# Record inventory -- grounding audit Phase 1 (deterministic)

Generated by `scripts/record-audit.py` at repo HEAD `148dcef` (2026-07-18T08:44:44Z).
Read-only extraction; zero judgment. Counting rules are in the script header:
docs/audit/* and memory-surface rows are inventoried but NOT counted toward
the contradiction signal; a changelog-excluded pair count is shown alongside.

## Summary

- files scanned: 179
- status-claim rows: 858 (plan 27, status 231, version 175, gate 425)
- CONTRADICTION GROUPS (counted surfaces): 12
- contradiction groups excluding changelog-class files: 10
- broken path refs: 319; orphan number refs: 170; unknown commit hashes: 115; bad file:line refs: 0

## 1. Doc census

| file | class | bytes | lines | last commit | inbound refs |
|---|---|---|---|---|---|
| docs/D-057-DECIDED-append.md | reference | 7168 | 37 | 2026-06-29 | 3 |
| docs/D-057-REVIEW-ITEMS.md | reference | 4069 | 58 | 2026-06-29 | 2 |
| docs/D-058-renumber.md | reference | 4772 | 77 | 2026-06-29 | 5 |
| docs/D-068-openbao-assessment-DRAFT.md | reference | 7258 | 108 | 2026-07-06 | 3 |
| docs/D-068-vault-1.8-vs-1.16-analysis.md | reference | 7781 | 114 | 2026-07-05 | 7 |
| docs/DOCFIX-064-phase08-changelist.md | reference | 5224 | 81 | 2026-07-02 | 1 |
| docs/README-D057-PACK.md | reference | 6969 | 108 | 2026-06-29 | 1 |
| docs/as-executed-log-convention.md | reference | 2019 | 38 | 2026-07-06 | 9 |
| docs/audit/grounding-audit-charter.md | audit | 15625 | 247 | 2026-07-18 | 2 |
| docs/audit/skill-additions-proposed.md | audit | 2258 | 36 | 2026-07-18 | 2 |
| docs/changelog-20260703-process-hardening.md | changelog | 23078 | 371 | 2026-07-03 | 3 |
| docs/changelog-20260709-adversarial-review-fixes.md | changelog | 5729 | 110 | 2026-07-10 | 1 |
| docs/changelog-20260709-ceph-replication-tooling.md | changelog | 8444 | 144 | 2026-07-10 | 2 |
| docs/changelog-20260709-dc-dc-design.md | changelog | 2365 | 45 | 2026-07-09 | 2 |
| docs/changelog-20260709-dc-dc-phase0-runbook.md | changelog | 4385 | 75 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase1-runbook.md | changelog | 3542 | 66 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase2-runbook.md | changelog | 3350 | 63 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase3-runbook.md | changelog | 3973 | 73 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase4-runbook.md | changelog | 4070 | 73 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase5-runbook.md | changelog | 3443 | 66 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-phase6-runbook.md | changelog | 3651 | 69 | 2026-07-10 | 1 |
| docs/changelog-20260709-dc-dc-repo-rename-sweep.md | changelog | 5123 | 87 | 2026-07-09 | 1 |
| docs/changelog-20260709-dc-selector-convention.md | changelog | 4637 | 78 | 2026-07-10 | 3 |
| docs/changelog-20260709-designate-cinderbackup-rbdmirror.md | changelog | 8053 | 134 | 2026-07-10 | 5 |
| docs/changelog-20260709-final-consolidation.md | changelog | 5450 | 98 | 2026-07-10 | 1 |
| docs/changelog-20260709-ipv6-family-matrix-overlay.md | changelog | 3794 | 71 | 2026-07-10 | 1 |
| docs/changelog-20260709-maas-scripts-dc-param.md | changelog | 8908 | 153 | 2026-07-10 | 3 |
| docs/changelog-20260709-mtu-ceph-budget-calculators.md | changelog | 8080 | 138 | 2026-07-10 | 2 |
| docs/changelog-20260709-netbox-dc-dc-pipeline.md | changelog | 6254 | 110 | 2026-07-10 | 2 |
| docs/changelog-20260709-netem-ula-gua-proposal.md | changelog | 2691 | 52 | 2026-07-10 | 1 |
| docs/changelog-20260709-office1-network-edge.md | changelog | 7516 | 134 | 2026-07-10 | 2 |
| docs/changelog-20260709-opentofu-audit.md | changelog | 6443 | 106 | 2026-07-09 | 1 |
| docs/changelog-20260709-opentofu-cloudinit-vm.md | changelog | 3721 | 67 | 2026-07-09 | 1 |
| docs/changelog-20260709-opentofu-maas-netem.md | changelog | 4566 | 84 | 2026-07-09 | 1 |
| docs/changelog-20260709-opentofu-node-vm.md | changelog | 4672 | 81 | 2026-07-09 | 1 |
| docs/changelog-20260709-opentofu-scaffold.md | changelog | 5132 | 86 | 2026-07-09 | 1 |
| docs/changelog-20260709-opnsense-config-design.md | changelog | 4585 | 80 | 2026-07-09 | 1 |
| docs/changelog-20260709-opnsense-edge-module.md | changelog | 5044 | 91 | 2026-07-09 | 1 |
| docs/changelog-20260709-opnsense-research.md | changelog | 3900 | 68 | 2026-07-09 | 2 |
| docs/changelog-20260709-repo-agnostic-sweep.md | changelog | 5681 | 90 | 2026-07-09 | 1 |
| docs/changelog-20260709-repo-lint-crlf-fix.md | changelog | 1711 | 31 | 2026-07-09 | 1 |
| docs/changelog-20260709-stage0-ratification.md | changelog | 4848 | 86 | 2026-07-09 | 2 |
| docs/changelog-20260710-carve-gua-hang-fix.md | changelog | 2490 | 48 | 2026-07-10 | 1 |
| docs/changelog-20260710-ledger-scan-self-inflicted-falsepositive-fix.md | changelog | 5710 | 101 | 2026-07-10 | 2 |
| docs/changelog-20260710-netbox-roles-aggregates.md | changelog | 3051 | 50 | 2026-07-10 | 1 |
| docs/changelog-20260710-opentofu-scaffold-first-validation.md | changelog | 4261 | 74 | 2026-07-10 | 1 |
| docs/changelog-20260710-opentofu-state-file-security.md | changelog | 6367 | 111 | 2026-07-10 | 1 |
| docs/changelog-20260710-phase0-runbook-as-executed.md | changelog | 2872 | 49 | 2026-07-10 | 1 |
| docs/changelog-20260710-phase01-bundle-staleness-fix.md | changelog | 3421 | 59 | 2026-07-10 | 1 |
| docs/changelog-20260710-prereq-install-scripts.md | changelog | 3635 | 60 | 2026-07-10 | 1 |
| docs/changelog-20260710-skill-vr1-awareness.md | changelog | 4304 | 74 | 2026-07-10 | 1 |
| docs/changelog-20260710-sweep-bundle-fixes.md | changelog | 4268 | 81 | 2026-07-10 | 1 |
| docs/changelog-20260710-sweep-dcdc-runbook-fixes.md | changelog | 4232 | 77 | 2026-07-10 | 1 |
| docs/changelog-20260710-sweep-script-fixes.md | changelog | 7306 | 118 | 2026-07-10 | 2 |
| docs/changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md | changelog | 5048 | 87 | 2026-07-10 | 2 |
| docs/changelog-20260710-vr1-teardown-rollback-runbook.md | changelog | 5959 | 104 | 2026-07-10 | 1 |
| docs/changelog-20260711-d111-subcarve-nn-alignment.md | changelog | 2830 | 48 | 2026-07-11 | 1 |
| docs/changelog-20260711-ula-gen-command-fix.md | changelog | 1730 | 31 | 2026-07-14 | 3 |
| docs/changelog-20260712-docfix189-max-context-session-audit.md | changelog | 5808 | 92 | 2026-07-12 | 1 |
| docs/changelog-20260712-libvirt-acpi-kernel-panic.md | changelog | 5668 | 120 | 2026-07-12 | 3 |
| docs/changelog-20260712-libvirt-memory-unit-rootcause.md | changelog | 6662 | 119 | 2026-07-12 | 4 |
| docs/changelog-20260712-office1-opnsense-edge-build.md | changelog | 3964 | 58 | 2026-07-12 | 5 |
| docs/changelog-20260712-opnsense-edge-boot-fixes.md | changelog | 3494 | 55 | 2026-07-12 | 3 |
| docs/changelog-20260712-opnsense-edge-real-isp-router.md | changelog | 2469 | 39 | 2026-07-12 | 2 |
| docs/changelog-20260712-opnsense-prep-bz2-fallback.md | changelog | 978 | 19 | 2026-07-12 | 1 |
| docs/changelog-20260713-apparmor-libvirt-prereq.md | changelog | 3351 | 60 | 2026-07-13 | 3 |
| docs/changelog-20260713-config-xml-danger-sweep.md | changelog | 3569 | 57 | 2026-07-13 | 2 |
| docs/changelog-20260713-config-xml-path-deleted.md | changelog | 4787 | 92 | 2026-07-13 | 2 |
| docs/changelog-20260713-d114-voffice1-nested-virt.md | changelog | 6601 | 110 | 2026-07-13 | 2 |
| docs/changelog-20260713-docfix194-opentofu-module-validation.md | changelog | 4618 | 103 | 2026-07-13 | 2 |
| docs/changelog-20260713-git-credential-store.md | changelog | 3385 | 65 | 2026-07-13 | 2 |
| docs/changelog-20260713-office1-dhcp-apply.md | changelog | 4996 | 97 | 2026-07-13 | 3 |
| docs/changelog-20260713-office1-headend-maas-lxd.md | changelog | 6399 | 102 | 2026-07-13 | 1 |
| docs/changelog-20260713-office1-netbox-deployed.md | changelog | 5360 | 93 | 2026-07-13 | 3 |
| docs/changelog-20260713-opnsense-api-client.md | changelog | 3350 | 63 | 2026-07-13 | 1 |
| docs/changelog-20260713-opnsense-api-proven.md | changelog | 3533 | 64 | 2026-07-13 | 4 |
| docs/changelog-20260713-opnsense-api-write-proven.md | changelog | 3059 | 64 | 2026-07-13 | 4 |
| docs/changelog-20260713-opnsense-apikey-bootstrap.md | changelog | 4404 | 83 | 2026-07-13 | 2 |
| docs/changelog-20260713-workflow-doc-status-correction.md | changelog | 3102 | 43 | 2026-07-13 | 1 |
| docs/changelog-20260714-c4-sandbox-loop-and-upstream-guard.md | changelog | 3117 | 54 | 2026-07-14 | 1 |
| docs/changelog-20260714-d119-region-qualified-dc-namespace.md | changelog | 6396 | 108 | 2026-07-14 | 2 |
