3 window do-doc + OpenBao research draft + H5 embed + stderr-sweep inventory ...

Operator-away autonomous batch complete (addenda 23-25). Repo-side queue
empty except H4 (main-chat backlog coordination) ; all remaining work is
the operator-present live window per the new do-doc.

Revert: per addendum-25 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 21: DOCFIX-091 tenant onboarding contract (A1 rulings) ...

New docs/tenant-onboarding-contract.md: operator/tenant boundary + rationale,
explicit role table (manager persona, never admin), tenant intake list,
stage dangers, onboarding confirmation set, hardening register H1-H5
(proposals logged, none implemented). v2-DRAFT banner defers to it.

Revert: per addendum-21 REVERT line (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clearing queue

D-072 dashboard TLS repair (executed) + DOCFIX-089 fail-closed check + BUNDLEFIX-011 ...

Identifiers consumed: D-072, DOCFIX-089, BUNDLEFIX-011.

Since-deploy dashboard VIP TLS defect fixed: cluster binding -> metal-admin
(live bind + durable bundle edit); https 200 CA-verified on both reachable
VIPs, all gates green, post-fix BOM committed. phase-03 3.3 rewritten
fail-closed; appendix-A symptom entry added; Launchpad bug draft ready for
operator submission.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

follow-on refreshes: magnum 96 + vault 714 (diff-verified); fleet fully current ...

No identifiers consumed. Vault refresh = operator-ruled Section 0 exception
(keys on hand, seal-detect gates, never sealed; still reactive/V0 per diff
-- D-068 fence intact). Appendix-B re-baselined from asbuilt/20260705-201118;
zero residual can-upgrade-to. Addendum 17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-20260705 window close: runbook as-executed corrections (DOCFIX-088) + D-071 amendment ...

Identifiers consumed: DOCFIX-088. D-071 AMENDMENT recorded (no new number).

Window complete: controller + 91 agents at 3.6.25, 17 apps refreshed,
all gates green, guests untouched. Runbook fold-back per first execution:
juju-status version sweep, create-backup as standard 2.1 step
(admin/controller), no separate controller-model upgrade, G3 probe on the
D-044 http leg with the VIP-TLS since-deploy defect cross-referenced,
mid-window target-drift expectation row. D-071 risk premise corrected
(supported backup exists; restore rehearsal -> Roosevelt open questions).
Ledger window section closed; post-window queue recorded (addendum 16).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-20260705: post-change BOM + appendix-B B.1 full re-baseline ...

Post-window validated state: asbuilt/20260705-194617 (CLOUD-ASSERT: PASS,
controller+91 agents 3.6.25, 17 apps at new in-channel revisions). B.1
regenerated from the BOM; absorbs stale non-window rows missed at the
prior rebuild's re-baseline (logged in addendum 16). No identifiers consumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-procedure runbook + D-071 update policy (jumphost stream) ...

Identifiers consumed by this push: D-071, DOCFIX-086. No BUNDLEFIX consumed
(BUNDLEFIX-010 remains next-free; see addendum-11 FINDING 2 on the scan's
wrapped-pointer over-report).

- NEW runbooks/ops-update-procedure.md (DOCFIX-086): routine update window,
  gated: controller patch -> model agents -> in-channel charm refreshes.
  Vault explicitly excluded (D-068 unruled). Not yet as-executed.
- docs/design-decisions.md: D-071 PROPOSED (update cadence + controller
  patch policy, explicit no-backup single-controller risk section).
- runbooks/README.md: index ops-update-procedure + missing ops-restart entry.
- docs/v1-redeploy-changelog.md: addendum 11 (what/why/revert + 2 findings).
- docs/session-ledger.md: numbering re-seeded (D=072, DOCFIX=087,
  BUNDLEFIX=010); D-071 contention resolved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

Patches

Tenant file updates

Merge branch 'main' of https://git.baldurkeep.com/git/OpenStack/openstack-caracal-ipv4 ...

# Conflicts:
#	runbooks/appendix-C-identity-rbac.md

Phase 8 updates

D064 Documents

Phase 7 updates

Script and file updates

Phase end updates

Phase end updates