diff --git a/docs/audit/env-snapshot-20260718.md b/docs/audit/env-snapshot-20260718.md new file mode 100644 index 0000000..2063cfc --- /dev/null +++ b/docs/audit/env-snapshot-20260718.md @@ -0,0 +1,62 @@ +# Environment snapshot -- grounding audit Phase 1 (measured 2026-07-18, read-only) + +Every value below was measured THIS session on the live environment or repo. +Nothing is carried from prior-session memory. Command outputs are quoted or +cited to their capture file. This snapshot + `outer-plan-20260718.txt` are the +Phase-1 "repo-vs-live divergence" record (charter section 2 item 5). + +## Host (vcloud) + +- `hostname` -> `vcloud`; `uname -r` -> `6.8.0-136-generic` (the bookend + kernel); `uptime` at 08:45 UTC -> up 9:06 (host rebooted ~2026-07-17 23:39). + The BOOKEND (patch + reboot, dc0-deploy-readiness.md) has HAPPENED. +- `virsh list --all`: `voffice1` running, `office1-opnsense` running -- both + `autostart=enable` (per-domain `virsh dominfo`). Cold-boot autostart path + self-recovered both guests, as designed. +- `bash scripts/site-baseleg.sh check office1` -> ok leg `10.10.0.10/24` on + virbr2, ok route `10.10.1.0/24 via 10.10.0.20` (D-126 unit survived reboot). + +## voffice1 (via `ssh voffice1`, read-only) + +- `uname -r` -> `6.8.0-136-generic` (guest matches host kernel). +- `snap list`: MAAS `3.7.2-17972-g.35e297c4d`; LXD `5.21.5-f2a1a0e`. + +## Toolchain + +- `tofu version` -> `OpenTofu v1.12.4` on linux_amd64. + (README.md pins 1.12.3 -- stale; see findings register GA-F03.) + +## Outer plan (THE citable plan-count source from here forward) + +- Command: `tofu -chdir=opentofu plan -no-color -input=false` +- Captured in full: `docs/audit/outer-plan-20260718.txt` +- Result: **Plan: 7 to add, 2 to change, 7 to destroy** -- does NOT match any + recorded gate count (5/0/6 nor 5/2/6). Decomposition, from the capture: + - Refresh-detected live drift: `module.voffice1.libvirt_cloudinit_disk.seed` + HAS BEEN DELETED (live volume gone since the reboot); + `module.voffice1.libvirt_domain.vm` and + `module.office1_opnsense.libvirt_domain.vm` have changed. + - 2 change (in-place): the voffice1 + office1-opnsense domains. + - 7 add = the 5 committed DC0 creates (`vvr1_dc0` domain/disk/seed-volume/ + cloudinit + `vr1_dc0_uplink`) PLUS voffice1 cloudinit seed (re-create) + PLUS voffice1 `libvirt_volume.seed` (replace-create). + - 7 destroy = the 6 empty `vr1-dc0` plane networks (intended Model B + relocation) PLUS voffice1 `libvirt_volume.seed` (replace-destroy; + `create.content.url` **forces replacement** -- the volume-replace-under- + running-domain bounce risk that STOPPED the DC0 apply on 2026-07-18). +- The two charter-exempted read-only verifications (v0.9.8 volume-replace + behavior on a throwaway domain; `ignore_changes` suppression) remain TO RUN; + they inform the D-130 mechanism ruling in Phase 5. + +## Repo state + +- HEAD at session start: `148dcef` (branch `dc-dc-stage3-phase2-dc-substrate`), + `git status` clean; `git pull` -> already up to date. +- `bash scripts/repo-lint.sh` -> 0 fail, 1 documented legacy WARN. +- `bash scripts/run-tests-all.sh` -> GAUNTLET ALL GREEN (69 harnesses, + including the new `tests/record-audit/`). +- `bash scripts/ledger-scan.sh` -> PROPOSED/OPEN: D-068, D-071, D-129; OPEN + SEC rows: SEC-001, -003..-008, -010 (9 rows); next-free D-130 / DOCFIX-197 / + BUNDLEFIX-052. `--fences` -> 1 fence, 0 errors, 0 warnings, OK. +- Auto-memory: DISABLED this session by design; the memory directory was read + as on-disk evidence only (5 files; see findings GA-F05..GA-F08). diff --git a/docs/audit/grounding-audit-20260718.md b/docs/audit/grounding-audit-20260718.md new file mode 100644 index 0000000..d83529e --- /dev/null +++ b/docs/audit/grounding-audit-20260718.md @@ -0,0 +1,208 @@ +# Grounding-audit findings register (GA-F) -- opened in Phase 1, 2026-07-18 + +Consolidated register per charter Phase 5; OPENED during Phase 1 so findings +land in one place from the start (no parallel scratch registers). FREEZE is in +effect: entries here are findings + proposed fixes ONLY. No fix is applied +until Phase 5, operator-gated, and every fix commit must name its GA-F number. + +Evidence sources: `record-inventory.md` (mechanical extraction, HEAD 148dcef), +`env-snapshot-20260718.md` + `outer-plan-20260718.txt` (measured live), +operator provenance rulings quoted verbatim from the 2026-07-18 charter +amendment. Severity: CRITICAL = blocks/falsifies a deploy gate; HIGH = +corrupts trust in a load-bearing record surface; MED = stale/contradictory +record needing adjudication; LOW = hygiene. + +--- + +## GA-F01 -- CRITICAL -- live outer plan is 7/2/7; no recorded gate count matches + +**Evidence:** `docs/audit/outer-plan-20260718.txt` (Plan: 7 to add, 2 to +change, 7 to destroy); decomposition in `env-snapshot-20260718.md`. Recorded +gate values: 5/0/6 (`docs/dc0-deploy-readiness.md:59`, `docs/session-ledger.md:278`) +and 5/2/6 (`docs/dc0-deploy-readiness.md:37`). The delta over 5/0/6 is entirely +voffice1's cloud-init seed: the live volume was deleted (post-reboot), and +`module.voffice1.libvirt_volume.seed` is a FORCED REPLACEMENT +(`create.content.url`) that would bounce the running Office1 headend; plus 2 +in-place domain updates. This is the defect that STOPPED the DC0 apply +(`43b29d7`). +**Proposed fix:** D-130 mechanism ruling in Phase 5, informed by the two +charter-exempted verifications (v0.9.8 volume-replace-under-running-domain; +`ignore_changes` suppression). Operator lean (a) `lifecycle { ignore_changes }` +is CONTINGENT on the suppression verification; if refuted, fall back to (b). +**Traces to:** GA-R6 (executable definition of done), D-130. + +## GA-F02 -- HIGH -- deploy-gate doc carries two live contradictory plan counts + +**Evidence:** `docs/dc0-deploy-readiness.md:37` (`5 add / 2 in-place / 6 +destroy`) vs `:59` (`5/0/6`) vs `:48`/`:167` (`5-add/(0-or-2)-change/ +6-destroy-empty`). Mechanically caught: record-inventory contradiction group +`plan` (10 distinct triples repo-wide). All three forms are presented as the +current gate in the same document. +**Proposed fix:** GA-R1 -- the gate count lives ONLY in CURRENT-STATE.md, +cited to the captured plan file; the readiness doc demotes to checklist. +**Traces to:** GA-R1, GA-R6. + +## GA-F03 -- MED -- tofu version pin stale: records say 1.12.3, binary is 1.12.4 + +**Evidence:** measured `tofu version` -> v1.12.4 (env snapshot). Stale 1.12.3 +claims: `README.md`, `docs/dc-dc-deployment-workflow.md:47`, `:360`, `:875` +(record-inventory `version tofu` group; `docs/session-ledger.md:214` already +records the 1.12.4 observation). +**Proposed fix:** GA-R1 pin table in CURRENT-STATE.md cited to `--version` +output; README drops its own pin. +**Traces to:** GA-R1. + +## GA-F04 -- MED -- operating skill pins OPNsense 26.1; live edge is 26.7 + +**Evidence:** live: `docs/vr1-office1-as-built.md:42` (OPNsense 26.7, updated +2026-07-18, D-129 review). Stale skill surfaces: +`references/platform-traps.md:22`, `:322`, `:351`; +`references/environment.md:35` (all 26.1). Skill divergence-rule case: facts +in the skill go stale fast; repo wins. +**Proposed fix:** Phase-5 skill sweep updates the version rows (or replaces +them with pointers to `runbooks/appendix-B` / CURRENT-STATE.md). +**Traces to:** GA-R1, Phase-5 skill sweep. + +## GA-F05 -- MED -- always-loaded surfaces name the jumphost `vopenstack-jesse`; the host is `vcloud` + +**KNOWN-STALE, registered per operator ruling.** Evidence: measured +`hostname` -> `vcloud` (env snapshot); D-128 records the operating model. +Stale: `CLAUDE.md:4`, `.claude/skills/openstack-cloud-ops/SKILL.md:46`, and +memory `multi-workstation-remote-control.md:13`. CLAUDE.md is loaded into +EVERY session -- do not trust it for environment identity until fixed. +**Proposed fix:** Phase-5 hygiene batch corrects all three surfaces. +**Traces to:** GA-R1, GA-R7 (memory), Phase-5 skill sweep. + +## GA-F06 -- HIGH -- one-time instruction over-generalized into an always-loaded standing rule (churn mechanism candidate) + +**Operator provenance ruling (quoted, 2026-07-18):** "It was not a standing +instruction. It was only supposed to be for a one time / very short sequence +of steps." +**Evidence:** memory `review-after-each-step.md` (mtime 2026-07-16 06:41, +originSessionId `839ad1a8...` -- a session launched from the `opentofu/` +subdirectory, per the sibling project dir; that dir holds NO memory). The +frontmatter generalizes to "on multi-step work ... after EVERY step", and +mandates a per-step drift sweep ("reconcile code vs the decision record vs +the docs/ledger") plus "Fix what the review finds THEN proceed" -- i.e. it +structurally mandates inline reconciliation fixes after every step. +**Timeline correlation (measured from git):** the 06:41 stamp falls inside the +Stage-3 review sweep (between commits 114d392 05:53 and 5175365 07:31 on +07-16 -- exactly when a one-time per-step review WAS in effect). From 15:47 +the same day the commit stream turns to reconciliation (8496c2e, 87f9d75, +788911c, 4d490cf -- four consecutive reconcile/drift subjects), and +reconciliation/record work dominates 07-17 (ledger re-seeds, markers) and +07-18 (findings, STOP). Assessment: CONSISTENT with this memory being a +primary mechanism of the 07-16..07-18 churn -- every subsequent session +loaded a rule requiring a records-reconciliation pass (with inline fixes) +after every step, which is the charter's "every fix to one copy creates +drift in another" loop made policy. It is not the SOLE mechanism (the +multi-surface hand-copied status problem predates it; 31 changelogs were +filed 2026-07-09), but it made the loop mandatory. +**Handling this session:** NOT followed (operator directive). +**Proposed fix:** Phase-5 memory hygiene -- remove or rewrite the file as a +narrowly-scoped observation; GA-R7 governs future memory writes. +**Traces to:** GA-R7, GA-R5. + +## GA-F07 -- HIGH -- memory records an operator "ruling" that was never ruled (security posture) + +**Operator provenance ruling (2026-07-18):** the recorded stance ("prioritize +deployment tooling/runbooks over real-world security") was NEVER ruled; it +emerged from the operator repeatedly de-escalating security spirals; the +operator did not know the stance had been adopted. +**Evidence:** memory `project-posture-closed-test.md:12` asserts "(operator +ruling, 2026-07-15)"; `MEMORY.md:4` propagates it as a standing prioritization. +**Directive now in force:** security posture returns to NEUTRAL -- industry +best practice with sourced debate. The underlying fact (VR1 is a closed +rehearsal environment) is already carried by the repo and needs no memory +entry. SEC-gated invariants (e.g. SEC-010's pre-apply pin) were never +deferred and remain gates. +**Proposed fix:** Phase-5 memory hygiene -- remove the file (or reduce to the +repo-carried fact with no priority claim); GA-R7 makes any memory entry +claiming operator intent PROPOSED until confirmed. +**Traces to:** GA-R7, GA-R5. + +## GA-F08 -- MED -- MEMORY.md index propagates both defective entries into every session + +**Evidence:** `MEMORY.md:4` (posture) and `:6` (review-after-each-step, stated +as "operator wants ... after EVERY step"). The index is the highest-blast- +radius record surface: loaded automatically at session start whenever +auto-memory is enabled. +**Proposed fix:** Phase-5 memory hygiene alongside GA-F06/GA-F07. +**Traces to:** GA-R7. + +## GA-F09 -- MED -- docs/ working set: 141 files (incl. 6 new audit outputs), 95 changelogs, all densely self-referential + +**Evidence:** record-inventory census (95 changelog-class files confirmed +mechanically; 31 filed 2026-07-09 per charter). Notably the "unreferenced +changelog" consolidation heuristic returns ZERO -- every changelog is cited by +at least one other record surface (ledger/changelogs cite changelogs), so +reference-counting cannot prune this set; only the GA-R2 class rule +(changelogs are session-scoped scratch, consolidated at stage close, never +citable as status authority) can. +**Proposed fix:** GA-R2 per-stage consolidation; target < 25 files in docs/. +**Traces to:** GA-R2. + +## GA-F10 -- MED -- stage-status vocabulary is inconsistent across surfaces (5 mechanical groups) + +**Evidence:** record-inventory `status` groups: stage-1 CLOSED/COMPLETE, +stage-2 CLOSED/COMPLETE, stage-3 BLOCKED/HELD, stage-4 CLOSED/HELD, stage-5 +BLOCKED/CLOSED. Some rows are historical prose, but the vocabulary itself is +unpinned -- there is no single legal status set, so mechanical checking of +stage state is impossible today. +**Proposed fix:** GA-R1 (stage status lives only in CURRENT-STATE.md) + a +fixed status vocabulary; GA-R6 makes CLOSED executable. +**Traces to:** GA-R1, GA-R6. + +## GA-F11 -- MED -- version-pin contradiction groups for juju/lxd/maas/netbox (adjudication needed) + +**Evidence:** record-inventory `version` groups. Measured ground truth this +session: MAAS 3.7.2, LXD 5.21.5 (voffice1, snap list); OpenTofu 1.12.4. Most +non-matching rows are historical or refer to different components (providers, +pylxd, VR0); a minority are live-surface stale pins. The pin table in +CURRENT-STATE.md (Phase 2) adjudicates each product against captured +`--version` output. +**Traces to:** GA-R1. + +## GA-F12 -- MED -- reference rot at scale (raw mechanical counts, false-positive rate unadjudicated) + +**Evidence:** record-inventory: 319 broken path references, 170 orphan/ +unregistered number references, 115 commit hashes not in this repo, 0 bad +file:line refs. The raw counts include placeholder-style mentions and +references to legitimately-retired files from historical changelogs; the +signal is that nothing currently distinguishes a live citation from a dead +one. Phase-2/5 adjudicate the live-surface subset (non-changelog classes +first). +**Traces to:** GA-R1, GA-R2. + +## GA-F13 -- LOW -- session ledger at 1142 lines with no rotation rule + +**Evidence:** `wc -l docs/session-ledger.md` -> 1142 (charter measured 1125 +two commits earlier; still growing). Fence integrity itself is OK +(`ledger-scan.sh --fences`: 0 errors). +**Proposed fix:** GA-R4 rotation (bounded close-out summary + docs/archive/). +**Traces to:** GA-R4. + +## GA-F14 -- MED -- changelog asserted a plan outcome that reality falsified (changelogs-as-status-authority defect) + +**Evidence:** `docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:32` +("5 add / 2 in-place / 6 destroy; the 2 in-place collapse to 0 once the +bookend sets those two autostart") -- the bookend HAS run, autostart IS enable +on both guests (measured), yet the live plan is 7/2/7 with 2 in-place changes +still present and a forced replacement the changelog did not anticipate. The +claim was plausible when written and is false now; nothing marks it stale. +This is the proof-case for GA-R2's "changelogs are NEVER citable as status +authority". +**Traces to:** GA-R2, GA-R1, GA-F01. + +--- + +## Phase-1 disposition notes + +- R3-F09 (D-115 ledger-scan false positive): RESOLVED -- fix landed 2026-07-16 + (`docs/changelog-20260716-review-sweep-phaseAB.md:32`); today's `ledger-scan` + run confirms D-115 is not flagged. No finding. +- Ledger fences: VALID (1 fence, 0 errors). No finding. +- The 2026-07-18 issue list (D-130 candidates, platform-traps items, + doc-integrity items, env reconcile) remains EVIDENCE to be folded in and + re-verified during Phase 5 per the charter; items already covered above: + seed-volume diff (GA-F01), tofu pin (GA-F03), OPNsense 26.1 refs (GA-F04). diff --git a/docs/audit/outer-plan-20260718.txt b/docs/audit/outer-plan-20260718.txt new file mode 100644 index 0000000..d45a256 --- /dev/null +++ b/docs/audit/outer-plan-20260718.txt @@ -0,0 +1,433 @@ +module.vr1_dc0_planes.libvirt_network.plane["metal-admin"]: Refreshing state... [id=29eca094-9b40-4e8c-9750-d1c7857f0a3c] +module.vr1_dc1_storage.libvirt_pool.dc: Refreshing state... [id=4a1df114-ee04-4c80-9233-cc0c140c8556] +module.vr1_dc0_planes.libvirt_network.plane["storage"]: Refreshing state... [id=e5558f0e-9601-48fc-8eff-6a0e6adad0d7] +module.mesh_vr1_dc1_office1.libvirt_network.link: Refreshing state... [id=38a20d2d-cd91-4604-a5f4-8e2a6609633c] +module.mesh_vr1_dc0_vr1_dc1.libvirt_network.link: Refreshing state... [id=9cbc8589-9f40-48e6-872e-ef3abfe29a93] +module.vr1_dc0_planes.libvirt_network.plane["replication"]: Refreshing state... [id=295dca85-52de-4e78-9894-16e48d969654] +module.vr1_dc0_planes.libvirt_network.plane["metal-internal"]: Refreshing state... [id=99768f9d-256a-4a89-90dd-38de04efea03] +module.vr1_dc0_planes.libvirt_network.plane["provider-public"]: Refreshing state... [id=3bb1e17c-53ce-4c1a-a4af-c9d6ad1f1c1b] +module.vr1_dc0_planes.libvirt_network.plane["data-tenant"]: Refreshing state... [id=31782537-790a-4399-a3a9-64dce7232e7b] +module.voffice1.libvirt_cloudinit_disk.seed: Refreshing state... [id=775234004c2669d9] +module.office1_storage.libvirt_pool.dc: Refreshing state... [id=5f94194c-69c1-4b04-a85f-c18d87303a03] +module.vr1_dc0_storage.libvirt_pool.dc: Refreshing state... [id=7ce1101c-a89e-40ca-9263-5f572bee40a9] +module.mesh_vr1_dc0_office1.libvirt_network.link: Refreshing state... [id=8318548f-c3d6-4e06-bef4-fe3f11d68125] +module.office1_network.libvirt_network.office1_local: Refreshing state... [id=8fdd2a97-417c-44d4-89e4-ae8d65594135] +module.ubuntu_noble_base.libvirt_volume.base: Refreshing state... [id=/var/lib/libvirt/vr1/office1/ubuntu-24.04-base.qcow2] +module.voffice1.libvirt_volume.seed: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso] +module.office1_opnsense.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/office1-opnsense-disk.qcow2] +module.voffice1.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-disk.qcow2] +module.office1_opnsense.libvirt_domain.vm: Refreshing state... [name=office1-opnsense] +module.voffice1.libvirt_domain.vm: Refreshing state... [name=voffice1] + +Note: Objects have changed outside of OpenTofu + +OpenTofu detected the following changes made outside of OpenTofu since the +last "tofu apply" which may have affected this plan: + + # module.office1_opnsense.libvirt_domain.vm has changed + ~ resource "libvirt_domain" "vm" { + ~ id = 13 -> 2 + name = "office1-opnsense" + # (10 unchanged attributes hidden) + } + + # module.voffice1.libvirt_cloudinit_disk.seed has been deleted + - resource "libvirt_cloudinit_disk" "seed" { + id = "775234004c2669d9" + name = "voffice1-cloudinit" + - path = "/tmp/terraform-provider-libvirt-cloudinit/cloudinit-775234004c2669d9.iso" -> null + # (4 unchanged attributes hidden) + } + + # module.voffice1.libvirt_domain.vm has changed + ~ resource "libvirt_domain" "vm" { + ~ id = 14 -> 1 + name = "voffice1" + # (10 unchanged attributes hidden) + } + + +Unless you have made equivalent changes to your configuration, or ignored the +relevant attributes using ignore_changes, the following plan may include +actions to undo or respond to these changes. + +───────────────────────────────────────────────────────────────────────────── + +OpenTofu used the selected providers to generate the following execution +plan. Resource actions are indicated with the following symbols: + + create + ~ update in-place (current -> planned) + - destroy +-/+ destroy and then create replacement + +OpenTofu will perform the following actions: + + # module.office1_opnsense.libvirt_domain.vm will be updated in-place + ~ resource "libvirt_domain" "vm" { + + autostart = true + id = 2 + name = "office1-opnsense" + # (10 unchanged attributes hidden) + } + + # module.voffice1.libvirt_cloudinit_disk.seed will be created + + resource "libvirt_cloudinit_disk" "seed" { + + id = (known after apply) + + meta_data = <<-EOT + instance-id: voffice1-d114 + local-hostname: voffice1 + EOT + + name = "voffice1-cloudinit" + + network_config = <<-EOT + version: 2 + ethernets: + lan: + match: + name: "en*" + dhcp4: true + EOT + + path = (known after apply) + + size = (known after apply) + + user_data = <<-EOT + #cloud-config + hostname: voffice1 + fqdn: voffice1.cloud.neumatrix.local + manage_etc_hosts: true + users: + - name: jessea123 + groups: [adm, sudo] + shell: /bin/bash + sudo: "ALL=(ALL) NOPASSWD:ALL" + ssh_authorized_keys: + - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINOgHIEyfMecOJ/G2Tbw5kKMd4ofUfxdyhVb00cjcpUX vr1-office1-svc + package_update: true + packages: + - qemu-guest-agent + runcmd: + - [systemctl, enable, --now, qemu-guest-agent] + EOT + } + + # module.voffice1.libvirt_domain.vm will be updated in-place + ~ resource "libvirt_domain" "vm" { + + autostart = true + id = 1 + name = "voffice1" + # (10 unchanged attributes hidden) + } + + # module.voffice1.libvirt_volume.seed must be replaced +-/+ resource "libvirt_volume" "seed" { + ~ allocation = 45056 -> (known after apply) + ~ capacity = 45056 -> (known after apply) + ~ create = { # forces replacement + ~ content = { + ~ url = "/tmp/terraform-provider-libvirt-cloudinit/cloudinit-775234004c2669d9.iso" -> (known after apply) + } + } + ~ id = "/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso" -> (known after apply) + ~ key = "/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso" -> (known after apply) + name = "voffice1-cloudinit.iso" + ~ path = "/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso" -> (known after apply) + ~ physical = 45056 -> (known after apply) + # (1 unchanged attribute hidden) + } + + # module.vr1_dc0_planes.libvirt_network.plane["data-tenant"] will be destroyed + # (because libvirt_network.plane is not in configuration) + - resource "libvirt_network" "plane" { + - autostart = true -> null + - domain = { + - name = "data-tenant.vr1-dc0.cloud.neumatrix.local" -> null + } -> null + - id = "31782537-790a-4399-a3a9-64dce7232e7b" -> null + - mtu = { + - size = 9000 -> null + } -> null + - name = "vr1-dc0-data-tenant" -> null + - uuid = "31782537-790a-4399-a3a9-64dce7232e7b" -> null + } + + # module.vr1_dc0_planes.libvirt_network.plane["metal-admin"] will be destroyed + # (because libvirt_network.plane is not in configuration) + - resource "libvirt_network" "plane" { + - autostart = true -> null + - domain = { + - name = "metal-admin.vr1-dc0.cloud.neumatrix.local" -> null + } -> null + - id = "29eca094-9b40-4e8c-9750-d1c7857f0a3c" -> null + - mtu = { + - size = 9000 -> null + } -> null + - name = "vr1-dc0-metal-admin" -> null + - uuid = "29eca094-9b40-4e8c-9750-d1c7857f0a3c" -> null + } + + # module.vr1_dc0_planes.libvirt_network.plane["metal-internal"] will be destroyed + # (because libvirt_network.plane is not in configuration) + - resource "libvirt_network" "plane" { + - autostart = true -> null + - domain = { + - name = "metal-internal.vr1-dc0.cloud.neumatrix.local" -> null + } -> null + - id = "99768f9d-256a-4a89-90dd-38de04efea03" -> null + - mtu = { + - size = 9000 -> null + } -> null + - name = "vr1-dc0-metal-internal" -> null + - uuid = "99768f9d-256a-4a89-90dd-38de04efea03" -> null + } + + # module.vr1_dc0_planes.libvirt_network.plane["provider-public"] will be destroyed + # (because libvirt_network.plane is not in configuration) + - resource "libvirt_network" "plane" { + - autostart = true -> null + - domain = { + - name = "provider-public.vr1-dc0.cloud.neumatrix.local" -> null + } -> null + - id = "3bb1e17c-53ce-4c1a-a4af-c9d6ad1f1c1b" -> null + - mtu = { + - size = 9000 -> null + } -> null + - name = "vr1-dc0-provider-public" -> null + - uuid = "3bb1e17c-53ce-4c1a-a4af-c9d6ad1f1c1b" -> null + } + + # module.vr1_dc0_planes.libvirt_network.plane["replication"] will be destroyed + # (because libvirt_network.plane is not in configuration) + - resource "libvirt_network" "plane" { + - autostart = true -> null + - domain = { + - name = "replication.vr1-dc0.cloud.neumatrix.local" -> null + } -> null + - id = "295dca85-52de-4e78-9894-16e48d969654" -> null + - mtu = { + - size = 9000 -> null + } -> null + - name = "vr1-dc0-replication" -> null + - uuid = "295dca85-52de-4e78-9894-16e48d969654" -> null + } + + # module.vr1_dc0_planes.libvirt_network.plane["storage"] will be destroyed + # (because libvirt_network.plane is not in configuration) + - resource "libvirt_network" "plane" { + - autostart = true -> null + - domain = { + - name = "storage.vr1-dc0.cloud.neumatrix.local" -> null + } -> null + - id = "e5558f0e-9601-48fc-8eff-6a0e6adad0d7" -> null + - mtu = { + - size = 9000 -> null + } -> null + - name = "vr1-dc0-storage" -> null + - uuid = "e5558f0e-9601-48fc-8eff-6a0e6adad0d7" -> null + } + + # module.vr1_dc0_uplink.libvirt_network.site_wan will be created + + resource "libvirt_network" "site_wan" { + + autostart = true + + domain = { + + name = "vr1-dc0-uplink" + } + + forward = { + + mode = "nat" + } + + id = (known after apply) + + ips = [ + + { + + address = "172.30.2.1" + + prefix = 24 + }, + ] + + mtu = { + + size = 1500 + } + + name = "vr1-dc0-uplink" + + uuid = (known after apply) + } + + # module.vvr1_dc0.libvirt_cloudinit_disk.seed will be created + + resource "libvirt_cloudinit_disk" "seed" { + + id = (known after apply) + + meta_data = <<-EOT + instance-id: vvr1-dc0-d123 + local-hostname: vvr1-dc0 + EOT + + name = "vvr1-dc0-cloudinit" + + network_config = <<-EOT + version: 2 + ethernets: + mgmt: + match: + name: "enp1s0" + set-name: mgmt + addresses: ["172.31.0.2/30"] + routes: + - to: "10.10.0.0/22" + via: "172.31.0.1" + uplink: + match: + name: "enp2s0" + set-name: uplink + dhcp4: false + dhcp6: false + bridges: + br-vr1-dc0-wan: + interfaces: [uplink] + dhcp4: false + dhcp6: false + parameters: + stp: false + forward-delay: 0 + EOT + + path = (known after apply) + + size = (known after apply) + + user_data = <<-EOT + #cloud-config + hostname: vvr1-dc0 + fqdn: vvr1-dc0.cloud.neumatrix.local + manage_etc_hosts: true + users: + - name: jessea123 + groups: [adm, sudo] + shell: /bin/bash + sudo: "ALL=(ALL) NOPASSWD:ALL" + ssh_authorized_keys: + # D-126 per-env-key (ruling 2026-07-16, option a): vvr1-dc0 authorizes the DEDICATED + # dc0 key, NOT office1's -- per-env blast-radius isolation. Inner root's qemu+ssh matches. + - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID54oMqwY4majxq4oWpBviXb6DlVyj99TUPxDkhszcZG vr1-dc0_svc (D-126 per-env key) + package_update: true + packages: + - qemu-guest-agent + runcmd: + - [systemctl, enable, --now, qemu-guest-agent] + EOT + } + + # module.vvr1_dc0.libvirt_domain.vm will be created + + resource "libvirt_domain" "vm" { + + autostart = false + + cpu = { + + features = [] + + mode = "host-passthrough" + } + + devices = { + + disks = [ + + { + + driver = { + + type = "qcow2" + } + + source = { + + volume = { + + pool = "vr1-dc0-pool" + + volume = "vvr1-dc0-disk.qcow2" + } + } + + target = { + + bus = "virtio" + + dev = "vda" + } + }, + + { + + device = "cdrom" + + source = { + + volume = { + + pool = "vr1-dc0-pool" + + volume = "vvr1-dc0-cloudinit.iso" + } + } + + target = { + + bus = "sata" + + dev = "sda" + } + }, + ] + + interfaces = [ + + { + + model = { + + type = "virtio" + } + + source = { + + network = { + + network = "mesh-vr1-dc0-office1" + } + } + }, + + { + + model = { + + type = "virtio" + } + + source = { + + network = { + + network = "vr1-dc0-uplink" + } + } + }, + ] + } + + features = { + + acpi = true + + apic = {} + } + + id = (known after apply) + + memory = 425984 + + memory_unit = "MiB" + + name = "vvr1-dc0" + + os = { + + type = "hvm" + + type_arch = "x86_64" + + type_machine = "q35" + } + + running = true + + type = "kvm" + + uuid = (known after apply) + + vcpu = 108 + } + + # module.vvr1_dc0.libvirt_volume.disk will be created + + resource "libvirt_volume" "disk" { + + allocation = (known after apply) + + backing_store = { + + format = { + + type = "qcow2" + } + + path = "/var/lib/libvirt/vr1/office1/ubuntu-24.04-base.qcow2" + } + + capacity = 3221225472000 + + id = (known after apply) + + key = (known after apply) + + name = "vvr1-dc0-disk.qcow2" + + path = (known after apply) + + physical = (known after apply) + + pool = "vr1-dc0-pool" + + target = { + + format = { + + type = "qcow2" + } + + path = (known after apply) + } + } + + # module.vvr1_dc0.libvirt_volume.seed will be created + + resource "libvirt_volume" "seed" { + + allocation = (known after apply) + + capacity = (known after apply) + + create = { + + content = { + + url = (known after apply) + } + } + + id = (known after apply) + + key = (known after apply) + + name = "vvr1-dc0-cloudinit.iso" + + path = (known after apply) + + physical = (known after apply) + + pool = "vr1-dc0-pool" + } + +Plan: 7 to add, 2 to change, 7 to destroy. + +───────────────────────────────────────────────────────────────────────────── + +Note: You didn't use the -out option to save this plan, so OpenTofu can't +guarantee to take exactly these actions if you run "tofu apply" now. diff --git a/docs/audit/record-inventory.md b/docs/audit/record-inventory.md new file mode 100644 index 0000000..b4fa95b --- /dev/null +++ b/docs/audit/record-inventory.md @@ -0,0 +1,1967 @@ +# Record inventory -- grounding audit Phase 1 (deterministic) + +Generated by `scripts/record-audit.py` at repo HEAD `148dcef` (2026-07-18T08:44:44Z). +Read-only extraction; zero judgment. Counting rules are in the script header: +docs/audit/* and memory-surface rows are inventoried but NOT counted toward +the contradiction signal; a changelog-excluded pair count is shown alongside. + +## Summary + +- files scanned: 179 +- status-claim rows: 858 (plan 27, status 231, version 175, gate 425) +- CONTRADICTION GROUPS (counted surfaces): 12 +- contradiction groups excluding changelog-class files: 10 +- broken path refs: 319; orphan number refs: 170; unknown commit hashes: 115; bad file:line refs: 0 + +## 1. Doc census + +| file | class | bytes | lines | last commit | inbound refs | +|---|---|---|---|---|---| +| docs/D-057-DECIDED-append.md | reference | 7168 | 37 | 2026-06-29 | 3 | +| docs/D-057-REVIEW-ITEMS.md | reference | 4069 | 58 | 2026-06-29 | 2 | +| docs/D-058-renumber.md | reference | 4772 | 77 | 2026-06-29 | 5 | +| docs/D-068-openbao-assessment-DRAFT.md | reference | 7258 | 108 | 2026-07-06 | 3 | +| docs/D-068-vault-1.8-vs-1.16-analysis.md | reference | 7781 | 114 | 2026-07-05 | 7 | +| docs/DOCFIX-064-phase08-changelist.md | reference | 5224 | 81 | 2026-07-02 | 1 | +| docs/README-D057-PACK.md | reference | 6969 | 108 | 2026-06-29 | 1 | +| docs/as-executed-log-convention.md | reference | 2019 | 38 | 2026-07-06 | 9 | +| docs/audit/grounding-audit-charter.md | audit | 15625 | 247 | 2026-07-18 | 2 | +| docs/audit/skill-additions-proposed.md | audit | 2258 | 36 | 2026-07-18 | 2 | +| docs/changelog-20260703-process-hardening.md | changelog | 23078 | 371 | 2026-07-03 | 3 | +| docs/changelog-20260709-adversarial-review-fixes.md | changelog | 5729 | 110 | 2026-07-10 | 1 | +| docs/changelog-20260709-ceph-replication-tooling.md | changelog | 8444 | 144 | 2026-07-10 | 2 | +| docs/changelog-20260709-dc-dc-design.md | changelog | 2365 | 45 | 2026-07-09 | 2 | +| docs/changelog-20260709-dc-dc-phase0-runbook.md | changelog | 4385 | 75 | 2026-07-10 | 1 | +| docs/changelog-20260709-dc-dc-phase1-runbook.md | changelog | 3542 | 66 | 2026-07-10 | 1 | +| docs/changelog-20260709-dc-dc-phase2-runbook.md | changelog | 3350 | 63 | 2026-07-10 | 1 | +| docs/changelog-20260709-dc-dc-phase3-runbook.md | changelog | 3973 | 73 | 2026-07-10 | 1 | +| docs/changelog-20260709-dc-dc-phase4-runbook.md | changelog | 4070 | 73 | 2026-07-10 | 1 | +| docs/changelog-20260709-dc-dc-phase5-runbook.md | changelog | 3443 | 66 | 2026-07-10 | 1 | +| docs/changelog-20260709-dc-dc-phase6-runbook.md | changelog | 3651 | 69 | 2026-07-10 | 1 | +| docs/changelog-20260709-dc-dc-repo-rename-sweep.md | changelog | 5123 | 87 | 2026-07-09 | 1 | +| docs/changelog-20260709-dc-selector-convention.md | changelog | 4637 | 78 | 2026-07-10 | 3 | +| docs/changelog-20260709-designate-cinderbackup-rbdmirror.md | changelog | 8053 | 134 | 2026-07-10 | 5 | +| docs/changelog-20260709-final-consolidation.md | changelog | 5450 | 98 | 2026-07-10 | 1 | +| docs/changelog-20260709-ipv6-family-matrix-overlay.md | changelog | 3794 | 71 | 2026-07-10 | 1 | +| docs/changelog-20260709-maas-scripts-dc-param.md | changelog | 8908 | 153 | 2026-07-10 | 3 | +| docs/changelog-20260709-mtu-ceph-budget-calculators.md | changelog | 8080 | 138 | 2026-07-10 | 2 | +| docs/changelog-20260709-netbox-dc-dc-pipeline.md | changelog | 6254 | 110 | 2026-07-10 | 2 | +| docs/changelog-20260709-netem-ula-gua-proposal.md | changelog | 2691 | 52 | 2026-07-10 | 1 | +| docs/changelog-20260709-office1-network-edge.md | changelog | 7516 | 134 | 2026-07-10 | 2 | +| docs/changelog-20260709-opentofu-audit.md | changelog | 6443 | 106 | 2026-07-09 | 1 | +| docs/changelog-20260709-opentofu-cloudinit-vm.md | changelog | 3721 | 67 | 2026-07-09 | 1 | +| docs/changelog-20260709-opentofu-maas-netem.md | changelog | 4566 | 84 | 2026-07-09 | 1 | +| docs/changelog-20260709-opentofu-node-vm.md | changelog | 4672 | 81 | 2026-07-09 | 1 | +| docs/changelog-20260709-opentofu-scaffold.md | changelog | 5132 | 86 | 2026-07-09 | 1 | +| docs/changelog-20260709-opnsense-config-design.md | changelog | 4585 | 80 | 2026-07-09 | 1 | +| docs/changelog-20260709-opnsense-edge-module.md | changelog | 5044 | 91 | 2026-07-09 | 1 | +| docs/changelog-20260709-opnsense-research.md | changelog | 3900 | 68 | 2026-07-09 | 2 | +| docs/changelog-20260709-repo-agnostic-sweep.md | changelog | 5681 | 90 | 2026-07-09 | 1 | +| docs/changelog-20260709-repo-lint-crlf-fix.md | changelog | 1711 | 31 | 2026-07-09 | 1 | +| docs/changelog-20260709-stage0-ratification.md | changelog | 4848 | 86 | 2026-07-09 | 2 | +| docs/changelog-20260710-carve-gua-hang-fix.md | changelog | 2490 | 48 | 2026-07-10 | 1 | +| docs/changelog-20260710-ledger-scan-self-inflicted-falsepositive-fix.md | changelog | 5710 | 101 | 2026-07-10 | 2 | +| docs/changelog-20260710-netbox-roles-aggregates.md | changelog | 3051 | 50 | 2026-07-10 | 1 | +| docs/changelog-20260710-opentofu-scaffold-first-validation.md | changelog | 4261 | 74 | 2026-07-10 | 1 | +| docs/changelog-20260710-opentofu-state-file-security.md | changelog | 6367 | 111 | 2026-07-10 | 1 | +| docs/changelog-20260710-phase0-runbook-as-executed.md | changelog | 2872 | 49 | 2026-07-10 | 1 | +| docs/changelog-20260710-phase01-bundle-staleness-fix.md | changelog | 3421 | 59 | 2026-07-10 | 1 | +| docs/changelog-20260710-prereq-install-scripts.md | changelog | 3635 | 60 | 2026-07-10 | 1 | +| docs/changelog-20260710-skill-vr1-awareness.md | changelog | 4304 | 74 | 2026-07-10 | 1 | +| docs/changelog-20260710-sweep-bundle-fixes.md | changelog | 4268 | 81 | 2026-07-10 | 1 | +| docs/changelog-20260710-sweep-dcdc-runbook-fixes.md | changelog | 4232 | 77 | 2026-07-10 | 1 | +| docs/changelog-20260710-sweep-script-fixes.md | changelog | 7306 | 118 | 2026-07-10 | 2 | +| docs/changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md | changelog | 5048 | 87 | 2026-07-10 | 2 | +| docs/changelog-20260710-vr1-teardown-rollback-runbook.md | changelog | 5959 | 104 | 2026-07-10 | 1 | +| docs/changelog-20260711-d111-subcarve-nn-alignment.md | changelog | 2830 | 48 | 2026-07-11 | 1 | +| docs/changelog-20260711-ula-gen-command-fix.md | changelog | 1730 | 31 | 2026-07-14 | 3 | +| docs/changelog-20260712-docfix189-max-context-session-audit.md | changelog | 5808 | 92 | 2026-07-12 | 1 | +| docs/changelog-20260712-libvirt-acpi-kernel-panic.md | changelog | 5668 | 120 | 2026-07-12 | 3 | +| docs/changelog-20260712-libvirt-memory-unit-rootcause.md | changelog | 6662 | 119 | 2026-07-12 | 4 | +| docs/changelog-20260712-office1-opnsense-edge-build.md | changelog | 3964 | 58 | 2026-07-12 | 5 | +| docs/changelog-20260712-opnsense-edge-boot-fixes.md | changelog | 3494 | 55 | 2026-07-12 | 3 | +| docs/changelog-20260712-opnsense-edge-real-isp-router.md | changelog | 2469 | 39 | 2026-07-12 | 2 | +| docs/changelog-20260712-opnsense-prep-bz2-fallback.md | changelog | 978 | 19 | 2026-07-12 | 1 | +| docs/changelog-20260713-apparmor-libvirt-prereq.md | changelog | 3351 | 60 | 2026-07-13 | 3 | +| docs/changelog-20260713-config-xml-danger-sweep.md | changelog | 3569 | 57 | 2026-07-13 | 2 | +| docs/changelog-20260713-config-xml-path-deleted.md | changelog | 4787 | 92 | 2026-07-13 | 2 | +| docs/changelog-20260713-d114-voffice1-nested-virt.md | changelog | 6601 | 110 | 2026-07-13 | 2 | +| docs/changelog-20260713-docfix194-opentofu-module-validation.md | changelog | 4618 | 103 | 2026-07-13 | 2 | +| docs/changelog-20260713-git-credential-store.md | changelog | 3385 | 65 | 2026-07-13 | 2 | +| docs/changelog-20260713-office1-dhcp-apply.md | changelog | 4996 | 97 | 2026-07-13 | 3 | +| docs/changelog-20260713-office1-headend-maas-lxd.md | changelog | 6399 | 102 | 2026-07-13 | 1 | +| docs/changelog-20260713-office1-netbox-deployed.md | changelog | 5360 | 93 | 2026-07-13 | 3 | +| docs/changelog-20260713-opnsense-api-client.md | changelog | 3350 | 63 | 2026-07-13 | 1 | +| docs/changelog-20260713-opnsense-api-proven.md | changelog | 3533 | 64 | 2026-07-13 | 4 | +| docs/changelog-20260713-opnsense-api-write-proven.md | changelog | 3059 | 64 | 2026-07-13 | 4 | +| docs/changelog-20260713-opnsense-apikey-bootstrap.md | changelog | 4404 | 83 | 2026-07-13 | 2 | +| docs/changelog-20260713-workflow-doc-status-correction.md | changelog | 3102 | 43 | 2026-07-13 | 1 | +| docs/changelog-20260714-c4-sandbox-loop-and-upstream-guard.md | changelog | 3117 | 54 | 2026-07-14 | 1 | +| docs/changelog-20260714-d119-region-qualified-dc-namespace.md | changelog | 6396 | 108 | 2026-07-14 | 2 | +| docs/changelog-20260714-d119-tofu-apply.md | changelog | 1995 | 43 | 2026-07-14 | 1 | +| docs/changelog-20260714-netbox-importers-waf-useragent.md | changelog | 2479 | 54 | 2026-07-14 | 3 | +| docs/changelog-20260714-netbox-write-path-hardening.md | changelog | 4987 | 85 | 2026-07-14 | 3 | +| docs/changelog-20260714-office1-lan-ipv6-executed.md | changelog | 7307 | 116 | 2026-07-14 | 3 | +| docs/changelog-20260714-opnsense-set-interface-v6.md | changelog | 4783 | 85 | 2026-07-14 | 2 | +| docs/changelog-20260715-creds-audit.md | changelog | 3530 | 60 | 2026-07-15 | 2 | +| docs/changelog-20260715-creds-consolidation.md | changelog | 3180 | 52 | 2026-07-15 | 2 | +| docs/changelog-20260715-d120-load-and-iprange-tooling.md | changelog | 3268 | 53 | 2026-07-15 | 3 | +| docs/changelog-20260715-d120-office1-service-reip.md | changelog | 4064 | 66 | 2026-07-15 | 1 | +| docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md | changelog | 8971 | 116 | 2026-07-16 | 2 | +| docs/changelog-20260715-docfix195-c2-netbox-of-record.md | changelog | 5225 | 75 | 2026-07-15 | 1 | +| docs/changelog-20260715-fidelity-check-scope-correctness.md | changelog | 4906 | 83 | 2026-07-15 | 4 | +| docs/changelog-20260715-stage3-prereqs-prep.md | changelog | 6334 | 88 | 2026-07-16 | 2 | +| docs/changelog-20260716-d124-addressing-pin.md | changelog | 3880 | 65 | 2026-07-16 | 3 | +| docs/changelog-20260716-d124-rack-addressing.md | changelog | 6471 | 92 | 2026-07-16 | 1 | +| docs/changelog-20260716-d126-durable-forward.md | changelog | 7703 | 111 | 2026-07-16 | 2 | +| docs/changelog-20260716-review-sweep-phaseAB.md | changelog | 4012 | 59 | 2026-07-16 | 2 | +| docs/changelog-20260716-review-sweep-phaseC.md | changelog | 4588 | 64 | 2026-07-16 | 2 | +| docs/changelog-20260716-review-sweep-phaseC2-D125.md | changelog | 5138 | 73 | 2026-07-16 | 2 | +| docs/changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md | changelog | 5684 | 75 | 2026-07-17 | 3 | +| docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md | changelog | 3579 | 60 | 2026-07-17 | 2 | +| docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md | changelog | 3580 | 54 | 2026-07-17 | 2 | +| docs/changelog-20260718-opnsense-plugins-installer.md | changelog | 2617 | 40 | 2026-07-18 | 2 | +| docs/changelog-20260718-permission-posture-ask-preempts-classifier.md | changelog | 2323 | 40 | 2026-07-18 | 2 | +| docs/clientdocs-workflow-review-20260708.md | workflow | 9694 | 190 | 2026-07-08 | 2 | +| docs/dc-dc-buildout-design.md | reference | 14449 | 239 | 2026-07-09 | 21 | +| docs/dc-dc-deployment-workflow.md | workflow | 78072 | 886 | 2026-07-17 | 54 | +| docs/dc-dc-ipv6-charm-research.md | reference | 8076 | 142 | 2026-07-10 | 3 | +| docs/dc-dc-netbox-buildout-scope.md | reference | 21942 | 310 | 2026-07-15 | 16 | +| docs/dc-dc-netem-and-ula-gua-proposal.md | reference | 8601 | 139 | 2026-07-11 | 5 | +| docs/dc-dc-replication-DR-seed.md | reference | 4200 | 75 | 2026-07-08 | 5 | +| docs/dc0-deploy-readiness.md | readiness | 12137 | 181 | 2026-07-17 | 4 | +| docs/design-decisions.md | decision | 323955 | 4108 | 2026-07-18 | 54 | +| docs/docfix-draft-20260702.md | reference | 15011 | 215 | 2026-07-03 | 2 | +| docs/finding-20260718-voffice1-cloudinit-seed-replace.md | finding | 15140 | 273 | 2026-07-18 | 2 | +| docs/handoff-20260703-open-items.md | reference | 9110 | 164 | 2026-07-03 | 3 | +| docs/handoff-20260705-open-items.md | reference | 11891 | 179 | 2026-07-06 | 2 | +| docs/incident-20260712-opnsense-edge-boot-triplefault.md | reference | 7623 | 113 | 2026-07-12 | 6 | +| docs/maas-as-built-reference.md | reference | 10331 | 191 | 2026-06-26 | 7 | +| docs/model-a-fallback-plan.md | reference | 7353 | 106 | 2026-07-16 | 10 | +| docs/netbox-vip-queue.md | reference | 6743 | 126 | 2026-07-03 | 7 | +| docs/opnsense-edge-addon-review-20260718.md | reference | 11038 | 146 | 2026-07-18 | 4 | +| docs/phase-00-maas-standup-notes.md | reference | 3018 | 52 | 2026-06-29 | 1 | +| docs/repo-lint-nextfree-bug-FINDING.md | reference | 4264 | 68 | 2026-07-06 | 3 | +| docs/script-quality-findings-20260707.md | finding | 8104 | 141 | 2026-07-07 | 3 | +| docs/security-ledger.md | ledger | 11096 | 57 | 2026-07-16 | 19 | +| docs/session-findings-2026-07-02.md | finding | 5890 | 77 | 2026-07-02 | 1 | +| docs/session-ledger.md | ledger | 98987 | 1142 | 2026-07-18 | 36 | +| docs/stage3-adversarial-review-20260716.md | reference | 27956 | 348 | 2026-07-16 | 4 | +| docs/stage3-review-base.patch | patch | 227584 | 3795 | 2026-07-16 | 3 | +| docs/tenant-cidr-overlap-correction-PLAN.md | reference | 8937 | 154 | 2026-07-06 | 2 | +| docs/tenant-onboarding-contract.md | reference | 9785 | 139 | 2026-07-07 | 10 | +| docs/upstream-bug-draft-dashboard-tls.md | reference | 2518 | 48 | 2026-07-05 | 3 | +| docs/v1-pre-deploy-fixes.md | reference | 36265 | 832 | 2026-07-03 | 5 | +| docs/v1-redeploy-changelog.md | reference | 245435 | 3453 | 2026-07-09 | 3 | +| docs/vr1-office1-as-built.md | reference | 15841 | 203 | 2026-07-18 | 14 | +| runbooks/README.md | runbook | 7224 | 95 | 2026-07-10 | 0 | +| runbooks/appendix-A-troubleshooting.md | runbook | 43905 | 660 | 2026-07-08 | 14 | +| runbooks/appendix-B-asbuilt-version-lock.md | runbook | 12146 | 155 | 2026-07-05 | 7 | +| runbooks/appendix-C-identity-rbac.md | runbook | 10393 | 142 | 2026-07-03 | 7 | +| runbooks/appendix-D-magnum-trust-model.md | runbook | 6907 | 100 | 2026-07-02 | 3 | +| runbooks/d011-batch3-window-DRAFT.md | runbook | 6572 | 121 | 2026-07-09 | 5 | +| runbooks/dc-dc-office1-service-reip.md | runbook | 6945 | 114 | 2026-07-15 | 4 | +| runbooks/dc-dc-phase0-vcloud-prep.md | runbook | 25232 | 527 | 2026-07-14 | 17 | +| runbooks/dc-dc-phase1-office1-standup.md | runbook | 48778 | 903 | 2026-07-17 | 13 | +| runbooks/dc-dc-phase2-tofu-dc-substrate.md | runbook | 43998 | 770 | 2026-07-18 | 15 | +| runbooks/dc-dc-phase3-maas-enlist-deploy.md | runbook | 29043 | 551 | 2026-07-15 | 8 | +| runbooks/dc-dc-phase4-juju-bundle-per-dc.md | runbook | 17030 | 338 | 2026-07-14 | 5 | +| runbooks/dc-dc-phase5-dr-failover-drill.md | runbook | 37810 | 687 | 2026-07-14 | 11 | +| runbooks/dc-dc-phase6-designate-cos-magnum.md | runbook | 34920 | 671 | 2026-07-18 | 8 | +| runbooks/dc-dc-teardown-rollback.md | runbook | 18612 | 377 | 2026-07-16 | 13 | +| runbooks/ops-capi-recovery.md | runbook | 13128 | 251 | 2026-06-18 | 6 | +| runbooks/ops-restart-procedure.md | runbook | 7040 | 156 | 2026-07-16 | 10 | +| runbooks/ops-update-procedure.md | runbook | 19590 | 424 | 2026-07-09 | 6 | +| runbooks/phase-00-teardown-maas-reset.md | runbook | 13317 | 252 | 2026-07-03 | 12 | +| runbooks/phase-01-bundle-deploy.md | runbook | 22714 | 422 | 2026-07-10 | 13 | +| runbooks/phase-02-vault-bringup.md | runbook | 9512 | 178 | 2026-06-18 | 5 | +| runbooks/phase-03-core-verify.md | runbook | 21284 | 361 | 2026-07-07 | 7 | +| runbooks/phase-04-network-carve.md | runbook | 11414 | 188 | 2026-06-30 | 5 | +| runbooks/phase-05-octavia-enablement.md | runbook | 13844 | 226 | 2026-06-30 | 5 | +| runbooks/phase-06-incloud-mgmt-cluster.md | runbook | 30690 | 577 | 2026-07-01 | 5 | +| runbooks/phase-07-conductor-graft.md | runbook | 29583 | 503 | 2026-07-03 | 5 | +| runbooks/phase-08-workload-cluster-acceptance.md | runbook | 21992 | 380 | 2026-07-10 | 9 | +| runbooks/tenant-onboarding-v2-DRAFT.md | runbook | 32894 | 476 | 2026-07-09 | 8 | +| README.md | reference | 6134 | 111 | 2026-06-18 | 66 | +| CLAUDE.md | reference | 2879 | 53 | 2026-07-03 | 11 | +| .claude/skills/openstack-cloud-ops/SKILL.md | skill | 13833 | 173 | n/a | 0 | +| .claude/skills/openstack-cloud-ops/references/environment.md | skill | 8018 | 131 | n/a | 0 | +| .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md | skill | 9233 | 154 | n/a | 0 | +| .claude/skills/openstack-cloud-ops/references/operating-discipline.md | skill | 8792 | 146 | n/a | 0 | +| .claude/skills/openstack-cloud-ops/references/platform-traps.md | skill | 24853 | 456 | n/a | 0 | +| .claude/skills/openstack-cloud-ops/references/script-authoring.md | skill | 12686 | 219 | n/a | 0 | +| .claude/skills/openstack-cloud-ops/references/troubleshooting.md | skill | 7047 | 113 | n/a | 0 | +| memory/MEMORY.md | memory | 781 | 6 | n/a | 0 | +| memory/creds-folder-convention.md | memory | 2055 | 32 | n/a | 0 | +| memory/multi-workstation-remote-control.md | memory | 1609 | 25 | n/a | 0 | +| memory/project-posture-closed-test.md | memory | 1566 | 28 | n/a | 0 | +| memory/review-after-each-step.md | memory | 1340 | 24 | n/a | 0 | + +Unreferenced changelogs (consolidation candidates by default): 0 + +## 2. Contradiction groups (mechanical) + +### CONTRADICTION: plan `plan` -> 10 distinct values: `0/1/0`, `0/1/1`, `11/0/11`, `13/0/0`, `4/32/36`, `5/0-or-2/6`, `5/0/0`, `5/0/6`, `5/2/6`, `7/2/7` + +| value | where | line | +|---|---|---| +| 0/1/0 | docs/changelog-20260712-docfix189-max-context-session-audit.md:46 | (`0 to add, 1 to change, 0 to destroy`). Removing it changes no resource. | +| 0/1/0 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:76 | - `tofu plan`: `0 to add, 1 to change, 0 to destroy` -- domain only; the 11 GiB direct-copy | +| 0/1/1 | docs/changelog-20260713-config-xml-path-deleted.md:45 | Plan: 0 to add, 1 to change, 1 to destroy. | +| 11/0/11 | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:94 | Plan: 11 to add, 0 to change, 11 to destroy. | +| 11/0/11 | docs/changelog-20260714-d119-tofu-apply.md:13 | Then a fresh `tofu plan`: **11 to add, 0 to change, 11 to destroy** -- all `must be replaced` | +| 11/0/11 | docs/session-ledger.md:741 | **THE `tofu apply` IS NOT DONE -- IT IS GATED.** Plan: 11 to add, 0 to change, 11 to destroy (the | +| 13/0/0 | runbooks/dc-dc-phase0-vcloud-prep.md:439 | NetBox assigns the supernet). Expect `Plan: 13 to add, 0 to change, 0 to destroy`. | +| 4/32/36 | docs/D-058-renumber.md:62 | Apply the same rotate (8->12, 12->16, 16->20, 24->8, 64->60; 4/32/36 fixed). These are | +| 5/0-or-2/6 | docs/dc0-deploy-readiness.md:167 | 6. Re-run the outer plan; confirm 5-add/(0-or-2)-change/6-destroy-empty (autostart in-place collapses to 0 pos... | +| 5/0-or-2/6 | docs/dc0-deploy-readiness.md:48 | > A fresh session MUST re-run the plan and re-confirm 5-add/(0-or-2)-change/6-destroy-empty (autostart in-plac... | +| 5/0/0 | docs/changelog-20260713-d114-voffice1-nested-virt.md:57 | - `tofu plan`: **5 to add, 0 to change, 0 to destroy** -- confirmed BEFORE applying that the running | +| 5/0/6 | docs/dc0-deploy-readiness.md:59 | keeps office1's key); tfvar set. Re-validated + re-planned -> outer plan UNCHANGED (5/0/6, create-only | +| 5/0/6 | docs/design-decisions.md:4064 | `office1-opnsense` and dirty the imminent DC0 outer plan (5/0/6). Set true only for NEW DC-edge | +| 5/0/6 | docs/session-ledger.md:278 | Gate before any apply: plan must read EXACTLY 5 add / 0 change / 6 destroy. Nothing applied this session. | +| 5/0/6 | docs/session-ledger.md:293 | re-plan UNCHANGED (5/0/6). netem RULED = placeholder for the rehearsal. Full remaining-prep checklist + | +| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:32 | `5 add / 2 in-place / 6 destroy`; the 2 in-place collapse to 0 once the bookend sets those two autostart | +| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:45 | D-127 implementation updated (IaC layer DONE); readiness-doc plan line updated (5/2/6, collapses to 0); | +| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:52 | - `tofu -chdir=opentofu plan` -> `5 add / 2 in-place / 6 destroy`; no forces-replacement on any existing. | +| 5/2/6 | docs/dc0-deploy-readiness.md:37 | `tofu -chdir=opentofu plan` => **5 add / 2 in-place / 6 destroy**, decomposed and verified: | +| 5/2/6 | docs/design-decisions.md:3957 | is a new create with autostart=false baked in. Outer plan is now `5 add / 2 in-place / 6 destroy`, which | +| 5/2/6 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:17 | **5 add / 2 in-place / 6 destroy**. The delta is NOT in DC0 scope -- it is entirely | +| 5/2/6 | docs/session-ledger.md:156 | in-place, NOT replacement). Outer plan now 5 add / 2 in-place / 6 destroy (collapses to 0-change once the | +| 5/2/6 | docs/session-ledger.md:215 | **5 add / 2 in-place / 6 destroy** in `docs/dc0-deploy-readiness.md`. The entire delta is `voffice1`, the | +| 7/2/7 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:14 | Plan: 7 to add, 2 to change, 7 to destroy. | +| 7/2/7 | docs/session-ledger.md:214 | root (read-only plan, **OpenTofu v1.12.4**) returns **7 add / 2 change / 7 destroy**, NOT the committed | + +### CONTRADICTION: version `juju` -> 5 distinct values: `2.1`, `2024.1`, `3.1`, `3.6`, `3.6.25` + +| value | where | line | +|---|---|---| +| 2.1 | docs/design-decisions.md:1684 | (committed pre-change BOM), a fresh `juju create-backup` archive (now the STANDARD 2.1 step, | +| 2.1 | docs/v1-redeploy-changelog.md:424 | Vault's own status agrees with the Juju workload-status. Cleared for 2.1b (vault init). | +| 2024.1 | runbooks/dc-dc-phase5-dr-failover-drill.md:153 | juju deploy cinder-backup --channel 2024.1/stable --to lxd: | +| 3.1 | runbooks/phase-03-core-verify.md:10 | backends confirmed LOADED via a functional sweep, NOT juju status; Step 3.1). Troubleshooting: | +| 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki | +| 3.6 | docs/design-decisions.md:1611 | policy for either: (a) the Juju controller/agents (patch releases on the 3.6 track; | +| 3.6 | docs/design-decisions.md:1632 | The testcloud controller is SINGLE (non-HA) and Juju 3.6 ships no supported controller | +| 3.6 | docs/design-decisions.md:1677 | ## D-071 -- AMENDMENT (2026-07-05): controller backup EXISTS on juju 3.6; risk section corrected | +| 3.6 | docs/design-decisions.md:1680 | premise "no supported backup in Juju 3.6": `juju create-backup` / `download-backup` exist on | +| 3.6 | docs/design-decisions.md:2043 | - Single-unit (not HA) for VR1, with the confirmed backup posture (juju 3.6 `create-backup` / `download-backup... | +| 3.6 | docs/design-decisions.md:994 | `remove-machine` option. Juju 3.6 `remove-machine` reference: a machine can be removed from the | +| 3.6 | docs/handoff-20260705-open-items.md:59 | Backups are confirmed to exist (juju 3.6 `create-backup`); the open half is single-controller HA. | +| 3.6 | docs/session-ledger.md:989 | `download-backup` DO exist on juju 3.6 -- the original "removed in 3.0" premise was wrong). | +| 3.6 | docs/upstream-bug-draft-dashboard-tls.md:14 | Reactive charm generation; juju 3.6. | +| 3.6 | docs/v1-redeploy-changelog.md:1819 | explicit Risk section: single non-HA controller, no supported backup in Juju 3.6, no | +| 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped `juju status keystone --format=line`, and juju 3.6 line format omits workload | +| 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped `juju status keystone --format=line`, and juju 3.6 line format omits workload | +| 3.6 | docs/v1-redeploy-changelog.md:1953 | `juju-status` (units do NOT carry `agent-status.version` on juju 3.6); 2.1 | +| 3.6 | docs/v1-redeploy-changelog.md:1954 | REWRITTEN -- `juju create-backup` EXISTS on 3.6 and is now the STANDARD gated | +| 3.6 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:289 | Per D-104: scheduled controller backups, confirmed backup posture (juju 3.6 | +| 3.6 | runbooks/dc-dc-phase5-dr-failover-drill.md:448 | against this controller's actual installed juju client (3.6 per D-104) before running restore | +| 3.6 | runbooks/ops-update-procedure.md:158 | on juju 3.6 (the "removed in 3.0" authoring assumption was wrong for this | +| 3.6 | runbooks/ops-update-procedure.md:8 | controller backup EXISTS on juju 3.6). | +| 3.6.25 | docs/handoff-20260705-open-items.md:169 | > juju 3.6.25. Vault is `1.8/stable` rev 714 (current in-channel). | +| 3.6.25 | docs/handoff-20260705-open-items.md:22 | in-channel revisions; controllers/agents at juju 3.6.25; appendix-B re-baselined. | +| 3.6.25 | docs/session-ledger.md:78 | - **VR0 / DC0 testcloud:** fleet fully current (juju 3.6.25, 91 agents); D-011 CLOSED except | + +### CONTRADICTION: version `lxd` -> 5 distinct values: `5.21`, `5.21.4`, `5.21.5`, `6.6`, `6.7` + +| value | where | line | +|---|---|---| +| 5.21 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | `v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk | +| 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \| | +| 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:254 | makes it a decision. **LXD 5.21 LTS is supported to June 2029** | +| 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 proven end to end | +| 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:62 | 3. **LXD snap track changes are ONE-WAY.** LXD must be installed DIRECTLY onto `5.21/stable` and | +| 5.21 | docs/dc-dc-deployment-workflow.md:65 | > LXD (pinned to the 5.21 LTS track) runs ON it**, that LXD is **registered BACK INTO MAAS as an | +| 5.21 | docs/dc-dc-deployment-workflow.md:84 | \| **Gate** \| Office1 OPNsense edge up (**MET** -- routing, NAT, egress, Kea DHCP; gap #17 closed for Office1... | +| 5.21 | docs/dc-dc-deployment-workflow.md:85 | \| **Owns** \| **D-114** (site containment VM + MAAS-composed LXD VMs, incl. the LXD 5.21 pin), D-103 as AMEND... | +| 5.21 | docs/dc-dc-deployment-workflow.md:85 | \| **Owns** \| **D-114** (site containment VM + MAAS-composed LXD VMs, incl. the LXD 5.21 pin), D-103 as AMEND... | +| 5.21 | docs/dc-dc-deployment-workflow.md:874 | \| **D-114 site containment VM (`voffice1`)** \| **BUILT + RUNNING 2026-07-13.** `module "voffice1"` (`modules... | +| 5.21 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: | +| 5.21 | docs/stage3-review-base.patch:2859 | + # createadmin/apikey/login, LXD (5.21 pin), LXD vm-host registration, compose-network DHCP. | +| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:116 | REGION CONTROLLER runs ON it. LXD (5.21 LTS) also runs ON it, and that LXD is | +| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:186 | D-114's hard LXD 5.21-LTS-track constraint, which IS decided). Each install | +| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:46 | including the LXD 5.21 LTS pin), **D-103** as AMENDED by D-114 (OpenTofu owns | +| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:488 | ssh 'sudo snap install lxd --channel=5.21/stable' | +| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the **5.21 LTS track** (D-114). MAAS 3.6/3.7 is | +| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:887 | - [ ] `runbooks/appendix-B-asbuilt-version-lock.md` updated with the LXD 5.21-LTS | +| 5.21.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:253 | VR0 runs LXD **5.21.4** and is therefore safe by accident of timing; D-114 | +| 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \| **Reuse vs new** \| NEW infra (Office1 didn't exist for VR0 DC0), but LESS new than it looks: the MAAS-comp... | +| 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \| **Reuse vs new** \| NEW infra (Office1 didn't exist for VR0 DC0), but LESS new than it looks: the MAAS-comp... | +| 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project `default`, LXD **5.21.4**; | +| 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project `default`, LXD **5.21.4**; | +| 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project `default`, LXD 5.21.4. | +| 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project `default`, LXD 5.21.4. | +| 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \|- voffice1 (L2) MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea reservation) | +| 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:6 | **LXD 5.21.5** are installed on it, that LXD is **registered back into MAAS as an LXD VM host**, and | +| 5.21.5 | docs/dc-dc-deployment-workflow.md:114 | - **DONE (site) -- D-114 IS PROVEN END TO END:** MAAS 3.7.2 region+rack ON `voffice1`; LXD 5.21.5 | +| 5.21.5 | docs/session-ledger.md:603 | and **LXD 5.21.5**, with that LXD **registered into MAAS as an LXD VM host**. MAAS then | +| 5.21.5 | docs/vr1-office1-as-built.md:43 | \| **voffice1** \| `10.10.0.20` (Kea reservation) \| **MAAS 3.7.2** region+rack + PostgreSQL 16.14; **LXD 5.21... | +| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:249 | not yet in a MAAS release). Verbatim guidance: "We recommend using LXD <=6.6 | +| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... | +| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... | +| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... | +| 6.6 | docs/design-decisions.md:2593 | pylxd >= 2.3.9, not yet in a MAAS release). Canonical's own guidance is "use LXD <= 6.6 or the | +| 6.7 | .claude/skills/openstack-cloud-ops/SKILL.md:100 | \| Creating/changing a `libvirt_domain`; anything about nested KVM, a libvirt storage pool, LXD versions, an O... | +| 6.7 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud | +| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \| | +| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) | +| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:247 | Canonical's own announcement: LXD 6.7 "consolidates some API endpoints" that | +| 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on `latest` first, because MAAS 3.6/3.7 is incompatible with LXD >= 6.7 | +| 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:64 | (pinned pylxd 2.3.5 vs LXD 6.7's consolidated endpoints). Bonus discovered in research: | +| 6.7 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: | +| 6.7 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to them (fixed in | +| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:491 | cannot talk to LXD >= 6.7 (pylxd 2.3.5 vs LXD's consolidated API endpoints). | +| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's | +| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's | + +### CONTRADICTION: version `maas` -> 6 distinct values: `10.12.8`, `2.3.5`, `2.7.2`, `3.6`, `3.7`, `3.7.2` + +| value | where | line | +|---|---|---| +| 10.12.8 | docs/D-058-renumber.md:67 | - scripts/phase-00-maas-carve.sh (METAL_CIDR default 10.12.8 -> 10.12.12; ranges) | +| 2.3.5 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:248 | MAAS's pinned **pylxd 2.3.5** cannot speak to (fixed in **pylxd >= 2.3.9**, | +| 2.3.5 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to them (fixed in | +| 2.7.2 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:82 | ### `canonical/maas` (pinned `2.7.2`, confirmed 2026-07-09) | +| 2.7.2 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:54 | hashes: `dmacvicar/libvirt` 0.9.8, `canonical/maas` 2.7.2). | +| 2.7.2 | runbooks/dc-dc-phase0-vcloud-prep.md:339 | fetch `dmacvicar/libvirt` 0.9.8 and `canonical/maas` 2.7.2) | +| 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | `v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk | +| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \| | +| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \| MAAS \| 3.7.2 (VR0) \| the LXD ceiling above is a property of MAAS 3.6/3.7 \| | +| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) | +| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... | +| 3.6 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on `latest` first, because MAAS 3.6/3.7 is incompatible with LXD >= 6.7 | +| 3.6 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: | +| 3.6 | runbooks/dc-dc-phase1-office1-standup.md:442 | ssh 'sudo snap install maas --channel= install the `maas` snap (3.7/stable) -> `maas init rack --maas-url | +| 3.7 | docs/stage3-review-base.patch:261 | +(D-123): disable timesyncd -> install the `maas` snap (3.7/stable) -> `maas init rack --maas-url | +| 3.7 | docs/stage3-review-base.patch:2786 | MAAS_CHANNEL="3.7/stable" | +| 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): | +| 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): | +| 3.7.2 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki | +| 3.7.2 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \| MAAS \| 3.7.2 (VR0) \| the LXD ceiling above is a property of MAAS 3.6/3.7 \| | +| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 proven end to end | +| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \|- voffice1 (L2) MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea reservation) | +| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:5 | `voffice1` is a working VR1 site headend. **MAAS 3.7.2** (region+rack, PostgreSQL 16.14) and | +| 3.7.2 | docs/dc-dc-deployment-workflow.md:114 | - **DONE (site) -- D-114 IS PROVEN END TO END:** MAAS 3.7.2 region+rack ON `voffice1`; LXD 5.21.5 | +| 3.7.2 | docs/design-decisions.md:2553 | **Measured as-built evidence (VR0 / `openstack-caracal-ipv4` MAAS 3.7.2, operator screenshots | +| 3.7.2 | docs/maas-as-built-reference.md:169 | - MAAS 3.7.2; controller `maas.maas`, Region+Rack, Non-HA(3 VLANs). | +| 3.7.2 | docs/session-ledger.md:602 | the pool), egress through the OPNsense edge. On it: **MAAS 3.7.2** region+rack (PostgreSQL 16.14) | +| 3.7.2 | docs/vr1-office1-as-built.md:43 | \| **voffice1** \| `10.10.0.20` (Kea reservation) \| **MAAS 3.7.2** region+rack + PostgreSQL 16.14; **LXD 5.21... | + +### CONTRADICTION: version `netbox` -> 5 distinct values: `10.1`, `172.31`, `4.5.8`, `4.6`, `4.6.4` + +| value | where | line | +|---|---|---| +| 10.1 | docs/changelog-20260716-d124-addressing-pin.md:21 | - **`netbox/dc-rack-mgmt-import.py`:** `CONTAINER = "10.12.0.0/16"` -> **`"172.31.0.0/24"`** (+ header | +| 172.31 | docs/changelog-20260716-d124-addressing-pin.md:44 | python3 netbox/dc-rack-mgmt-import.py --transit-cidr 172.31.0.0/30 --rack-ip 10.12.8.2 # dry-run; add --comm... | +| 4.5.8 | docs/changelog-20260710-netbox-roles-aggregates.md:42 | Script previewed (read-only) against live NetBox 4.5.8: correctly reports 12 objects to create | +| 4.5.8 | docs/dc-dc-netbox-buildout-scope.md:45 | `netbox.baldurkeep.com` v4.5.8. Regions: US West -> Eugene (prod); **Virtual Regions -> VR0, VR1**. | +| 4.5.8 | docs/design-decisions.md:2893 | **The collision, measured live against `netbox.baldurkeep.com` (4.5.8) on 2026-07-13:** | +| 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:25 | ### 2. NetBox 4.6 v2 API tokens: the wire format is `nbt_.` -- NOT the `token` field | +| 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:29 | NetBox 4.6 **hashes** API tokens. The `Token` model has `key` (a 12-char PREFIX), `plaintext` (40), | +| 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited (0) ~3h earlier and was | +| 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited (0) ~3h earlier and was | +| 4.6 | docs/stage3-review-base.patch:1120 | + die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v2 token " | +| 4.6 | docs/stage3-review-base.patch:897 | + die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v2 token " | +| 4.6 | docs/vr1-office1-as-built.md:141 | **NetBox API token format (4.6):** the wire form is `nbt_<key>.