| docs/changelog-20260714-d119-tofu-apply.md | changelog | 1995 | 43 | 2026-07-14 | 1 |
| docs/changelog-20260714-netbox-importers-waf-useragent.md | changelog | 2479 | 54 | 2026-07-14 | 3 |
| docs/changelog-20260714-netbox-write-path-hardening.md | changelog | 4987 | 85 | 2026-07-14 | 3 |
| docs/changelog-20260714-office1-lan-ipv6-executed.md | changelog | 7307 | 116 | 2026-07-14 | 3 |
| docs/changelog-20260714-opnsense-set-interface-v6.md | changelog | 4783 | 85 | 2026-07-14 | 2 |
| docs/changelog-20260715-creds-audit.md | changelog | 3530 | 60 | 2026-07-15 | 2 |
| docs/changelog-20260715-creds-consolidation.md | changelog | 3180 | 52 | 2026-07-15 | 2 |
| docs/changelog-20260715-d120-load-and-iprange-tooling.md | changelog | 3268 | 53 | 2026-07-15 | 3 |
| docs/changelog-20260715-d120-office1-service-reip.md | changelog | 4064 | 66 | 2026-07-15 | 1 |
| docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md | changelog | 8971 | 116 | 2026-07-16 | 2 |
| docs/changelog-20260715-docfix195-c2-netbox-of-record.md | changelog | 5225 | 75 | 2026-07-15 | 1 |
| docs/changelog-20260715-fidelity-check-scope-correctness.md | changelog | 4906 | 83 | 2026-07-15 | 4 |
| docs/changelog-20260715-stage3-prereqs-prep.md | changelog | 6334 | 88 | 2026-07-16 | 2 |
| docs/changelog-20260716-d124-addressing-pin.md | changelog | 3880 | 65 | 2026-07-16 | 3 |
| docs/changelog-20260716-d124-rack-addressing.md | changelog | 6471 | 92 | 2026-07-16 | 1 |
| docs/changelog-20260716-d126-durable-forward.md | changelog | 7703 | 111 | 2026-07-16 | 2 |
| docs/changelog-20260716-review-sweep-phaseAB.md | changelog | 4012 | 59 | 2026-07-16 | 2 |
| docs/changelog-20260716-review-sweep-phaseC.md | changelog | 4588 | 64 | 2026-07-16 | 2 |
| docs/changelog-20260716-review-sweep-phaseC2-D125.md | changelog | 5138 | 73 | 2026-07-16 | 2 |
| docs/changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md | changelog | 5684 | 75 | 2026-07-17 | 3 |
| docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md | changelog | 3579 | 60 | 2026-07-17 | 2 |
| docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md | changelog | 3580 | 54 | 2026-07-17 | 2 |
| docs/changelog-20260718-opnsense-plugins-installer.md | changelog | 2617 | 40 | 2026-07-18 | 2 |
| docs/changelog-20260718-permission-posture-ask-preempts-classifier.md | changelog | 2323 | 40 | 2026-07-18 | 2 |
| docs/clientdocs-workflow-review-20260708.md | workflow | 9694 | 190 | 2026-07-08 | 2 |
| docs/dc-dc-buildout-design.md | reference | 14449 | 239 | 2026-07-09 | 21 |
| docs/dc-dc-deployment-workflow.md | workflow | 78072 | 886 | 2026-07-17 | 54 |
| docs/dc-dc-ipv6-charm-research.md | reference | 8076 | 142 | 2026-07-10 | 3 |
| docs/dc-dc-netbox-buildout-scope.md | reference | 21942 | 310 | 2026-07-15 | 16 |
| docs/dc-dc-netem-and-ula-gua-proposal.md | reference | 8601 | 139 | 2026-07-11 | 5 |
| docs/dc-dc-replication-DR-seed.md | reference | 4200 | 75 | 2026-07-08 | 5 |
| docs/dc0-deploy-readiness.md | readiness | 12137 | 181 | 2026-07-17 | 4 |
| docs/design-decisions.md | decision | 323955 | 4108 | 2026-07-18 | 54 |
| docs/docfix-draft-20260702.md | reference | 15011 | 215 | 2026-07-03 | 2 |
| docs/finding-20260718-voffice1-cloudinit-seed-replace.md | finding | 15140 | 273 | 2026-07-18 | 2 |
| docs/handoff-20260703-open-items.md | reference | 9110 | 164 | 2026-07-03 | 3 |
| docs/handoff-20260705-open-items.md | reference | 11891 | 179 | 2026-07-06 | 2 |
| docs/incident-20260712-opnsense-edge-boot-triplefault.md | reference | 7623 | 113 | 2026-07-12 | 6 |
| docs/maas-as-built-reference.md | reference | 10331 | 191 | 2026-06-26 | 7 |
| docs/model-a-fallback-plan.md | reference | 7353 | 106 | 2026-07-16 | 10 |
| docs/netbox-vip-queue.md | reference | 6743 | 126 | 2026-07-03 | 7 |
| docs/opnsense-edge-addon-review-20260718.md | reference | 11038 | 146 | 2026-07-18 | 4 |
| docs/phase-00-maas-standup-notes.md | reference | 3018 | 52 | 2026-06-29 | 1 |
| docs/repo-lint-nextfree-bug-FINDING.md | reference | 4264 | 68 | 2026-07-06 | 3 |
| docs/script-quality-findings-20260707.md | finding | 8104 | 141 | 2026-07-07 | 3 |
| docs/security-ledger.md | ledger | 11096 | 57 | 2026-07-16 | 19 |
| docs/session-findings-2026-07-02.md | finding | 5890 | 77 | 2026-07-02 | 1 |
| docs/session-ledger.md | ledger | 98987 | 1142 | 2026-07-18 | 36 |
| docs/stage3-adversarial-review-20260716.md | reference | 27956 | 348 | 2026-07-16 | 4 |
| docs/stage3-review-base.patch | patch | 227584 | 3795 | 2026-07-16 | 3 |
| docs/tenant-cidr-overlap-correction-PLAN.md | reference | 8937 | 154 | 2026-07-06 | 2 |
| docs/tenant-onboarding-contract.md | reference | 9785 | 139 | 2026-07-07 | 10 |
| docs/upstream-bug-draft-dashboard-tls.md | reference | 2518 | 48 | 2026-07-05 | 3 |
| docs/v1-pre-deploy-fixes.md | reference | 36265 | 832 | 2026-07-03 | 5 |
| docs/v1-redeploy-changelog.md | reference | 245435 | 3453 | 2026-07-09 | 3 |
| docs/vr1-office1-as-built.md | reference | 15841 | 203 | 2026-07-18 | 14 |
| runbooks/README.md | runbook | 7224 | 95 | 2026-07-10 | 0 |
| runbooks/appendix-A-troubleshooting.md | runbook | 43905 | 660 | 2026-07-08 | 14 |
| runbooks/appendix-B-asbuilt-version-lock.md | runbook | 12146 | 155 | 2026-07-05 | 7 |
| runbooks/appendix-C-identity-rbac.md | runbook | 10393 | 142 | 2026-07-03 | 7 |
| runbooks/appendix-D-magnum-trust-model.md | runbook | 6907 | 100 | 2026-07-02 | 3 |
| runbooks/d011-batch3-window-DRAFT.md | runbook | 6572 | 121 | 2026-07-09 | 5 |
| runbooks/dc-dc-office1-service-reip.md | runbook | 6945 | 114 | 2026-07-15 | 4 |
| runbooks/dc-dc-phase0-vcloud-prep.md | runbook | 25232 | 527 | 2026-07-14 | 17 |
| runbooks/dc-dc-phase1-office1-standup.md | runbook | 48778 | 903 | 2026-07-17 | 13 |
| runbooks/dc-dc-phase2-tofu-dc-substrate.md | runbook | 43998 | 770 | 2026-07-18 | 15 |
| runbooks/dc-dc-phase3-maas-enlist-deploy.md | runbook | 29043 | 551 | 2026-07-15 | 8 |
| runbooks/dc-dc-phase4-juju-bundle-per-dc.md | runbook | 17030 | 338 | 2026-07-14 | 5 |
| runbooks/dc-dc-phase5-dr-failover-drill.md | runbook | 37810 | 687 | 2026-07-14 | 11 |
| runbooks/dc-dc-phase6-designate-cos-magnum.md | runbook | 34920 | 671 | 2026-07-18 | 8 |
| runbooks/dc-dc-teardown-rollback.md | runbook | 18612 | 377 | 2026-07-16 | 13 |
| runbooks/ops-capi-recovery.md | runbook | 13128 | 251 | 2026-06-18 | 6 |
| runbooks/ops-restart-procedure.md | runbook | 7040 | 156 | 2026-07-16 | 10 |
| runbooks/ops-update-procedure.md | runbook | 19590 | 424 | 2026-07-09 | 6 |
| runbooks/phase-00-teardown-maas-reset.md | runbook | 13317 | 252 | 2026-07-03 | 12 |
| runbooks/phase-01-bundle-deploy.md | runbook | 22714 | 422 | 2026-07-10 | 13 |
| runbooks/phase-02-vault-bringup.md | runbook | 9512 | 178 | 2026-06-18 | 5 |
| runbooks/phase-03-core-verify.md | runbook | 21284 | 361 | 2026-07-07 | 7 |
| runbooks/phase-04-network-carve.md | runbook | 11414 | 188 | 2026-06-30 | 5 |
| runbooks/phase-05-octavia-enablement.md | runbook | 13844 | 226 | 2026-06-30 | 5 |
| runbooks/phase-06-incloud-mgmt-cluster.md | runbook | 30690 | 577 | 2026-07-01 | 5 |
| runbooks/phase-07-conductor-graft.md | runbook | 29583 | 503 | 2026-07-03 | 5 |
| runbooks/phase-08-workload-cluster-acceptance.md | runbook | 21992 | 380 | 2026-07-10 | 9 |
| runbooks/tenant-onboarding-v2-DRAFT.md | runbook | 32894 | 476 | 2026-07-09 | 8 |
| README.md | reference | 6134 | 111 | 2026-06-18 | 66 |
| CLAUDE.md | reference | 2879 | 53 | 2026-07-03 | 11 |
| .claude/skills/openstack-cloud-ops/SKILL.md | skill | 13833 | 173 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/environment.md | skill | 8018 | 131 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md | skill | 9233 | 154 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/operating-discipline.md | skill | 8792 | 146 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/platform-traps.md | skill | 24853 | 456 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/script-authoring.md | skill | 12686 | 219 | n/a | 0 |
| .claude/skills/openstack-cloud-ops/references/troubleshooting.md | skill | 7047 | 113 | n/a | 0 |
| memory/MEMORY.md | memory | 781 | 6 | n/a | 0 |
| memory/creds-folder-convention.md | memory | 2055 | 32 | n/a | 0 |
| memory/multi-workstation-remote-control.md | memory | 1609 | 25 | n/a | 0 |
| memory/project-posture-closed-test.md | memory | 1566 | 28 | n/a | 0 |
| memory/review-after-each-step.md | memory | 1340 | 24 | n/a | 0 |

