# Session changelog -- 2026-07-27 -- Stage-5 grounding audit ONE changelog for this session (GA-R2/D1). Branch `dc-dc-stage5-grounding-audit` off post-merge `main` at `71519a2`. Status claims live ONLY in `docs/CURRENT-STATE.md`; this file records what CHANGED and how to revert it. Operator direction: a full reconciliation and grounding from a fresh session before Stage 5 opens -- current status, the changes required to reach the as-built, configuration versus project goal, readiness to enter the next stage error-free, then a review of the upcoming stages. Run autonomously while the operator was away, with rulings QUEUED not adopted. --- ## 1. Session-scoped permission expansion (settings.local.json -- GITIGNORED) The operator offered a broad exception; a SCOPED READ-ONLY expansion was taken instead, on the grounds that the task is read-only by construction and the `ask` rules ARE the enforcement of hard rule 3 (CLAUDE.md says not to work around them). Design: the allow list enumerates READ verbs, the ask list enumerates MUTATING verbs, and anything matching neither falls through and FAILS SAFE -- logged UNMEASURED, never assumed absent. Added (allow): read-only shell tooling (`sed -n`, `head`, `tail`, `wc`, `sort`, `uniq`, `comm`, `diff`, `find`, `stat`, `cut`, `nl`, `file`, `column`, `tee docs/audit/*`); read-only `virsh` (local + quoted remote variants); `ssh voffice1 *maas admin * read*` and `query-power-state`; the per-DC artifact and rack checkers; `Write`/`Edit` on `docs/**`; `git commit`/`git push`; `WebSearch` + eight upstream doc domains. Replaced (ask): the five broad `ssh voffice1 "maas admin *` rules, which walled READ calls because `ask` beats `allow` regardless of specificity, with 23 verb-scoped MUTATION asks. Quoted variants used throughout, per the 2026-07-26 finding that a quote breaks pattern matching. NOT granted and not requested: jumphost `sudo`, `tofu apply|destroy|import|state rm`, any `maas admin` write, `juju deploy|add-model|bootstrap`, `opnsense-api.sh POST`, `scripts/* apply|install`, `*--commit*`, `rm *`. `Edit(.claude/settings*.json)` deliberately LEFT as `ask` so the session could not widen its own permissions unattended. Deny list and the PreToolUse guard untouched. Deliberately NOT requested: blanket `Bash(cat *)` -- the guard's NEVER list covers `vault-init/`, `as-executed/`, `tenant-*/`, `*-cred.txt`, `appcred`, `*.pem` but NOT the `~/vr1-*-creds/` key files, so a blanket `cat` would open exactly the hazard CLAUDE.md forbids. **REVERT: delete the added allow entries and restore the five original `ssh voffice1 "maas admin *` ask rules. The file is gitignored, so `docs/audit/stage5-grounding-audit-scope-20260727.md` section 6 is its only durable record. REMOVE THE BLOCK AT SESSION CLOSE.** Flagged NOT fixed (hard rule 1): `Bash(awk *)`, `Bash(grep *)` and `Bash(python3 *)` were ALREADY broadly allowed and can each read a `~/*-creds/` key file without tripping the guard. Pre-existing gap, not introduced here. ## 2. Deliverables (all new files) - `docs/audit/stage5-grounding-audit-scope-20260727.md` -- the charter, committed BEFORE any agent was spawned so a session that died mid-run still left the plan. - `docs/audit/stage5-readiness-20260727.md` -- the ordered precondition checklist. - `docs/audit/stage5-committee-raw-20260727.md` -- all 7 lenses verbatim, kept separate from synthesis so synthesis cannot quietly reshape a lens's claim. - `docs/audit/queued-rulings-20260727.md` -- 11 Stage-5-blocking + 4 standing questions, GA-R5 shape, blank utterance lines. NONE adopted. - `docs/audit/stage5-live-measurement-20260727.txt` -- this session's measurements. - `docs/audit/outer-plan-20260727-stage5-audit.txt`, `docs/audit/preflight-20260727-stage5-audit.txt`, `docs/audit/stage5-creds-privileged-20260727.txt` -- captures. REVERT: `git revert` the three audit commits (`514f0aa`, `6d511e8`, `fb8f6bc`, `de11bf4`); every file is new. ## 3. CURRENT-STATE edits (GA-R1 amendment C2 -- measurement corrects the record in the capture's own commit; also what repo-lint L10 requires) - Section 7 pin table: Juju row corrected to the MEASURED 3.6.27 on voffice1 (was 3.6.25). In-channel patch refresh, which D-071 permits -- policy-compliant drift, not an incident, but it is the client that will bootstrap the controller. - Section 7: NEW row recording that the `openstack` client is ABSENT on BOTH hosts while ten Stage-5/6/7 scripts invoke it. No prior surface carried this. - Section 5: convergence history extended with the three-root ZERO-DIFF re-confirmation and the validity proof behind the inner pair. - D-137 block: the 2026-07-27 privileged re-run recorded as a RE-CONFIRMATION of the 2026-07-26 run, not a newly-closed item (an overclaim corrected mid-session). - Section 1: the audit's verdict and pointers to the five artifacts. - **Gate row G3 CORRECTED** -- the one mechanical fix taken. See below. REVERT: each edit is additive except G3; restore G3's prior cell text from `git show de11bf4^:docs/CURRENT-STATE.md`. ## 4. The single mechanical fix (deliberately chosen, not opportunistic) Gate row G3 read OPEN with "FREEZE holds for un-gated surfaces", contradicted by its OWN cited evidence file (`docs/audit/phase6-exit-runs-20260719.md:84,91-92` records the re-signature PASS and "G3 + G11 CLOSED") and by row G11 and section 11. No ruling was required -- two surfaces already declared it closed. The consequential half was the FREEZE clause, not the state token: left standing it would have blocked the very DOCFIX batch this audit queues. REVERT: restore the prior cell text (see 3). ## 5. Logged, NOT executed (hard rule 1) The 21-item DOCFIX remediation batch in Phase 3 of the readiness doc, and every gate-integrity fix in Phase 4. Nearly every runbook fix interlocks with an unanswered ruling, so landing them now would encode assumptions. No D-, DOCFIX- or BUNDLEFIX- number was assigned; next-free is unchanged at D 138 / DOCFIX 205 / BUNDLEFIX 053, correctly, because nothing was remediated. ## 6. Owned errors, recorded rather than quietly corrected - The per-DC artifact checkers were first run LOCALLY on vcloud, producing a comprehensive FAIL with every probe MISS -- output indistinguishable from "never installed". Both scripts are designed to be PIPED TO THE RACK. Corrected by direct functional probe; lens 2 independently ran the canonical piped form and got PASS on all three. The scripts were not at fault. - The first exit-code reading of those checkers captured `tail`'s status through a pipe, not the script's. Re-measured: both correctly exit 1. - The measurement capture initially waved P3's "33 pins, 0 fail, 33 warn" through as expected. Lens 4 established the CAUSE was a missing `juju` binary, so ZERO pins are verified against charmhub. The count was expected; the cause was not. Capture amended. - The privileged credential sweep was first described as closing an item outstanding since 2026-07-26. It was not -- that sweep completed on 07-26. Today's run RE-CONFIRMS it against the current 82-row matrix. ## 7. Committee mechanics Seven read-only lenses, each under a contract requiring: no mutating shape; the `claim / evidence / blocks-Stage-5 / disposition` schema; and any denied or prompted tool call reported UNMEASURED with its exact command, never folded into a negative finding. Lens 5 died on an API error with no output and was relaunched with the interim findings folded in. Lens 1 hit one classifier denial (`timeout 240 bash scripts/preflight.sh`) and correctly reported it UNMEASURED; root cause was a missing `Bash(timeout *)` allow rule -- a failed-to-MATCH, the same class as 2026-07-26, not a classifier override. The audit session had measured preflight independently, so that gap was closed.