<plaintext>`. The API's `token` field | +| 4.6 | docs/vr1-office1-as-built.md:44 | \| **office1-netbox** \| `10.10.1.10` \| **NetBox 4.6** (netbox-docker; `/opt/netbox-docker`, `docker compose ... | +| 4.6 | runbooks/dc-dc-phase1-office1-standup.md:725 | --draft draft/vr1-draft.json`. It STRUCTURALLY cannot reach upstream. NetBox 4.6 | +| 4.6.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:453 | **Note:** this is an UPSTREAM-only trap so far. The Office1 sandbox NetBox (4.6.4, no proxy in | +| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Office1 headend | +| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Office1 headend | +| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:6 | laid down by MAAS) and runs **NetBox 4.6.4** (netbox-docker, Django 6.0.6). Its API authenticates. | +| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:74 | - NetBox **4.6.4** on Django 6.0.6, containers `netbox` + `netbox-worker` + `postgres` + `redis` + | +| 4.6.4 | docs/dc-dc-deployment-workflow.md:116 | machines **COMPOSED BY MAAS** and deployed -- `office1-netbox` (10.10.1.10, NetBox 4.6.4) and | +| 4.6.4 | docs/dc-dc-netbox-buildout-scope.md:198 | (`10.10.1.10:8000`, NetBox 4.6.4 on the Office1 VM, `docs/changelog-20260713-office1-netbox-deployed.md`): | + +### CONTRADICTION: version `opnsense` -> 3 distinct values: `14.3`, `26.1`, `26.7` + +| value | where | line | +|---|---|---| +| 14.3 | docs/session-ledger.md:189 | security pkgs) THEN reboot; (b) office1-opnsense itself is still on 14.3-RELEASE-p16 (guest OS not patched, | +| 26.1 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud | +| 26.1 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:130 | https://docs.opnsense.org/releases/CE_26.1.html | +| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:22 | \| OPNsense \| 26.1 "Witty Woodpecker" \| ISC-DHCP left core in 26.1 -- Kea/dnsmasq only (see below) \| | +| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:322 | ## 4. OPNsense 26.1 edge | +| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:351 | https://docs.opnsense.org/releases/CE_26.1.html | +| 26.1 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:108 | **sizing** question, not a regression of this fix -- check OPNsense 26.1's documented | +| 26.1 | docs/changelog-20260712-office1-opnsense-edge-build.md:33 | (`opnsense-26.1-nano.qcow2`), so there is no target-path collision. Same conclusion, | +| 26.1 | docs/changelog-20260712-opnsense-prep-bz2-fallback.md:15 | `opnsense-26.1-nano.qcow2` (qcow2, 11 GiB virtual) via the python path. | +| 26.1 | docs/changelog-20260713-opnsense-api-proven.md:24 | GET core/firmware/status -> HTTP 200, OPNsense 26.1 (auth works) | +| 26.1 | docs/changelog-20260713-opnsense-api-proven.md:8 | An API key was minted for `root` in the GUI. In OPNsense **26.1** this is NOT in the user-edit | +| 26.1 | docs/changelog-20260714-opnsense-set-interface-v6.md:10 | among the API-covered surfaces. **Measured on the live Office1 edge (OPNsense 26.1): that is | +| 26.1 | docs/design-decisions.md:2498 | **MEASURED on the live Office1 edge (2026-07-14), OPNsense 26.1:** | +| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense **26.1 nano** amd64 (`scripts/opnsense-prep-image.sh 26.1`), prepped to | +| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense **26.1 nano** amd64 (`scripts/opnsense-prep-image.sh 26.1`), prepped to | +| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:60 | `/var/lib/libvirt/vr1/office1/opnsense-26.1-nano.qcow2` (11 GiB virtual). | +| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:92 | the real fix, check OPNsense 26.1's documented minimum before picking a number. | +| 26.1 | docs/session-ledger.md:649 | CANNOT be done via the REST API. Measured on the live edge (OPNsense 26.1): `Interfaces > [LAN]` is | +| 26.1 | docs/stage3-review-base.patch:1373 | + base_volume_path = "/var/lib/libvirt/vr1/vr1-dc0/opnsense-26.1-nano.qcow2" | +| 26.7 | docs/design-decisions.md:4074 | **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock install (only | +| 26.7 | docs/design-decisions.md:4074 | **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock install (only | +| 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | **Subject.** `office1-opnsense`, **OPNsense 26.7** (amd64), reviewed for plugin/add-on | +| 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | **Subject.** `office1-opnsense`, **OPNsense 26.7** (amd64), reviewed for plugin/add-on | +| 26.7 | docs/session-ledger.md:830 | **OPNsense EDGE 26.7 UPDATE + PLUGIN/ADD-ON REVIEW (2026-07-18).** Operator updated `office1-opnsense` | +| 26.7 | docs/vr1-office1-as-built.md:42 | \| **office1-opnsense** \| LAN `10.10.0.1` / WAN `172.30.1.2` \| **OPNsense 26.7** (FreeBSD base **15.1**-RELE... | + +### CONTRADICTION: version `tofu` -> 5 distinct values: `0.9.8`, `1.1`, `1.12.3`, `1.12.4`, `1.6.0` + +| value | where | line | +|---|---|---| +| 0.9.8 | .claude/skills/openstack-cloud-ops/references/environment.md:33 | libvirt/KVM via the `dmacvicar/libvirt` OpenTofu provider `0.9.8` on OpenTofu | +| 1.1 | docs/dc-dc-deployment-workflow.md:360 | - **A `tofu` binary EXISTS on the jumphost: OpenTofu v1.12.3.** The tree can | +| 1.12.3 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:19 | \| OpenTofu \| `v1.12.3` (as-run) \| the binary that actually executed Stage 1 \| | +| 1.12.3 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:4 | binary (OpenTofu v1.12.3), on the vcloud host, executing | +| 1.12.3 | docs/changelog-20260713-docfix194-opentofu-module-validation.md:19 | This was only findable because a `tofu` binary now exists on the jumphost (OpenTofu v1.12.3) -- | +| 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \| gap #2: "UNVALIDATED -- no `tofu` binary available" \| **OpenTofu v1.12.3 IS installed.** The tree validate... | +| 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \| gap #2: "UNVALIDATED -- no `tofu` binary available" \| **OpenTofu v1.12.3 IS installed.** The tree validate... | +| 1.12.3 | docs/dc-dc-deployment-workflow.md:360 | - **A `tofu` binary EXISTS on the jumphost: OpenTofu v1.12.3.** The tree can | +| 1.12.3 | docs/dc-dc-deployment-workflow.md:47 | infrastructure; vcloud host, OpenTofu v1.12.3). As-built: nested KVM already-on; | +| 1.12.3 | docs/dc-dc-deployment-workflow.md:875 | \| `opentofu/` (networks/pools/node-VM PXE/cloud-init-VM patterns) \| **VALIDATED 2026-07-13** (OpenTofu v1.12... | +| 1.12.3 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:27 | > **The OpenTofu 1.12.3 -> 1.12.4 bump is COINCIDENTAL, not causal.** The binary is now | +| 1.12.3 | docs/session-ledger.md:277 | 5/0/6-vs-5/2/6, DOCFIX-196 stale Stage-3 NetBox blocker, README tofu 1.12.3->1.12.4, phase-2 runbook). | +| 1.12.3 | docs/session-ledger.md:77 | tofu v1.12.3; tree validates (10/10 modules); lock committed. | +| 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \| L1-06 \| `tofu validate`: Success (OpenTofu v1.12.3, 11/11 modules). \| | +| 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \| L1-06 \| `tofu validate`: Success (OpenTofu v1.12.3, 11/11 modules). \| | +| 1.12.3 | runbooks/dc-dc-phase0-vcloud-prep.md:3 | > **FIRST EXECUTED 2026-07-10** (vcloud host, OpenTofu v1.12.3) -- run | +| 1.12.4 | docs/session-ledger.md:214 | root (read-only plan, **OpenTofu v1.12.4**) returns **7 add / 2 change / 7 destroy**, NOT the committed | +| 1.12.4 | docs/session-ledger.md:260 | **Version drift to log:** OpenTofu on the jumphost is now **v1.12.4**; `README.md:41` and the readiness | +| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** | +| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** | +| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** | +| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:42 | `bash scripts/prereqs/install-opentofu.sh` pointer + the >=1.6.0 floor. | +| 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \| OpenTofu `tofu` >= 1.6.0 (installs as `/usr/bin/tofu`, not the `opentofu` snap) \| Steps 8-10 \| `scripts/p... | +| 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \| OpenTofu `tofu` >= 1.6.0 (installs as `/usr/bin/tofu`, not the `opentofu` snap) \| Steps 8-10 \| `scripts/p... | + +### CONTRADICTION: status `stage-1` -> 2 distinct values: `CLOSED`, `COMPLETE` + +| value | where | line | +|---|---|---| +| CLOSED | docs/dc-dc-deployment-workflow.md:570 | 9. **Runbook debt -- CLOSED 2026-07-09.** All seven Stage 1-7 runbooks are now | +| CLOSED | docs/security-ledger.md:20 | \| SEC-009 \| 2026-07-15 \| Credential/env SPRAWL + world-readable exposure on vcloud: three env files sat loo... | +| CLOSED | docs/stage3-review-base.patch:658 | \| SEC-009 \| 2026-07-15 \| Credential/env SPRAWL + world-readable exposure on vcloud: three env files sat loo... | +| COMPLETE | docs/changelog-20260709-office1-network-edge.md:42 | Stage 1/2 runbooks) implicitly assume that command is a COMPLETE inventory | +| COMPLETE | docs/session-ledger.md:91 | VR1 Stage 1 COMPLETE; Stage 2 was in CLOSE-OUT -- now superseded by the merge above. | + +### CONTRADICTION: status `stage-2` -> 2 distinct values: `CLOSED`, `COMPLETE` + +| value | where | line | +|---|---|---| +| CLOSED | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (DOCFIX-195) -- and holds the C... | +| CLOSED | docs/dc-dc-deployment-workflow.md:384 | which is what forced Stage 2's old Option A / Option B fork -- is **CLOSED | +| COMPLETE | docs/changelog-20260715-d120-load-and-iprange-tooling.md:45 | - Stage 2 close-out (C1..C5) is COMPLETE -> the branch->main merge point is reached | +| COMPLETE | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (DOCFIX-195) -- and holds the C... | + +### CONTRADICTION: status `stage-3` -> 2 distinct values: `BLOCKED`, `HELD` + +| value | where | line | +|---|---|---| +| BLOCKED | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:3 | Closes the collision that BLOCKED Stage 3. **D-119 COMPLETES D-117; it does not reverse it.** | +| HELD | docs/session-ledger.md:205 | `docs/dc-dc-deployment-workflow.md`'s Stage 3 section still reads "**Blocking to EXECUTE:** the HELD NetBox | + +### CONTRADICTION: status `stage-4` -> 2 distinct values: `CLOSED`, `HELD` + +| value | where | line | +|---|---|---| +| CLOSED | docs/dc-dc-deployment-workflow.md:884 | \| `lib-net.sh` / `lib-hosts.sh` \| `$DC` selector mechanism ADDED 2026-07-09 (DOCFIX-151, gap #1 CLOSED) -- `... | +| HELD | docs/session-ledger.md:51 | Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned.) | + +### CONTRADICTION: status `stage-5` -> 2 distinct values: `BLOCKED`, `CLOSED` + +| value | where | line | +|---|---|---| +| BLOCKED | docs/changelog-20260709-dc-selector-convention.md:5 | which explicitly BLOCKED the Stage 5 "high reuse" claim (`phase-01..08` | +| CLOSED | docs/changelog-20260709-dc-selector-convention.md:72 | Tooling gap register item #1 CLOSED. Stage 5's runbook (Juju controller + | + +## 3. Status-claim rows (full table) + +| kind | key | value | where | line | +|---|---|---|---|---| +| plan | plan | 4/32/36 | docs/D-058-renumber.md:62 | Apply the same rotate (8->12, 12->16, 16->20, 24->8, 64->60; 4/32/36 fixed). The... | +| plan (not counted) | plan | 5/0/6 | docs/audit/grounding-audit-charter.md:193 | 5 add / 0 change / 6 destroy AND the fresh-agent test question 7 passes. Prose | +| plan (not counted) | plan | 5/0/6 | docs/audit/grounding-audit-charter.md:228 | 4. The captured outer plan reads exactly 5 add / 0 change / 6 destroy (the stand... | +| plan | plan | 0/1/0 | docs/changelog-20260712-docfix189-max-context-session-audit.md:46 | (`0 to add, 1 to change, 0 to destroy`). Removing it changes no resource. | +| plan | plan | 0/1/0 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:76 | - `tofu plan`: `0 to add, 1 to change, 0 to destroy` -- domain only; the 11 GiB ... | +| plan | plan | 0/1/1 | docs/changelog-20260713-config-xml-path-deleted.md:45 | Plan: 0 to add, 1 to change, 1 to destroy. | +| plan | plan | 5/0/0 | docs/changelog-20260713-d114-voffice1-nested-virt.md:57 | - `tofu plan`: **5 to add, 0 to change, 0 to destroy** -- confirmed BEFORE apply... | +| plan | plan | 11/0/11 | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:94 | Plan: 11 to add, 0 to change, 11 to destroy. | +| plan | plan | 11/0/11 | docs/changelog-20260714-d119-tofu-apply.md:13 | Then a fresh `tofu plan`: **11 to add, 0 to change, 11 to destroy** -- all `must... | +| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:32 | `5 add / 2 in-place / 6 destroy`; the 2 in-place collapse to 0 once the bookend ... | +| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:45 | D-127 implementation updated (IaC layer DONE); readiness-doc plan line updated (... | +| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:52 | - `tofu -chdir=opentofu plan` -> `5 add / 2 in-place / 6 destroy`; no forces-rep... | +| plan | plan | 5/0-or-2/6 | docs/dc0-deploy-readiness.md:167 | 6. Re-run the outer plan; confirm 5-add/(0-or-2)-change/6-destroy-empty (autosta... | +| plan | plan | 5/2/6 | docs/dc0-deploy-readiness.md:37 | `tofu -chdir=opentofu plan` => **5 add / 2 in-place / 6 destroy**, decomposed an... | +| plan | plan | 5/0-or-2/6 | docs/dc0-deploy-readiness.md:48 | > A fresh session MUST re-run the plan and re-confirm 5-add/(0-or-2)-change/6-de... | +| plan | plan | 5/0/6 | docs/dc0-deploy-readiness.md:59 | keeps office1's key); tfvar set. Re-validated + re-planned -> outer plan UNCHANG... | +| plan | plan | 5/2/6 | docs/design-decisions.md:3957 | is a new create with autostart=false baked in. Outer plan is now `5 add / 2 in-p... | +| plan | plan | 5/0/6 | docs/design-decisions.md:4064 | `office1-opnsense` and dirty the imminent DC0 outer plan (5/0/6). Set true only ... | +| plan | plan | 7/2/7 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:14 | Plan: 7 to add, 2 to change, 7 to destroy. | +| plan | plan | 5/2/6 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:17 | **5 add / 2 in-place / 6 destroy**. The delta is NOT in DC0 scope -- it is entir... | +| plan | plan | 5/2/6 | docs/session-ledger.md:156 | in-place, NOT replacement). Outer plan now 5 add / 2 in-place / 6 destroy (colla... | +| plan | plan | 7/2/7 | docs/session-ledger.md:214 | root (read-only plan, **OpenTofu v1.12.4**) returns **7 add / 2 change / 7 destr... | +| plan | plan | 5/2/6 | docs/session-ledger.md:215 | **5 add / 2 in-place / 6 destroy** in `docs/dc0-deploy-readiness.md`. The entire... | +| plan | plan | 5/0/6 | docs/session-ledger.md:278 | Gate before any apply: plan must read EXACTLY 5 add / 0 change / 6 destroy. Noth... | +| plan | plan | 5/0/6 | docs/session-ledger.md:293 | re-plan UNCHANGED (5/0/6). netem RULED = placeholder for the rehearsal. Full rem... | +| plan | plan | 11/0/11 | docs/session-ledger.md:741 | **THE `tofu apply` IS NOT DONE -- IT IS GATED.** Plan: 11 to add, 0 to change, 1... | +| plan | plan | 13/0/0 | runbooks/dc-dc-phase0-vcloud-prep.md:439 | NetBox assigns the supernet). Expect `Plan: 13 to add, 0 to change, 0 to destroy... | +| status | - | CLOSED | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:109 | The narrative ledger must not claim CLOSED what the scan shows OPEN, nor omit wh... | +| status | - | CLOSED | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:127 | report PASS_PENDING_MANUAL while the row is OPEN, PASS only when it is attested ... | +| status (not counted) | - | CLOSED | docs/audit/grounding-audit-charter.md:190 | - **GA-R6: Executable definition of done.** A stage is CLOSED only when a named | +| status (not counted) | - | READY | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | +| status (not counted) | - | BLOCKED | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | +| status (not counted) | - | CLOSED | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | +| status (not counted) | - | COMPLETE | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | +| status (not counted) | - | HELD | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins | +| status | - | HELD | docs/changelog-20260703-process-hardening.md:127 | 403, conductor LIVE args). Missing admin scope = HELD exit 2, never a silent | +| status | - | CLOSED | docs/changelog-20260709-ceph-replication-tooling.md:135 | Tooling gap register item #5's MECHANISM is CLOSED; its DATA half (a real | +| status | - | CLOSED | docs/changelog-20260709-ceph-replication-tooling.md:143 | workflow.md` tooling gap register item #5 updated to CLOSED (mechanism), | +| status | - | CLOSED | docs/changelog-20260709-dc-dc-phase6-runbook.md:66 | item #9 now CLOSED for authoring). Remaining work is the adversarial | +| status | - | CLOSED | docs/changelog-20260709-mtu-ceph-budget-calculators.md:124 | Tooling gap register item #7 CLOSED (mechanism). Both calculators are | +| status | - | CLOSED | docs/changelog-20260709-netbox-dc-dc-pipeline.md:104 | Tooling gap register #3 CLOSED (mechanism). Before a real run: the operator | +| status | - | CLOSED | docs/changelog-20260709-office1-network-edge.md:126 | Tooling gap register items #12 and #16 CLOSED. Gap #17 (NEW) is now the | +| status | - | HELD | docs/changelog-20260710-netbox-roles-aggregates.md:34 | `2602:f3e2::/36` (the HELD allocation = region-0 of the planned `/32`; NOT `/32`... | +| status | - | CLOSED | docs/changelog-20260710-opentofu-state-file-security.md:81 | (this gap, CLOSED) and #19 (a related, still-OPEN gap found in the same | +| status | - | CLOSED | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:68 | CLOSED). | +| status | - | COMPLETE | docs/changelog-20260712-office1-opnsense-edge-build.md:50 | - Edge build COMPLETE except the boot: image, `office1-wan`, creds, config, ISO,... | +| status | - | COMPLETE | docs/changelog-20260713-config-xml-path-deleted.md:1 | # 2026-07-13 -- D-113(a2) COMPLETE: the config.xml path is DELETED | +| status | - | CLOSED | docs/changelog-20260713-workflow-doc-status-correction.md:14 | \| gap #17: "no per-site ISP-uplink network exists anywhere, for ANY site" \| **... | +| status | - | CLOSED | docs/changelog-20260715-d120-load-and-iprange-tooling.md:41 | - **C2 sub-task (ii) CLOSED; C2 fully closed.** office1-netbox now holds the com... | +| status | - | CLOSED | docs/changelog-20260715-d120-load-and-iprange-tooling.md:43 | - **D-120 Step 6 CLOSED** -- the band layout is now recorded in NetBox, no apex ... | +| status | - | COMPLETE | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:35 | C2 redefined: office1-netbox holds the COMPLETE validated dataset (carve + roles... | +| status | - | CLOSED | docs/changelog-20260715-fidelity-check-scope-correctness.md:61 | - **C2 sub-task (i) is CLOSED** -- the sandbox is faithful, established by a che... | +| status | - | HELD | docs/changelog-20260715-stage3-prereqs-prep.md:35 | netem HELD as a comment (Step 11, runtime SSH target + unruled params; the vr1-d... | +| status | - | HELD | docs/changelog-20260715-stage3-prereqs-prep.md:36 | bridge is `virbr7`, measured). **HELD pending D-123:** the `vvr1-dc0` headend + ... | +| status | - | CLOSED | docs/changelog-20260716-review-sweep-phaseAB.md:33 | - **SEC-011:** CLOSED (operator ruling -- keep uniform 6-NIC; A2's Roosevelt-del... | +| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:25 | WAN (bridge-in is single-NAT; RULED, not HELD). [CORRECTED 2026-07-16: an earlie... | +| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:25 | WAN (bridge-in is single-NAT; RULED, not HELD). [CORRECTED 2026-07-16: an earlie... | +| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:47 | (commit `5175365` + OBS-3 RESOLVED-by-D-125 + new HELD gates); `references/platf... | +| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:63 | (No new HELD addressing: the `/24` is the ruled `172.30.2.0/24` and the OPNsense... | +| status | - | COMPLETE | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:29 | ## Block B (D-124 rack transit + rack IP) -- COMPLETE (operator chose: write the... | +| status | - | COMPLETE | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:44 | So the full NetBox D-124/edge-WAN import is COMPLETE in the apex. Copied importe... | +| status | - | CLOSED | docs/clientdocs-workflow-review-20260708.md:77 | no steer away from flannel. CLOSED 2026-07-08 in kubernetes.md + the Jenkins | +| status | - | CLOSED | docs/clientdocs-workflow-review-20260708.md:83 | host" -- the exact failure devteam hit. CLOSED in the Jenkins guide; NOT yet | +| status | - | COMPLETE | docs/dc-dc-deployment-workflow.md:132 | the COMPLETE validated dataset, NOT by any upstream write. See C2 for what "comp... | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:142 | \| C3 \| The `$DC` shell-selector collision resolved. \| **DONE 2026-07-14 (D-11... | +| status | - | COMPLETE | docs/dc-dc-deployment-workflow.md:160 | WRITTEN + RESHAPED to Model B, NOT YET EXECUTED. Authoring for this stage is eff... | +| status | - | HELD | docs/dc-dc-deployment-workflow.md:161 | remains is operator-gated (HELD NetBox addressing) + deploy-time gates. | +| status | - | HELD | docs/dc-dc-deployment-workflow.md:187 | **Blocking to EXECUTE (all operator-gated):** the HELD NetBox addressing -- **D-... | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:344 | 1. **`$DC` selector convention -- CLOSED 2026-07-09 (DOCFIX-151).** | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:438 | 3. **NetBox multi-DC/dual-stack import pipeline -- MECHANISM CLOSED | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:500 | CLOSED 2026-07-09 (DOCFIX-165), data half still open.** `runbooks/dc- | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:526 | 6. **Designate reactivation is a bundle change -- CLOSED 2026-07-10 | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:538 | 7. **MTU/geneve budget + Ceph disk-budget calculators -- CLOSED 2026-07-09 | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:580 | 10. **Harness debt -- LARGELY CLOSED 2026-07-09/10.** This repo's own delivery | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:597 | CLOSED 2026-07-09.** `main.tf` previously wired only `office1_pool_path` | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:643 | 14. **Three real `bundle.yaml` gaps for D-108's DR mechanism -- CLOSED | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:662 | section). **Sub-item 2 (script `$DC`-parameterization) CLOSED | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:682 | CLOSED 2026-07-09.** The topology (buildout design Section 1) is | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:702 | now also CLOSED) -- that gap was the service VMs' own attach point; | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:714 | 17. **PARTIALLY CLOSED 2026-07-13 -- the DECISION is made and PROVEN for | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:716 | - **Office1: CLOSED.** The answer was the one this gap proposed -- a | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:761 | 18. **OpenTofu state file had no documented protection -- CLOSED 2026-07-10 | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:783 | infrastructure itself -- CLOSED 2026-07-10 (DOCFIX-176).** | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:835 | tool -- CLOSED for Office1; DC path templated.** | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:84 | \| **Gate** \| Office1 OPNsense edge up (**MET** -- routing, NAT, egress, Kea DH... | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:845 | **CLOSED for Office1 (D-126 amendment):** `scripts/site-baseleg.sh` + | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:862 | **Status: Office1 CLOSED; DC rows DEFERRED-until-measured (mechanism in place).*... | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:87 | \| **Authoring status** \| **Runbook REWRITTEN 2026-07-13 to the D-114 model: `r... | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:881 | \| Office1-local network (`modules/office1-network`) \| BUILT + INSTANTIATED 202... | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:882 | \| Office1 OPNsense edge ownership \| **BUILT AND LIVE 2026-07-12/13.** `module ... | +| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:885 | \| NetBox DC-DC pipeline (`netbox/dc-dc-prefixes-import.py`) \| MECHANISM BUILT ... | +| status | - | COMPLETE | docs/dc-dc-netbox-buildout-scope.md:288 | IPAM apex) holds the COMPLETE validated dataset AND it is VERIFIED. Two sub-task... | +| status | - | CLOSED | docs/dc-dc-netbox-buildout-scope.md:58 | \| G5 \| **DC naming** \| ~~NetBox = `vr1-dc0`/`vr1-dc1`; tool = DC1/DC2~~ \| **... | +| status | - | HELD | docs/dc0-deploy-readiness.md:100 | ### C6. `vr1-dc1` -- HELD (do not attempt) | +| status | - | CLOSED | docs/dc0-deploy-readiness.md:156 | After this lands the host is on -136 (matching the guests) and the bookend is CL... | +| status | - | HELD | docs/dc0-deploy-readiness.md:6 | and is operator-gated. `vr1-dc1` is HELD (no ruled addressing; see below), DC0 o... | +| status | - | COMPLETE | docs/dc0-deploy-readiness.md:8 | > **STATUS 2026-07-17: PREP COMPLETE -- DC0 IS DEPLOY-READY.** Final gate re-che... | +| status | - | READY | docs/dc0-deploy-readiness.md:8 | > **STATUS 2026-07-17: PREP COMPLETE -- DC0 IS DEPLOY-READY.** Final gate re-che... | +| status | - | CLOSED | docs/design-decisions.md:1061 | ## D-063: RESOLVED / CLOSED (2026-07-03) -- tighten the capi-mgmt-cluster securi... | +| status | - | CLOSED | docs/design-decisions.md:1063 | **Status:** PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... | +| status | - | CLOSED | docs/design-decisions.md:1063 | **Status:** PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... | +| status | - | CLOSED | docs/design-decisions.md:1124 | ### D-063 -- RESOLVED / CLOSED (2026-07-03): applied and functionally verified | +| status | - | CLOSED | docs/design-decisions.md:1172 | **Status:** RESOLVED / CLOSED (applied + functionally verified 2026-07-03). Supe... | +| status | - | CLOSED | docs/design-decisions.md:1411 | ### D-067 -- AMENDMENT (2026-07-02, post-fix): corrected mechanism; FIXED live; ... | +| status | - | CLOSED | docs/design-decisions.md:1449 | **Status:** CLOSED for v1 (fixed + validated live 2026-07-02). **Adds:** BUNDLEF... | +| status | - | CLOSED | docs/design-decisions.md:1536 | FAIL-CLOSED deploy-gate check in `provider-bundle-check.py` (content compare). A... | +| status | - | CLOSED | docs/design-decisions.md:1726 | Operator ruled 2026-07-06: D-050 is CLOSED as resolved by D-051's option (b) -- ... | +| status | - | CLOSED | docs/design-decisions.md:1729 | FAIL-CLOSED zip-vs-yaml drift check in the deploy gate and behavioral acceptance... | +| status | - | CLOSED | docs/design-decisions.md:1811 | therefore CLOSED-except-item-6. The v1-close checklist (handoff section 6) | +| status | - | HELD | docs/design-decisions.md:2148 | - Vault pinned 1.8/stable (the only viable charm lineage for this stack; the 1.1... | +| status | - | CLOSED | docs/design-decisions.md:3512 | uplink, and LAN role are CLOSED by this entry (build `vr1-dc0-wan`, wire the edg... | +| status | - | HELD | docs/design-decisions.md:3568 | HELD until it lands (assigning IPs by guess would violate hard rule 2). Everythi... | +| status | - | HELD | docs/design-decisions.md:3770 | **Addressing: RULED, not HELD (corrected 2026-07-16).** The vcloud ISP `/24` is ... | +| status | - | HELD | docs/design-decisions.md:3773 | `module "vr1_dc0_uplink"` (cidr `172.30.2.0/24`), NOT a NetBox-assigned HELD tfv... | +| status | - | HELD | docs/design-decisions.md:3776 | loaded, D-115-ruled value not invented), and it introduces NO new HELD gate. (An... | +| status | - | HELD | docs/design-decisions.md:3777 | draft of this entry wrongly modeled a `var.vr1_dc0_uplink_cidr` HELD value + an ... | +| status | - | CLOSED | docs/design-decisions.md:730 | The D-042 cosmetic `health_status = UNHEALTHY` false-negative is a property of d... | +| status | - | CLOSED | docs/design-decisions.md:732 | ## D-050: RESOLVED / CLOSED (2026-07-06) -- keystone `use-policyd-override=true`... | +| status | - | CLOSED | docs/design-decisions.md:734 | **Status:** RESOLVED / CLOSED 2026-07-06 (recorded 2026-06-17 as an unruled find... | +| status | - | CLOSED | docs/handoff-20260705-open-items.md:168 | > **Current state:** last ops-update window (ops-update-20260705) is CLOSED; fle... | +| status | - | CLOSED | docs/handoff-20260705-open-items.md:21 | - The last jumphost ops-update window (`ops-update-20260705`) is CLOSED; fleet r... | +| status | - | CLOSED | docs/handoff-20260705-open-items.md:65 | - ~~D-050 / list_trusts hardening~~ RESOLVED: D-050 CLOSED via D-051 (ruling | +| status | - | HELD | docs/model-a-fallback-plan.md:75 | (No HELD gate here: the /24 is a ruled literal, not a tfvar.) | +| status | - | CLOSED | docs/script-quality-findings-20260707.md:133 | direction is CLOSED (safe), but a benign stderr warning on a noisy CLI would | +| status | - | CLOSED | docs/security-ledger.md:22 | \| SEC-011 \| 2026-07-16 \| **Node least-connectivity gap (not an L2 breach).** ... | +| status | - | CLOSED | docs/session-ledger.md:1001 | - **quota-vs-capacity: CLOSED** -- operator ACCEPTS as-documented (no quota trim... | +| status | - | BLOCKED | docs/session-ledger.md:1064 | ## NetBox import -- DONE for Office1; DC import BLOCKED on one operator ruling (... | +| status | - | BLOCKED | docs/session-ledger.md:1088 | ### ~~BLOCKED~~ **UNBLOCKED and DONE** -- D-118 ratified the org ULA; both DCs i... | +| status | - | STOPPED | docs/session-ledger.md:1124 | Using it anyway would violate hard rule 2 (never use an inferred value), so the ... | +| status | - | CLOSED | docs/session-ledger.md:119 | tooling gap is CLOSED (dumper + checker now cover both classes). NO apex write -... | +| status | - | CLOSED | docs/session-ledger.md:12 | This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what... | +| status | - | CLOSED | docs/session-ledger.md:192 | **BOOKEND ITEM (a) CLOSED 2026-07-18 -- MEASURED, and the autostart chain PROVED... | +| status | - | CLOSED | docs/session-ledger.md:20 | session narratives. Those streams are CLOSED and reconciled into the one list be... | +| status | - | BLOCKED | docs/session-ledger.md:212 | **!! DC0 OUTER APPLY IS BLOCKED ON NEW DRIFT -- do NOT apply. See | +| status | - | BLOCKED | docs/session-ledger.md:240 | Options (a)-(d) are in the finding. **DC0 IS NOT BLOCKED on the unresolved provi... | +| status | - | COMPLETE | docs/session-ledger.md:281 | **DC0 DEPLOY READINESS -- PREP COMPLETE 2026-07-17 (deploy-ready). See `docs/dc0... | +| status | - | BLOCKED | docs/session-ledger.md:319 | rack transit/30 + rack IP in office1-netbox, feed the 4 tfvars (tofu plan BLOCKE... | +| status | - | CLOSED | docs/session-ledger.md:374 | - **[R-4] SEC-011 CLOSED (operator ruling 2026-07-16, "Keep uniform 6-NIC").** A... | +| status | - | CLOSED | docs/session-ledger.md:377 | `local.vr1_dc0_node_nics`); amend the SEC-011 ledger row to CLOSED / accepted-no... | +| status | - | COMPLETE | docs/session-ledger.md:423 | items COMPLETE. NOTHING applied/committed since 114d392; Phase C/D edits present... | +| status | - | HELD | docs/session-ledger.md:442 | - **No new HELD gate (CORRECTED 2026-07-16):** the vcloud ISP /24 is the SAME `1... | +| status | - | HELD | docs/session-ledger.md:445 | no re-address. D-125 adds NO NetBox object. (An earlier draft's `vr1_dc0_uplink_... | +| status | - | HELD | docs/session-ledger.md:469 | (operator-ratified 2026-07-16): the vcloud ISP /24 is the ruled `172.30.2.0/24` ... | +| status | - | HELD | docs/session-ledger.md:554 | netem HELD (Step 11; mesh bridge = virbr7 measured), stale `vr1_dc1_planes` comm... | +| status | - | HELD | docs/session-ledger.md:554 | netem HELD (Step 11; mesh bridge = virbr7 measured), stale `vr1_dc1_planes` comm... | +| status | - | READY | docs/session-ledger.md:557 | (172.30.2/3.0/24, role edge, site-scoped), DRY-BY-DEFAULT with whole-plan prefli... | +| status | - | COMPLETE | docs/session-ledger.md:612 | **OFFICE1 IS ESSENTIALLY COMPLETE (2026-07-13).