Unreferenced changelogs (consolidation candidates by default): 0

## 2. Contradiction groups (mechanical)

### CONTRADICTION: plan `plan` -> 10 distinct values: `0/1/0`, `0/1/1`, `11/0/11`, `13/0/0`, `4/32/36`, `5/0-or-2/6`, `5/0/0`, `5/0/6`, `5/2/6`, `7/2/7`

| value | where | line |
|---|---|---|
| 0/1/0 | docs/changelog-20260712-docfix189-max-context-session-audit.md:46 | (`0 to add, 1 to change, 0 to destroy`). Removing it changes no resource. |
| 0/1/0 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:76 | - `tofu plan`: `0 to add, 1 to change, 0 to destroy` -- domain only; the 11 GiB direct-copy |
| 0/1/1 | docs/changelog-20260713-config-xml-path-deleted.md:45 | Plan: 0 to add, 1 to change, 1 to destroy. |
| 11/0/11 | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:94 | Plan: 11 to add, 0 to change, 11 to destroy. |
| 11/0/11 | docs/changelog-20260714-d119-tofu-apply.md:13 | Then a fresh `tofu plan`: **11 to add, 0 to change, 11 to destroy** -- all `must be replaced` |
| 11/0/11 | docs/session-ledger.md:741 | **THE `tofu apply` IS NOT DONE -- IT IS GATED.** Plan: 11 to add, 0 to change, 11 to destroy (the |
| 13/0/0 | runbooks/dc-dc-phase0-vcloud-prep.md:439 | NetBox assigns the supernet). Expect `Plan: 13 to add, 0 to change, 0 to destroy`. |
| 4/32/36 | docs/D-058-renumber.md:62 | Apply the same rotate (8->12, 12->16, 16->20, 24->8, 64->60; 4/32/36 fixed). These are |
| 5/0-or-2/6 | docs/dc0-deploy-readiness.md:167 | 6. Re-run the outer plan; confirm 5-add/(0-or-2)-change/6-destroy-empty (autostart in-place collapses to 0 pos... |
| 5/0-or-2/6 | docs/dc0-deploy-readiness.md:48 | > A fresh session MUST re-run the plan and re-confirm 5-add/(0-or-2)-change/6-destroy-empty (autostart in-plac... |
| 5/0/0 | docs/changelog-20260713-d114-voffice1-nested-virt.md:57 | - `tofu plan`: **5 to add, 0 to change, 0 to destroy** -- confirmed BEFORE applying that the running |
| 5/0/6 | docs/dc0-deploy-readiness.md:59 | keeps office1's key); tfvar set. Re-validated + re-planned -> outer plan UNCHANGED (5/0/6, create-only |
| 5/0/6 | docs/design-decisions.md:4064 | `office1-opnsense` and dirty the imminent DC0 outer plan (5/0/6). Set true only for NEW DC-edge |
| 5/0/6 | docs/session-ledger.md:278 | Gate before any apply: plan must read EXACTLY 5 add / 0 change / 6 destroy. Nothing applied this session. |
| 5/0/6 | docs/session-ledger.md:293 | re-plan UNCHANGED (5/0/6). netem RULED = placeholder for the rehearsal. Full remaining-prep checklist + |
| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:32 | `5 add / 2 in-place / 6 destroy`; the 2 in-place collapse to 0 once the bookend sets those two autostart |
| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:45 | D-127 implementation updated (IaC layer DONE); readiness-doc plan line updated (5/2/6, collapses to 0); |
| 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:52 | - `tofu -chdir=opentofu plan` -> `5 add / 2 in-place / 6 destroy`; no forces-replacement on any existing. |
| 5/2/6 | docs/dc0-deploy-readiness.md:37 | `tofu -chdir=opentofu plan` => **5 add / 2 in-place / 6 destroy**, decomposed and verified: |
| 5/2/6 | docs/design-decisions.md:3957 | is a new create with autostart=false baked in. Outer plan is now `5 add / 2 in-place / 6 destroy`, which |
| 5/2/6 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:17 | **5 add / 2 in-place / 6 destroy**. The delta is NOT in DC0 scope -- it is entirely |
| 5/2/6 | docs/session-ledger.md:156 | in-place, NOT replacement). Outer plan now 5 add / 2 in-place / 6 destroy (collapses to 0-change once the |
| 5/2/6 | docs/session-ledger.md:215 | **5 add / 2 in-place / 6 destroy** in `docs/dc0-deploy-readiness.md`. The entire delta is `voffice1`, the |
| 7/2/7 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:14 | Plan: 7 to add, 2 to change, 7 to destroy. |
| 7/2/7 | docs/session-ledger.md:214 | root (read-only plan, **OpenTofu v1.12.4**) returns **7 add / 2 change / 7 destroy**, NOT the committed |

