# Changelog 2026-07-10 -- Full-project sweep: VR0 runbook + OpenTofu doc fixes (DOCFIX-170)

No live infrastructure touched. Part of the full-project sweep requested
after DOCFIX-169 (the first cascading-staleness fix). Eight parallel
review agents audited bundle.yaml, VR0 runbooks, scripts, OpenTofu
modules, DC-DC runbook consistency, test harness quality, security
posture, and NetBox/IPAM consistency. This changelog covers the VR0
runbook and OpenTofu documentation findings; sibling changelogs cover
DC-DC runbook fixes (DOCFIX-171), bundle.yaml fixes (DOCFIX-172), and
script logic bugs (DOCFIX-173).

## Items

### 1. DOCFIX-170a -- `runbooks/phase-08-workload-cluster-acceptance.md` Designate framing
FILE: `runbooks/phase-08-workload-cluster-acceptance.md`.

WHAT: same cascading-staleness class as DOCFIX-169 (phase-01), found by a
dedicated VR0-runbook-audit agent: this runbook's header and its D-011.8
acceptance-bar item both still framed Designate as flatly "DEFERRED (D-019)"
even though `bundle.yaml`'s DOCFIX-167 edit now deploys `designate`/
`designate-bind`/`designate-mysql-router`/`designate-hacluster` live (D-106
supersedes D-019). Fixed with a NUANCED correction, not a blanket flip to
PASS: D-011.1's "all charms active/idle" check will now include these 4
units, but D-011.8's actual acceptance criterion (tenant hostname
resolution) is STILL not meaningfully testable for a plain VR0 run -- the
full D-008 bootstrap chain needs the per-DC `os-public-hostname` overlay
this shared bundle deliberately does NOT carry (Stage 7's job, not
automatic from the charms merely being deployed). The runbook now says so
explicitly, cross-referencing `runbooks/dc-dc-phase6-designate-cos-magnum.md`
Step 9 as where D-011.8 actually gets exercised for real.

### 2. DOCFIX-170b -- `opentofu/modules/base-image/outputs.tf` stale comment
FILE: `opentofu/modules/base-image/outputs.tf`.

WHAT: found by the OpenTofu deep-review agent: the `pool`/`name` output
descriptions referenced nonexistent `modules/cloudinit-vm` input variables
(`base_volume_pool`/`base_volume_name`) -- that module only ever declared
`base_volume_path`, which is what its real `main.tf` actually consumes (via
`.path`, the third, correctly-described output). Leftover wording from an
earlier design that named things differently before settling on passing
`.path` directly. No functional effect (neither module is instantiated
yet, nothing calls `.pool`/`.name`) -- cosmetic, now corrected.

## Verification

`bash scripts/repo-lint.sh`: 0 fail, 1 documented legacy warn. Full test
gauntlet (`bash scripts/run-tests-all.sh`): 23/51 FAILED, identical to
every prior check tonight (same pre-existing "jq missing on this
workstation" environment gaps) -- zero regressions.

## Sweep summary (all eight dimensions, for the record)

- **bundle.yaml deep audit**: found `magnum-dashboard` missing its entire
  `bindings:` block (pre-existing, since the D-052 commit, not tonight's
  regression) + two cosmetically-misplaced section-header comments +
  header VIP-count staleness -- see DOCFIX-172.
- **VR0 runbooks audit**: this changelog's item 1, plus confirmed
  phase-00/02/03/04/05/06/07 and all four appendices clean of the same
  staleness class; script/flag/D-NNN citation spot-checks all clean.
- **scripts/*.sh audit**: found 4 confirmed logic bugs (unguarded
  pipelines/function calls under `set -e`+pipefail) + 1 dormant landmine
  in `ledger-scan.sh`'s DOCFIX/BUNDLEFIX regex -- see DOCFIX-173.
- **OpenTofu modules deep review**: this changelog's item 2; otherwise
  clean, including the newest module (`office1-network`) correctly
  mirroring the already-fixed attribute-style syntax convention.
- **DC-DC runbook consistency (second pass)**: found Stage 1's calculator
  scripts never wired into Step 3, Stage 5's stale Sequence-list bracket
  tag, Stage 6's checklist overstating its own step content, and two
  DOCFIX numbers (164, 167) never closed out in the ledger's own
  boilerplate -- see DOCFIX-171 and this session's direct ledger fix.
- **Test harness quality audit**: clean -- no new instances of the
  dead-assertion bug class found anywhere else in 51 harnesses; the
  originally-fixed `dc-dc-prefixes-import` harness reconfirmed correct
  (40/40, exact call-site count match).
- **Security/secrets posture audit**: one moderate finding (rbd-mirror
  bootstrap token's predictable path, no permission hardening) -- see
  DOCFIX-173; everything else clean, including a spot-check of 3 older
  secrets-handling scripts.
- **NetBox/IPAM consistency audit**: clean for the current, active DC-DC
  pipeline (byte-for-byte match against `lib-net.sh`); one refinement to
  an already-known v1-script staleness (the retired `ipv4-prefixes-
  import.py`'s "LBaaS Mgmt" role label on a CIDR now repurposed to
  `storage` -- out of scope, that script is deliberately not maintained).

REVERT (this changelog's items only): `git checkout HEAD~ -- runbooks/
phase-08-workload-cluster-acceptance.md opentofu/modules/base-image/
outputs.tf` (safe).