** `office1-netbox` (10.10.1.10) ... | +| status | - | CLOSED | docs/session-ledger.md:627 | 1a. **DONE 2026-07-14 -- Office1's LAN IPv6 is LIVE and PROVEN ON THE WIRE. C1 i... | +| status | - | COMPLETE | docs/session-ledger.md:687 | runbook, and **ensure `office1-netbox` holds the COMPLETE validated dataset** (c... | +| status | - | CLOSED | docs/session-ledger.md:699 | **C2 sub-task (ii) DONE 2026-07-15 -> C2 FULLY CLOSED -> STAGE 2 CLOSE-OUT COMPL... | +| status | - | COMPLETE | docs/session-ledger.md:699 | **C2 sub-task (ii) DONE 2026-07-15 -> C2 FULLY CLOSED -> STAGE 2 CLOSE-OUT COMPL... | +| status | - | CLOSED | docs/session-ledger.md:704 | delta (D-115/D-117/D-118/D-120)." Gauntlet ALL GREEN (60). D-120 Step 6 CLOSED (... | +| status | - | CLOSED | docs/session-ledger.md:707 | 3. **`pynetbox` -- CLOSED 2026-07-13.** Installed (7.0.0) on `office1-netbox`, w... | +| status | - | CLOSED | docs/session-ledger.md:713 | 4. **The apparmor rule is now IN THE REPO -- CLOSED 2026-07-13.** | +| status | - | CLOSED | docs/session-ledger.md:721 | 5. **The DEFERRED literals are now ALL ASSIGNED -- item CLOSED 2026-07-14.** The... | +| status | - | CLOSED | docs/session-ledger.md:730 | 6. **D-119 (ADOPTED 2026-07-14) -- THE DC NAMESPACE IS REGION-QUALIFIED. C3/gap ... | +| status | - | CLOSED | docs/session-ledger.md:747 | 6a. **(historical) G5 NetBox site rename -- CLOSED as D-117 (ADOPTED, Option B).... | +| status | - | CLOSED | docs/session-ledger.md:755 | G2 (aggregates) and G3 (ULA /48) are both CLOSED by the same work. | +| status | - | CLOSED | docs/session-ledger.md:761 | 9. **DHCP PROVEN END TO END -- CLOSED 2026-07-13.** `voffice1` (the first client... | +| status | - | CLOSED | docs/session-ledger.md:776 | **VCLOUD POST-RESTART SWEEP + D-126 BASE-LEG + D-128 OPERATING MODEL (2026-07-17... | +| status | - | CLOSED | docs/session-ledger.md:78 | - **VR0 / DC0 testcloud:** fleet fully current (juju 3.6.25, 91 agents); D-011 C... | +| status | - | CLOSED | docs/session-ledger.md:795 | item **20** CLOSED for Office1 + the skill's per-DC discipline). Gauntlet ALL GR... | +| status | - | CLOSED | docs/session-ledger.md:81 | - **STAGE 2 CLOSED AND MERGED (2026-07-15).** All close-out gates C1..C5 met; br... | +| status | - | HELD | docs/session-ledger.md:905 | offboard) are HELD** by the operator until the DOCFIX-126/127 live-verify lands. | +| status | - | CLOSED | docs/session-ledger.md:913 | PROPOSED/OPEN. D-063 is `RESOLVED / CLOSED` in `design-decisions.md` (verified).... | +| status | - | HELD | docs/stage3-adversarial-review-20260716.md:319 | \| **L5** (exit gate "conditionally met at best") \| **CONFIRMED -- still condit... | +| status | - | BLOCKED | docs/stage3-adversarial-review-20260716.md:319 | \| **L5** (exit gate "conditionally met at best") \| **CONFIRMED -- still condit... | +| status | - | BLOCKED | docs/stage3-adversarial-review-20260716.md:61 | \| L1-07 \| `tofu plan`: **BLOCKED** -- 4 required vars unset/no-default (`vr1_d... | +| status | - | HELD | docs/stage3-review-base.patch:1415 | +# netem (runbook Step 11) -- HELD as a comment. It is a POST-apply step that ru... | +| status | - | HELD | docs/stage3-review-base.patch:163 | + netem HELD as a comment (Step 11, runtime SSH target + unruled params; the vr... | +| status | - | HELD | docs/stage3-review-base.patch:164 | + bridge is `virbr7`, measured). **HELD pending D-123:** the `vvr1-dc0` headend... | +| status | - | BLOCKED | docs/stage3-review-base.patch:2063 | + scope is BLOCKED and this pass's real reach is Steps 1-8 (see the GATE | +| status | - | CLOSED | docs/stage3-review-base.patch:537 | +uplink, and LAN role are CLOSED by this entry (build `vr1-dc0-wan`, wire the ed... | +| status | - | HELD | docs/stage3-review-base.patch:564 | +HELD until it lands (assigning IPs by guess would violate hard rule 2). Everyth... | +| status | - | HELD | docs/stage3-review-base.patch:687 | + HELD until it lands.) | +| status | - | HELD | docs/stage3-review-base.patch:763 | + netem HELD (Step 11; mesh bridge = virbr7 measured), stale `vr1_dc1_planes`... | +| status | - | HELD | docs/stage3-review-base.patch:763 | + netem HELD (Step 11; mesh bridge = virbr7 measured), stale `vr1_dc1_planes`... | +| status | - | READY | docs/stage3-review-base.patch:766 | + (172.30.2/3.0/24, role edge, site-scoped), DRY-BY-DEFAULT with whole-plan p... | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:1365 | ## 2026-07-02 (session 2) -- D-067 FIXED live + CLOSED; root cause corrected to ... | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:1564 | First live run of d063-apply.sh --audit failed CLOSED at exit 20 with zero mutat... | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:1585 | ### 2026-07-03 (addendum 7) -- D-063 RESOLVED/CLOSED: applied + functionally ver... | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:1667 | row in docs/security-ledger.md. OPEN/PENDING -> PASS_PENDING_MANUAL(3); CLOSED/R... | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:1704 | D-063 header/first-status reconciled to RESOLVED/CLOSED (the closure had been ap... | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:1758 | gauntlet 31. The full-d011 profile is now COMPLETE (all six items exist). REQUIR... | +| status | - | HELD | docs/v1-redeploy-changelog.md:1873 | re-gate on a true PASS) -- the update window is HELD at Section 1.4 until this l... | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:1924 | ### 2026-07-05 (addendum 16, jumphost stream) -- ops-update-20260705 WINDOW CLOS... | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:1929 | WINDOW RESULT: COMPLETE, all gates green. Controller 3.6.24 -> 3.6.25 (single, | +| status | - | HELD | docs/v1-redeploy-changelog.md:1945 | EXCLUSIONS HELD: vault untouched (1.8/stable rev 372; its in-channel 372->714 | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:2023 | DOCFIX-089: phase-03 3.3 https/cookie check rewritten FAIL-CLOSED (transport, HT... | +| status | - | HELD | docs/v1-redeploy-changelog.md:2257 | probe.** First live run HELD on the queued VERIFY-LIVE item: admin-side | +| status | - | HELD | docs/v1-redeploy-changelog.md:2271 | half correctly self-HELD (headroom UNKNOWN, fail-closed as designed) on the | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:2308 | DOCFIX candidate, not actioned. (2) barbican host_href observation CLOSED | +| status | - | HELD | docs/v1-redeploy-changelog.md:2327 | devteam PINNED next (onboarding HELD on operator snapshot ruling). | +| status | - | HELD | docs/v1-redeploy-changelog.md:2346 | 1 DRIFT / 2 HELD. Harness 10/10 (mock leader deliberately keystone/1; ssh | +| status | - | HELD | docs/v1-redeploy-changelog.md:2378 | instantiation = devteam tenant (HELD on snapshot). Intake questions for the | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:2463 | the capi-mgmt net (resolved live by stable name, FAIL-CLOSED on lookup | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:2499 | ### 2026-07-06 (addendum 30, jumphost stream) -- client handover package COMPLET... | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:2638 | found-not-fixed since addendum 28, now CLOSED); (d) LB-gone wait counts | +| status | - | HELD | docs/v1-redeploy-changelog.md:2700 | of intake answers (pack instantiation HELD on them); capi-test-1 | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:2842 | 5.3 FAILS-as-anticipated, CLOSED via its own CLI-path clause (API | +| status | - | BLOCKED | docs/v1-redeploy-changelog.md:2946 | -- BLOCKED on the cross-stream ruling that its resize-acceptance role | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:298 | - **DOCFIX-040 COMPLETE.** `pre-flight-checks.sh` and `osd-blank-check.sh` both ... | +| status | - | HELD | docs/v1-redeploy-changelog.md:3001 | - **HELD for operator (morning):** the broad ease-of-use review across ALL | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:318 | ## Phase-02 vault bring-up (as-executed -- COMPLETE 2026-06-27) | +| status | - | CLOSED | docs/v1-redeploy-changelog.md:477 | principals -- reconciles with the handoff's original 31. **PHASE-02 EXIT GATE CL... | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:487 | PHASE-02 COMPLETE -- discrete vault mutations done. Cascade-settle + the post-in... | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:661 | ### Phase-04 EXECUTED -- network carve COMPLETE (2026-06-27) | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:739 | ### Step 5.1 EXECUTED -- configure-resources COMPLETE (2026-06-27) | +| status | - | COMPLETE | docs/v1-redeploy-changelog.md:747 | ### Step 5.2 EXECUTED -- amphora pipeline COMPLETE; PHASE-05 EXIT GATE MET (2026... | +| status | - | BLOCKED | docs/v1-redeploy-changelog.md:932 | ### Phase-06 6.3 BLOCKED -- provider FIP range dark cloud-wide; root-caused as D... | +| status | - | BLOCKED | docs/v1-redeploy-changelog.md:983 | Supersedes the framing of the 2026-06-27 "Phase-06 6.3 BLOCKED ... D-057" entry | +| status (not counted) | - | CLOSED | memory/project-posture-closed-test.md:10 | VR1 (the DC-DC buildout) is a CLOSED IN-HOUSE TEST cloud, not a live/shared/prod... | +| status | - | BLOCKED | runbooks/appendix-A-troubleshooting.md:329 | - Symptom: after authorize-charm, vault stays BLOCKED "Missing CA cert". | +| status | - | HELD | runbooks/d011-batch3-window-DRAFT.md:9 | - Section 3: first --include-disruptive run self-HELD (headroom UNKNOWN) on | +| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:100 | ISP uplink -- gap #17 CLOSED for Office1), and the `dc1`/`office1`/`dc2` | +| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:144 | CLOSED.** The old fork ("OpenTofu `cloudinit-vm`, blocked pending user_data | +| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:167 | 4. **GitBucket: CLOSED, NOT DEFERRED (D-116).** There is NO Office1-local GitBuc... | +| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:308 | CLOSED for Office1 via the dedicated `office1-wan` ISP-uplink network. DC1/DC2 | +| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:834 | - **Office1-local + office1-wan networks created:** **MET** (gaps #12 and #17-fo... | +| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:901 | gap #12 CLOSED). | +| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:902 | - [x] Office1 OPNsense edge RESOLVED and BUILT 2026-07-12/13 (gap #16 CLOSED for | +| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:903 | ownership; gap #17 CLOSED for Office1 via `office1-wan`). | +| status | - | HELD | runbooks/dc-dc-phase2-tofu-dc-substrate.md:192 | ruled for vr1-dc0's edge WAN -- a ruled literal, NOT a HELD tfvar; no new NetBox... | +| status | - | BLOCKED | runbooks/dc-dc-phase2-tofu-dc-substrate.md:294 | scope is BLOCKED and this pass's real reach is Steps 1-8 (see the GATE | +| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:334 | **The script now accepts a `$DC` env var (gap #2's CLI half CLOSED | +| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:436 | **Gap #2's CLI half is CLOSED (2026-07-10, DOCFIX-166):** the script now | +| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:530 | - [x] Gap #2's CLI half CLOSED 2026-07-10 (DOCFIX-166): | +| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:72 | 2. **CLOSED 2026-07-10 (DOCFIX-166), CLI half only.** | +| status | - | BLOCKED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:162 | - **DC2:** BLOCKED until its VIP band exists (see above). Once NetBox | +| status | - | CLOSED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:20 | selector convention, CLOSED 2026-07-09 DOCFIX-151 -- this is the stage that | +| status | - | BLOCKED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:64 | bundle deploy is BLOCKED on this** -- you cannot pick DC2's VIP band, the | +| status | - | CLOSED | runbooks/dc-dc-phase6-designate-cos-magnum.md:244 | **This step is CLOSED, not a template anymore.** `bundle.yaml` now carries | +| status | - | CLOSED | runbooks/dc-dc-phase6-designate-cos-magnum.md:630 | cert) is CLOSED for this DC. | +| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:211 | * vault/0 BLOCKED "Vault needs to be initialized" (the phase-02 trigger, not a f... | +| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:214 | * octavia BLOCKED "Awaiting configure-resources" (D-021); gss unknown (pre-run). | +| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:224 | * magnum/0 BLOCKED "Ports which should be open, but are not: 9501" -- pre-vault ... | +| status | - | BLOCKED | runbooks/phase-02-vault-bringup.md:26 | - vault/0 sits BLOCKED needing initialization (a fresh, uninitialized vault). | +| status | - | BLOCKED | runbooks/phase-03-core-verify.md:7 | Decisions: B5 (IP-only endpoints; no FQDN), D-021 (octavia stays BLOCKED awaitin... | +| status | - | BLOCKED | runbooks/phase-03-core-verify.md:72 | **GATE:** expected non-active/idle = **1** (octavia/0 BLOCKED "Awaiting configur... | +| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:23 | is satisfied. octavia/0 sits BLOCKED "Awaiting ... configure-resources" (the | +| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:3 | Bring Octavia from its post-deploy BLOCKED state to fully enabled: run the | +| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:62 | juju status octavia -m openstack \| grep -E 'octavia/0' \|\| true # expect BLO... | +| status | stage-0 | CLOSED | docs/dc-dc-deployment-workflow.md:873 | \| Stage 0-7 runbooks \| Stage 0 DONE (ratification). **Stages 1-7 ALL WRITTEN 2... | +| status | stage-1 | COMPLETE | docs/changelog-20260709-office1-network-edge.md:42 | Stage 1/2 runbooks) implicitly assume that command is a COMPLETE inventory | +| status | stage-1 | CLOSED | docs/dc-dc-deployment-workflow.md:570 | 9. **Runbook debt -- CLOSED 2026-07-09.** All seven Stage 1-7 runbooks are now | +| status | stage-1 | CLOSED | docs/security-ledger.md:20 | \| SEC-009 \| 2026-07-15 \| Credential/env SPRAWL + world-readable exposure on v... | +| status | stage-1 | COMPLETE | docs/session-ledger.md:91 | VR1 Stage 1 COMPLETE; Stage 2 was in CLOSE-OUT -- now superseded by the merge ab... | +| status | stage-1 | CLOSED | docs/stage3-review-base.patch:658 | \| SEC-009 \| 2026-07-15 \| Credential/env SPRAWL + world-readable exposure on v... | +| status | stage-2 | COMPLETE | docs/changelog-20260715-d120-load-and-iprange-tooling.md:45 | - Stage 2 close-out (C1..C5) is COMPLETE -> the branch->main merge point is reac... | +| status | stage-2 | COMPLETE | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (... | +| status | stage-2 | CLOSED | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (... | +| status | stage-2 | CLOSED | docs/dc-dc-deployment-workflow.md:384 | which is what forced Stage 2's old Option A / Option B fork -- is **CLOSED | +| status | stage-3 | BLOCKED | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:3 | Closes the collision that BLOCKED Stage 3. **D-119 COMPLETES D-117; it does not ... | +| status | stage-3 | HELD | docs/session-ledger.md:205 | `docs/dc-dc-deployment-workflow.md`'s Stage 3 section still reads "**Blocking to... | +| status | stage-4 | CLOSED | docs/dc-dc-deployment-workflow.md:884 | \| `lib-net.sh` / `lib-hosts.sh` \| `$DC` selector mechanism ADDED 2026-07-09 (D... | +| status | stage-4 | HELD | docs/session-ledger.md:51 | Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned... | +| status | stage-5 | BLOCKED | docs/changelog-20260709-dc-selector-convention.md:5 | which explicitly BLOCKED the Stage 5 "high reuse" claim (`phase-01..08` | +| status | stage-5 | CLOSED | docs/changelog-20260709-dc-selector-convention.md:72 | Tooling gap register item #1 CLOSED. Stage 5's runbook (Juju controller + | +| version | juju | 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki | +| version | juju | 3.6 | docs/design-decisions.md:1611 | policy for either: (a) the Juju controller/agents (patch releases on the 3.6 tra... | +| version | juju | 3.6 | docs/design-decisions.md:1632 | The testcloud controller is SINGLE (non-HA) and Juju 3.6 ships no supported cont... | +| version | juju | 3.6 | docs/design-decisions.md:1677 | ## D-071 -- AMENDMENT (2026-07-05): controller backup EXISTS on juju 3.6; risk s... | +| version | juju | 3.6 | docs/design-decisions.md:1680 | premise "no supported backup in Juju 3.6": `juju create-backup` / `download-back... | +| version | juju | 2.1 | docs/design-decisions.md:1684 | (committed pre-change BOM), a fresh `juju create-backup` archive (now the STANDA... | +| version | juju | 3.6 | docs/design-decisions.md:2043 | - Single-unit (not HA) for VR1, with the confirmed backup posture (juju 3.6 `cre... | +| version | juju | 3.6 | docs/design-decisions.md:994 | `remove-machine` option. Juju 3.6 `remove-machine` reference: a machine can be r... | +| version | juju | 3.6.25 | docs/handoff-20260705-open-items.md:169 | > juju 3.6.25. Vault is `1.8/stable` rev 714 (current in-channel). | +| version | juju | 3.6.25 | docs/handoff-20260705-open-items.md:22 | in-channel revisions; controllers/agents at juju 3.6.25; appendix-B re-baselined... | +| version | juju | 3.6 | docs/handoff-20260705-open-items.md:59 | Backups are confirmed to exist (juju 3.6 `create-backup`); the open half is sing... | +| version | juju | 3.6.25 | docs/session-ledger.md:78 | - **VR0 / DC0 testcloud:** fleet fully current (juju 3.6.25, 91 agents); D-011 C... | +| version | juju | 3.6 | docs/session-ledger.md:989 | `download-backup` DO exist on juju 3.6 -- the original "removed in 3.0" premise ... | +| version | juju | 3.6 | docs/upstream-bug-draft-dashboard-tls.md:14 | Reactive charm generation; juju 3.6. | +| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1819 | explicit Risk section: single non-HA controller, no supported backup in Juju 3.6... | +| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped `juju status keystone --format=line`, and juju 3.6 line format omits wor... | +| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped `juju status keystone --format=line`, and juju 3.6 line format omits wor... | +| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1953 | `juju-status` (units do NOT carry `agent-status.version` on juju 3.6); 2.1 | +| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1954 | REWRITTEN -- `juju create-backup` EXISTS on 3.6 and is now the STANDARD gated | +| version | juju | 2.1 | docs/v1-redeploy-changelog.md:424 | Vault's own status agrees with the Juju workload-status. Cleared for 2.1b (vault... | +| version | juju | 3.6 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:289 | Per D-104: scheduled controller backups, confirmed backup posture (juju 3.6 | +| version | juju | 2024.1 | runbooks/dc-dc-phase5-dr-failover-drill.md:153 | juju deploy cinder-backup --channel 2024.1/stable --to lxd:<UNIT_NUMBER_TBD> | +| version | juju | 3.6 | runbooks/dc-dc-phase5-dr-failover-drill.md:448 | against this controller's actual installed juju client (3.6 per D-104) before ru... | +| version | juju | 3.6 | runbooks/ops-update-procedure.md:158 | on juju 3.6 (the "removed in 3.0" authoring assumption was wrong for this | +| version | juju | 3.6 | runbooks/ops-update-procedure.md:8 | controller backup EXISTS on juju 3.6). | +| version | juju | 3.1 | runbooks/phase-03-core-verify.md:10 | backends confirmed LOADED via a functional sweep, NOT juju status; Step 3.1). Tr... | +| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/SKILL.md:100 | \| Creating/changing a `libvirt_domain`; anything about nested KVM, a libvirt st... | +| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | `v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk | +| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud | +| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... | +| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... | +| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) | +| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:247 | Canonical's own announcement: LXD 6.7 "consolidates some API endpoints" that | +| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:249 | not yet in a MAAS release). Verbatim guidance: "We recommend using LXD <=6.6 | +| version | lxd | 5.21.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:253 | VR0 runs LXD **5.21.4** and is therefore safe by accident of timing; D-114 | +| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:254 | makes it a decision. **LXD 5.21 LTS is supported to June 2029** | +| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed ... | +| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed ... | +| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed ... | +| version | lxd | 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 pro... | +| version | lxd | 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \|- voffice1 (L2) MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea r... | +| version | lxd | 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:6 | **LXD 5.21.5** are installed on it, that LXD is **registered back into MAAS as a... | +| version | lxd | 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:62 | 3. **LXD snap track changes are ONE-WAY.** LXD must be installed DIRECTLY onto `... | +| version | lxd | 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on `latest` first, because MAAS 3.6/3.7 is incompatible wi... | +| version | lxd | 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:64 | (pinned pylxd 2.3.5 vs LXD 6.7's consolidated endpoints). Bonus discovered in re... | +| version | lxd | 5.21.5 | docs/dc-dc-deployment-workflow.md:114 | - **DONE (site) -- D-114 IS PROVEN END TO END:** MAAS 3.7.2 region+rack ON `voff... | +| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:65 | > LXD (pinned to the 5.21 LTS track) runs ON it**, that LXD is **registered BACK... | +| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:84 | \| **Gate** \| Office1 OPNsense edge up (**MET** -- routing, NAT, egress, Kea DH... | +| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:85 | \| **Owns** \| **D-114** (site containment VM + MAAS-composed LXD VMs, incl. the... | +| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:85 | \| **Owns** \| **D-114** (site containment VM + MAAS-composed LXD VMs, incl. the... | +| version | lxd | 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \| **Reuse vs new** \| NEW infra (Office1 didn't exist for VR0 DC0), but LESS ne... | +| version | lxd | 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \| **Reuse vs new** \| NEW infra (Office1 didn't exist for VR0 DC0), but LESS ne... | +| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:874 | \| **D-114 site containment VM (`voffice1`)** \| **BUILT + RUNNING 2026-07-13.**... | +| version | lxd | 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project `default`,... | +| version | lxd | 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project `default`,... | +| version | lxd | 5.21 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE... | +| version | lxd | 6.7 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE... | +| version | lxd | 6.7 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to... | +| version | lxd | 6.6 | docs/design-decisions.md:2593 | pylxd >= 2.3.9, not yet in a MAAS release). Canonical's own guidance is "use LXD... | +| version | lxd | 5.21.5 | docs/session-ledger.md:603 | and **LXD 5.21.5**, with that LXD **registered into MAAS as an LXD VM host**. MA... | +| version | lxd | 5.21 | docs/stage3-review-base.patch:2859 | + # createadmin/apikey/login, LXD (5.21 pin), LXD vm-host registration, compose... | +| version | lxd | 5.21.5 | docs/vr1-office1-as-built.md:43 | \| **voffice1** \| `10.10.0.20` (Kea reservation) \| **MAAS 3.7.2** region+rack ... | +| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:116 | REGION CONTROLLER runs ON it. LXD (5.21 LTS) also runs ON it, and that LXD is | +| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:186 | D-114's hard LXD 5.21-LTS-track constraint, which IS decided). Each install | +| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:46 | including the LXD 5.21 LTS pin), **D-103** as AMENDED by D-114 (OpenTofu owns | +| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:488 | ssh <voffice1> 'sudo snap install lxd --channel=5.21/stable' | +| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:491 | cannot talk to LXD >= 6.7 (pylxd 2.3.5 vs LXD's consolidated API endpoints). | +| version | lxd | 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project `default`, LXD 5.21.4. | +| version | lxd | 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project `default`, LXD 5.21.4. | +| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the **5.21 LTS track** (D-114). MAAS 3.6/3.7 is | +| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's | +| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's | +| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:887 | - [ ] `runbooks/appendix-B-asbuilt-version-lock.md` updated with the LXD 5.21-LT... | +| version | maas | 3.7.2 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki | +| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | `v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk | +| version | maas | 2.7.2 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:82 | ### `canonical/maas` (pinned `2.7.2`, confirmed 2026-07-09) | +| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... | +| version | maas | 3.7.2 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \| MAAS \| 3.7.2 (VR0) \| the LXD ceiling above is a property of MAAS 3.6/3.7 \| | +| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \| MAAS \| 3.7.2 (VR0) \| the LXD ceiling above is a property of MAAS 3.6/3.7 \| | +| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) | +| version | maas | 2.3.5 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:248 | MAAS's pinned **pylxd 2.3.5** cannot speak to (fixed in **pylxd >= 2.3.9**, | +| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed ... | +| version | maas | 10.12.8 | docs/D-058-renumber.md:67 | - scripts/phase-00-maas-carve.sh (METAL_CIDR default 10.12.8 -> 10.12.12; rang... | +| version | maas | 2.7.2 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:54 | hashes: `dmacvicar/libvirt` 0.9.8, `canonical/maas` 2.7.2). | +| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 pro... | +| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \|- voffice1 (L2) MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea r... | +| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:5 | `voffice1` is a working VR1 site headend. **MAAS 3.7.2** (region+rack, PostgreSQ... | +| version | maas | 3.6 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on `latest` first, because MAAS 3.6/3.7 is incompatible wi... | +| version | maas | 3.7 | docs/changelog-20260716-d124-rack-addressing.md:39 | (D-123): disable timesyncd -> install the `maas` snap (3.7/stable) -> `maas init... | +| version | maas | 3.7.2 | docs/dc-dc-deployment-workflow.md:114 | - **DONE (site) -- D-114 IS PROVEN END TO END:** MAAS 3.7.2 region+rack ON `voff... | +| version | maas | 3.7.2 | docs/design-decisions.md:2553 | **Measured as-built evidence (VR0 / `openstack-caracal-ipv4` MAAS 3.7.2, operato... | +| version | maas | 3.6 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE... | +| version | maas | 2.3.5 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to... | +| version | maas | 3.7.2 | docs/maas-as-built-reference.md:169 | - MAAS 3.7.2; controller `maas.maas`, Region+Rack, Non-HA(3 VLANs). | +| version | maas | 3.7.2 | docs/session-ledger.md:602 | the pool), egress through the OPNsense edge. On it: **MAAS 3.7.2** region+rack (... | +| version | maas | 3.7 | docs/stage3-review-base.patch:261 | +(D-123): disable timesyncd -> install the `maas` snap (3.7/stable) -> `maas ini... | +| version | maas | 3.7 | docs/stage3-review-base.patch:2786 | MAAS_CHANNEL="3.7/stable" | +| version | maas | 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): | +| version | maas | 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): | +| version | maas | 3.7.2 | docs/vr1-office1-as-built.md:43 | \| **voffice1** \| `10.10.0.20` (Kea reservation) \| **MAAS 3.7.2** region+rack ... | +| version | maas | 2.7.2 | runbooks/dc-dc-phase0-vcloud-prep.md:339 | fetch `dmacvicar/libvirt` 0.9.8 and `canonical/maas` 2.7.2) | +| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:442 | ssh <voffice1> 'sudo snap install maas --channel=<PENDING VERIFICATION: the curr... | +| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:490 | The `5.21` track is a HARD D-114 constraint, not a preference: MAAS 3.6/3.7 | +| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the **5.21 LTS track** (D-114). MAAS 3.6/3.7 is | +| version | netbox | 4.6.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:453 | **Note:** this is an UPSTREAM-only trap so far. The Office1 sandbox NetBox (4.6.... | +| version | netbox | 4.5.8 | docs/changelog-20260710-netbox-roles-aggregates.md:42 | Script previewed (read-only) against live NetBox 4.5.8: correctly reports 12 obj... | +| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Offi... | +| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Offi... | +| version | netbox | 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:25 | ### 2. NetBox 4.6 v2 API tokens: the wire format is `nbt_<key>.<plaintext>` -- N... | +| version | netbox | 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:29 | NetBox 4.6 **hashes** API tokens. The `Token` model has `key` (a 12-char PREFIX)... | +| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:6 | laid down by MAAS) and runs **NetBox 4.6.4** (netbox-docker, Django 6.0.6). Its ... | +| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:74 | - NetBox **4.6.4** on Django 6.0.6, containers `netbox` + `netbox-worker` + `pos... | +| version | netbox | 10.1 | docs/changelog-20260716-d124-addressing-pin.md:21 | - **`netbox/dc-rack-mgmt-import.py`:** `CONTAINER = "10.12.0.0/16"` -> **`"172.3... | +| version | netbox | 172.31 | docs/changelog-20260716-d124-addressing-pin.md:44 | python3 netbox/dc-rack-mgmt-import.py --transit-cidr 172.31.0.0/30 --rack-ip 10.... | +| version | netbox | 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited ... | +| version | netbox | 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited ... | +| version | netbox | 4.6.4 | docs/dc-dc-deployment-workflow.md:116 | machines **COMPOSED BY MAAS** and deployed -- `office1-netbox` (10.10.1.10, NetB... | +| version | netbox | 4.6.4 | docs/dc-dc-netbox-buildout-scope.md:198 | (`10.10.1.10:8000`, NetBox 4.6.4 on the Office1 VM, `docs/changelog-20260713-off... | +| version | netbox | 4.5.8 | docs/dc-dc-netbox-buildout-scope.md:45 | `netbox.baldurkeep.com` v4.5.8. Regions: US West -> Eugene (prod); **Virtual Reg... | +| version | netbox | 4.5.8 | docs/design-decisions.md:2893 | **The collision, measured live against `netbox.baldurkeep.com` (4.5.8) on 2026-0... | +| version | netbox | 4.6 | docs/stage3-review-base.patch:1120 | + die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v... | +| version | netbox | 4.6 | docs/stage3-review-base.patch:897 | + die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v... | +| version | netbox | 4.6 | docs/vr1-office1-as-built.md:141 | **NetBox API token format (4.6):** the wire form is `nbt_<key>.