### CONTRADICTION: version `juju` -> 5 distinct values: `2.1`, `2024.1`, `3.1`, `3.6`, `3.6.25`

| value | where | line |
|---|---|---|
| 2.1 | docs/design-decisions.md:1684 | (committed pre-change BOM), a fresh `juju create-backup` archive (now the STANDARD 2.1 step, |
| 2.1 | docs/v1-redeploy-changelog.md:424 | Vault's own status agrees with the Juju workload-status. Cleared for 2.1b (vault init). |
| 2024.1 | runbooks/dc-dc-phase5-dr-failover-drill.md:153 | juju deploy cinder-backup --channel 2024.1/stable --to lxd:<UNIT_NUMBER_TBD> |
| 3.1 | runbooks/phase-03-core-verify.md:10 | backends confirmed LOADED via a functional sweep, NOT juju status; Step 3.1). Troubleshooting: |
| 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki |
| 3.6 | docs/design-decisions.md:1611 | policy for either: (a) the Juju controller/agents (patch releases on the 3.6 track; |
| 3.6 | docs/design-decisions.md:1632 | The testcloud controller is SINGLE (non-HA) and Juju 3.6 ships no supported controller |
| 3.6 | docs/design-decisions.md:1677 | ## D-071 -- AMENDMENT (2026-07-05): controller backup EXISTS on juju 3.6; risk section corrected |
| 3.6 | docs/design-decisions.md:1680 | premise "no supported backup in Juju 3.6": `juju create-backup` / `download-backup` exist on |
| 3.6 | docs/design-decisions.md:2043 | - Single-unit (not HA) for VR1, with the confirmed backup posture (juju 3.6 `create-backup` / `download-backup... |
| 3.6 | docs/design-decisions.md:994 | `remove-machine` option. Juju 3.6 `remove-machine` reference: a machine can be removed from the |
| 3.6 | docs/handoff-20260705-open-items.md:59 | Backups are confirmed to exist (juju 3.6 `create-backup`); the open half is single-controller HA. |
| 3.6 | docs/session-ledger.md:989 | `download-backup` DO exist on juju 3.6 -- the original "removed in 3.0" premise was wrong). |
| 3.6 | docs/upstream-bug-draft-dashboard-tls.md:14 | Reactive charm generation; juju 3.6. |
| 3.6 | docs/v1-redeploy-changelog.md:1819 | explicit Risk section: single non-HA controller, no supported backup in Juju 3.6, no |
| 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped `juju status keystone --format=line`, and juju 3.6 line format omits workload |
| 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped `juju status keystone --format=line`, and juju 3.6 line format omits workload |
| 3.6 | docs/v1-redeploy-changelog.md:1953 | `juju-status` (units do NOT carry `agent-status.version` on juju 3.6); 2.1 |
| 3.6 | docs/v1-redeploy-changelog.md:1954 | REWRITTEN -- `juju create-backup` EXISTS on 3.6 and is now the STANDARD gated |
| 3.6 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:289 | Per D-104: scheduled controller backups, confirmed backup posture (juju 3.6 |
| 3.6 | runbooks/dc-dc-phase5-dr-failover-drill.md:448 | against this controller's actual installed juju client (3.6 per D-104) before running restore |
| 3.6 | runbooks/ops-update-procedure.md:158 | on juju 3.6 (the "removed in 3.0" authoring assumption was wrong for this |
| 3.6 | runbooks/ops-update-procedure.md:8 | controller backup EXISTS on juju 3.6). |
| 3.6.25 | docs/handoff-20260705-open-items.md:169 | > juju 3.6.25. Vault is `1.8/stable` rev 714 (current in-channel). |
| 3.6.25 | docs/handoff-20260705-open-items.md:22 | in-channel revisions; controllers/agents at juju 3.6.25; appendix-B re-baselined. |
| 3.6.25 | docs/session-ledger.md:78 | - **VR0 / DC0 testcloud:** fleet fully current (juju 3.6.25, 91 agents); D-011 CLOSED except |

### CONTRADICTION: version `lxd` -> 5 distinct values: `5.21`, `5.21.4`, `5.21.5`, `6.6`, `6.7`

| value | where | line |
|---|---|---|
| 5.21 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | `v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk |
| 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \| |
| 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:254 | makes it a decision. **LXD 5.21 LTS is supported to June 2029** |
| 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 proven end to end |
| 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:62 | 3. **LXD snap track changes are ONE-WAY.** LXD must be installed DIRECTLY onto `5.21/stable` and |
| 5.21 | docs/dc-dc-deployment-workflow.md:65 | > LXD (pinned to the 5.21 LTS track) runs ON it**, that LXD is **registered BACK INTO MAAS as an |
| 5.21 | docs/dc-dc-deployment-workflow.md:84 | \| **Gate** \| Office1 OPNsense edge up (**MET** -- routing, NAT, egress, Kea DHCP; gap #17 closed for Office1... |
| 5.21 | docs/dc-dc-deployment-workflow.md:85 | \| **Owns** \| **D-114** (site containment VM + MAAS-composed LXD VMs, incl. the LXD 5.21 pin), D-103 as AMEND... |
| 5.21 | docs/dc-dc-deployment-workflow.md:85 | \| **Owns** \| **D-114** (site containment VM + MAAS-composed LXD VMs, incl. the LXD 5.21 pin), D-103 as AMEND... |
| 5.21 | docs/dc-dc-deployment-workflow.md:874 | \| **D-114 site containment VM (`voffice1`)** \| **BUILT + RUNNING 2026-07-13.** `module "voffice1"` (`modules... |
| 5.21 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: |
| 5.21 | docs/stage3-review-base.patch:2859 | +  # createadmin/apikey/login, LXD (5.21 pin), LXD vm-host registration, compose-network DHCP. |
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:116 | REGION CONTROLLER runs ON it. LXD (5.21 LTS) also runs ON it, and that LXD is |
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:186 | D-114's hard LXD 5.21-LTS-track constraint, which IS decided). Each install |
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:46 | including the LXD 5.21 LTS pin), **D-103** as AMENDED by D-114 (OpenTofu owns |
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:488 | ssh <voffice1> 'sudo snap install lxd --channel=5.21/stable' |
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the **5.21 LTS track** (D-114). MAAS 3.6/3.7 is |
| 5.21 | runbooks/dc-dc-phase1-office1-standup.md:887 | - [ ] `runbooks/appendix-B-asbuilt-version-lock.md` updated with the LXD 5.21-LTS |
| 5.21.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:253 | VR0 runs LXD **5.21.4** and is therefore safe by accident of timing; D-114 |
| 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \| **Reuse vs new** \| NEW infra (Office1 didn't exist for VR0 DC0), but LESS new than it looks: the MAAS-comp... |
| 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \| **Reuse vs new** \| NEW infra (Office1 didn't exist for VR0 DC0), but LESS new than it looks: the MAAS-comp... |
| 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project `default`, LXD **5.21.4**; |
| 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project `default`, LXD **5.21.4**; |
| 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project `default`, LXD 5.21.4. |
| 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project `default`, LXD 5.21.4. |
| 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \|- voffice1        (L2)  MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea reservation) |
| 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:6 | **LXD 5.21.5** are installed on it, that LXD is **registered back into MAAS as an LXD VM host**, and |
| 5.21.5 | docs/dc-dc-deployment-workflow.md:114 | - **DONE (site) -- D-114 IS PROVEN END TO END:** MAAS 3.7.2 region+rack ON `voffice1`; LXD 5.21.5 |
| 5.21.5 | docs/session-ledger.md:603 | and **LXD 5.21.5**, with that LXD **registered into MAAS as an LXD VM host**. MAAS then |
| 5.21.5 | docs/vr1-office1-as-built.md:43 | \| **voffice1** \| `10.10.0.20` (Kea reservation) \| **MAAS 3.7.2** region+rack + PostgreSQL 16.14; **LXD 5.21... |
| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:249 | not yet in a MAAS release). Verbatim guidance: "We recommend using LXD <=6.6 |
| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... |
| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... |
| 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... |
| 6.6 | docs/design-decisions.md:2593 | pylxd >= 2.3.9, not yet in a MAAS release). Canonical's own guidance is "use LXD <= 6.6 or the |
| 6.7 | .claude/skills/openstack-cloud-ops/SKILL.md:100 | \| Creating/changing a `libvirt_domain`; anything about nested KVM, a libvirt storage pool, LXD versions, an O... |
| 6.7 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud |
| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \| |
| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) |
| 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:247 | Canonical's own announcement: LXD 6.7 "consolidates some API endpoints" that |
| 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on `latest` first, because MAAS 3.6/3.7 is incompatible with LXD >= 6.7 |
| 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:64 | (pinned pylxd 2.3.5 vs LXD 6.7's consolidated endpoints). Bonus discovered in research: |
| 6.7 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: |
| 6.7 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to them (fixed in |
| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:491 | cannot talk to LXD >= 6.7 (pylxd 2.3.5 vs LXD's consolidated API endpoints). |
| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's |
| 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's |