<plaintext>`. The... | +| version | netbox | 4.6 | docs/vr1-office1-as-built.md:44 | \| **office1-netbox** \| `10.10.1.10` \| **NetBox 4.6** (netbox-docker; `/opt/ne... | +| version | netbox | 4.6 | runbooks/dc-dc-phase1-office1-standup.md:725 | --draft draft/vr1-draft.json`. It STRUCTURALLY cannot reach upstream. NetBox 4.6 | +| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud | +| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:130 | https://docs.opnsense.org/releases/CE_26.1.html | +| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:22 | \| OPNsense \| 26.1 "Witty Woodpecker" \| ISC-DHCP left core in 26.1 -- Kea/dnsm... | +| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:322 | ## 4. OPNsense 26.1 edge | +| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:351 | https://docs.opnsense.org/releases/CE_26.1.html | +| version | opnsense | 26.1 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:108 | **sizing** question, not a regression of this fix -- check OPNsense 26.1's docum... | +| version | opnsense | 26.1 | docs/changelog-20260712-office1-opnsense-edge-build.md:33 | (`opnsense-26.1-nano.qcow2`), so there is no target-path collision. Same conclus... | +| version | opnsense | 26.1 | docs/changelog-20260712-opnsense-prep-bz2-fallback.md:15 | `opnsense-26.1-nano.qcow2` (qcow2, 11 GiB virtual) via the python path. | +| version | opnsense | 26.1 | docs/changelog-20260713-opnsense-api-proven.md:24 | GET core/firmware/status -> HTTP 200, OPNsense 26.1 (auth works) | +| version | opnsense | 26.1 | docs/changelog-20260713-opnsense-api-proven.md:8 | An API key was minted for `root` in the GUI. In OPNsense **26.1** this is NOT in... | +| version | opnsense | 26.1 | docs/changelog-20260714-opnsense-set-interface-v6.md:10 | among the API-covered surfaces. **Measured on the live Office1 edge (OPNsense 26... | +| version | opnsense | 26.1 | docs/design-decisions.md:2498 | **MEASURED on the live Office1 edge (2026-07-14), OPNsense 26.1:** | +| version | opnsense | 26.7 | docs/design-decisions.md:4074 | **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock... | +| version | opnsense | 26.7 | docs/design-decisions.md:4074 | **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock... | +| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense **26.1 nano** amd64 (`scripts/opnsense-prep-image.sh 26.1`), p... | +| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense **26.1 nano** amd64 (`scripts/opnsense-prep-image.sh 26.1`), p... | +| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:60 | `/var/lib/libvirt/vr1/office1/opnsense-26.1-nano.qcow2` (11 GiB virtual). | +| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:92 | the real fix, check OPNsense 26.1's documented minimum before picking a number. | +| version | opnsense | 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | **Subject.** `office1-opnsense`, **OPNsense 26.7** (amd64), reviewed for plugin/... | +| version | opnsense | 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | **Subject.** `office1-opnsense`, **OPNsense 26.7** (amd64), reviewed for plugin/... | +| version | opnsense | 14.3 | docs/session-ledger.md:189 | security pkgs) THEN reboot; (b) office1-opnsense itself is still on 14.3-RELEASE... | +| version | opnsense | 26.1 | docs/session-ledger.md:649 | CANNOT be done via the REST API. Measured on the live edge (OPNsense 26.1): `Int... | +| version | opnsense | 26.7 | docs/session-ledger.md:830 | **OPNsense EDGE 26.7 UPDATE + PLUGIN/ADD-ON REVIEW (2026-07-18).** Operator upda... | +| version | opnsense | 26.1 | docs/stage3-review-base.patch:1373 | + base_volume_path = "/var/lib/libvirt/vr1/vr1-dc0/opnsense-26.1-nano.qcow2" | +| version | opnsense | 26.7 | docs/vr1-office1-as-built.md:42 | \| **office1-opnsense** \| LAN `10.10.0.1` / WAN `172.30.1.2` \| **OPNsense 26.7... | +| version | tofu | 0.9.8 | .claude/skills/openstack-cloud-ops/references/environment.md:33 | libvirt/KVM via the `dmacvicar/libvirt` OpenTofu provider `0.9.8` on OpenTofu | +| version | tofu | 1.12.3 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:19 | \| OpenTofu \| `v1.12.3` (as-run) \| the binary that actually executed Stage 1 \... | +| version (not counted) | tofu | 1.12.3 | docs/audit/grounding-audit-charter.md:25 | 2026-07-18 session's own findings). README pins tofu 1.12.3; the binary is 1.12.... | +| version | tofu | 1.12.3 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:4 | binary (OpenTofu v1.12.3), on the vcloud host, executing | +| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** | +| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** | +| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** | +| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:42 | `bash scripts/prereqs/install-opentofu.sh` pointer + the >=1.6.0 floor. | +| version | tofu | 1.12.3 | docs/changelog-20260713-docfix194-opentofu-module-validation.md:19 | This was only findable because a `tofu` binary now exists on the jumphost (OpenT... | +| version | tofu | 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \| gap #2: "UNVALIDATED -- no `tofu` binary available" \| **OpenTofu v1.12.3 IS ... | +| version | tofu | 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \| gap #2: "UNVALIDATED -- no `tofu` binary available" \| **OpenTofu v1.12.3 IS ... | +| version | tofu | 1.1 | docs/dc-dc-deployment-workflow.md:360 | - **A `tofu` binary EXISTS on the jumphost: OpenTofu v1.12.3.** The tree can | +| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:360 | - **A `tofu` binary EXISTS on the jumphost: OpenTofu v1.12.3.** The tree can | +| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:47 | infrastructure; vcloud host, OpenTofu v1.12.3). As-built: nested KVM already-on; | +| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:875 | \| `opentofu/` (networks/pools/node-VM PXE/cloud-init-VM patterns) \| **VALIDATE... | +| version | tofu | 1.12.3 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:27 | > **The OpenTofu 1.12.3 -> 1.12.4 bump is COINCIDENTAL, not causal.** The binary... | +| version | tofu | 1.12.4 | docs/session-ledger.md:214 | root (read-only plan, **OpenTofu v1.12.4**) returns **7 add / 2 change / 7 destr... | +| version | tofu | 1.12.4 | docs/session-ledger.md:260 | **Version drift to log:** OpenTofu on the jumphost is now **v1.12.4**; `README.m... | +| version | tofu | 1.12.3 | docs/session-ledger.md:277 | 5/0/6-vs-5/2/6, DOCFIX-196 stale Stage-3 NetBox blocker, README tofu 1.12.3->1.1... | +| version | tofu | 1.12.3 | docs/session-ledger.md:77 | tofu v1.12.3; tree validates (10/10 modules); lock committed. | +| version | tofu | 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \| L1-06 \| `tofu validate`: Success (OpenTofu v1.12.3, 11/11 modules). \| | +| version | tofu | 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \| L1-06 \| `tofu validate`: Success (OpenTofu v1.12.3, 11/11 modules). \| | +| version | tofu | 1.12.3 | runbooks/dc-dc-phase0-vcloud-prep.md:3 | > **FIRST EXECUTED 2026-07-10** (vcloud host, OpenTofu v1.12.3) -- run | +| version | tofu | 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \| OpenTofu `tofu` >= 1.6.0 (installs as `/usr/bin/tofu`, not the `opentofu` sna... | +| version | tofu | 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \| OpenTofu `tofu` >= 1.6.0 (installs as `/usr/bin/tofu`, not the `opentofu` sna... | + +## 4. Gate-assertion rows + +| word | where | line | +|---|---|---| +| blocking | .claude/skills/openstack-cloud-ops/SKILL.md:142 | whether the stage you're about to run has any open blocking item -> Stage 1 | +| unexercised | .claude/skills/openstack-cloud-ops/SKILL.md:149 | available, and treat every OpenTofu step as reviewed-but-unexercised. **At STAGE | +| verified | .claude/skills/openstack-cloud-ops/SKILL.md:172 | sin - if you have not verified an option name or version, say so and verify. | +| unexercised | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:110 | surfaces. A ledger without this check rots (cf. D-070's unexercised-snapshot cri... | +| unverified | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:133 | practice over the quick fix and will push back hard on unverified claims. | +| verified | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:58 | collisions have happened. State "next-free verified" when you assign. | +| unverified | .claude/skills/openstack-cloud-ops/references/platform-traps.md:181 | - **UNVERIFIED:** the 0.9.4 notes name a `destroy.shutdown.timeout` option | +| verified | .claude/skills/openstack-cloud-ops/references/platform-traps.md:426 | \| a MAAS-composed VM gets a lease MAAS did not issue, or PXEs on the wrong L2 \... | +| imported | README.md:17 | or as a separate repository (TBD when v2 begins). IPv6 prefixes already imported... | +| imported | README.md:56 | \| \|-- README.md what is imported vs. deferred to v2 | +| unverified | docs/D-068-openbao-assessment-DRAFT.md:32 | privileged plugin-catalog access; per-CVE 1.8.8 applicability UNVERIFIED). | +| verified | docs/D-068-openbao-assessment-DRAFT.md:5 | discussion starts from verified facts. Items that could not be confirmed are mar... | +| unverified | docs/D-068-openbao-assessment-DRAFT.md:6 | UNVERIFIED. Companion: docs/D-068-vault-1.8-vs-1.16-analysis.md (the 1.16 ruling... | +| unverified | docs/D-068-openbao-assessment-DRAFT.md:63 | 1.15.6+ (BUSL -- licensing review required). Remaining UNVERIFIED before any | +| verified | docs/D-068-openbao-assessment-DRAFT.md:70 | vault swap. Also verified live 2026-07-06: the charm's Vault-listener TLS | +| blocking | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: | +| unblocked | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: | +| imported | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: | +| verified | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: | +| verified | docs/audit/grounding-audit-charter.md:128 | verified evidence needed to answer it attached. | +| verified | docs/audit/grounding-audit-charter.md:13 | Measured evidence (verified 2026-07-18 against the pushed repo at `43b29d7`): | +| verified | docs/audit/grounding-audit-charter.md:43 | not a work queue. It gets re-verified and folded into the findings register. | +| verified | docs/changelog-20260703-process-hardening.md:241 | ### 21. Harness-estate findings (pre-existing at HEAD; verified against pristine... | +| verified | docs/changelog-20260703-process-hardening.md:263 | Runbook paste blocks: every `exit` verified nested in a subshell or a remote- | +| verified | docs/changelog-20260703-process-hardening.md:309 | Runbook->script contract cross-check: CLEAN (both automated hits verified | +| verified | docs/changelog-20260703-process-hardening.md:320 | dir -- a live shell with real cloud credentials. Mechanics verified against | +| verified | docs/changelog-20260703-process-hardening.md:37 | points at lib-net.sh / lib-hosts.sh; only verified-current literals remain. | +| verified | docs/changelog-20260703-process-hardening.md:8 | harnesses 33/33 cases, all python compiles. Identifier numbering verified | +| verified | docs/changelog-20260709-adversarial-review-fixes.md:23 | succeeds. Verified empirically (`python3 -c` reproduction): the `else` | +| verified | docs/changelog-20260709-adversarial-review-fixes.md:31 | actually verified: the safety property (rejecting bad input) was still | +| unverified | docs/changelog-20260709-adversarial-review-fixes.md:33 | but "valid input is accepted, not spuriously rejected" was unverified and | +| verified | docs/changelog-20260709-adversarial-review-fixes.md:52 | VERIFIED: re-ran the harness -- the three previously-silent labels now | +| verified | docs/changelog-20260709-adversarial-review-fixes.md:86 | VERIFIED (all three items): `bash scripts/repo-lint.sh` 0 fail, 1 | +| verified | docs/changelog-20260709-adversarial-review-fixes.md:94 | every file that mentions it); the ULA/GUA carve arithmetic (hand-verified | +| verified | docs/changelog-20260709-ceph-replication-tooling.md:106 | ## VERIFIED | +| verified | docs/changelog-20260709-ceph-replication-tooling.md:114 | 11.4b(promote RECOVERING), verified by grepping actual line numbers in | +| blocking | docs/changelog-20260709-ceph-replication-tooling.md:119 | dry-run-informational/apply-blocking split, the `--apply`/typed- | +| blocking | docs/changelog-20260709-ceph-replication-tooling.md:82 | BLOCKING immediately before any `--apply` execution (refuses to mutate an | +| verified | docs/changelog-20260709-dc-dc-design.md:4 | `openstack-caracal-dc-dc` HEAD 8813efc (seed-verified). All decisions PROPOSED -... | +| verified | docs/changelog-20260709-dc-dc-phase0-runbook.md:58 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn | +| verified | docs/changelog-20260709-dc-dc-phase1-runbook.md:45 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. | +| verified | docs/changelog-20260709-dc-dc-phase2-runbook.md:52 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn (no | +| verified | docs/changelog-20260709-dc-dc-phase3-runbook.md:62 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn (no | +| blocking | docs/changelog-20260709-dc-dc-phase4-runbook.md:47 | plausible-looking option names, Step 6 names this as blocking work with | +| unverified | docs/changelog-20260709-dc-dc-phase4-runbook.md:50 | 2. **D-109's IPv6-SAN cert-issuance requirement is an unverified charm- | +| verified | docs/changelog-20260709-dc-dc-phase4-runbook.md:61 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. | +| verified | docs/changelog-20260709-dc-dc-phase4-runbook.md:71 | stage's own "Ceph-over-v6 and geneve-over-v6 verified" gate criterion and | +| verified | docs/changelog-20260709-dc-dc-phase5-runbook.md:53 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn (no | +| verified | docs/changelog-20260709-dc-dc-phase6-runbook.md:57 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn (no | +| verified | docs/changelog-20260709-dc-selector-convention.md:38 | VERIFIED: | +| blocking | docs/changelog-20260709-dc-selector-convention.md:43 | messages cite the correct blocking reason (NetBox gap vs. no-enrollment), | +| verified | docs/changelog-20260709-final-consolidation.md:54 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. | +| blocking | docs/changelog-20260709-final-consolidation.md:90 | Genuinely open items still blocking real progress, in rough execution | +| verified | docs/changelog-20260709-ipv6-family-matrix-overlay.md:58 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. | +| verified | docs/changelog-20260709-ipv6-family-matrix-overlay.md:69 | over-v6 verified" gate: (a) confirm the 8 inferred-by-pattern charms' | +| verified | docs/changelog-20260709-maas-scripts-dc-param.md:48 | maas-reset.md` (see VERIFIED below). | +| verified | docs/changelog-20260709-maas-scripts-dc-param.md:56 | VERIFIED (this workstation; no jq installed, no live jumphost/MAAS/juju | +| verified | docs/changelog-20260709-maas-scripts-dc-param.md:84 | this delivery's. Instead, correctness was verified directly (the | +| verified | docs/changelog-20260709-maas-scripts-dc-param.md:98 | bypassing the harness's own jq gate, per the VERIFIED bullet above). | +| verified | docs/changelog-20260709-mtu-ceph-budget-calculators.md:41 | VERIFIED: | +| blocking | docs/changelog-20260709-mtu-ceph-budget-calculators.md:7 | arithmetic in prose today, not a script -- blocking the Stage 1 Phase-0 | +| verified | docs/changelog-20260709-mtu-ceph-budget-calculators.md:98 | VERIFIED: | +| verified | docs/changelog-20260709-netbox-dc-dc-pipeline.md:68 | VERIFIED, not just asserted: | +| verified | docs/changelog-20260709-netem-ula-gua-proposal.md:39 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. | +| blocking | docs/changelog-20260709-office1-network-edge.md:127 | blocking dependency for instantiating ANY of the three sites' | +| verified | docs/changelog-20260709-office1-network-edge.md:52 | VERIFIED: | +| verified | docs/changelog-20260709-office1-network-edge.md:97 | VERIFIED: `bash scripts/repo-lint.sh`: 0 fail (module block is commented | +| unverified | docs/changelog-20260709-opentofu-audit.md:10 | ### 1. DOCFIX-148 -- audited every flagged UNVERIFIED/inferred/assumed note | +| unverified | docs/changelog-20260709-opentofu-audit.md:15 | METHOD: grepped the entire `opentofu/` tree for every "UNVERIFIED"/"NOT | +| unverified | docs/changelog-20260709-opentofu-audit.md:57 | remains unverified. | +| unverified | docs/changelog-20260709-opentofu-cloudinit-vm.md:64 | then `tofu providers schema -json` to confirm the remaining unverified | +| verified | docs/changelog-20260709-opentofu-scaffold.md:48 | interfaces, filesystems, graphics, etc.) could not be verified with enough | +| verified | docs/changelog-20260709-opentofu-scaffold.md:62 | all before this, since none existed) -- verified this introduces no new | +| verified | docs/changelog-20260709-opnsense-config-design.md:44 | real behavior -- happy path, well-formed-XML output (verified with | +| verified | docs/changelog-20260709-opnsense-edge-module.md:38 | path -- not independently verified. | +| unverified | docs/changelog-20260709-opnsense-edge-module.md:53 | disk, not over the network, so the field flagged UNVERIFIED in | +| unverified | docs/changelog-20260709-opnsense-edge-module.md:91 | against a real OPNsense instance rather than sourced-but-unverified research. | +| verified | docs/changelog-20260709-opnsense-research.md:54 | (`genisoimage`/`xorriso` -- exact tool/flags not yet verified against a | +| verified | docs/changelog-20260709-repo-agnostic-sweep.md:38 | entirely. Verified no new L1 findings from widening scope (checked non-ASCII/ | +| verified | docs/changelog-20260709-repo-lint-crlf-fix.md:24 | VERIFIED: re-ran `--record-clientdocs-sweep` after the fix; `sweep-receipt.txt` | +| blocking | docs/changelog-20260709-stage0-ratification.md:4 | of `docs/dc-dc-deployment-workflow.md`, the gate blocking real Phase-0/1/2 | +| verified | docs/changelog-20260709-stage0-ratification.md:64 | VERIFIED, not just asserted: `bash scripts/ledger-scan.sh`'s "PROPOSED / OPEN | +| blocking | docs/changelog-20260710-carve-gua-hang-fix.md:29 | any FUTURE blocking regression in this Python test self-aborts after 30s with a | +| verified | docs/changelog-20260710-opentofu-state-file-security.md:31 | OUTPUT -- verified against HashiCorp's own current documentation (not | +| verified | docs/changelog-20260710-phase01-bundle-staleness-fix.md:48 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. | +| verified | docs/changelog-20260710-sweep-bundle-fixes.md:7 | DOCFIX-167 edit, since that edit only added/verified the 5 new charms. | +| verified | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:42 | those step BODIES (verified by reading them) still showed only raw | +| verified | docs/changelog-20260710-sweep-script-fixes.md:20 | instead, verified via the same reproduction technique before committing. | +| verified | docs/changelog-20260710-sweep-script-fixes.md:45 | Fixed with the verified `if pipeline; then :; fi` idiom (see the process | +| verified | docs/changelog-20260710-sweep-script-fixes.md:82 | convention. Re-verified `bash scripts/ledger-scan.sh` still reports the | +| verified | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:62 | targeting-risk warning text) was verified against HashiCorp's own current | +| verified | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:97 | verified clean of the self-inflicted false positive before this number was | +| verified | docs/changelog-20260711-ula-gen-command-fix.md:12 | `s/\(..\)\(....\)\(....\)/\1:\2:\3/` -> `fdXX:XXXX:XXXX::/48`. Verified: the | +| unverified | docs/changelog-20260712-docfix189-max-context-session-audit.md:56 | - **"OPNsense's 3 GB min" is UNVERIFIED** (incident report, ranked step 3). No s... | +| verified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:110 | Proposed durable fix (NOT yet implemented/verified): have the runbook/module pre... | +| verified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:85 | `172.30.1.2` / LAN `10.10.0.1`. The config ISO is **verified well-formed** -- it... | +| unverified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:90 | This is the mechanism `modules/opnsense-edge`'s own header has always flagged UN... | +| unverified | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:109 | minimum RAM (the incident report's "3 GB" is UNVERIFIED) and bump to 4096 if war... | +| unexercised | docs/changelog-20260712-office1-opnsense-edge-build.md:5 | this repo -- reviewed-but-unexercised module + image chain. This records the rep... | +| verified | docs/changelog-20260713-docfix194-opentofu-module-validation.md:29 | Verified against the provider's own schema (`tofu providers schema -json`, dmacv... | +| verified | docs/changelog-20260713-office1-dhcp-apply.md:30 | NOT yet verified end-to-end: an actual client DHCPDISCOVER->lease. No client exi... | +| verified | docs/changelog-20260713-office1-headend-maas-lxd.md:56 | `raw.dnsmasq="port=0"`. Verified after the fact: dnsmasq runs but holds **zero**... | +| imported | docs/changelog-20260713-office1-netbox-deployed.md:88 | - The D-115 carve is NOT yet imported into this NetBox (it is the next step). | +| blocking | docs/changelog-20260713-opnsense-api-client.md:39 | ## Not done yet -- the blocking step | +| verified | docs/changelog-20260713-opnsense-apikey-bootstrap.md:18 | OPNsense stores API secrets as `crypt(secret, '$6$')` -- SHA-512 with an EMPTY s... | +| verified | docs/changelog-20260713-opnsense-apikey-bootstrap.md:33 | ## VERIFIED END TO END on the live edge (2026-07-12/13) | +| verified | docs/changelog-20260713-workflow-doc-status-correction.md:14 | \| gap #17: "no per-site ISP-uplink network exists anywhere, for ANY site" \| **... | +| verified | docs/changelog-20260714-d119-tofu-apply.md:21 | Verified ON THE HOST, not just in state: | +| verified | docs/changelog-20260715-creds-audit.md:32 | `*-creds/`). **Reads NO secret values -- metadata only** (stat/size), verified b... | +| verified | docs/changelog-20260715-creds-audit.md:49 | the SEC-009 sandbox-token gap is now closed and tool-verified. | +| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:1 | # 2026-07-15 -- C2 sub-task (ii): D-120 bands loaded + verified; sandbox loop ex... | +| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:16 | Verified live: the endpoints dump (0/0 before the load). | +| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:42 | validated VR1 dataset, verified by a fidelity check that covers every object cla... | +| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:9 | fidelity check. This closes that gap and then does the load, verified. | +| verified | docs/changelog-20260715-d120-office1-service-reip.md:12 | No wipe. Both services verified on the wire: | +| blocking | docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md:6 | `runbooks/dc-dc-phase2-tofu-dc-substrate.md` to surface its blocking decisions b... | +| imported | docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md:77 | assigned (D-115 `10.12.64.0/19`, imported to office1-netbox); it stays out of sc... | +| verified | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:36 | D-120 child ranges + service IPs), verified by (i) a hardened-fidelity-check re-... | +| verified | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:58 | D-120 load cannot be machine-verified until they are extended (each with its har... | +| verified | docs/changelog-20260715-fidelity-check-scope-correctness.md:1 | # 2026-07-15 -- C2 sub-task (i): sandbox re-verified faithful; fidelity checker ... | +| unverified | docs/changelog-20260715-stage3-prereqs-prep.md:77 | (the `to:` list-replace merge is the one unverified overlay mechanism). | +| unexercised | docs/changelog-20260716-d126-durable-forward.md:63 | ## Forward layer -- reviewed-but-UNEXERCISED (operator completes if/when wanted) | +| verified | docs/changelog-20260716-review-sweep-phaseAB.md:32 | reads the ADOPTED token cleanly (R3-F09; verified -- D-115 no longer flagged PRO... | +| blocking | docs/changelog-20260716-review-sweep-phaseAB.md:6 | ruled the review's blocking decisions step-by-step (R-1..R-4, logged in `docs/se... | +| blocking | docs/changelog-20260716-review-sweep-phaseC.md:57 | - Agent cross-check of the two-root reshape: FAITHFUL, no BLOCKING. | +| blocking | docs/changelog-20260716-review-sweep-phaseC.md:8 | the two-root implementation was cross-checked by a second agent (verdict: FAITHF... | +| verified | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:29 | **HARD GATE verified:** `tofu plan` shows the two EXISTING Office1 domains (voff... | +| verified | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:15 | services (netbox, netbox-worker, postgres, redis, redis-cache) -- verified via `... | +| verified | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:20 | ## Apex writes (Block A -- gated, dry-run-verified then committed) | +| verified | docs/dc-dc-buildout-design.md:129 | controller backup taken and stored; Ceph-over-v6 and geneve-over-v6 verified. | +| verified | docs/dc-dc-buildout-design.md:13 | `openstack-caracal-dc-dc` (verified). Six-plane values are `scripts/lib-net.sh` | +| verified | docs/dc-dc-buildout-design.md:92 | Gate: nested KVM verified; disk budget computed and the Ceph size decision recor... | +| verified | docs/dc-dc-deployment-workflow.md:132 | the COMPLETE validated dataset, NOT by any upstream write. See C2 for what "comp... | +| verified | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (... | +| blocking | docs/dc-dc-deployment-workflow.md:163 | **Rulings landed (through 2026-07-16; supersedes the earlier "two blocking rulin... | +| blocking | docs/dc-dc-deployment-workflow.md:187 | **Blocking to EXECUTE (all operator-gated):** the HELD NetBox addressing -- **D-... | +| verified | docs/dc-dc-deployment-workflow.md:216 | \| **Gate** \| `preflight.sh` PASS before add-model; post-deploy `cloud-assert.s... | +| blocking | docs/dc-dc-deployment-workflow.md:219 | \| **Authoring status** \| **Runbook WRITTEN 2026-07-09: `runbooks/dc-dc-phase4-... | +| unverified | docs/dc-dc-deployment-workflow.md:219 | \| **Authoring status** \| **Runbook WRITTEN 2026-07-09: `runbooks/dc-dc-phase4-... | +| verified | docs/dc-dc-deployment-workflow.md:27 | per-DC. Verified via `bash scripts/ledger-scan.sh`: none of D-100..D-110 | +| verified | docs/dc-dc-deployment-workflow.md:331 | > longer takes `config_iso_path` (verified -- no `config_seed`/`config_iso_path`... | +| verified | docs/dc-dc-deployment-workflow.md:41 | \| **Gate** \| Nested KVM verified; disk budget computed + Ceph size decision re... | +| unverified | docs/dc-dc-deployment-workflow.md:432 | UNVERIFIED in `node-vm/main.tf`, an inference by pattern not a confirmed | +| blocking | docs/dc-dc-deployment-workflow.md:542 | that were manual arithmetic in prose, not a script, blocking the Stage 1 | +| verified | docs/dc-dc-deployment-workflow.md:721 | is verified (0.0% loss). So the topology question is ANSWERED and the | +| verified | docs/dc-dc-deployment-workflow.md:767 | `var.maas_api_key` in plaintext (verified against HashiCorp's own docs, | +| unexercised | docs/dc-dc-deployment-workflow.md:875 | \| `opentofu/` (networks/pools/node-VM PXE/cloud-init-VM patterns) \| **VALIDATE... | +| verified | docs/dc-dc-netbox-buildout-scope.md:288 | IPAM apex) holds the COMPLETE validated dataset AND it is VERIFIED. Two sub-task... | +| verified | docs/dc0-deploy-readiness.md:117 | - `voffice1` + `office1-opnsense` are BOTH `autostart=enable` (set 2026-07-17, e... | +| verified | docs/dc0-deploy-readiness.md:120 | `virsh shutdown`s the guests first so the reboot exercises the verified **cold-b... | +| verified | docs/dc0-deploy-readiness.md:21 | ## A. Readiness ESTABLISHED (done, verified this session) | +| blocking | docs/dc0-deploy-readiness.md:32 | - **Blocking design rulings LANDED** -- D-121/122/123/124 ADOPTED; R-1 Model B, ... | +| verified | docs/dc0-deploy-readiness.md:35 | ## B. The outer-root plan -- VERIFIED SAFE (this is the apply gate) | +| verified | docs/dc0-deploy-readiness.md:37 | `tofu -chdir=opentofu plan` => **5 add / 2 in-place / 6 destroy**, decomposed an... | +| verified | docs/dc0-deploy-readiness.md:39 | -- an **update-in-place** (verified: NOT replacement; replacement would destroy ... | +| non-blocking | docs/dc0-deploy-readiness.md:75 | (D-100 gap #11) is DEFERRED. Non-blocking for the outer apply. | +| non-blocking | docs/dc0-deploy-readiness.md:86 | ### C4. IPAM record hygiene (parallel, NON-blocking -- now runnable via `ssh off... | +| non-blocking | docs/dc0-deploy-readiness.md:93 | ### C5. Record-hygiene sweep (NON-blocking; queued from the Stage-3 adversarial ... | +| verified | docs/design-decisions.md:1063 | **Status:** PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... | +| verified | docs/design-decisions.md:1124 | ### D-063 -- RESOLVED / CLOSED (2026-07-03): applied and functionally verified | +| verified | docs/design-decisions.md:1172 | **Status:** RESOLVED / CLOSED (applied + functionally verified 2026-07-03). Supe... | +| unblocked | docs/design-decisions.md:1262 | create_trust with identity:create_trust 403 -- AFTER D-064 unblocked create_user... | +| verified | docs/design-decisions.md:1504 | D-011 item 6 read "Vault unseal + auto-unseal-after-reboot pattern verified". Th... | +| verified | docs/design-decisions.md:1508 | verified (sealed-on-restart is BY DESIGN, not a fault)". The acceptance bar and ... | +| unexercised | docs/design-decisions.md:1584 | mentions in the repo are dated as-built value captures. An adopted-but-unexercis... | +| verified | docs/design-decisions.md:1710 | https 200 on 10.12.4.58 and 10.12.8.58 (vault-CA-verified, csrftoken cookie pres... | +| verified | docs/design-decisions.md:1769 | (evidence-gated per D-064: code-guarded, and no verified shipped-default strings... | +| imported | docs/design-decisions.md:209 | **Deferred to v2 (per Q2):** VR0 DC0-VLANs group additions beyond VID 240 (alrea... | +| verified | docs/design-decisions.md:2162 | - The DC-DC decision series starts at D-100 in the repo `openstack-caracal-dc-dc... | +| verified | docs/design-decisions.md:223 | 6. Vault unseal + auto-unseal-after-reboot pattern verified | +| verified | docs/design-decisions.md:2279 | but comes up on FACTORY DEFAULTS. The config ISO is well-formed and correctly at... | +| unverified | docs/design-decisions.md:2310 | nano image -- and it does not. The module header has always flagged this exact m... | +| unverified | docs/design-decisions.md:2317 | importer, no ISO, no boot-time interactivity. RISK/UNVERIFIED: writing FreeBSD U... | +| verified | docs/design-decisions.md:2349 | 2. **VyOS LTS binaries are subscription-gated** (verified 2026-07-13, vyos.net/g... | +| verified | docs/design-decisions.md:2468 | the internet, serves DHCP, managed over SSH with a verified push pipeline). Edge... | +| verified | docs/design-decisions.md:3069 | CSPRNG-generated. That claim originates in an earlier session and **cannot be re... | +| imported | docs/design-decisions.md:3170 | break the already-imported sandbox prefixes. | +| verified | docs/design-decisions.md:3260 | Re-IP executed on the two running services, no wipe, verified on the wire: | +| blocking | docs/design-decisions.md:3306 | Stage 3's `modules/node-vm` sizing/count (was blocking phase2 runbook Step 6 -- ... | +| unblocked | docs/design-decisions.md:3306 | Stage 3's `modules/node-vm` sizing/count (was blocking phase2 runbook Step 6 -- ... | +| verified | docs/design-decisions.md:3376 | leans on the already-3-unit mysql-innodb-cluster. Must be verified against the d... | +| verified | docs/design-decisions.md:361 | **What is lost vs. graceful path:** verified-clean release path for CAPI workloa... | +| unexercised | docs/design-decisions.md:3794 | continue that"). Tooling delivered (`scripts/site-forward.sh` + harness, reviewe... | +| unexercised | docs/design-decisions.md:3850 | met. The systemd FORWARD layer (`site-forward.sh`) remains reviewed-but-unexerci... | +| verified | docs/design-decisions.md:3918 | settings are applied AFTER a verified clean cold boot (operator sequencing). | +| verified | docs/design-decisions.md:3931 | - **office1-opnsense -> AUTOSTART, but enable only AFTER one verified post-fix c... | +| unverified | docs/design-decisions.md:3934 | boot post-fix is unverified ("live boot verification is the remaining gated step... | +| verified | docs/design-decisions.md:3947 | `office1-opnsense` after its verified cold boot); runs as jessea123 via the libv... | +| verified | docs/design-decisions.md:3954 | matrix against drift (auto-booting the 416 GiB container / MAAS nodes is the exa... | +| verified | docs/design-decisions.md:428 | **Finding (verified 2026-06-05):** k8s-keystone-auth 1.5.1 exposes no keystone-C... | +| verified | docs/design-decisions.md:45 | **Verification source:** Caracal channel matrix per Canonical Charmed OpenStack ... | +| blocking | docs/design-decisions.md:565 | - `magnum-shared-db` missing colon ? causes a relation endpoint syntax error, de... | +| verified | docs/design-decisions.md:584 | \| 2026-05-22 \| D-002 hacluster row added (channel `2.4/stable`) per Canonical ... | +| verified | docs/design-decisions.md:666 | **Status:** Adopted + APPLIED 2026-06-11; re-verified 2026-06-16 post phase-05. | +| verified | docs/design-decisions.md:712 | **Rationale:** (1) FINDING-3 -- glance's web-download plugin fetches with urllib... | +| verified | docs/design-decisions.md:755 | **Why this approach (and NOT enforce_scope):** Charmed OpenStack deliberately do... | +| non-blocking | docs/design-decisions.md:761 | **base_* alignment (open verification, non-blocking):** the base_* rules in `dom... | +| verified | docs/design-decisions.md:769 | **Status:** ADOPTED 2026-06-25 (operator-approved). AUTHORITATIVE; SUPERSEDES th... | +| verified | docs/design-decisions.md:789 | - Ceph control relations (ceph-mon client/mon/osd/mds/radosgw/rbd-mirror/bootstr... | +| verified | docs/design-decisions.md:928 | **No re-CIDR.