### CONTRADICTION: version `maas` -> 6 distinct values: `10.12.8`, `2.3.5`, `2.7.2`, `3.6`, `3.7`, `3.7.2`

| value | where | line |
|---|---|---|
| 10.12.8 | docs/D-058-renumber.md:67 | - scripts/phase-00-maas-carve.sh   (METAL_CIDR default 10.12.8 -> 10.12.12; ranges) |
| 2.3.5 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:248 | MAAS's pinned **pylxd 2.3.5** cannot speak to (fixed in **pylxd >= 2.3.9**, |
| 2.3.5 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to them (fixed in |
| 2.7.2 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:82 | ### `canonical/maas` (pinned `2.7.2`, confirmed 2026-07-09) |
| 2.7.2 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:54 | hashes: `dmacvicar/libvirt` 0.9.8, `canonical/maas` 2.7.2). |
| 2.7.2 | runbooks/dc-dc-phase0-vcloud-prep.md:339 | fetch `dmacvicar/libvirt` 0.9.8 and `canonical/maas` 2.7.2) |
| 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | `v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk |
| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) \| |
| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \| MAAS \| 3.7.2 (VR0) \| the LXD ceiling above is a property of MAAS 3.6/3.7 \| |
| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) |
| 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed past 6.6; MAAS 3.6/3.7 needs L... |
| 3.6 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on `latest` first, because MAAS 3.6/3.7 is incompatible with LXD >= 6.7 |
| 3.6 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7: |
| 3.6 | runbooks/dc-dc-phase1-office1-standup.md:442 | ssh <voffice1> 'sudo snap install maas --channel=<PENDING VERIFICATION: the current MAAS LTS/stable channel pe... |
| 3.6 | runbooks/dc-dc-phase1-office1-standup.md:490 | The `5.21` track is a HARD D-114 constraint, not a preference: MAAS 3.6/3.7 |
| 3.6 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the **5.21 LTS track** (D-114). MAAS 3.6/3.7 is |
| 3.7 | docs/changelog-20260716-d124-rack-addressing.md:39 | (D-123): disable timesyncd -> install the `maas` snap (3.7/stable) -> `maas init rack --maas-url <url> |
| 3.7 | docs/stage3-review-base.patch:261 | +(D-123): disable timesyncd -> install the `maas` snap (3.7/stable) -> `maas init rack --maas-url <url> |
| 3.7 | docs/stage3-review-base.patch:2786 | MAAS_CHANNEL="3.7/stable" |
| 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): |
| 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): |
| 3.7.2 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki |
| 3.7.2 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \| MAAS \| 3.7.2 (VR0) \| the LXD ceiling above is a property of MAAS 3.6/3.7 \| |
| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 proven end to end |
| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \|- voffice1        (L2)  MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea reservation) |
| 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:5 | `voffice1` is a working VR1 site headend. **MAAS 3.7.2** (region+rack, PostgreSQL 16.14) and |
| 3.7.2 | docs/dc-dc-deployment-workflow.md:114 | - **DONE (site) -- D-114 IS PROVEN END TO END:** MAAS 3.7.2 region+rack ON `voffice1`; LXD 5.21.5 |
| 3.7.2 | docs/design-decisions.md:2553 | **Measured as-built evidence (VR0 / `openstack-caracal-ipv4` MAAS 3.7.2, operator screenshots |
| 3.7.2 | docs/maas-as-built-reference.md:169 | - MAAS 3.7.2; controller `maas.maas`, Region+Rack, Non-HA(3 VLANs). |
| 3.7.2 | docs/session-ledger.md:602 | the pool), egress through the OPNsense edge. On it: **MAAS 3.7.2** region+rack (PostgreSQL 16.14) |
| 3.7.2 | docs/vr1-office1-as-built.md:43 | \| **voffice1** \| `10.10.0.20` (Kea reservation) \| **MAAS 3.7.2** region+rack + PostgreSQL 16.14; **LXD 5.21... |

### CONTRADICTION: version `netbox` -> 5 distinct values: `10.1`, `172.31`, `4.5.8`, `4.6`, `4.6.4`

| value | where | line |
|---|---|---|
| 10.1 | docs/changelog-20260716-d124-addressing-pin.md:21 | - **`netbox/dc-rack-mgmt-import.py`:** `CONTAINER = "10.12.0.0/16"` -> **`"172.31.0.0/24"`** (+ header |
| 172.31 | docs/changelog-20260716-d124-addressing-pin.md:44 | python3 netbox/dc-rack-mgmt-import.py --transit-cidr 172.31.0.0/30 --rack-ip 10.12.8.2   # dry-run; add --comm... |
| 4.5.8 | docs/changelog-20260710-netbox-roles-aggregates.md:42 | Script previewed (read-only) against live NetBox 4.5.8: correctly reports 12 objects to create |
| 4.5.8 | docs/dc-dc-netbox-buildout-scope.md:45 | `netbox.baldurkeep.com` v4.5.8. Regions: US West -> Eugene (prod); **Virtual Regions -> VR0, VR1**. |
| 4.5.8 | docs/design-decisions.md:2893 | **The collision, measured live against `netbox.baldurkeep.com` (4.5.8) on 2026-07-13:** |
| 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:25 | ### 2. NetBox 4.6 v2 API tokens: the wire format is `nbt_<key>.<plaintext>` -- NOT the `token` field |
| 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:29 | NetBox 4.6 **hashes** API tokens. The `Token` model has `key` (a 12-char PREFIX), `plaintext` (40), |
| 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited (0) ~3h earlier and was |
| 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited (0) ~3h earlier and was |
| 4.6 | docs/stage3-review-base.patch:1120 | +                die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v2 token " |
| 4.6 | docs/stage3-review-base.patch:897 | +                die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v2 token " |
| 4.6 | docs/vr1-office1-as-built.md:141 | **NetBox API token format (4.6):** the wire form is `nbt_<key>.<plaintext>`. The API's `token` field |
| 4.6 | docs/vr1-office1-as-built.md:44 | \| **office1-netbox** \| `10.10.1.10` \| **NetBox 4.6** (netbox-docker; `/opt/netbox-docker`, `docker compose ... |
| 4.6 | runbooks/dc-dc-phase1-office1-standup.md:725 | --draft draft/vr1-draft.json`. It STRUCTURALLY cannot reach upstream. NetBox 4.6 |
| 4.6.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:453 | **Note:** this is an UPSTREAM-only trap so far. The Office1 sandbox NetBox (4.6.4, no proxy in |
| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Office1 headend |
| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Office1 headend |
| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:6 | laid down by MAAS) and runs **NetBox 4.6.4** (netbox-docker, Django 6.0.6). Its API authenticates. |
| 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:74 | - NetBox **4.6.4** on Django 6.0.6, containers `netbox` + `netbox-worker` + `postgres` + `redis` + |
| 4.6.4 | docs/dc-dc-deployment-workflow.md:116 | machines **COMPOSED BY MAAS** and deployed -- `office1-netbox` (10.10.1.10, NetBox 4.6.4) and |
| 4.6.4 | docs/dc-dc-netbox-buildout-scope.md:198 | (`10.10.1.10:8000`, NetBox 4.6.4 on the Office1 VM, `docs/changelog-20260713-office1-netbox-deployed.md`): |