** The live MAAS is already on D-052/D-053 (verified 2026-06-29: ju... | +| verified | docs/design-decisions.md:947 | restored). The bundle diff `bf7de5a..HEAD` was verified to be PURELY D-057/D-058... | +| verified | docs/design-decisions.md:957 | `scripts/d057-bundle-check.py`. Verified PASS against the reverted bundle. | +| verified | docs/docfix-draft-20260702.md:177 | pattern verified"; phase-08 D-011.6 rules MANUAL unseal is the v1 standard (auto... | +| verified | docs/docfix-draft-20260702.md:192 | IMPLEMENTED in the delivered ZIP (numbers verified next-free at HEAD 690779a; | +| verified | docs/docfix-draft-20260702.md:4 | Numbers are PROVISIONAL from next-free DOCFIX-066 (verified against HEAD | +| verified | docs/docfix-draft-20260702.md:64 | scripts/lib-hosts.sh (host identity); retain only verified-current literals. | +| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:124 | each DC containment VM, so it scales badly. **Mechanism -- partially verified:**... | +| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:125 | is **NO provider-level knob** for the staging path (VERIFIED via | +| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:129 | `os.TempDir()`, i.e. **`$TMPDIR` for the tofu process** -- **UNVERIFIED by | +| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:138 | verified empirically against live state: | +| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:147 | **VERIFIED AGAINST PRIMARY SOURCE** (provider v0.9.8, | +| blocking | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:3 | **Class:** deploy-blocking drift, discovered during pre-apply re-verification. | +| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:58 | ## The seed-volume replacement (root cause; danger UNVERIFIED) | +| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:86 | **UNVERIFIED -- do not treat as established:** what provider 0.9.8 actually does... | +| non-blocking | docs/handoff-20260705-open-items.md:53 | live tenant -- operator, browser; non-blocking. | +| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:66 | ## What was tried -- ALL applied and verified in the domain XML, NONE resolved i... | +| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:69 | 2. **`machine` q35 -> i440fx** (`pc-i440fx-noble`, verified). No change. (Note: ... | +| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:72 | 3. **Disk: COW overlay -> direct per-VM copy** of the nano (verified 11 GiB / 2.... | +| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:74 | 4. **CPU `host-passthrough`** (verified). No change. | +| unverified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:91 | UNVERIFIED (no source given); do not propagate it. If 2 GiB proves insufficient ... | +| imported | docs/netbox-vip-queue.md:3 | **Status:** Queued. To be imported after successful cloud deployment + validatio... | +| unblocked | docs/netbox-vip-queue.md:81 | ## Execution path (when unblocked) | +| blocking | docs/netbox-vip-queue.md:9 | under workstream 2 (2026-05-22) to avoid blocking the rebuild on the engineer | +| verified | docs/phase-00-maas-standup-notes.md:14 | script refuses to build onto a CIDR the wrong plane occupies. Verified idempoten... | +| verified | docs/security-ledger.md:21 | \| SEC-010 \| 2026-07-16 \| **metal-admin DC-LOCAL invariant (D-052/D-100) is PR... | +| unblocked | docs/session-findings-2026-07-02.md:11 | 1. D-064 (prior): create_user template fix unblocked trustee-user creation. | +| verified | docs/session-ledger.md:1053 | is **jumbo, underlay_mtu=9000** (operator ruling; verified on all 10 nets). | +| verified | docs/session-ledger.md:1070 | Idempotent, and **verified FIELD-BY-FIELD** against the upstream draft | +| unblocked | docs/session-ledger.md:1088 | ### ~~BLOCKED~~ **UNBLOCKED and DONE** -- D-118 ratified the org ULA; both DCs i... | +| imported | docs/session-ledger.md:1088 | ### ~~BLOCKED~~ **UNBLOCKED and DONE** -- D-118 ratified the org ULA; both DCs i... | +| imported | docs/session-ledger.md:1096 | **Imported into the sandbox:** six-plane roles + 2 RIRs + 5 aggregates, then **V... | +| blocking | docs/session-ledger.md:1136 | ### Also open (recorded, not blocking) | +| verified | docs/session-ledger.md:118 | --commit` and VERIFIED by the (now-extended) fidelity check -> exit 0. The `ip-r... | +| verified | docs/session-ledger.md:128 | 10.10.1.0/24 via 10.10.0.20 dev virbr2` in a real terminal; verified HTTP 302 at... | +| unexercised | docs/session-ledger.md:138 | the guard/classifier). The systemd FORWARD layer stays reviewed-but-unexercised ... | +| verified | docs/session-ledger.md:142 | Both blocks COMMITTED (gated, dry-run-verified; token server-side, sandbox-only)... | +| verified | docs/session-ledger.md:155 | vvr1-dc0/nodes=FALSE); opentofu T11-T15 pin it; HARD GATE verified (voffice1/off... | +| verified | docs/session-ledger.md:162 | build). D-127 RULED: voffice1 autostarts; office1-opnsense autostarts AFTER one ... | +| verified | docs/session-ledger.md:176 | (graceful ACPI `virsh shutdown` -> confirmed `shut off` -> `virsh start`) and VE... | +| verified | docs/session-ledger.md:178 | gw + egress 0% loss, netbox 302 + tailscale reachable behind it. That satisfies ... | +| verified | docs/session-ledger.md:181 | stay MANUAL and do not exist yet). **LXD service-VM autostart VERIFIED (2026-07-... | +| blocking | docs/session-ledger.md:205 | `docs/dc-dc-deployment-workflow.md`'s Stage 3 section still reads "**Blocking to... | +| blocking | docs/session-ledger.md:210 | blocker; the workflow doc's Stage-3 "Blocking to EXECUTE" line needs a DOCFIX (n... | +| unverified | docs/session-ledger.md:222 | state drift, not a config change (the volume-replace CONSEQUENCE on a running do... | +| verified | docs/session-ledger.md:252 | **Mechanism correction:** there is **NO provider knob** for this (VERIFIED via `... | +| unverified | docs/session-ledger.md:254 | almost certainly **`$TMPDIR`** for the tofu process (Go `os.TempDir()`), UNVERIF... | +| verified | docs/session-ledger.md:261 | evidence say **v1.12.3**. Presumed to have arrived with the host patch (not veri... | +| verified | docs/session-ledger.md:265 | ESTABLISHED: (1) An autostart-ONLY diff **bounces the guest** -- VERIFIED FROM P... | +| verified | docs/session-ledger.md:287 | clean). Outer-root `tofu plan` RUN + VERIFIED SAFE: 5 add (`vvr1-dc0` 416GiB/108... | +| verified | docs/session-ledger.md:288 | 0 change / 6 destroy (the six EMPTY vr1-dc0 planes relocating to the inner root ... | +| blocking | docs/session-ledger.md:312 | hard-gate grounds (substrate design is sound). BLOCKING headline: **2 decisions ... | +| unverified | docs/session-ledger.md:347 | `vault-hacluster` VIP. Still 3x manual unseal (SEC-003). **HARD FEASIBILITY GATE... | +| verified | docs/session-ledger.md:352 | - **[R-2 FEASIBILITY GATE FAILED -- verified 2026-07-16.]** `bundle.yaml:133-138... | +| verified | docs/session-ledger.md:414 | applied+verified on vvr1-dc0. | +| blocking | docs/session-ledger.md:426 | - **Model B cross-check (agent) = FAITHFUL, no BLOCKING**; fixes applied: 32-GiB... | +| verified | docs/session-ledger.md:43 | but stays OPEN until applied + verified on vvr1-dc0. SEC-008 -- the vcloud re-en... | +| imported | docs/session-ledger.md:49 | record. Also: D-124 transit addressing PINNED (172.31.0.0/24) + imported to offi... | +| blocking | docs/session-ledger.md:512 | Walked the phase2 runbook and surfaced its blocking decisions; the operator rule... | +| imported | docs/session-ledger.md:592 | supernet" -- D-115 ALREADY assigned it (`10.12.64.0/19`, imported to office1-net... | +| imported | docs/session-ledger.md:622 | upstream draft and PROVEN faithful field-by-field; carve + six-plane roles + BOT... | +| verified | docs/session-ledger.md:628 | Address `2602:f3e2:f01:100::1/64` on the edge LAN (kernel-verified) + radvd adve... | +| verified | docs/session-ledger.md:703 | (`--commit`, operator-approved) and VERIFIED: re-dump + fidelity check -> exit 0... | +| verified | docs/session-ledger.md:72 | `tofu apply`: **11 added, 0 changed, 11 destroyed**; `tofu plan` now reports "No... | +| verified | docs/session-ledger.md:723 | **ORG_ULA_48 = `fd50:840e:74e2::/48`** (**D-118 ADOPTED** -- RFC 4193 valid, and... | +| imported | docs/session-ledger.md:727 | All are IMPORTED and fidelity-checked in the sandbox. | +| verified | docs/session-ledger.md:818 | ABSENT on all three), idempotent grep-guarded append, verified 2 keys each. This... | +| verified | docs/session-ledger.md:835 | only `os-git-backup` installed, and **UNCONFIGURED** (php-verified no config nod... | +| verified | docs/session-ledger.md:852 | **INSTALL VERIFIED 2026-07-18 (operator ran the firmware POSTs via `!`):** `os-q... | +| verified | docs/session-ledger.md:897 | -- VERIFIED still open), then use the combined gate to regenerate the stale rest... | +| verified | docs/session-ledger.md:900 | watch + D-066-evidence wrapper. NOT STARTED (verified absent). | +| verified | docs/session-ledger.md:913 | PROPOSED/OPEN. D-063 is `RESOLVED / CLOSED` in `design-decisions.md` (verified).... | +| blocking | docs/stage3-adversarial-review-20260716.md:111 | - **Contested (severity):** A1 argues MAJOR-not-BLOCKING for D-123 -- a status L... | +| blocking | docs/stage3-adversarial-review-20260716.md:113 | (L1-07). Adjudication: kept BLOCKING because (i) the prompt frames C2 as BLOCKIN... | +| blocking | docs/stage3-adversarial-review-20260716.md:113 | (L1-07). Adjudication: kept BLOCKING because (i) the prompt frames C2 as BLOCKIN... | +| blocking | docs/stage3-adversarial-review-20260716.md:262 | deploy-BLOCKING: a status label is not a value "entering a command" (hard-rule-2... | +| blocking | docs/stage3-adversarial-review-20260716.md:265 | specific inference. Code's adjudication keeps R3-F01 BLOCKING on decision-record... | +| verified | docs/stage3-adversarial-review-20260716.md:294 | run). Integration -- with one A4 claim verified-and-rejected (I check agent cita... | +| verified | docs/stage3-adversarial-review-20260716.md:300 | Verified: the runbook does NOT -- at `:507` it cites "D-123 (PROPOSED, recommend... | +| blocking | docs/stage3-adversarial-review-20260716.md:329 | Blocking conditions to clear (each operator-gated, applied in a post-acceptance ... | +| verified | docs/stage3-adversarial-review-20260716.md:50 | claims hold independently, but specific benchmark/control identifiers should be ... | +| blocking | docs/stage3-adversarial-review-20260716.md:73 | ### R3-F01 -- BLOCKING -- Two ADOPTED rulings rest on inferred/agent-authored op... | +| verified | docs/stage3-adversarial-review-20260716.md:79 | sub-ruling. Code verified the second case directly against the transcript (L1-13... | +| blocking | docs/stage3-review-base.patch:12 | +`runbooks/dc-dc-phase2-tofu-dc-substrate.md` to surface its blocking decisions ... | +| imported | docs/stage3-review-base.patch:1320 | +# imported to office1-netbox), superseding the old "wait for NetBox" premise. I... | +| imported | docs/stage3-review-base.patch:1897 | + that carve is imported to `office1-netbox`. So the blocker is no longer a | +| unblocked | docs/stage3-review-base.patch:1928 | + used to block Step 6; it is now UNBLOCKED. Still open (one sub-ruling | +| unverified | docs/stage3-review-base.patch:205 | + (the `to:` list-replace merge is the one unverified overlay mechanism). | +| unblocked | docs/stage3-review-base.patch:2187 | -**GATE:** base image path and (if unblocked) config ISO path recorded as real | +| unblocked | docs/stage3-review-base.patch:2285 | -ends at whatever the last unblocked step was (Step 5 or wherever Step 4 left | +| verified | docs/stage3-review-base.patch:2544 | -honestly rather than declaring edge routing verified when it is not. | +| verified | docs/stage3-review-base.patch:2547 | +record that honestly rather than declaring edge routing verified when it is | +| blocking | docs/stage3-review-base.patch:325 | +**Two blocking rulings landed 2026-07-15** (from a walk of the runbook's decisi... | +| blocking | docs/stage3-review-base.patch:364 | +Stage 3's `modules/node-vm` sizing/count (was blocking phase2 runbook Step 6 --... | +| unblocked | docs/stage3-review-base.patch:364 | +Stage 3's `modules/node-vm` sizing/count (was blocking phase2 runbook Step 6 --... | +| verified | docs/stage3-review-base.patch:434 | + leans on the already-3-unit mysql-innodb-cluster. Must be verified against... | +| blocking | docs/stage3-review-base.patch:660 | +\| SEC-011 \| 2026-07-16 \| **Node least-connectivity gap (not an L2 breach).**... | +| blocking | docs/stage3-review-base.patch:721 | +Walked the phase2 runbook and surfaced its blocking decisions; the operator rul... | +| imported | docs/stage3-review-base.patch:801 | + supernet" -- D-115 ALREADY assigned it (`10.12.64.0/19`, imported to office1-... | +| imported | docs/stage3-review-base.patch:83 | + assigned (D-115 `10.12.64.0/19`, imported to office1-netbox); it stays out of... | +| verified | docs/tenant-onboarding-contract.md:94 | VERIFIED LIVE 2026-07-07 (devteam, full three-account walkthrough): login | +| verified | docs/upstream-bug-draft-dashboard-tls.md:29 | (verified: plain-HTTP GET to :433 answers 200). TLS clients fail handshake | +| verified | docs/upstream-bug-draft-dashboard-tls.md:41 | Bind `cluster` to the same space as the application default binding. Verified: | +| imported | docs/v1-pre-deploy-fixes.md:654 | The IPv6 prefixes already imported into NetBox (and marked Reservation status) i... | +| verified | docs/v1-redeploy-changelog.md:1028 | core-verified cloud -- mysql clustered, Vault PKI up, cert cascade settled, 31/3... | +| verified | docs/v1-redeploy-changelog.md:117 | practice (D-054): tested scripts committed to the repo, verified by sha256 on th... | +| verified | docs/v1-redeploy-changelog.md:13 | (Verified by grep of design-decisions.md: max D-053, max DOCFIX-038.) | +| unblocked | docs/v1-redeploy-changelog.md:1312 | identity:create_trust 403 -- AFTER D-064 unblocked create_user (trustee user cre... | +| verified | docs/v1-redeploy-changelog.md:1371 | remote_binding (LP#1895185, verified at vendored commit 6f7848c), so the externa... | +| verified | docs/v1-redeploy-changelog.md:1382 | Also this session: handoff commit 22a1eef verified 7/8 (bundle.yaml was DELETED ... | +| verified | docs/v1-redeploy-changelog.md:1383 | commit pattern; restored + verified in 10e9186 -- diff vs pre-delete is exactly ... | +| verified | docs/v1-redeploy-changelog.md:1400 | template create (stage5) drops --keypair (keypair_id optional, default=None -- v... | +| verified | docs/v1-redeploy-changelog.md:1456 | tests/*/run-tests.sh; both harnesses in this package were verified under it pre-... | +| verified | docs/v1-redeploy-changelog.md:1511 | ### 2026-07-03 (addendum 4) -- 8d verified; V-1 ruled; D-063 measured + adopted ... | +| verified | docs/v1-redeploy-changelog.md:1585 | ### 2026-07-03 (addendum 7) -- D-063 RESOLVED/CLOSED: applied + functionally ver... | +| verified | docs/v1-redeploy-changelog.md:1589 | /32 on 22. VERIFIED through the tightened SG: (R1) TCP handshake magnum/0 -> mgm... | +| verified | docs/v1-redeploy-changelog.md:17 | ## Verified-state checkpoint (measured this session -- authoritative as-built) | +| verified | docs/v1-redeploy-changelog.md:1880 | Identifier consumed: BUNDLEFIX-010 (vault bundle revert; scan-verified next-free... | +| verified | docs/v1-redeploy-changelog.md:2016 | provider-public). VERIFIED: https 200 on 10.12.4.58 + 10.12.8.58 for the FIRST | +| verified | docs/v1-redeploy-changelog.md:2017 | TIME on this build, vault-CA-verified with csrftoken cookie present; http leg | +| verified | docs/v1-redeploy-changelog.md:2037 | readback grep (juju-ssh quoting); the render had in fact succeeded -- verified | +| verified | docs/v1-redeploy-changelog.md:2171 | abort discipline. Check ids verified against validate.sh (--checks, --list). | +| unverified | docs/v1-redeploy-changelog.md:2178 | snap-channel-headroom measurement + Sunbeam parity watch. UNVERIFIED items | +| verified | docs/v1-redeploy-changelog.md:2217 | is **1.12.11**, not 1.14.x. Listener TLS options verified present and empty: | +| verified | docs/v1-redeploy-changelog.md:2253 | teardown verified server/FIP/SG removed). CANARY_SSH_USER verify-live item | +| non-blocking | docs/v1-redeploy-changelog.md:2255 | logged as open, non-blocking per the do-doc. | +| verified | docs/v1-redeploy-changelog.md:2262 | application_credential rules -- verified both sides). Fix (operator-ruled): | +| verified | docs/v1-redeploy-changelog.md:2326 | node_count=2 deliberate), foil1 complete/verified, acme absent (offboarded), | +| verified | docs/v1-redeploy-changelog.md:2355 | orphans only (trusts first, post-delete verified) behind a typed | +| unverified | docs/v1-redeploy-changelog.md:2377 | radosgw tenant enablement UNVERIFIED). {{PLACEHOLDER}}-driven; first | +| verified | docs/v1-redeploy-changelog.md:2384 | (WARN rc 2 + count; benign-placeholder whitelist; scrub re-verified by | +| verified | docs/v1-redeploy-changelog.md:2431 | numbering authority is correct again (verified: highest=104 -> next-free=105 | +| verified | docs/v1-redeploy-changelog.md:2489 | in place with a note (the standing identifier-pollution rule; scan verified | +| verified | docs/v1-redeploy-changelog.md:2573 | Verified-correct non-changes logged by the pass: -svc-appcred.txt | +| verified | docs/v1-redeploy-changelog.md:2580 | it had only read); it re-based onto main and verified its reads against | +| unverified | docs/v1-redeploy-changelog.md:2664 | warns UNVERIFIED on the HOLD path. Harness 8->10. REVERT: git checkout | +| verified | docs/v1-redeploy-changelog.md:2677 | deferred-findings register -- R5/R6/R7/R9/R11 verified with locations, | +| verified | docs/v1-redeploy-changelog.md:268 | the no-DHCP planes never produced a self-lease. Verified: mock self-release path... | +| verified | docs/v1-redeploy-changelog.md:2734 | --ram 51200` applied + re-read verified. Values equal the nova class | +| verified | docs/v1-redeploy-changelog.md:2766 | delivered occurrences in ~/devteam-package corrected by sed + re-verified | +| verified | docs/v1-redeploy-changelog.md:2841 | - **DOCFIX-120 -- contract section 5 live verdicts:** 5.1 VERIFIED (devteam); | +| verified | docs/v1-redeploy-changelog.md:2913 | delivered copies, zero tokens verified); operator pushes tonight. | +| verified | docs/v1-redeploy-changelog.md:3000 | verified); operator pushes with the rest tonight. | +| verified | docs/v1-redeploy-changelog.md:302 | added its sourced-library shellcheck directive. osd-blank verified via mock | +| verified | docs/v1-redeploy-changelog.md:3020 | operator-side; net state verified clean, so no agent delete was needed. | +| verified | docs/v1-redeploy-changelog.md:3022 | created in devteam-prod as devteam-svc app-cred. Verified attributes: | +| verified | docs/v1-redeploy-changelog.md:3123 | both verified name-based). | +| verified | docs/v1-redeploy-changelog.md:3219 | (VERIFIED -- catalog has only glance + product-streams, no registry service); | +| verified | docs/v1-redeploy-changelog.md:322 | Next free numbers at section open: design decision D-056; doc fix DOCFIX-042 (ve... | +| verified | docs/v1-redeploy-changelog.md:3226 | 3. Scaling (2.5 new): `openstack coe cluster resize <cluster> <count>` (VERIFIED | +| unverified | docs/v1-redeploy-changelog.md:3232 | UNVERIFIED, see operator follow-up). | +| verified | docs/v1-redeploy-changelog.md:3418 | (hard-rule #3; Roosevelt = 1 edit not 6). lib-net verified source-safe before wi... | +| non-blocking | docs/v1-redeploy-changelog.md:579 | ALSO (value drift, non-blocking): gss image-stream endpoint is HTTP on metal 10.... | +| non-blocking | docs/v1-redeploy-changelog.md:689 | live + D-052. Non-blocking. | +| non-blocking | docs/v1-redeploy-changelog.md:724 | confirm it reaches internal glance. Non-blocking. | +| verified | docs/v1-redeploy-changelog.md:750 | ec332b438a87c3cc1e38318ced110568392484cc2f33e29c8f4eaf9ecc9de297 verified vs pub... | +| verified | docs/v1-redeploy-changelog.md:883 | ### Phase-06 6.0-BOOT verified + 6.0/6.1 scripted (2026-06-27) | +| imported | docs/v1-redeploy-changelog.md:885 | ubuntu-24.04-noble imported + active, disk_format=raw, checksum 5fa5b05e...1a44 ... | +| verified | docs/v1-redeploy-changelog.md:954 | verified this session. carve-host-interfaces.sh is correct per the as-built | +| blocking | docs/v1-redeploy-changelog.md:963 | ex-lbaas enp11s0 to be REMOVED). OPEN blocking question: the interaction with | +| imported | docs/vr1-office1-as-built.md:11 | and the divergence gets fixed here. **The D-115 carve IS now imported** into the... | +| verified | docs/vr1-office1-as-built.md:110 | self-hosted control server and **verified from the workstation** -- the OPNsense... | +| imported | docs/vr1-office1-as-built.md:167 | ## 6. IPAM -- what NetBox now says about this site (D-115 carve, imported 2026-0... | +| verified | runbooks/appendix-A-troubleshooting.md:253 | - Fix: the four host system_ids are fixed and eyeball-verified | +| non-blocking | runbooks/appendix-A-troubleshooting.md:298 | - Impact: NON-BLOCKING -- systemd-resolved deprioritizes .10 and falls through t... | +| verified | runbooks/appendix-A-troubleshooting.md:442 | provenance-verified path cloud-wide. | +| verified | runbooks/appendix-A-troubleshooting.md:484 | verified blocks: runbooks/ops-capi-recovery.md. | +| verified | runbooks/appendix-A-troubleshooting.md:514 | ~15 seconds on NoValidHost. Verified to the megabyte 2026-06-10. Roosevelt | +| verified | runbooks/appendix-C-identity-rbac.md:122 | - CORRECTION (verified live 2026-07-01): on THIS deployment a domain manager's `... | +| unblocked | runbooks/appendix-D-magnum-trust-model.md:19 | the magnum domain). Unblocked by D-064. PROVEN live. | +| unblocked | runbooks/appendix-D-magnum-trust-model.md:21 | user; impersonation=True; roles = the creator's token roles). Unblocked by D-065... | +| non-blocking | runbooks/d011-batch3-window-DRAFT.md:15 | open, non-blocking per this doc's own clause. | +| blocking | runbooks/dc-dc-office1-service-reip.md:24 | ## Step 0 -- Confirm the recovery backstop FIRST (READ-ONLY, blocking) | +| verified | runbooks/dc-dc-office1-service-reip.md:3 | **EXECUTED 2026-07-15** (D-120 ADOPTED, option (a)). Both services re-IP'd, no w... | +| blocking | runbooks/dc-dc-phase0-vcloud-prep.md:168 | own nested libvirt/OpenStack) is not viable on it. That is a blocking finding | +| unexercised | runbooks/dc-dc-phase0-vcloud-prep.md:406 | STAGE-1-VALIDATED (the Stage 2/3 modules remain unexercised). | +| unverified | runbooks/dc-dc-phase0-vcloud-prep.md:408 | If `validate` surfaces a schema mismatch against the flagged UNVERIFIED | +| verified | runbooks/dc-dc-phase0-vcloud-prep.md:464 | storage (verified against HashiCorp's own docs; see `opentofu/README.md` | +| verified | runbooks/dc-dc-phase0-vcloud-prep.md:500 | **GATE (buildout-design Section 4, Phase 0):** nested KVM verified (Step 2/4); | +| verified | runbooks/dc-dc-phase1-office1-standup.md:157 | command lines are NOT yet verified.** See the PENDING VERIFICATION banner | +| blocking | runbooks/dc-dc-phase1-office1-standup.md:679 | this runbook. Record that as the blocking condition rather than inventing | +| verified | runbooks/dc-dc-phase1-office1-standup.md:835 | - **OpenTofu reaches vcloud host libvirt:** **MET** (Stage 1; re-verified in Ste... | +| imported | runbooks/dc-dc-phase1-office1-standup.md:892 | the D-101 literals were genuinely assigned and imported this run. | +| verified | runbooks/dc-dc-phase1-office1-standup.md:896 | inherits a verified procedure rather than repeating the verification. | +| verified | runbooks/dc-dc-phase2-tofu-dc-substrate.md:176 | the `org.qemu.guest_agent.0` virtio-serial channel** (verified ABSENT 2026-07-18... | +| imported | runbooks/dc-dc-phase2-tofu-dc-substrate.md:57 | that carve is imported to `office1-netbox`. So the blocker is no longer a | +| verified | runbooks/dc-dc-phase2-tofu-dc-substrate.md:674 | record that honestly rather than declaring edge routing verified when it is | +| unblocked | runbooks/dc-dc-phase2-tofu-dc-substrate.md:85 | used to block Step 6; it is now UNBLOCKED. Still open (one sub-ruling | +| unblocked | runbooks/dc-dc-phase3-maas-enlist-deploy.md:104 | is unblocked at this layer (D-101: DC1 inherits DC0's v4 layout | +| imported | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:163 | assigns DC2's real supernet and it's imported via `netbox/dc-dc-prefixes- | +| unverified | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:190 | UNVERIFIED -- check the actual charm config/relation-data schema (e.g. | +| verified | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:315 | Ceph-over-v6 and geneve-over-v6 verified (Step 12, contingent on Step 6). | +| unblocked | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:318 | since only DC1 is unblocked by real address literals today) -> proceed to | +| verified | runbooks/dc-dc-phase5-dr-failover-drill.md:13 | and geneve-over-v6 verified. Do not start this runbook against a DC that hasn't ... | +| verified | runbooks/dc-dc-phase5-dr-failover-drill.md:465 | restore-verified-working as this drill's own RTO data point (control-plane, dist... | +| blocking | runbooks/dc-dc-phase5-dr-failover-drill.md:614 | passed; partial otherwise, with the specific blocking item named). | +| verified | runbooks/dc-dc-teardown-rollback.md:16 | (verified against HashiCorp's own current docs where cited), not invented -- | +| verified | runbooks/dc-dc-teardown-rollback.md:374 | verified: this runbook's commands have never been run against a real `tofu` | +| unexercised | runbooks/dc-dc-teardown-rollback.md:376 | `opentofu/`) -- treat every command here as reviewed-but-unexercised until | +| verified | runbooks/ops-capi-recovery.md:113 | GATE: `cluster status: ready`. Verified convergence on gp.mid: ~20-21 min from | +| verified | runbooks/ops-capi-recovery.md:218 | Verified timing: ~108 s to ACTIVE; op holds ONLINE; VIP+FIP preserved (VIP port | +| verified | runbooks/ops-capi-recovery.md:3 | Status: blocks below are AS-EXECUTED-VERIFIED 2026-06-10 (this is their first | +| verified | runbooks/ops-capi-recovery.md:50 | # (no wtmp shutdown entry; verified 2026-06-10). Accepted for this VM class. | +| verified | runbooks/ops-capi-recovery.md:91 | GATE: SSH-PORT-OK. Timing (verified, gp.mid): ACTIVE ~20 s; sshd ~3.5 min. | +| verified | runbooks/ops-restart-procedure.md:51 | the cloud guests above. FOUNDATIONAL service VMs autostart (`voffice1`; `office1... | +| unverified | runbooks/ops-update-procedure.md:123 | unhealthy or unverified cloud. Commit the `asbuilt/<ts>/` BOM as the | +| verified | runbooks/ops-update-procedure.md:187 | **RUN -- jumphost** (flags per 1.6; form verified as-executed 2026-07-05) | +| verified | runbooks/ops-update-procedure.md:216 | **RUN -- jumphost** (form verified as-executed 2026-07-05) | +| verified | runbooks/ops-update-procedure.md:222 | already brought machine 0's agent to target (verified live; check with | +| verified | runbooks/ops-update-procedure.md:88 | version under `juju-status`, NOT `agent-status` -- verified 2026-07-05; | +| non-blocking | runbooks/phase-01-bundle-deploy.md:199 | clean). FINDING (non-blocking, R15): the unreachable region resolver `10.12.8.10... | +| non-blocking | runbooks/phase-03-core-verify.md:187 | keystone admin on `:35357`). Two non-blocking notes for later: s3/swift is regis... | +| verified | runbooks/phase-05-octavia-enablement.md:102 | This is the verified canonical block (06-03). One `( set -e )` | +| verified | runbooks/phase-05-octavia-enablement.md:161 | echo "[OK] checksum verified ($GOT)" | +| verified | runbooks/phase-06-incloud-mgmt-cluster.md:113 | PROJ_DOMAIN="capi" # as-built, verified live 2... | +| verified | runbooks/phase-06-incloud-mgmt-cluster.md:143 | echo "=== flavors (as-built specs; public -- verified live 2026-06-10 pre-teardo... | +| verified | runbooks/phase-06-incloud-mgmt-cluster.md:173 | echo "[OK] checksum verified ($GOT)" | +| verified | runbooks/phase-06-incloud-mgmt-cluster.md:180 | # as-built (verified live 2026-06-10): visibility=public, os_distro=ubuntu, os_v... | +| verified | runbooks/phase-06-incloud-mgmt-cluster.md:24 | - Charmed OpenStack live and verified (phase-03 done); Keystone reachable on the | +| verified | runbooks/phase-06-incloud-mgmt-cluster.md:77 | Flavor specs are as-built ground truth (2026-06-08 verified-state checkpoint): | +| verified | runbooks/phase-06-incloud-mgmt-cluster.md:94 | AS-BUILT FACTS (verified live 2026-06-10 pre-teardown; supersede the rebuild | +| verified | runbooks/phase-07-conductor-graft.md:246 | # AND symlink /usr/bin/helm -> it (/usr/bin IS on the restricted init PATH). Che... | +| verified | runbooks/phase-07-conductor-graft.md:493 | /etc/magnum/magnum.conf.d"`; verified live via `ps` and the init script `show-ar... | +| verified | runbooks/phase-08-workload-cluster-acceptance.md:138 | echo "[OK] sha512 verified against the azimuth-images 0.28.0 manifest" | +| verified | runbooks/tenant-onboarding-v2-DRAFT.md:34 | [PROCEDURE-PENDING] design-derived (appendix-D from magnum source); NOT yet... | +| verified | runbooks/tenant-onboarding-v2-DRAFT.md:422 | STATUS: NOT YET LIVE-VERIFIED on the multi-tenant path as of this draft. D-064 f... | + +## 5. Reference integrity + +### Broken path references +| ref | where | +|---|---| +| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3061 | +| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3072 | +| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3158 | +| creds-manifests/vr1-dc | docs/dc0-deploy-readiness.md:27 | +| docs/3.7 | docs/v1-redeploy-changelog.md:226 | +| docs/CURRENT-STATE.md | docs/audit/grounding-audit-charter.md:119 | +| docs/CURRENT-STATE.md | docs/audit/skill-additions-proposed.md:11 | +| docs/archive | docs/audit/grounding-audit-charter.md:184 | +| docs/changelog | docs/session-ledger.md:24 | +| docs/changelog-20260709-ceph-replication | runbooks/dc-dc-phase5-dr-failover-drill.md:674 | +| docs/changelog-20260709-designate | docs/dc-dc-deployment-workflow.md:658 | +| docs/changelog-20260710 | runbooks/dc-dc-phase0-vcloud-prep.md:7 | +| docs/changelog-20260716-review | docs/session-ledger.md:407 | +| docs/cli/how-to-use-lxd.html | .claude/skills/openstack-cloud-ops/references/platform-traps.md:310 | +| docs/code | docs/session-ledger.md:407 | +| docs/configuration/storage | docs/D-068-openbao-assessment-DRAFT.md:85 | +| docs/data-sources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:67 | +| docs/dc-dc | docs/changelog-20260709-dc-dc-phase1-runbook.md:12 | +| docs/dc-dc | docs/changelog-20260709-dc-dc-phase2-runbook.md:13 | +| docs/dc-dc | docs/changelog-20260709-dc-dc-phase3-runbook.md:12 | +| docs/dc-dc | docs/changelog-20260709-dc-dc-phase4-runbook.md:12 | +| docs/dc-dc | docs/changelog-20260709-dc-dc-phase5-runbook.md:12 | +| docs/dc-dc | docs/changelog-20260709-dc-dc-phase6-runbook.md:12 | +| docs/dc-dc | docs/changelog-20260709-netem-ula-gua-proposal.md:10 | +| docs/dc-dc | runbooks/dc-dc-phase6-designate-cos-magnum.md:113 | +| docs/dc-dc-D100-D110.append.md | docs/changelog-20260709-dc-dc-design.md:16 | +| docs/dc-dc-D100-D110.append.md | docs/dc-dc-buildout-design.md:230 | +| docs/dc-dc-buildout | .claude/skills/openstack-cloud-ops/references/environment.md:112 | +| docs/dc-dc-buildout | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:4 | +| docs/dc-dc-deployment | docs/changelog-20260709-adversarial-review-fixes.md:34 | +| docs/dc-dc-deployment | docs/changelog-20260709-ceph-replication-tooling.md:142 | +| docs/dc-dc-deployment | docs/changelog-20260709-ceph-replication-tooling.md:4 | +| docs/dc-dc-deployment | docs/changelog-20260709-dc-dc-phase0-runbook.md:13 | +| docs/dc-dc-deployment | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:144 | +| docs/dc-dc-deployment | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:16 | +| docs/dc-dc-deployment | runbooks/dc-dc-phase6-designate-cos-magnum.md:623 | +| docs/dc-dc-ipv6 | docs/changelog-20260709-ipv6-family-matrix-overlay.md:11 | +| docs/dc-dc-ipv6-charm | docs/changelog-20260709-ipv6-family-matrix-overlay.md:61 | +| docs/dc-dc-ipv6-charm | docs/dc-dc-deployment-workflow.md:625 | +| docs/dc-dc-netem-and-ula-gua | docs/dc-dc-deployment-workflow.md:494 | +| docs/design-decisions | docs/v1-pre-deploy-fixes.md:130 | +| docs/design-decisions | docs/v1-pre-deploy-fixes.md:170 | +| docs/design-decisions | docs/v1-pre-deploy-fixes.md:660 | +| docs/discourse | docs/changelog-20260716-d124-rack-addressing.md:46 | +| docs/discourse | docs/stage3-review-base.patch:268 | +| docs/fip-edge-diagnosis-checkpoint-20260627.md | docs/v1-redeploy-changelog.md:968 | +| docs/forum/GitHub | docs/changelog-20260709-opentofu-audit.md:84 | +| docs/forum/GitHub | docs/changelog-20260709-opnsense-research.md:9 | +| docs/guides/migration | docs/D-068-openbao-assessment-DRAFT.md:85 | +| docs/how-to-manage-machines | .claude/skills/openstack-cloud-ops/references/platform-traps.md:283 | +| docs/how-to/virtualisation/enable-nested-virtualisation | .claude/skills/openstack-cloud-ops/references/platform-traps.md:117 | +| docs/index.md | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:88 | +| docs/language/resources/provisioners/local-exec | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:99 | +| docs/language/resources/tf-data | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:101 | +| docs/latest/reference/network_bridge | .claude/skills/openstack-cloud-ops/references/platform-traps.md:274 | +| docs/latest/reference/releases-snap | .claude/skills/openstack-cloud-ops/references/platform-traps.md:263 | +| docs/ledger | memory/review-after-each-step.md:21 | +| docs/netbox-vip-queue | docs/v1-pre-deploy-fixes.md:740 | +| docs/r | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:42 | +| docs/r | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:68 | +| docs/repro-example.md | docs/changelog-20260710-ledger-scan-self-inflicted-falsepositive-fix.md:50 | +| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:42 | +| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:67 | +| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:88 | +| docs/resources | .claude/skills/openstack-cloud-ops/references/platform-traps.md:47 | +| docs/resources | docs/changelog-20260709-opentofu-maas-netem.md:23 | +| docs/resources | docs/changelog-20260709-opentofu-scaffold.md:34 | +| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:182 | +| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:78 | +| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:92 | +| docs/stage3-adversarial-review | docs/session-ledger.md:309 | +| docs/tenant-cidr-overlap | docs/v1-redeploy-changelog.md:2439 | +| docs/v1-deploy-runbook.md | docs/handoff-20260703-open-items.md:139 | +| docs/v1-deploy-runbook.md | docs/handoff-20260705-open-items.md:84 | +| docs/v1-deploy-runbook.md | docs/session-ledger.md:1060 | +| docs/v1-deploy-runbook.md | runbooks/phase-08-workload-cluster-acceptance.md:357 | +| docs/v1-deploy-runbook.md | runbooks/phase-08-workload-cluster-acceptance.md:379 | +| netbox/MAAS | docs/dc0-deploy-readiness.md:13 | +| netbox/api/authentication.py | docs/changelog-20260713-office1-netbox-deployed.md:30 | +| netbox/dc-dc | docs/dc-dc-netem-and-ula-gua-proposal.md:109 | +| netbox/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:439 | +| netbox/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:806 | +| netbox/dc-dc-prefixes | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:163 | +| netbox/ipv4-prefixes | docs/v1-pre-deploy-fixes.md:694 | +| netbox/ipv4-prefixes | docs/v1-pre-deploy-fixes.md:712 | +| netbox/ipv4-vips-import.py | docs/netbox-vip-queue.md:89 | +| netbox/tailscale | docs/design-decisions.md:3929 | +| netbox/tailscale | docs/design-decisions.md:3959 | +| netbox/tailscale | docs/session-ledger.md:185 | +| netbox/tailscale | docs/vr1-office1-as-built.md:59 | +| opentofu/templates/opnsense-config.xml.tmpl | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:116 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260709-opnsense-config-design.md:10 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260709-opnsense-config-design.md:9 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260712-opnsense-edge-real-isp-router.md:15 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260712-opnsense-edge-real-isp-router.md:38 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260713-config-xml-path-deleted.md:29 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260713-opnsense-apikey-bootstrap.md:70 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/dc-dc-deployment-workflow.md:332 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/dc-dc-deployment-workflow.md:474 | +| opentofu/templates/opnsense-config.xml.tmpl | docs/design-decisions.md:2386 | +| references/ci-automation.md | docs/clientdocs-workflow-review-20260708.md:57 | +| references/day2-operations.md | docs/clientdocs-workflow-review-20260708.md:115 | +| references/kubernetes.md | docs/v1-redeploy-changelog.md:2987 | +| references/kubernetes.md | docs/v1-redeploy-changelog.md:3179 | +| references/kubernetes.md | docs/v1-redeploy-changelog.md:3346 | +| references/kubernetes.md | docs/v1-redeploy-changelog.md:3366 | +| references/kubernetes.md | docs/v1-redeploy-changelog.md:3400 | +| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:225 | +| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:303 | +| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:327 | +| runbooks/01-destroy-model.md | docs/design-decisions.md:367 | +| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:226 | +| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:318 | +| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:339 | +| runbooks/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:304 | +| runbooks/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:328 | +| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:227 | +| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:305 | +| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:329 | +| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:228 | +| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:306 | +| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:330 | +| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:229 | +| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:307 | +| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:331 | +| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:147 | +| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:328 | +| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:332 | +| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:583 | +| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:230 | +| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:308 | +| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:332 | +| runbooks/05-magnum-capi-driver.md | docs/design-decisions.md:138 | +| runbooks/05-magnum-capi-driver.md | docs/design-decisions.md:149 | +| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:231 | +| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:309 | +| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:333 | +| runbooks/06-tenant-setup.md | docs/netbox-vip-queue.md:76 | +| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:232 | +| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:310 | +| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:334 | +| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:233 | +| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:311 | +| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:335 | +| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:234 | +| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:312 | +| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:336 | +| runbooks/appendix-B | .claude/skills/openstack-cloud-ops/references/environment.md:89 | +| runbooks/appendix-B | docs/v1-redeploy-changelog.md:2051 | +| runbooks/dc | docs/dc-dc-deployment-workflow.md:500 | +| runbooks/dc-dc-phase0..6 | .claude/skills/openstack-cloud-ops/references/environment.md:114 | +| runbooks/dc-dc-phase1-office1 | docs/changelog-20260715-creds-consolidation.md:30 | +| runbooks/dc-dc-phase2 | docs/changelog-20260713-config-xml-danger-sweep.md:17 | +| runbooks/dc-dc-phase3 | docs/changelog-20260709-maas-scripts-dc-param.md:145 | +| runbooks/dc-dc-phase4-juju | docs/changelog-20260709-ipv6-family-matrix-overlay.md:12 | +| runbooks/dc-dc-phase4-juju-bundle | docs/changelog-20260709-ipv6-family-matrix-overlay.md:62 | +| runbooks/dc-dc-phase5-dr | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:76 | +| runbooks/dc-dc-phase6-designate | docs/changelog-20260709-designate-cinderbackup-rbdmirror.md:55 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:213 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:289 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:293 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:297 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:325 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:327 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:328 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:329 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:330 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:331 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:332 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:333 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:334 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:335 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:336 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:345 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:402 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:803 | +| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:804 | +| runbooks/deprecated/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:303 | +| runbooks/deprecated/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:304 | +| runbooks/deprecated/02-deploy.md | docs/v1-pre-deploy-fixes.md:305 | +| runbooks/deprecated/03-vault-init.md | docs/v1-pre-deploy-fixes.md:306 | +| runbooks/deprecated/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:307 | +| runbooks/deprecated/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:308 | +| runbooks/deprecated/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:309 | +| runbooks/deprecated/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:310 | +| runbooks/deprecated/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:311 | +| runbooks/deprecated/08-validate.md | docs/v1-pre-deploy-fixes.md:312 | +| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:293 | +| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:360 | +| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:364 | +| runbooks/hardening | memory/project-posture-closed-test.md:3 | +| runbooks/jumphost-provider-vip-gateway.md | docs/README-D057-PACK.md:104 | +| runbooks/jumphost-provider-vip-gateway.md | docs/README-D057-PACK.md:54 | +| runbooks/jumphost-provider-vip-gateway.md | docs/design-decisions.md:971 | +| runbooks/opentofu/scripts | docs/changelog-20260710-skill-vr1-awareness.md:35 | +| runbooks/phase-00 | docs/changelog-20260709-dc-dc-phase0-runbook.md:18 | +| runbooks/phase-00-maas-reconfigure.md | docs/design-decisions.md:972 | +| runbooks/phase-00-maas-reconfigure.md | docs/v1-redeploy-changelog.md:1013 | +| runbooks/phase-00-teardown | docs/changelog-20260709-maas-scripts-dc-param.md:47 | +| runbooks/phase-00-teardown | docs/dc-dc-deployment-workflow.md:784 | +| runbooks/phase-00-teardown-release.sh | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:11 | +| runbooks/phase-00-teardown-release.sh | runbooks/dc-dc-teardown-rollback.md:8 | +| runbooks/phase-00..08 | .claude/skills/openstack-cloud-ops/references/environment.md:85 | +| runbooks/phase-00b-host-reenrollment.md | docs/v1-redeploy-changelog.md:193 | +| runbooks/phase-01..08 | docs/dc-dc-deployment-workflow.md:218 | +| runbooks/phase-01..08 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:6 | +| runbooks/phase-04-network | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:258 | +| runbooks/phase-06 | docs/design-decisions.md:149 | +| runbooks/phase-06 | docs/design-decisions.md:332 | +| runbooks/provider-vip-maas-standup.md | docs/README-D057-PACK.md:49 | +| runbooks/provider-vip-maas-standup.md | docs/design-decisions.md:972 | +| runbooks/tenant-onboarding-runbook.md | docs/tenant-cidr-overlap-correction-PLAN.md:112 | +| scripts/RUN-blocks/skill | .claude/skills/openstack-cloud-ops/references/environment.md:55 | +| scripts/X.sh | docs/v1-redeploy-changelog.md:51 | +| scripts/X.sh | docs/v1-redeploy-changelog.md:692 | +| scripts/X.sh | docs/v1-redeploy-changelog.md:693 | +| scripts/X.sh | docs/v1-redeploy-changelog.md:826 | +| scripts/carve | docs/changelog-20260709-maas-scripts-dc-param.md:110 | +| scripts/carve-host | docs/changelog-20260709-maas-scripts-dc-param.md:8 | +| scripts/clouds.yaml.template | docs/clientdocs-workflow-review-20260708.md:112 | +| scripts/clouds.yaml.template | docs/clientdocs-workflow-review-20260708.md:54 | +| scripts/d057-bundle-check.py | docs/D-057-REVIEW-ITEMS.md:27 | +| scripts/d057-bundle-check.py | docs/D-058-renumber.md:57 | +| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:37 | +| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:39 | +| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:98 | +| scripts/d057-bundle-check.py | docs/design-decisions.md:957 | +| scripts/d057-bundle-check.py | docs/design-decisions.md:970 | +| scripts/dc-dc | .claude/skills/openstack-cloud-ops/references/environment.md:116 | +| scripts/dc-dc | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:19 | +| scripts/dc-dc | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:46 | +| scripts/dc-dc | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:65 | +| scripts/dc-dc | runbooks/dc-dc-phase5-dr-failover-drill.md:652 | +| scripts/harnesses | docs/changelog-20260709-ceph-replication-tooling.md:126 | +| scripts/lib | docs/changelog-20260709-dc-dc-phase3-runbook.md:70 | +| scripts/opentofu | docs/dc-dc-deployment-workflow.md:588 | +| scripts/opnsense-apply-config.sh | docs/changelog-20260713-office1-dhcp-apply.md:86 | +| scripts/opnsense-apply-config.sh | docs/session-ledger.md:1026 | +| scripts/opnsense-build-config-iso.sh | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:117 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-ceph-replication-tooling.md:17 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opentofu-audit.md:105 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opentofu-audit.md:13 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-config-design.md:23 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:25 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:26 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:80 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260713-config-xml-danger-sweep.md:36 | +| scripts/opnsense-build-config-iso.sh | docs/changelog-20260713-config-xml-path-deleted.md:31 | +| scripts/opnsense-build-config-iso.sh | docs/dc-dc-deployment-workflow.md:472 | +| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2274 | +| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2330 | +| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2387 | +| scripts/opnsense-prep | docs/changelog-20260709-ceph-replication-tooling.md:16 | +| scripts/opnsense-render-config.sh | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:117 | +| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:11 | +| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:19 | +| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:70 | +| scripts/opnsense-render-config.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:20 | +| scripts/opnsense-render-config.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:38 | +| scripts/opnsense-render-config.sh | docs/changelog-20260713-config-xml-danger-sweep.md:35 | +| scripts/opnsense-render-config.sh | docs/changelog-20260713-config-xml-path-deleted.md:30 | +| scripts/opnsense-render-config.sh | docs/changelog-20260713-office1-dhcp-apply.md:13 | +| scripts/opnsense-render-config.sh | docs/dc-dc-deployment-workflow.md:477 | +| scripts/opnsense-render-config.sh | docs/design-decisions.md:2386 | +| scripts/phase-00 | docs/changelog-20260709-ceph-replication-tooling.md:72 | +| scripts/phase-00-maas-carve.sh | docs/D-058-renumber.md:67 | +| scripts/phase-00-maas-carve.sh | docs/v1-redeploy-changelog.md:817 | +| scripts/phase-00-maas-recidr.sh | docs/design-decisions.md:969 | +| scripts/phase-00-maas-recidr.sh | docs/v1-redeploy-changelog.md:1012 | +| scripts/phase-00-teardown.sh | docs/changelog-20260703-process-hardening.md:172 | +| scripts/phase-00-teardown.sh | docs/design-decisions.md:961 | +| scripts/phase-00-teardown.sh | docs/docfix-draft-20260702.md:24 | +| scripts/provider | docs/dc-dc-deployment-workflow.md:657 | +| scripts/provider-bundle | docs/dc-dc-deployment-workflow.md:534 | +| scripts/provider-vip-standup.sh | docs/D-057-REVIEW-ITEMS.md:52 | +| scripts/provider-vip-standup.sh | docs/D-057-REVIEW-ITEMS.md:9 | +| scripts/provider-vip-standup.sh | docs/D-058-renumber.md:56 | +| scripts/provider-vip-standup.sh | docs/README-D057-PACK.md:23 | +| scripts/provider-vip-standup.sh | docs/README-D057-PACK.md:99 | +| scripts/provider-vip-standup.sh | docs/design-decisions.md:970 | +| scripts/review-bundle.py | docs/D-057-REVIEW-ITEMS.md:18 | +| scripts/review-bundle.py | docs/D-058-renumber.md:69 | +| scripts/review-bundle.py | docs/changelog-20260703-process-hardening.md:171 | +| scripts/review-bundle.py | docs/changelog-20260703-process-hardening.md:50 | +| scripts/review-bundle.py | docs/docfix-draft-20260702.md:76 | +| scripts/runbooks | docs/design-decisions.md:860 | +| scripts/runbooks/skill | docs/changelog-20260709-repo-agnostic-sweep.md:10 | +| scripts/tenant | docs/v1-redeploy-changelog.md:2406 | +| scripts/tenant-cluster-create.sh | docs/session-ledger.md:899 | +| scripts/tenant-cluster-create.sh | docs/v1-redeploy-changelog.md:1449 | +| scripts/x.sh | docs/docfix-draft-20260702.md:72 | +| tests/-fixture | docs/v1-redeploy-changelog.md:2481 | +| tests/carve-host-interfaces/run | docs/changelog-20260709-maas-scripts-dc-param.md:18 | +| tests/dc-dc | docs/changelog-20260709-ceph-replication-tooling.md:129 | +| tests/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:445 | +| tests/dc-dc-rbd-mirror/run | docs/changelog-20260709-ceph-replication-tooling.md:40 | +| tests/dc-selector/run | docs/changelog-20260709-adversarial-review-fixes.md:88 | +| tests/opnsense-build-config-iso | docs/changelog-20260709-opnsense-edge-module.md:81 | +| tests/opnsense-build-config-iso | docs/changelog-20260713-config-xml-path-deleted.md:31 | +| tests/opnsense-build-config-iso/run-tests.sh | docs/changelog-20260709-opnsense-edge-module.md:26 | +| tests/opnsense-render-config | docs/changelog-20260709-opnsense-config-design.md:71 | +| tests/opnsense-render-config | docs/changelog-20260713-config-xml-path-deleted.md:30 | +| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260709-opnsense-config-design.md:12 | +| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:21 | +| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:26 | +| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:39 | +| tests/phase-00-carve | docs/v1-redeploy-changelog.md:822 | +| tests/phase-00-carve/run-tests.sh | docs/D-058-renumber.md:75 | +| tests/phase-00-maas-recidr | docs/changelog-20260703-process-hardening.md:246 | +| tests/phase-00-teardown | docs/changelog-20260703-process-hardening.md:243 | +| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:814 | +| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:835 | +| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:838 | +| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:844 | +| tests/provider-vip-standup | docs/README-D057-PACK.md:42 | +| tests/provider-vip-standup | docs/changelog-20260703-process-hardening.md:245 | +| tests/provider-vip-standup/run-tests.sh | docs/README-D057-PACK.md:107 | +| tests/reenroll | docs/changelog-20260709-maas-scripts-dc-param.md:19 | +| tests/tenant | docs/v1-redeploy-changelog.md:2673 | + +### Orphan / unregistered number references +| ref | where | why | +|---|---|---| +| BUNDLEFIX-013 | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:96 | referenced nowhere else | +| BUNDLEFIX-051 | docs/repo-lint-nextfree-bug-FINDING.md:20 | referenced nowhere else | +| D-054 | docs/D-057-DECIDED-append.md:9 | not in design-decisions.md | +| D-054 | docs/D-058-renumber.md:5 | not in design-decisions.md | +| D-054 | docs/v1-redeploy-changelog.md:117 | not in design-decisions.md | +| D-054 | docs/v1-redeploy-changelog.md:12 | not in design-decisions.md | +| D-054 | docs/v1-redeploy-changelog.md:42 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:1119 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:1196 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:1213 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:322 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:491 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:500 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:546 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:775 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:791 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:800 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:801 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:864 | not in design-decisions.md | +| D-056 | docs/v1-redeploy-changelog.md:890 | not in design-decisions.md | +| D-056 | runbooks/phase-04-network-carve.md:79 | not in design-decisions.md | +| D-056 | runbooks/phase-06-incloud-mgmt-cluster.md:13 | not in design-decisions.md | +| D-130 | docs/audit/grounding-audit-charter.md:126 | not in design-decisions.md | +| D-130 | docs/audit/grounding-audit-charter.md:201 | not in design-decisions.md | +| D-130 | docs/audit/grounding-audit-charter.md:216 | not in design-decisions.md | +| D-130 | docs/audit/grounding-audit-charter.md:41 | not in design-decisions.md | +| D-130 | docs/audit/grounding-audit-charter.md:72 | not in design-decisions.md | +| D-130 | docs/audit/grounding-audit-charter.md:81 | not in design-decisions.md | +| D-130 | docs/audit/grounding-audit-charter.md:83 | not in design-decisions.md | +| D-130 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:131 | not in design-decisions.md | +| D-130 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:235 | not in design-decisions.md | +| D-130 | docs/session-ledger.md:255 | not in design-decisions.md | +| D-130 | docs/session-ledger.md:273 | not in design-decisions.md | +| D-130 | docs/session-ledger.md:275 | not in design-decisions.md | +| D-2 | docs/handoff-20260703-open-items.md:123 | referenced nowhere else | +| DOCFIX-017 | runbooks/appendix-A-troubleshooting.md:250 | referenced nowhere else | +| DOCFIX-028 | runbooks/phase-02-vault-bringup.md:160 | referenced nowhere else | +| DOCFIX-029 | runbooks/phase-02-vault-bringup.md:117 | referenced nowhere else | +| DOCFIX-029 | runbooks/phase-02-vault-bringup.md:57 | referenced nowhere else | +| DOCFIX-037 | runbooks/phase-08-workload-cluster-acceptance.md:217 | referenced nowhere else | +| DOCFIX-041 | docs/v1-redeploy-changelog.md:195 | referenced nowhere else | +| DOCFIX-041 | docs/v1-redeploy-changelog.md:323 | referenced nowhere else | +| DOCFIX-043 | docs/v1-redeploy-changelog.md:346 | referenced nowhere else | +| DOCFIX-043 | docs/v1-redeploy-changelog.md:481 | referenced nowhere else | +| DOCFIX-043 | docs/v1-redeploy-changelog.md:493 | referenced nowhere else | +| DOCFIX-044 | docs/v1-redeploy-changelog.md:491 | referenced nowhere else | +| DOCFIX-044 | docs/v1-redeploy-changelog.md:500 | referenced nowhere else | +| DOCFIX-044 | docs/v1-redeploy-changelog.md:502 | referenced nowhere else | +| DOCFIX-044 | docs/v1-redeploy-changelog.md:547 | referenced nowhere else | +| DOCFIX-044 | docs/v1-redeploy-changelog.md:556 | referenced nowhere else | +| DOCFIX-044 | docs/v1-redeploy-changelog.md:732 | referenced nowhere else | +| DOCFIX-045 | docs/v1-redeploy-changelog.md:546 | referenced nowhere else | +| DOCFIX-045 | docs/v1-redeploy-changelog.md:573 | referenced nowhere else | +| DOCFIX-045 | docs/v1-redeploy-changelog.md:720 | referenced nowhere else | +| DOCFIX-046 | docs/v1-redeploy-changelog.md:1084 | referenced nowhere else | +| DOCFIX-046 | docs/v1-redeploy-changelog.md:608 | referenced nowhere else | +| DOCFIX-046 | docs/v1-redeploy-changelog.md:616 | referenced nowhere else | +| DOCFIX-048 | docs/v1-redeploy-changelog.md:682 | referenced nowhere else | +| DOCFIX-049 | docs/v1-redeploy-changelog.md:697 | referenced nowhere else | +| DOCFIX-049 | docs/v1-redeploy-changelog.md:716 | referenced nowhere else | +| DOCFIX-049 | docs/v1-redeploy-changelog.md:754 | referenced nowhere else | +| DOCFIX-049 | docs/v1-redeploy-changelog.md:757 | referenced nowhere else | +| DOCFIX-050 | docs/v1-redeploy-changelog.md:821 | referenced nowhere else | +| DOCFIX-050 | docs/v1-redeploy-changelog.md:828 | referenced nowhere else | +| DOCFIX-051 | docs/v1-redeploy-changelog.md:831 | referenced nowhere else | +| DOCFIX-052 | docs/v1-redeploy-changelog.md:835 | referenced nowhere else | +| DOCFIX-052 | docs/v1-redeploy-changelog.md:843 | referenced nowhere else | +| DOCFIX-053 | docs/v1-redeploy-changelog.md:873 | referenced nowhere else | +| DOCFIX-056 | docs/v1-redeploy-changelog.md:1023 | referenced nowhere else | +| DOCFIX-058 | docs/v1-redeploy-changelog.md:1083 | referenced nowhere else | +| DOCFIX-079 | docs/changelog-20260703-process-hardening.md:199 | referenced nowhere else | +| DOCFIX-080 | docs/changelog-20260703-process-hardening.md:213 | referenced nowhere else | +| DOCFIX-081 | docs/changelog-20260703-process-hardening.md:222 | referenced nowhere else | +| DOCFIX-090 | docs/v1-redeploy-changelog.md:2040 | referenced nowhere else | +| DOCFIX-092 | docs/v1-redeploy-changelog.md:2093 | referenced nowhere else | +| DOCFIX-092 | docs/v1-redeploy-changelog.md:2095 | referenced nowhere else | +| DOCFIX-092 | docs/v1-redeploy-changelog.md:2116 | referenced nowhere else | +| DOCFIX-103 | docs/v1-redeploy-changelog.md:2392 | referenced nowhere else | +| DOCFIX-108 | docs/v1-redeploy-changelog.md:2497 | referenced nowhere else | +| DOCFIX-108 | docs/v1-redeploy-changelog.md:2499 | referenced nowhere else | +| DOCFIX-108 | docs/v1-redeploy-changelog.md:2506 | referenced nowhere else | +| DOCFIX-108 | docs/v1-redeploy-changelog.md:2544 | referenced nowhere else | +| DOCFIX-109 | docs/v1-redeploy-changelog.md:2499 | referenced nowhere else | +| DOCFIX-109 | docs/v1-redeploy-changelog.md:2525 | referenced nowhere else | +| DOCFIX-109 | docs/v1-redeploy-changelog.md:2546 | referenced nowhere else | +| DOCFIX-109 | docs/v1-redeploy-changelog.md:3168 | referenced nowhere else | +| DOCFIX-110 | docs/v1-redeploy-changelog.md:2555 | referenced nowhere else | +| DOCFIX-110 | docs/v1-redeploy-changelog.md:2557 | referenced nowhere else | +| DOCFIX-110 | docs/v1-redeploy-changelog.md:2559 | referenced nowhere else | +| DOCFIX-117 | docs/v1-redeploy-changelog.md:2670 | referenced nowhere else | +| DOCFIX-119 | docs/v1-redeploy-changelog.md:2814 | referenced nowhere else | +| DOCFIX-119 | docs/v1-redeploy-changelog.md:2816 | referenced nowhere else | +| DOCFIX-119 | docs/v1-redeploy-changelog.md:2831 | referenced nowhere else | +| DOCFIX-119 | docs/v1-redeploy-changelog.md:2859 | referenced nowhere else | +| DOCFIX-124 | docs/v1-redeploy-changelog.md:3031 | referenced nowhere else | +| DOCFIX-124 | docs/v1-redeploy-changelog.md:3071 | referenced nowhere else | +| DOCFIX-125 | docs/v1-redeploy-changelog.md:3074 | referenced nowhere else | +| DOCFIX-125 | docs/v1-redeploy-changelog.md:3078 | referenced nowhere else | +| DOCFIX-125 | docs/v1-redeploy-changelog.md:3093 | referenced nowhere else | +| DOCFIX-127 | docs/v1-redeploy-changelog.md:3096 | referenced nowhere else | +| DOCFIX-127 | docs/v1-redeploy-changelog.md:3113 | referenced nowhere else | +| DOCFIX-127 | docs/v1-redeploy-changelog.md:3129 | referenced nowhere else | +| DOCFIX-128 | docs/v1-redeploy-changelog.md:3132 | referenced nowhere else | +| DOCFIX-128 | docs/v1-redeploy-changelog.md:3157 | referenced nowhere else | +| DOCFIX-129 | docs/v1-redeploy-changelog.md:3160 | referenced nowhere else | +| DOCFIX-129 | docs/v1-redeploy-changelog.md:3193 | referenced nowhere else | +| DOCFIX-129 | docs/v1-redeploy-changelog.md:3345 | referenced nowhere else | +| DOCFIX-130 | docs/v1-redeploy-changelog.md:3196 | referenced nowhere else | +| DOCFIX-130 | docs/v1-redeploy-changelog.md:3256 | referenced nowhere else | +| DOCFIX-130 | docs/v1-redeploy-changelog.md:3339 | referenced nowhere else | +| DOCFIX-130 | docs/v1-redeploy-changelog.md:3342 | referenced nowhere else | +| DOCFIX-130 | docs/v1-redeploy-changelog.md:3360 | referenced nowhere else | +| DOCFIX-130 | docs/v1-redeploy-changelog.md:3362 | referenced nowhere else | +| DOCFIX-130 | docs/v1-redeploy-changelog.md:3385 | referenced nowhere else | +| DOCFIX-131 | docs/v1-redeploy-changelog.md:3259 | referenced nowhere else | +| DOCFIX-131 | docs/v1-redeploy-changelog.md:3284 | referenced nowhere else | +| DOCFIX-132 | docs/v1-redeploy-changelog.md:3287 | referenced nowhere else | +| DOCFIX-132 | docs/v1-redeploy-changelog.md:3297 | referenced nowhere else | +| DOCFIX-133 | docs/v1-redeploy-changelog.md:3300 | referenced nowhere else | +| DOCFIX-133 | docs/v1-redeploy-changelog.md:3316 | referenced nowhere else | +| DOCFIX-133 | docs/v1-redeploy-changelog.md:3427 | referenced nowhere else | +| DOCFIX-134 | docs/v1-redeploy-changelog.md:3319 | referenced nowhere else | +| DOCFIX-134 | docs/v1-redeploy-changelog.md:3331 | referenced nowhere else | +| DOCFIX-134 | docs/v1-redeploy-changelog.md:3437 | referenced nowhere else | +| DOCFIX-136 | docs/v1-redeploy-changelog.md:3360 | referenced nowhere else | +| DOCFIX-136 | docs/v1-redeploy-changelog.md:3387 | referenced nowhere else | +| DOCFIX-136 | docs/v1-redeploy-changelog.md:3393 | referenced nowhere else | +| DOCFIX-143 | docs/changelog-20260709-repo-lint-crlf-fix.md:1 | referenced nowhere else | +| DOCFIX-143 | docs/changelog-20260709-repo-lint-crlf-fix.md:5 | referenced nowhere else | +| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:1 | referenced nowhere else | +| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:25 | referenced nowhere else | +| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:40 | referenced nowhere else | +| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:9 | referenced nowhere else | +| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:1 | referenced nowhere else | +| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:41 | referenced nowhere else | +| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:9 | referenced nowhere else | +| DOCFIX-149 | docs/changelog-20260709-opnsense-config-design.md:1 | referenced nowhere else | +| DOCFIX-149 | docs/changelog-20260709-opnsense-config-design.md:9 | referenced