### CONTRADICTION: version `opnsense` -> 3 distinct values: `14.3`, `26.1`, `26.7`

| value | where | line |
|---|---|---|
| 14.3 | docs/session-ledger.md:189 | security pkgs) THEN reboot; (b) office1-opnsense itself is still on 14.3-RELEASE-p16 (guest OS not patched, |
| 26.1 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud |
| 26.1 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:130 | https://docs.opnsense.org/releases/CE_26.1.html |
| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:22 | \| OPNsense \| 26.1 "Witty Woodpecker" \| ISC-DHCP left core in 26.1 -- Kea/dnsmasq only (see below) \| |
| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:322 | ## 4. OPNsense 26.1 edge |
| 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:351 | https://docs.opnsense.org/releases/CE_26.1.html |
| 26.1 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:108 | **sizing** question, not a regression of this fix -- check OPNsense 26.1's documented |
| 26.1 | docs/changelog-20260712-office1-opnsense-edge-build.md:33 | (`opnsense-26.1-nano.qcow2`), so there is no target-path collision. Same conclusion, |
| 26.1 | docs/changelog-20260712-opnsense-prep-bz2-fallback.md:15 | `opnsense-26.1-nano.qcow2` (qcow2, 11 GiB virtual) via the python path. |
| 26.1 | docs/changelog-20260713-opnsense-api-proven.md:24 | GET  core/firmware/status      -> HTTP 200, OPNsense 26.1 (auth works) |
| 26.1 | docs/changelog-20260713-opnsense-api-proven.md:8 | An API key was minted for `root` in the GUI. In OPNsense **26.1** this is NOT in the user-edit |
| 26.1 | docs/changelog-20260714-opnsense-set-interface-v6.md:10 | among the API-covered surfaces. **Measured on the live Office1 edge (OPNsense 26.1): that is |
| 26.1 | docs/design-decisions.md:2498 | **MEASURED on the live Office1 edge (2026-07-14), OPNsense 26.1:** |
| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense **26.1 nano** amd64 (`scripts/opnsense-prep-image.sh 26.1`), prepped to |
| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense **26.1 nano** amd64 (`scripts/opnsense-prep-image.sh 26.1`), prepped to |
| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:60 | `/var/lib/libvirt/vr1/office1/opnsense-26.1-nano.qcow2` (11 GiB virtual). |
| 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:92 | the real fix, check OPNsense 26.1's documented minimum before picking a number. |
| 26.1 | docs/session-ledger.md:649 | CANNOT be done via the REST API. Measured on the live edge (OPNsense 26.1): `Interfaces > [LAN]` is |
| 26.1 | docs/stage3-review-base.patch:1373 | +  base_volume_path = "/var/lib/libvirt/vr1/vr1-dc0/opnsense-26.1-nano.qcow2" |
| 26.7 | docs/design-decisions.md:4074 | **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock install (only |
| 26.7 | docs/design-decisions.md:4074 | **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock install (only |
| 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | **Subject.** `office1-opnsense`, **OPNsense 26.7** (amd64), reviewed for plugin/add-on |
| 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | **Subject.** `office1-opnsense`, **OPNsense 26.7** (amd64), reviewed for plugin/add-on |
| 26.7 | docs/session-ledger.md:830 | **OPNsense EDGE 26.7 UPDATE + PLUGIN/ADD-ON REVIEW (2026-07-18).** Operator updated `office1-opnsense` |
| 26.7 | docs/vr1-office1-as-built.md:42 | \| **office1-opnsense** \| LAN `10.10.0.1` / WAN `172.30.1.2` \| **OPNsense 26.7** (FreeBSD base **15.1**-RELE... |

### CONTRADICTION: version `tofu` -> 5 distinct values: `0.9.8`, `1.1`, `1.12.3`, `1.12.4`, `1.6.0`

| value | where | line |
|---|---|---|
| 0.9.8 | .claude/skills/openstack-cloud-ops/references/environment.md:33 | libvirt/KVM via the `dmacvicar/libvirt` OpenTofu provider `0.9.8` on OpenTofu |
| 1.1 | docs/dc-dc-deployment-workflow.md:360 | - **A `tofu` binary EXISTS on the jumphost: OpenTofu v1.12.3.** The tree can |
| 1.12.3 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:19 | \| OpenTofu \| `v1.12.3` (as-run) \| the binary that actually executed Stage 1 \| |
| 1.12.3 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:4 | binary (OpenTofu v1.12.3), on the vcloud host, executing |
| 1.12.3 | docs/changelog-20260713-docfix194-opentofu-module-validation.md:19 | This was only findable because a `tofu` binary now exists on the jumphost (OpenTofu v1.12.3) -- |
| 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \| gap #2: "UNVALIDATED -- no `tofu` binary available" \| **OpenTofu v1.12.3 IS installed.** The tree validate... |
| 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \| gap #2: "UNVALIDATED -- no `tofu` binary available" \| **OpenTofu v1.12.3 IS installed.** The tree validate... |
| 1.12.3 | docs/dc-dc-deployment-workflow.md:360 | - **A `tofu` binary EXISTS on the jumphost: OpenTofu v1.12.3.** The tree can |
| 1.12.3 | docs/dc-dc-deployment-workflow.md:47 | infrastructure; vcloud host, OpenTofu v1.12.3). As-built: nested KVM already-on; |
| 1.12.3 | docs/dc-dc-deployment-workflow.md:875 | \| `opentofu/` (networks/pools/node-VM PXE/cloud-init-VM patterns) \| **VALIDATED 2026-07-13** (OpenTofu v1.12... |
| 1.12.3 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:27 | > **The OpenTofu 1.12.3 -> 1.12.4 bump is COINCIDENTAL, not causal.** The binary is now |
| 1.12.3 | docs/session-ledger.md:277 | 5/0/6-vs-5/2/6, DOCFIX-196 stale Stage-3 NetBox blocker, README tofu 1.12.3->1.12.4, phase-2 runbook). |
| 1.12.3 | docs/session-ledger.md:77 | tofu v1.12.3; tree validates (10/10 modules); lock committed. |
| 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \| L1-06 \| `tofu validate`: Success (OpenTofu v1.12.3, 11/11 modules). \| |
| 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \| L1-06 \| `tofu validate`: Success (OpenTofu v1.12.3, 11/11 modules). \| |
| 1.12.3 | runbooks/dc-dc-phase0-vcloud-prep.md:3 | > **FIRST EXECUTED 2026-07-10** (vcloud host, OpenTofu v1.12.3) -- run |
| 1.12.4 | docs/session-ledger.md:214 | root (read-only plan, **OpenTofu v1.12.4**) returns **7 add / 2 change / 7 destroy**, NOT the committed |
| 1.12.4 | docs/session-ledger.md:260 | **Version drift to log:** OpenTofu on the jumphost is now **v1.12.4**; `README.md:41` and the readiness |
| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** |
| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** |
| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** |
| 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:42 | `bash scripts/prereqs/install-opentofu.sh` pointer + the >=1.6.0 floor. |
| 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \| OpenTofu `tofu` >= 1.6.0 (installs as `/usr/bin/tofu`, not the `opentofu` snap) \| Steps 8-10 \| `scripts/p... |
| 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \| OpenTofu `tofu` >= 1.6.0 (installs as `/usr/bin/tofu`, not the `opentofu` snap) \| Steps 8-10 \| `scripts/p... |

### CONTRADICTION: status `stage-1` -> 2 distinct values: `CLOSED`, `COMPLETE`

| value | where | line |
|---|---|---|
| CLOSED | docs/dc-dc-deployment-workflow.md:570 | 9. **Runbook debt -- CLOSED 2026-07-09.** All seven Stage 1-7 runbooks are now |
| CLOSED | docs/security-ledger.md:20 | \| SEC-009 \| 2026-07-15 \| Credential/env SPRAWL + world-readable exposure on vcloud: three env files sat loo... |
| CLOSED | docs/stage3-review-base.patch:658 | \| SEC-009 \| 2026-07-15 \| Credential/env SPRAWL + world-readable exposure on vcloud: three env files sat loo... |
| COMPLETE | docs/changelog-20260709-office1-network-edge.md:42 | Stage 1/2 runbooks) implicitly assume that command is a COMPLETE inventory |
| COMPLETE | docs/session-ledger.md:91 | VR1 Stage 1 COMPLETE; Stage 2 was in CLOSE-OUT -- now superseded by the merge above. |

### CONTRADICTION: status `stage-2` -> 2 distinct values: `CLOSED`, `COMPLETE`

| value | where | line |
|---|---|---|
| CLOSED | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (DOCFIX-195) -- and holds the C... |
| CLOSED | docs/dc-dc-deployment-workflow.md:384 | which is what forced Stage 2's old Option A / Option B fork -- is **CLOSED |
| COMPLETE | docs/changelog-20260715-d120-load-and-iprange-tooling.md:45 | - Stage 2 close-out (C1..C5) is COMPLETE -> the branch->main merge point is reached |
| COMPLETE | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (DOCFIX-195) -- and holds the C... |

### CONTRADICTION: status `stage-3` -> 2 distinct values: `BLOCKED`, `HELD`

| value | where | line |
|---|---|---|
| BLOCKED | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:3 | Closes the collision that BLOCKED Stage 3. **D-119 COMPLETES D-117; it does not reverse it.** |
| HELD | docs/session-ledger.md:205 | `docs/dc-dc-deployment-workflow.md`'s Stage 3 section still reads "**Blocking to EXECUTE:** the HELD NetBox |

### CONTRADICTION: status `stage-4` -> 2 distinct values: `CLOSED`, `HELD`

| value | where | line |
|---|---|---|
| CLOSED | docs/dc-dc-deployment-workflow.md:884 | \| `lib-net.sh` / `lib-hosts.sh` \| `$DC` selector mechanism ADDED 2026-07-09 (DOCFIX-151, gap #1 CLOSED) -- `... |
| HELD | docs/session-ledger.md:51 | Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned.) |

### CONTRADICTION: status `stage-5` -> 2 distinct values: `BLOCKED`, `CLOSED`

| value | where | line |
|---|---|---|
| BLOCKED | docs/changelog-20260709-dc-selector-convention.md:5 | which explicitly BLOCKED the Stage 5 "high reuse" claim (`phase-01..08` |
| CLOSED | docs/changelog-20260709-dc-selector-convention.md:72 | Tooling gap register item #1 CLOSED. Stage 5's runbook (Juju controller + |