nowhere else | +| DOCFIX-150 | docs/changelog-20260709-stage0-ratification.md:1 | referenced nowhere else | +| DOCFIX-150 | docs/changelog-20260709-stage0-ratification.md:9 | referenced nowhere else | +| DOCFIX-153 | docs/changelog-20260709-dc-dc-phase0-runbook.md:1 | referenced nowhere else | +| DOCFIX-153 | docs/changelog-20260709-dc-dc-phase0-runbook.md:12 | referenced nowhere else | +| DOCFIX-154 | docs/changelog-20260709-dc-dc-phase1-runbook.md:1 | referenced nowhere else | +| DOCFIX-154 | docs/changelog-20260709-dc-dc-phase1-runbook.md:11 | referenced nowhere else | +| DOCFIX-155 | docs/changelog-20260709-dc-dc-phase2-runbook.md:1 | referenced nowhere else | +| DOCFIX-155 | docs/changelog-20260709-dc-dc-phase2-runbook.md:12 | referenced nowhere else | +| DOCFIX-156 | docs/changelog-20260709-dc-dc-phase4-runbook.md:1 | referenced nowhere else | +| DOCFIX-156 | docs/changelog-20260709-dc-dc-phase4-runbook.md:11 | referenced nowhere else | +| DOCFIX-157 | docs/changelog-20260709-dc-dc-phase3-runbook.md:1 | referenced nowhere else | +| DOCFIX-157 | docs/changelog-20260709-dc-dc-phase3-runbook.md:11 | referenced nowhere else | +| DOCFIX-158 | docs/changelog-20260709-dc-dc-phase5-runbook.md:1 | referenced nowhere else | +| DOCFIX-158 | docs/changelog-20260709-dc-dc-phase5-runbook.md:11 | referenced nowhere else | +| DOCFIX-159 | docs/changelog-20260709-dc-dc-phase6-runbook.md:1 | referenced nowhere else | +| DOCFIX-159 | docs/changelog-20260709-dc-dc-phase6-runbook.md:11 | referenced nowhere else | +| DOCFIX-161 | docs/changelog-20260709-final-consolidation.md:1 | referenced nowhere else | +| DOCFIX-161 | docs/changelog-20260709-final-consolidation.md:71 | referenced nowhere else | +| DOCFIX-177 | docs/changelog-20260710-skill-vr1-awareness.md:1 | referenced nowhere else | +| GA-F01 | docs/audit/grounding-audit-charter.md:199 | referenced nowhere else | +| GA-R1 | docs/audit/grounding-audit-charter.md:165 | referenced nowhere else | +| GA-R3 | docs/audit/grounding-audit-charter.md:175 | referenced nowhere else | +| GA-R3 | docs/audit/grounding-audit-charter.md:68 | referenced nowhere else | +| GA-R4 | docs/audit/grounding-audit-charter.md:182 | referenced nowhere else | +| GA-R5 | docs/audit/grounding-audit-charter.md:186 | referenced nowhere else | +| GA-R5 | docs/audit/grounding-audit-charter.md:68 | referenced nowhere else | +| R3-F05 | docs/stage3-adversarial-review-20260716.md:170 | referenced nowhere else | +| R3-F05 | docs/stage3-adversarial-review-20260716.md:306 | referenced nowhere else | +| R3-F07 | docs/stage3-adversarial-review-20260716.md:193 | referenced nowhere else | +| R3-F11 | docs/stage3-adversarial-review-20260716.md:230 | referenced nowhere else | +| R3-F11 | docs/stage3-adversarial-review-20260716.md:317 | referenced nowhere else | +| R3-F13 | docs/stage3-adversarial-review-20260716.md:246 | referenced nowhere else | + +### Unknown commit hashes +| hash | where | +|---|---| +| 01ac01a | docs/stage3-review-base.patch:3005 | +| 04d3175865f4 | memory/creds-folder-convention.md:7 | +| 04d3175865f4 | memory/project-posture-closed-test.md:7 | +| 070de108 | docs/v1-redeploy-changelog.md:1142 | +| 070de108 | runbooks/phase-05-octavia-enablement.md:208 | +| 0885dca3 | docs/v1-redeploy-changelog.md:1230 | +| 09199e8 | docs/stage3-review-base.patch:3256 | +| 097e972 | docs/stage3-review-base.patch:1502 | +| 0d00ddc1 | runbooks/phase-06-incloud-mgmt-cluster.md:42 | +| 0d00ddc1 | runbooks/phase-08-workload-cluster-acceptance.md:47 | +| 0dc65fb | docs/stage3-review-base.patch:2874 | +| 0f968008 | runbooks/ops-capi-recovery.md:19 | +| 0f968008 | runbooks/phase-08-workload-cluster-acceptance.md:366 | +| 14c07d77f167 | runbooks/phase-06-incloud-mgmt-cluster.md:42 | +| 14c07d77f167 | runbooks/phase-08-workload-cluster-acceptance.md:47 | +| 15a14c5a | runbooks/phase-05-octavia-enablement.md:208 | +| 193a8915 | runbooks/tenant-onboarding-v2-DRAFT.md:98 | +| 1dedb917e5ea | docs/changelog-20260709-final-consolidation.md:43 | +| 1f260c0 | docs/stage3-review-base.patch:1561 | +| 25e0aa3 | docs/stage3-review-base.patch:1624 | +| 25e6971 | docs/stage3-review-base.patch:316 | +| 26ed1091 | docs/v1-redeploy-changelog.md:1235 | +| 26ed1091 | runbooks/phase-07-conductor-graft.md:487 | +| 2b8e36983072 | docs/v1-redeploy-changelog.md:665 | +| 2cc95d507e2a | memory/review-after-each-step.md:7 | +| 36582e857d7c | runbooks/phase-04-network-carve.md:171 | +| 4262fb9 | docs/stage3-review-base.patch:1658 | +| 438e59088c6c | docs/changelog-20260713-opnsense-api-write-proven.md:9 | +| 452e126982cf | runbooks/phase-08-workload-cluster-acceptance.md:366 | +| 4586faa7 | docs/v1-redeploy-changelog.md:957 | +| 46e7dd7 | docs/stage3-review-base.patch:2666 | +| 48eb444 | docs/stage3-review-base.patch:1306 | +| 4aa5c18 | docs/stage3-review-base.patch:3756 | +| 544afa6a | docs/v1-redeploy-changelog.md:665 | +| 550f5c691bfb | docs/v1-redeploy-changelog.md:664 | +| 550f5c691bfb | docs/v1-redeploy-changelog.md:860 | +| 581022d | docs/stage3-review-base.patch:652 | +| 5fa5b05e | docs/v1-redeploy-changelog.md:885 | +| 627e3f12 | docs/changelog-20260714-office1-lan-ipv6-executed.md:107 | +| 62f7c00 | runbooks/appendix-B-asbuilt-version-lock.md:97 | +| 62f7c00 | runbooks/phase-06-incloud-mgmt-cluster.md:571 | +| 674171fd | runbooks/ops-capi-recovery.md:19 | +| 6de15cf4 | runbooks/phase-08-workload-cluster-acceptance.md:364 | +| 6ed034f7 | docs/v1-redeploy-changelog.md:749 | +| 6f7848c | docs/design-decisions.md:1422 | +| 6f7848c | docs/v1-redeploy-changelog.md:1371 | +| 7072d66e | docs/v1-redeploy-changelog.md:914 | +| 70b34bb2 | runbooks/phase-04-network-carve.md:171 | +| 75c0e0cb | memory/creds-folder-convention.md:7 | +| 75c0e0cb | memory/project-posture-closed-test.md:7 | +| 760bdb3 | docs/design-decisions.md:722 | +| 76aea330 | docs/v1-redeploy-changelog.md:1461 | +| 7efde485 | docs/design-decisions.md:722 | +| 807e3f5b | docs/v1-redeploy-changelog.md:1143 | +| 807e3f5b | runbooks/phase-05-octavia-enablement.md:210 | +| 839ad1a8 | memory/review-after-each-step.md:7 | +| 8592ee35 | docs/v1-redeploy-changelog.md:1463 | +| 8592ee35 | docs/v1-redeploy-changelog.md:1513 | +| 872a43d1 | runbooks/phase-02-vault-bringup.md:173 | +| 899b4b5c | runbooks/phase-05-octavia-enablement.md:213 | +| 899b4b5c | runbooks/phase-06-incloud-mgmt-cluster.md:43 | +| 89e36ff79901 | docs/v1-redeploy-changelog.md:749 | +| 8a11535 | docs/stage3-review-base.patch:1571 | +| 8b7c3c0 | docs/stage3-review-base.patch:1519 | +| 8de2c48d92cf | runbooks/phase-08-workload-cluster-acceptance.md:364 | +| 8ec679e | docs/stage3-review-base.patch:3406 | +| 8f7329f | docs/stage3-review-base.patch:652 | +| 9005515f23a8 | runbooks/phase-04-network-carve.md:173 | +| 91f8bcc | docs/stage3-review-base.patch:1502 | +| 948e7ee | docs/stage3-review-base.patch:316 | +| 979503c | docs/stage3-review-base.patch:2666 | +| 9a08253 | docs/stage3-review-base.patch:3 | +| 9e141708dd6f | docs/v1-redeploy-changelog.md:752 | +| a08a471 | docs/stage3-review-base.patch:344 | +| a11cf69 | docs/v1-redeploy-changelog.md:912 | +| a275f2a0a6fc | docs/changelog-20260714-office1-lan-ipv6-executed.md:107 | +| a360df32 | docs/v1-redeploy-changelog.md:1407 | +| a360df32 | docs/v1-redeploy-changelog.md:1409 | +| a4e1a7fa | docs/v1-redeploy-changelog.md:1095 | +| a4e1a7fa | runbooks/phase-04-network-carve.md:171 | +| a57aa64 | docs/stage3-review-base.patch:1846 | +| a5aa1e1 | docs/stage3-review-base.patch:2923 | +| a9210d0eefe8 | runbooks/phase-06-incloud-mgmt-cluster.md:43 | +| ae90b82f | docs/v1-redeploy-changelog.md:3024 | +| b0d41d1 | docs/stage3-review-base.patch:1001 | +| b4d6c72e8fe9 | memory/multi-workstation-remote-control.md:7 | +| b87023b | docs/stage3-review-base.patch:665 | +| bb386c86 | docs/v1-redeploy-changelog.md:664 | +| bb386c86 | docs/v1-redeploy-changelog.md:860 | +| c53184b | docs/stage3-review-base.patch:665 | +| c8f9f53a | docs/v1-redeploy-changelog.md:752 | +| c954a6a | docs/stage3-review-base.patch:3756 | +| ca5552a5 | runbooks/phase-05-octavia-enablement.md:211 | +| d527847 | runbooks/appendix-B-asbuilt-version-lock.md:98 | +| d527847 | runbooks/phase-06-incloud-mgmt-cluster.md:571 | +| d878c13 | docs/stage3-review-base.patch:219 | +| d8c4033 | docs/stage3-review-base.patch:811 | +| d8ca624 | docs/stage3-review-base.patch:3307 | +| d9d0a4a8 | docs/v1-redeploy-changelog.md:1229 | +| da0d7b8c89b2 | docs/v1-redeploy-changelog.md:2716 | +| da757cb1 | runbooks/phase-05-octavia-enablement.md:208 | +| df0c9a6 | docs/stage3-review-base.patch:125 | +| e3afcbae | runbooks/phase-04-network-carve.md:173 | +| e4bb2db | docs/stage3-review-base.patch:344 | +| e5fa05aa | memory/multi-workstation-remote-control.md:7 | +| e752f6dd | docs/changelog-20260709-final-consolidation.md:43 | +| ed25519 | docs/design-decisions.md:2227 | +| ed25519 | docs/design-decisions.md:2264 | +| ed25519 | docs/session-ledger.md:814 | +| f50888b | docs/stage3-review-base.patch:1608 | +| f66e5bc5 | docs/v1-redeploy-changelog.md:1096 | +| f66e5bc5 | runbooks/phase-04-network-carve.md:173 | +| f75981d | docs/stage3-review-base.patch:1306 | +| fa61feb | docs/stage3-review-base.patch:1846 | +| fae7ec70 | docs/v1-redeploy-changelog.md:2716 | + +### file:line references out of range or absent +| ref | line | where | why | +|---|---|---|---| + diff --git a/scripts/record-audit.py b/scripts/record-audit.py new file mode 100755 index 0000000..ac28910 --- /dev/null +++ b/scripts/record-audit.py @@ -0,0 +1,474 @@ +#!/usr/bin/env python3 +"""scripts/record-audit.py -- Phase-1 deterministic record inventory (grounding audit). + +Implements Phase 1 items 1, 2 and 4 of docs/audit/grounding-audit-charter.md as a +SCRIPT, not judgment: doc census, status-claim extraction (plan counts, stage +statuses, version pins, gate assertions), and reference integrity (path refs, +D-/DOCFIX-/BUNDLEFIX-/SEC-/R3-F number refs, commit hashes, file:line refs). +Scope per the operator's 2026-07-18 amendment: docs/ + runbooks/ + README.md + +CLAUDE.md + the .claude/skills/openstack-cloud-ops/ tree + (via --memory-dir) the +auto-memory directory, read as on-disk evidence. + +Mutates NOTHING except writing the single report file (--out, default +docs/audit/record-inventory.md under --repo). + +Deterministic counting rules (zero judgment, stated so re-runs are comparable): + - Files under docs/audit/ and the memory dir are INVENTORIED but their rows do + NOT count toward the contradiction-pair exit signal -- the audit's own record + of a defect must not keep the defect alive (charter Phase 6 criterion 1). + - A "contradiction group" is a claim key (the global plan-count set; one + version product; one stage key) holding >1 distinct value across counted + surfaces. The report lists every row; adjudication happens in the findings + register, not here. + - A second pair count EXCLUDING changelog-class files is reported alongside + (changelogs are historical by nature; GA-R2 owns their consolidation). + +Usage: + python3 scripts/record-audit.py [--repo DIR] [--memory-dir DIR] + [--out FILE] [--stamp STRING] [--no-git] + +Exit: 0 = zero counted contradiction groups (PROCEED), 1 = contradictions found +(HOLD), 2 = precondition missing (repo absent/unreadable). ASCII + LF. +""" +import argparse +import os +import re +import subprocess +import sys +from collections import defaultdict +from pathlib import Path + +TEXT_EXT = {".md", ".sh", ".py", ".tf", ".yaml", ".yml", ".txt", ".cfg", ".conf", + ".json", ".tfvars", ".php", ""} +SKIP_DIRS = {".git", ".terraform", "__pycache__", "node_modules"} +MAX_TEXT = 4 * 1024 * 1024 + +STATUS_TOKENS = r"(DEPLOY-READY|READY|BLOCKED|CLOSED|COMPLETED|COMPLETE|HELD|STOPPED)" +GATE_WORDS = r"(non-blocking|blocking|unblocked|unexercised|unverified|imported|verified)" +PRODUCTS = [ + ("tofu", r"(?:OpenTofu|opentofu|tofu)"), + ("maas", r"(?:MAAS|maas)"), + ("juju", r"(?:Juju|juju)"), + ("opnsense", r"(?:OPNsense|opnsense)"), + ("netbox", r"(?:NetBox|netbox)"), + ("lxd", r"(?:LXD|lxd)"), +] +VER_RE = r"v?(\d+\.\d+(?:\.\d+)?)" + + +def die(msg, code): + print(f"record-audit: {msg}", file=sys.stderr) + sys.exit(code) + + +def run_git(repo, args): + try: + out = subprocess.run(["git", "-C", str(repo)] + args, capture_output=True, + text=True, timeout=60) + return out.returncode, out.stdout.strip() + except Exception: + return 1, "" + + +def is_text_candidate(p: Path): + return p.suffix.lower() in TEXT_EXT and p.is_file() and p.stat().st_size <= MAX_TEXT + + +def read_lines(p: Path): + try: + return p.read_text(encoding="utf-8", errors="replace").splitlines() + except Exception: + return [] + + +def classify(rel: str): + b = os.path.basename(rel) + if rel.startswith("docs/audit/"): + return "audit" + if b.startswith("changelog-"): + return "changelog" + if b == "design-decisions.md": + return "decision" + if "ledger" in b: + return "ledger" + if "readiness" in b: + return "readiness" + if "finding" in b: + return "finding" + if "patch" in b or rel.endswith(".patch"): + return "patch" + if "workflow" in b: + return "workflow" + if rel.startswith("runbooks/"): + return "runbook" + return "reference" + + +def trim(line, n=110): + s = line.strip().replace("|", "\\|") + return s[:n] + ("..." if len(s) > n else "") + + +class Row: + __slots__ = ("kind", "key", "value", "loc", "line", "counted", "census_class") + + def __init__(self, kind, key, value, loc, line, counted, census_class): + self.kind, self.key, self.value = kind, key, value + self.loc, self.line = loc, line + self.counted, self.census_class = counted, census_class + + +def extract_claims(rel, lines, counted, census_class): + rows = [] + + def add(kind, key, value, i, line): + rows.append(Row(kind, key, value, f"{rel}:{i}", line, counted, census_class)) + + plan_wordy = re.compile( + r"(\d+)\s*(?:add|create[sd]?)\s*/\s*(\d+(?:-or-\d+)?)\s*" + r"(?:change[sd]?|in-place|update[sd]?)\s*/\s*(\d+)\s*(?:destroy|delete[sd]?)", re.I) + plan_hyphen = re.compile( + r"(\d+)-add/\(?(\d+(?:-or-\d+)?)\)?-change/(\d+)-destroy", re.I) + plan_tofu = re.compile(r"(\d+) to add, (\d+) to change, (\d+) to destroy") + plan_compact = re.compile(r"\b(\d{1,2})/(\d{1,2})/(\d{1,2})\b") + plan_context = re.compile(r"\b(plan|apply|add|destroy|outer|inner)\b", re.I) + stage_tok = re.compile(r"\b" + STATUS_TOKENS + r"\b") + stage_key = re.compile(r"[Ss]tage[- ]?(\d+)") + gate_tok = re.compile(r"\b" + GATE_WORDS + r"\b", re.I) + + # Version attribution: the version string must follow the product token with + # no digits and no OTHER product/noise token in between (kills cross-product + # bleed, Ubuntu/Django/kernel versions, URL/section numbers). + prod_words = [(k, re.compile(r"(?<![A-Za-z])" + pat + r"(?![A-Za-z])")) + for k, pat in PRODUCTS] + ver_only = re.compile(VER_RE) + ver_noise = re.compile( + r"ubuntu|django|freebsd|postgres|python|pynetbox|kernel|kea|topic|" + r"section|vault|mysql|ceph|caracal|noble|raft|charm", re.I) + + for i, line in enumerate(lines, 1): + seen_span = [] + for m in plan_wordy.finditer(line): + add("plan", "plan", "/".join(m.groups()), i, line) + seen_span.append(m.span()) + for m in plan_hyphen.finditer(line): + add("plan", "plan", "/".join(m.groups()), i, line) + seen_span.append(m.span()) + for m in plan_tofu.finditer(line): + add("plan", "plan", "/".join(m.groups()), i, line) + seen_span.append(m.span()) + if plan_context.search(line): + for m in plan_compact.finditer(line): + if any(a <= m.start() < b for a, b in seen_span): + continue + # not part of a longer x/y/z/w chain, date range, or decimal + tail = line[m.end():] + head = line[:m.start()] + if tail[:1] in "/-." or head[-1:] in "/-.": + continue + add("plan", "plan", "/".join(m.groups()), i, line) + + for m in stage_tok.finditer(line): + tok = m.group(1) + norm = {"DEPLOY-READY": "READY", "COMPLETED": "COMPLETE"}.get(tok, tok) + km = stage_key.search(line) + key = f"stage-{km.group(1)}" if km else "-" + add("status", key, norm, i, line) + + for prod, pre in prod_words: + for pm in pre.finditer(line): + seg = line[pm.end():pm.end() + 46] + vm = ver_only.search(seg) + if not vm: + continue + between = seg[:vm.start()] + if re.search(r"\d", between) or ver_noise.search(between): + continue + if vm.start() > 0 and (seg[vm.start() - 1] == "." or + seg[vm.start() - 1].isalpha()): + continue # '.8.20' octet fragment / 'C2.3' checklist id + if any(k2 != prod and p2.search(between) for k2, p2 in prod_words): + continue + after = seg[vm.end():] + if (after[:1] == "." and after[1:2].isdigit()) or after[:1] == "%": + continue # IP fragment / percentage, not a version + add("version", prod, vm.group(1), i, line) + + for m in gate_tok.finditer(line): + add("gate", "gate", m.group(1).lower(), i, line) + return rows + + +PATH_RE = re.compile( + r"\b((?:docs|runbooks|scripts|tests|opentofu|netbox|policies|clientdocs|" + r"creds-manifests|references)/[A-Za-z0-9._@/-]*[A-Za-z0-9])") +NUM_RE = re.compile(r"\b((?:D|DOCFIX|BUNDLEFIX|SEC)-\d{1,3}|GA-[FR]\d{1,2}|R3-F\d{2})\b") +HASH_RE = re.compile(r"\b[0-9a-f]{7,12}\b") +FILELINE_RE = re.compile( + r"\b((?:docs|runbooks|scripts|opentofu|tests)/[A-Za-z0-9._/-]+\." + r"(?:md|sh|py|tf)):(\d+)\b") + + +def extract_refs(rel, lines, skill_base): + paths, nums, hashes, filelines = [], [], [], [] + for i, line in enumerate(lines, 1): + for m in PATH_RE.finditer(line): + p = m.group(1).rstrip(".,;:") + if any(c in p for c in "*<>{}$") or "YYYY" in p or "NN" in p: + continue + paths.append((p, f"{rel}:{i}")) + for m in NUM_RE.finditer(line): + nums.append((m.group(1), f"{rel}:{i}")) + for m in HASH_RE.finditer(line): + h = m.group(0) + if re.search(r"[a-f]", h) and re.search(r"[0-9]", h): + hashes.append((h, f"{rel}:{i}")) + for m in FILELINE_RE.finditer(line): + filelines.append((m.group(1), int(m.group(2)), f"{rel}:{i}")) + return paths, nums, hashes, filelines + + +def main(): + ap = argparse.ArgumentParser(description=__doc__.splitlines()[0]) + ap.add_argument("--repo", default=None) + ap.add_argument("--memory-dir", default=None) + ap.add_argument("--out", default=None) + ap.add_argument("--stamp", default="") + ap.add_argument("--no-git", action="store_true") + a = ap.parse_args() + + here = Path(__file__).resolve().parent + repo = Path(a.repo).resolve() if a.repo else here.parent + if not repo.is_dir() or not (repo / "docs").is_dir(): + die(f"repo dir absent or has no docs/: {repo}", 2) + out = Path(a.out) if a.out else repo / "docs" / "audit" / "record-inventory.md" + memdir = Path(a.memory_dir).resolve() if a.memory_dir else None + if memdir and not memdir.is_dir(): + die(f"--memory-dir not a directory: {memdir}", 2) + use_git = not a.no_git + head = run_git(repo, ["rev-parse", "--short", "HEAD"])[1] if use_git else "(no-git)" + + skill_base = repo / ".claude" / "skills" / "openstack-cloud-ops" + + # ---- collect scan targets: (label, path, counted, surface) --------------- + targets = [] + for base, surface in (("docs", "repo"), ("runbooks", "repo")): + d = repo / base + if d.is_dir(): + for p in sorted(d.rglob("*")): + if p.is_file() and not any(s in p.parts for s in SKIP_DIRS): + rel = p.relative_to(repo).as_posix() + targets.append((rel, p, not rel.startswith("docs/audit/"), surface)) + for extra in ("README.md", "CLAUDE.md"): + p = repo / extra + if p.is_file(): + targets.append((extra, p, True, "repo")) + if skill_base.is_dir(): + for p in sorted(skill_base.rglob("*.md")): + rel = p.relative_to(repo).as_posix() + targets.append((rel, p, True, "skill")) + if memdir: + for p in sorted(memdir.iterdir()): + if p.is_file(): + targets.append((f"memory/{p.name}", p, False, "memory")) + out_rel = out.resolve() + targets = [t for t in targets if t[1].resolve() != out_rel] + + # ---- census + claims + refs --------------------------------------------- + census, claims = [], [] + all_paths, all_nums, all_hashes, all_filelines = [], [], [], [] + contents = {} + for rel, p, counted, surface in targets: + lines = read_lines(p) + contents[rel] = lines + cls = classify(rel) if surface == "repo" else surface + if use_git and surface == "repo": + _, cdate = run_git(repo, ["log", "-1", "--format=%as", "--", rel]) + cdate = cdate or "uncommitted" + else: + cdate = "n/a" + census.append((rel, cls, p.stat().st_size, len(lines), cdate)) + claims.extend(extract_claims(rel, lines, counted, cls)) + pa, nu, ha, fl = extract_refs(rel, lines, skill_base) + all_paths.extend(pa) + all_nums.extend(nu) + all_hashes.extend(ha) + all_filelines.extend(fl) + + # ---- inbound-reference corpus (whole repo text) ------------------------- + corpus = {} + for p in sorted(repo.rglob("*")): + if any(s in p.parts for s in SKIP_DIRS): + continue + if is_text_candidate(p): + rel = p.relative_to(repo).as_posix() + corpus[rel] = "\n".join(contents.get(rel) or read_lines(p)) + inbound = defaultdict(list) + doc_basenames = {os.path.basename(rel): rel for rel, _, _, s in targets if s == "repo"} + for b, target_rel in sorted(doc_basenames.items()): + for rel, text in corpus.items(): + if rel == target_rel: + continue + if b in text: + inbound[target_rel].append(rel) + + # ---- reference integrity checks ----------------------------------------- + dd_text = corpus.get("docs/design-decisions.md", "") + sec_text = corpus.get("docs/security-ledger.md", "") + broken_paths = sorted({(p, loc) for p, loc in all_paths + if not (repo / p).exists() and not (skill_base / p).exists()}) + orphan_nums = [] + for n, loc in sorted(set(all_nums)): + canon = n if "-" in n else n + if n.startswith("D-") and len(n) >= 4: + if canon not in dd_text: + orphan_nums.append((n, loc, "not in design-decisions.md")) + elif n.startswith("SEC-"): + if canon not in sec_text: + orphan_nums.append((n, loc, "not in security-ledger.md")) + else: + hits = sum(1 for t in corpus.values() if canon in t) + if hits <= 1: + orphan_nums.append((n, loc, "referenced nowhere else")) + unknown_hashes = [] + if use_git: + for h, loc in sorted(set(all_hashes)): + rc, _ = run_git(repo, ["cat-file", "-e", f"{h}^{{commit}}"]) + if rc != 0: + unknown_hashes.append((h, loc)) + bad_filelines = [] + for f, ln, loc in sorted(set(all_filelines)): + tgt = repo / f + if not tgt.exists(): + bad_filelines.append((f, ln, loc, "target absent")) + elif ln > len(read_lines(tgt)): + bad_filelines.append((f, ln, loc, f"only {len(read_lines(tgt))} lines")) + + # ---- contradiction groups ----------------------------------------------- + def groups(kind): + g = defaultdict(list) + for r in claims: + if r.kind == kind: + g[r.key].append(r) + return g + + contra, contra_nochg = [], [] + for kind in ("plan", "version", "status"): + for key, rows in sorted(groups(kind).items()): + if kind == "status" and key == "-": + continue + counted_rows = [r for r in rows if r.counted] + vals = sorted({r.value for r in counted_rows}) + if len(vals) > 1: + contra.append((kind, key, vals, counted_rows)) + v2 = sorted({r.value for r in counted_rows if r.census_class != "changelog"}) + if len(v2) > 1: + contra_nochg.append((kind, key, v2)) + + # ---- render ------------------------------------------------------------- + L = [] + w = L.append + w("# Record inventory -- grounding audit Phase 1 (deterministic)") + w("") + w(f"Generated by `scripts/record-audit.py` at repo HEAD `{head}`" + + (f" ({a.stamp})" if a.stamp else "") + ".") + w("Read-only extraction; zero judgment. Counting rules are in the script header:") + w("docs/audit/* and memory-surface rows are inventoried but NOT counted toward") + w("the contradiction signal; a changelog-excluded pair count is shown alongside.") + w("") + w("## Summary") + w("") + w(f"- files scanned: {len(targets)}") + w(f"- status-claim rows: {len(claims)} " + f"(plan {sum(1 for r in claims if r.kind == 'plan')}, " + f"status {sum(1 for r in claims if r.kind == 'status')}, " + f"version {sum(1 for r in claims if r.kind == 'version')}, " + f"gate {sum(1 for r in claims if r.kind == 'gate')})") + w(f"- CONTRADICTION GROUPS (counted surfaces): {len(contra)}") + w(f"- contradiction groups excluding changelog-class files: {len(contra_nochg)}") + w(f"- broken path refs: {len(broken_paths)}; orphan number refs: {len(orphan_nums)}; " + f"unknown commit hashes: {len(unknown_hashes)}; bad file:line refs: {len(bad_filelines)}") + w("") + + w("## 1. Doc census") + w("") + w("| file | class | bytes | lines | last commit | inbound refs |") + w("|---|---|---|---|---|---|") + for rel, cls, size, nlines, cdate in census: + n_in = len(inbound.get(rel, [])) + w(f"| {rel} | {cls} | {size} | {nlines} | {cdate} | {n_in} |") + w("") + unref = [c for c in census if c[1] == "changelog" and not inbound.get(c[0])] + w(f"Unreferenced changelogs (consolidation candidates by default): {len(unref)}") + for rel, *_ in unref: + w(f"- {rel}") + w("") + + w("## 2. Contradiction groups (mechanical)") + w("") + if not contra: + w("NONE.") + for kind, key, vals, rows in contra: + w(f"### CONTRADICTION: {kind} `{key}` -> {len(vals)} distinct values: " + + ", ".join(f"`{v}`" for v in vals)) + w("") + w("| value | where | line |") + w("|---|---|---|") + for r in sorted(rows, key=lambda r: (r.value, r.loc)): + w(f"| {r.value} | {r.loc} | {trim(r.line)} |") + w("") + + w("## 3. Status-claim rows (full table)") + w("") + w("| kind | key | value | where | line |") + w("|---|---|---|---|---|") + for r in sorted((r for r in claims if r.kind != "gate"), + key=lambda r: (r.kind, r.key, r.loc)): + flag = "" if r.counted else " (not counted)" + w(f"| {r.kind}{flag} | {r.key} | {r.value} | {r.loc} | {trim(r.line, 80)} |") + w("") + + w("## 4. Gate-assertion rows") + w("") + w("| word | where | line |") + w("|---|---|---|") + for r in sorted((r for r in claims if r.kind == "gate"), key=lambda r: r.loc): + w(f"| {r.value} | {r.loc} | {trim(r.line, 80)} |") + w("") + + w("## 5. Reference integrity") + w("") + w("### Broken path references") + w("| ref | where |") + w("|---|---|") + for p, loc in broken_paths: + w(f"| {p} | {loc} |") + w("") + w("### Orphan / unregistered number references") + w("| ref | where | why |") + w("|---|---|---|") + for n, loc, why in orphan_nums: + w(f"| {n} | {loc} | {why} |") + w("") + w("### Unknown commit hashes") + w("| hash | where |") + w("|---|---|") + for h, loc in unknown_hashes: + w(f"| {h} | {loc} |") + w("") + w("### file:line references out of range or absent") + w("| ref | line | where | why |") + w("|---|---|---|---|") + for f, ln, loc, why in bad_filelines: + w(f"| {f} | {ln} | {loc} | {why} |") + w("") + + out.parent.mkdir(parents=True, exist_ok=True) + out.write_text("\n".join(L) + "\n", encoding="ascii", errors="replace") + print(f"record-audit: {len(targets)} files, {len(claims)} claim rows, " + f"{len(contra)} contradiction groups -> {out}") + sys.exit(1 if contra else 0) + + +if __name__ == "__main__": + main() diff --git a/tests/record-audit/run-tests.sh b/tests/record-audit/run-tests.sh new file mode 100755 index 0000000..ad024f0 --- /dev/null +++ b/tests/record-audit/run-tests.sh @@ -0,0 +1,109 @@ +#!/usr/bin/env bash +# Harness for scripts/record-audit.py (grounding-audit Phase 1 extractor). +# Read-only over throwaway fixture trees; asserts contradiction detection, the +# counted/not-counted surface rules, reference integrity, census classes, and +# the 0/1/2 exit contract. All runs use --no-git (fixtures are not git repos). +set -u +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +SCRIPT="$HERE/../../scripts/record-audit.py" +WORK="$(mktemp -d)" +trap 'rm -rf "$WORK"' EXIT +PASS=0; FAIL=0 +ok() { PASS=$((PASS+1)); } +bad() { FAIL=$((FAIL+1)); echo " FAIL: $1"; } + +assert_exit() { # <desc> <want-rc> <cmd...> + local desc="$1" want="$2"; shift 2 + "$@" >/dev/null 2>&1; local got=$? + [ "$got" -eq "$want" ] && ok || bad "$desc (want exit $want, got $got)" +} +assert_report() { # <desc> <fixed-substring> <report-file> + local desc="$1" want="$2" f="$3" + grep -qF -- "$want" "$f" && ok || bad "$desc (want '$want' in $f)" +} +assert_not_report() { # <desc> <fixed-substring> <report-file> + local desc="$1" want="$2" f="$3" + grep -qF -- "$want" "$f" && bad "$desc (must NOT contain '$want')" || ok +} + +# ---- fixture A: contradictions + broken refs -------------------------------- +A="$WORK/a"; mkdir -p "$A/docs/audit" "$A/runbooks" "$WORK/mem" +cat > "$A/docs/design-decisions.md" <<'EOF' +# decisions +D-001 something ADOPTED. +EOF +cat > "$A/docs/readiness.md" <<'EOF' +The outer plan reads 5 add / 2 in-place / 6 destroy today. +Earlier note: outer plan UNCHANGED (5/0/6, create-only content). +Re-confirm 5-add/(0-or-2)-change/6-destroy-empty before apply. +Stage 3 is COMPLETE per this doc. Pin: OpenTofu v1.12.3. +See docs/absent.md and D-999 for details. This gate is blocking. +EOF +cat > "$A/docs/notes.md" <<'EOF' +Stage 3 is HELD per this doc. The binary is tofu 1.12.4. +MAAS `thing` (10.12.4.100) must not become a version row. +Egress through the OPNsense edge. On it: MAAS 3.7.2 region+rack. +The exit contract is 0/1/2 for the ROUTER gate poll. +EOF +cat > "$A/docs/changelog-20260101-old.md" <<'EOF' +Plan: 7 to add, 2 to change, 7 to destroy. +EOF +cat > "$A/docs/audit/quote.md" <<'EOF' +Charter quotes the defect: plan 9/9/9 seen once. +EOF +cat > "$A/README.md" <<'EOF' +Nothing here. +EOF +cat > "$WORK/mem/mem-note.md" <<'EOF' +Memory claim: plan 1/1/1 recorded here. +EOF + +REPORT_A="$WORK/a-report.md" +assert_exit "fixture A -> exit 1 (HOLD)" 1 \ + python3 "$SCRIPT" --repo "$A" --memory-dir "$WORK/mem" --out "$REPORT_A" --no-git +assert_report "plan contradiction group" "CONTRADICTION: plan" "$REPORT_A" +assert_report "wordy plan value present" "5/2/6" "$REPORT_A" +assert_report "compact plan value present" "5/0/6" "$REPORT_A" +assert_report "hyphen or-form value present" "5/0-or-2/6" "$REPORT_A" +assert_report "tofu-output plan value present" "7/2/7" "$REPORT_A" +assert_report "version contradiction (tofu)" "CONTRADICTION: version \`tofu\`" "$REPORT_A" +assert_report "stage-status contradiction" "CONTRADICTION: status \`stage-3\`" "$REPORT_A" +assert_report "broken path ref detected" "docs/absent.md" "$REPORT_A" +assert_report "orphan D-number detected" "D-999" "$REPORT_A" +assert_report "unreferenced changelog listed" "docs/changelog-20260101-old.md" "$REPORT_A" +assert_report "memory file in census" "memory/mem-note.md" "$REPORT_A" +assert_report "gate assertion captured" "blocking" "$REPORT_A" +assert_not_report "IP fragment is not a MAAS version row" "| 10.12 |" "$REPORT_A" +assert_report "cross-product line credits MAAS" "| version | maas | 3.7.2 |" "$REPORT_A" +assert_not_report "cross-product bleed (opnsense=maas ver)" "| opnsense | 3.7.2 |" "$REPORT_A" +assert_not_report "exit-code triple not a plan row (ROUTER!=outer)" "0/1/2" "$REPORT_A" +# audit-class and memory rows must not create counted groups: 9/9/9 and 1/1/1 +# appear only as not-counted rows, never as a CONTRADICTION value list entry. +assert_not_report "audit-quoted 9/9/9 not a counted value" "\`9/9/9\`" "$REPORT_A" +assert_not_report "memory 1/1/1 not a counted value" "\`1/1/1\`" "$REPORT_A" + +# ---- fixture B: clean -> exit 0 --------------------------------------------- +B="$WORK/b"; mkdir -p "$B/docs" +cat > "$B/docs/one.md" <<'EOF' +The outer plan reads 5 add / 0 change / 6 destroy. Pin: OpenTofu v1.12.3. +EOF +REPORT_B="$WORK/b-report.md" +assert_exit "clean fixture -> exit 0" 0 \ + python3 "$SCRIPT" --repo "$B" --out "$REPORT_B" --no-git +assert_report "clean summary zero groups" "CONTRADICTION GROUPS (counted surfaces): 0" "$REPORT_B" + +# ---- preconditions ---------------------------------------------------------- +assert_exit "absent repo -> exit 2" 2 \ + python3 "$SCRIPT" --repo "$WORK/nope" --out "$WORK/x.md" --no-git +assert_exit "bad memory dir -> exit 2" 2 \ + python3 "$SCRIPT" --repo "$B" --memory-dir "$WORK/nope" --out "$WORK/x.md" --no-git + +# ---- determinism: identical reruns produce identical bytes ------------------ +R1="$WORK/d1.md"; R2="$WORK/d2.md" +python3 "$SCRIPT" --repo "$A" --memory-dir "$WORK/mem" --out "$R1" --no-git >/dev/null 2>&1 +python3 "$SCRIPT" --repo "$A" --memory-dir "$WORK/mem" --out "$R2" --no-git >/dev/null 2>&1 +if cmp -s "$R1" "$R2"; then ok; else bad "non-deterministic report output"; fi + +TOTAL=$((PASS+FAIL)) +echo "record-audit: $PASS/$TOTAL PASS" +[ "$FAIL" -eq 0 ]