## 3. Status-claim rows (full table)

| kind | key | value | where | line |
|---|---|---|---|---|
| plan | plan | 4/32/36 | docs/D-058-renumber.md:62 | Apply the same rotate (8->12, 12->16, 16->20, 24->8, 64->60; 4/32/36 fixed). The... |
| plan (not counted) | plan | 5/0/6 | docs/audit/grounding-audit-charter.md:193 | 5 add / 0 change / 6 destroy AND the fresh-agent test question 7 passes. Prose |
| plan (not counted) | plan | 5/0/6 | docs/audit/grounding-audit-charter.md:228 | 4. The captured outer plan reads exactly 5 add / 0 change / 6 destroy (the stand... |
| plan | plan | 0/1/0 | docs/changelog-20260712-docfix189-max-context-session-audit.md:46 | (`0 to add, 1 to change, 0 to destroy`). Removing it changes no resource. |
| plan | plan | 0/1/0 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:76 | - `tofu plan`: `0 to add, 1 to change, 0 to destroy` -- domain only; the 11 GiB ... |
| plan | plan | 0/1/1 | docs/changelog-20260713-config-xml-path-deleted.md:45 | Plan: 0 to add, 1 to change, 1 to destroy. |
| plan | plan | 5/0/0 | docs/changelog-20260713-d114-voffice1-nested-virt.md:57 | - `tofu plan`: **5 to add, 0 to change, 0 to destroy** -- confirmed BEFORE apply... |
| plan | plan | 11/0/11 | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:94 | Plan: 11 to add, 0 to change, 11 to destroy. |
| plan | plan | 11/0/11 | docs/changelog-20260714-d119-tofu-apply.md:13 | Then a fresh `tofu plan`: **11 to add, 0 to change, 11 to destroy** -- all `must... |
| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:32 | `5 add / 2 in-place / 6 destroy`; the 2 in-place collapse to 0 once the bookend ... |
| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:45 | D-127 implementation updated (IaC layer DONE); readiness-doc plan line updated (... |
| plan | plan | 5/2/6 | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:52 | - `tofu -chdir=opentofu plan` -> `5 add / 2 in-place / 6 destroy`; no forces-rep... |
| plan | plan | 5/0-or-2/6 | docs/dc0-deploy-readiness.md:167 | 6. Re-run the outer plan; confirm 5-add/(0-or-2)-change/6-destroy-empty (autosta... |
| plan | plan | 5/2/6 | docs/dc0-deploy-readiness.md:37 | `tofu -chdir=opentofu plan` => **5 add / 2 in-place / 6 destroy**, decomposed an... |
| plan | plan | 5/0-or-2/6 | docs/dc0-deploy-readiness.md:48 | > A fresh session MUST re-run the plan and re-confirm 5-add/(0-or-2)-change/6-de... |
| plan | plan | 5/0/6 | docs/dc0-deploy-readiness.md:59 | keeps office1's key); tfvar set. Re-validated + re-planned -> outer plan UNCHANG... |
| plan | plan | 5/2/6 | docs/design-decisions.md:3957 | is a new create with autostart=false baked in. Outer plan is now `5 add / 2 in-p... |
| plan | plan | 5/0/6 | docs/design-decisions.md:4064 | `office1-opnsense` and dirty the imminent DC0 outer plan (5/0/6). Set true only ... |
| plan | plan | 7/2/7 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:14 | Plan: 7 to add, 2 to change, 7 to destroy. |
| plan | plan | 5/2/6 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:17 | **5 add / 2 in-place / 6 destroy**. The delta is NOT in DC0 scope -- it is entir... |
| plan | plan | 5/2/6 | docs/session-ledger.md:156 | in-place, NOT replacement). Outer plan now 5 add / 2 in-place / 6 destroy (colla... |
| plan | plan | 7/2/7 | docs/session-ledger.md:214 | root (read-only plan, **OpenTofu v1.12.4**) returns **7 add / 2 change / 7 destr... |
| plan | plan | 5/2/6 | docs/session-ledger.md:215 | **5 add / 2 in-place / 6 destroy** in `docs/dc0-deploy-readiness.md`. The entire... |
| plan | plan | 5/0/6 | docs/session-ledger.md:278 | Gate before any apply: plan must read EXACTLY 5 add / 0 change / 6 destroy. Noth... |
| plan | plan | 5/0/6 | docs/session-ledger.md:293 | re-plan UNCHANGED (5/0/6). netem RULED = placeholder for the rehearsal. Full rem... |
| plan | plan | 11/0/11 | docs/session-ledger.md:741 | **THE `tofu apply` IS NOT DONE -- IT IS GATED.** Plan: 11 to add, 0 to change, 1... |
| plan | plan | 13/0/0 | runbooks/dc-dc-phase0-vcloud-prep.md:439 | NetBox assigns the supernet). Expect `Plan: 13 to add, 0 to change, 0 to destroy... |
| status | - | CLOSED | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:109 | The narrative ledger must not claim CLOSED what the scan shows OPEN, nor omit wh... |
| status | - | CLOSED | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:127 | report PASS_PENDING_MANUAL while the row is OPEN, PASS only when it is attested ... |
| status (not counted) | - | CLOSED | docs/audit/grounding-audit-charter.md:190 | - **GA-R6: Executable definition of done.** A stage is CLOSED only when a named |
| status (not counted) | - | READY | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins |
| status (not counted) | - | BLOCKED | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins |
| status (not counted) | - | CLOSED | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins |
| status (not counted) | - | COMPLETE | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins |
| status (not counted) | - | HELD | docs/audit/grounding-audit-charter.md:98 | stage statuses (READY / BLOCKED / CLOSED / COMPLETE / HELD), version pins |
| status | - | HELD | docs/changelog-20260703-process-hardening.md:127 | 403, conductor LIVE args). Missing admin scope = HELD exit 2, never a silent |
| status | - | CLOSED | docs/changelog-20260709-ceph-replication-tooling.md:135 | Tooling gap register item #5's MECHANISM is CLOSED; its DATA half (a real |
| status | - | CLOSED | docs/changelog-20260709-ceph-replication-tooling.md:143 | workflow.md` tooling gap register item #5 updated to CLOSED (mechanism), |
| status | - | CLOSED | docs/changelog-20260709-dc-dc-phase6-runbook.md:66 | item #9 now CLOSED for authoring). Remaining work is the adversarial |
| status | - | CLOSED | docs/changelog-20260709-mtu-ceph-budget-calculators.md:124 | Tooling gap register item #7 CLOSED (mechanism). Both calculators are |
| status | - | CLOSED | docs/changelog-20260709-netbox-dc-dc-pipeline.md:104 | Tooling gap register #3 CLOSED (mechanism). Before a real run: the operator |
| status | - | CLOSED | docs/changelog-20260709-office1-network-edge.md:126 | Tooling gap register items #12 and #16 CLOSED. Gap #17 (NEW) is now the |
| status | - | HELD | docs/changelog-20260710-netbox-roles-aggregates.md:34 | `2602:f3e2::/36` (the HELD allocation = region-0 of the planned `/32`; NOT `/32`... |
| status | - | CLOSED | docs/changelog-20260710-opentofu-state-file-security.md:81 | (this gap, CLOSED) and #19 (a related, still-OPEN gap found in the same |
| status | - | CLOSED | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:68 | CLOSED). |
| status | - | COMPLETE | docs/changelog-20260712-office1-opnsense-edge-build.md:50 | - Edge build COMPLETE except the boot: image, `office1-wan`, creds, config, ISO,... |
| status | - | COMPLETE | docs/changelog-20260713-config-xml-path-deleted.md:1 | # 2026-07-13 -- D-113(a2) COMPLETE: the config.xml path is DELETED |
| status | - | CLOSED | docs/changelog-20260713-workflow-doc-status-correction.md:14 | \| gap #17: "no per-site ISP-uplink network exists anywhere, for ANY site" \| **... |
| status | - | CLOSED | docs/changelog-20260715-d120-load-and-iprange-tooling.md:41 | - **C2 sub-task (ii) CLOSED; C2 fully closed.** office1-netbox now holds the com... |
| status | - | CLOSED | docs/changelog-20260715-d120-load-and-iprange-tooling.md:43 | - **D-120 Step 6 CLOSED** -- the band layout is now recorded in NetBox, no apex ... |
| status | - | COMPLETE | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:35 | C2 redefined: office1-netbox holds the COMPLETE validated dataset (carve + roles... |
| status | - | CLOSED | docs/changelog-20260715-fidelity-check-scope-correctness.md:61 | - **C2 sub-task (i) is CLOSED** -- the sandbox is faithful, established by a che... |
| status | - | HELD | docs/changelog-20260715-stage3-prereqs-prep.md:35 | netem HELD as a comment (Step 11, runtime SSH target + unruled params; the vr1-d... |
| status | - | HELD | docs/changelog-20260715-stage3-prereqs-prep.md:36 | bridge is `virbr7`, measured). **HELD pending D-123:** the `vvr1-dc0` headend + ... |
| status | - | CLOSED | docs/changelog-20260716-review-sweep-phaseAB.md:33 | - **SEC-011:** CLOSED (operator ruling -- keep uniform 6-NIC; A2's Roosevelt-del... |
| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:25 | WAN (bridge-in is single-NAT; RULED, not HELD). [CORRECTED 2026-07-16: an earlie... |
| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:25 | WAN (bridge-in is single-NAT; RULED, not HELD). [CORRECTED 2026-07-16: an earlie... |
| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:47 | (commit `5175365` + OBS-3 RESOLVED-by-D-125 + new HELD gates); `references/platf... |
| status | - | HELD | docs/changelog-20260716-review-sweep-phaseC2-D125.md:63 | (No new HELD addressing: the `/24` is the ruled `172.30.2.0/24` and the OPNsense... |
| status | - | COMPLETE | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:29 | ## Block B (D-124 rack transit + rack IP) -- COMPLETE (operator chose: write the... |
| status | - | COMPLETE | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:44 | So the full NetBox D-124/edge-WAN import is COMPLETE in the apex. Copied importe... |
| status | - | CLOSED | docs/clientdocs-workflow-review-20260708.md:77 | no steer away from flannel. CLOSED 2026-07-08 in kubernetes.md + the Jenkins |
| status | - | CLOSED | docs/clientdocs-workflow-review-20260708.md:83 | host" -- the exact failure devteam hit. CLOSED in the Jenkins guide; NOT yet |
| status | - | COMPLETE | docs/dc-dc-deployment-workflow.md:132 | the COMPLETE validated dataset, NOT by any upstream write. See C2 for what "comp... |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:142 | \| C3 \| The `$DC` shell-selector collision resolved. \| **DONE 2026-07-14 (D-11... |
| status | - | COMPLETE | docs/dc-dc-deployment-workflow.md:160 | WRITTEN + RESHAPED to Model B, NOT YET EXECUTED. Authoring for this stage is eff... |
| status | - | HELD | docs/dc-dc-deployment-workflow.md:161 | remains is operator-gated (HELD NetBox addressing) + deploy-time gates. |
| status | - | HELD | docs/dc-dc-deployment-workflow.md:187 | **Blocking to EXECUTE (all operator-gated):** the HELD NetBox addressing -- **D-... |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:344 | 1. **`$DC` selector convention -- CLOSED 2026-07-09 (DOCFIX-151).** |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:438 | 3. **NetBox multi-DC/dual-stack import pipeline -- MECHANISM CLOSED |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:500 | CLOSED 2026-07-09 (DOCFIX-165), data half still open.** `runbooks/dc- |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:526 | 6. **Designate reactivation is a bundle change -- CLOSED 2026-07-10 |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:538 | 7. **MTU/geneve budget + Ceph disk-budget calculators -- CLOSED 2026-07-09 |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:580 | 10. **Harness debt -- LARGELY CLOSED 2026-07-09/10.** This repo's own delivery |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:597 | CLOSED 2026-07-09.** `main.tf` previously wired only `office1_pool_path` |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:643 | 14. **Three real `bundle.yaml` gaps for D-108's DR mechanism -- CLOSED |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:662 | section). **Sub-item 2 (script `$DC`-parameterization) CLOSED |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:682 | CLOSED 2026-07-09.** The topology (buildout design Section 1) is |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:702 | now also CLOSED) -- that gap was the service VMs' own attach point; |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:714 | 17. **PARTIALLY CLOSED 2026-07-13 -- the DECISION is made and PROVEN for |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:716 | - **Office1: CLOSED.** The answer was the one this gap proposed -- a |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:761 | 18. **OpenTofu state file had no documented protection -- CLOSED 2026-07-10 |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:783 | infrastructure itself -- CLOSED 2026-07-10 (DOCFIX-176).** |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:835 | tool -- CLOSED for Office1; DC path templated.** |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:84 | \| **Gate** \| Office1 OPNsense edge up (**MET** -- routing, NAT, egress, Kea DH... |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:845 | **CLOSED for Office1 (D-126 amendment):** `scripts/site-baseleg.sh` + |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:862 | **Status: Office1 CLOSED; DC rows DEFERRED-until-measured (mechanism in place).*... |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:87 | \| **Authoring status** \| **Runbook REWRITTEN 2026-07-13 to the D-114 model: `r... |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:881 | \| Office1-local network (`modules/office1-network`) \| BUILT + INSTANTIATED 202... |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:882 | \| Office1 OPNsense edge ownership \| **BUILT AND LIVE 2026-07-12/13.** `module ... |
| status | - | CLOSED | docs/dc-dc-deployment-workflow.md:885 | \| NetBox DC-DC pipeline (`netbox/dc-dc-prefixes-import.py`) \| MECHANISM BUILT ... |
| status | - | COMPLETE | docs/dc-dc-netbox-buildout-scope.md:288 | IPAM apex) holds the COMPLETE validated dataset AND it is VERIFIED. Two sub-task... |
| status | - | CLOSED | docs/dc-dc-netbox-buildout-scope.md:58 | \| G5 \| **DC naming** \| ~~NetBox = `vr1-dc0`/`vr1-dc1`; tool = DC1/DC2~~ \| **... |
| status | - | HELD | docs/dc0-deploy-readiness.md:100 | ### C6. `vr1-dc1` -- HELD (do not attempt) |
| status | - | CLOSED | docs/dc0-deploy-readiness.md:156 | After this lands the host is on -136 (matching the guests) and the bookend is CL... |
| status | - | HELD | docs/dc0-deploy-readiness.md:6 | and is operator-gated. `vr1-dc1` is HELD (no ruled addressing; see below), DC0 o... |
| status | - | COMPLETE | docs/dc0-deploy-readiness.md:8 | > **STATUS 2026-07-17: PREP COMPLETE -- DC0 IS DEPLOY-READY.** Final gate re-che... |
| status | - | READY | docs/dc0-deploy-readiness.md:8 | > **STATUS 2026-07-17: PREP COMPLETE -- DC0 IS DEPLOY-READY.** Final gate re-che... |
| status | - | CLOSED | docs/design-decisions.md:1061 | ## D-063: RESOLVED / CLOSED (2026-07-03) -- tighten the capi-mgmt-cluster securi... |
| status | - | CLOSED | docs/design-decisions.md:1063 | **Status:** PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... |
| status | - | CLOSED | docs/design-decisions.md:1063 | **Status:** PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... |
| status | - | CLOSED | docs/design-decisions.md:1124 | ### D-063 -- RESOLVED / CLOSED (2026-07-03): applied and functionally verified |
| status | - | CLOSED | docs/design-decisions.md:1172 | **Status:** RESOLVED / CLOSED (applied + functionally verified 2026-07-03). Supe... |
| status | - | CLOSED | docs/design-decisions.md:1411 | ### D-067 -- AMENDMENT (2026-07-02, post-fix): corrected mechanism; FIXED live; ... |
| status | - | CLOSED | docs/design-decisions.md:1449 | **Status:** CLOSED for v1 (fixed + validated live 2026-07-02). **Adds:** BUNDLEF... |
| status | - | CLOSED | docs/design-decisions.md:1536 | FAIL-CLOSED deploy-gate check in `provider-bundle-check.py` (content compare). A... |
| status | - | CLOSED | docs/design-decisions.md:1726 | Operator ruled 2026-07-06: D-050 is CLOSED as resolved by D-051's option (b) -- ... |
| status | - | CLOSED | docs/design-decisions.md:1729 | FAIL-CLOSED zip-vs-yaml drift check in the deploy gate and behavioral acceptance... |
| status | - | CLOSED | docs/design-decisions.md:1811 | therefore CLOSED-except-item-6. The v1-close checklist (handoff section 6) |
| status | - | HELD | docs/design-decisions.md:2148 | - Vault pinned 1.8/stable (the only viable charm lineage for this stack; the 1.1... |
| status | - | CLOSED | docs/design-decisions.md:3512 | uplink, and LAN role are CLOSED by this entry (build `vr1-dc0-wan`, wire the edg... |
| status | - | HELD | docs/design-decisions.md:3568 | HELD until it lands (assigning IPs by guess would violate hard rule 2). Everythi... |
| status | - | HELD | docs/design-decisions.md:3770 | **Addressing: RULED, not HELD (corrected 2026-07-16).** The vcloud ISP `/24` is ... |
| status | - | HELD | docs/design-decisions.md:3773 | `module "vr1_dc0_uplink"` (cidr `172.30.2.0/24`), NOT a NetBox-assigned HELD tfv... |
| status | - | HELD | docs/design-decisions.md:3776 | loaded, D-115-ruled value not invented), and it introduces NO new HELD gate. (An... |
| status | - | HELD | docs/design-decisions.md:3777 | draft of this entry wrongly modeled a `var.vr1_dc0_uplink_cidr` HELD value + an ... |
| status | - | CLOSED | docs/design-decisions.md:730 | The D-042 cosmetic `health_status = UNHEALTHY` false-negative is a property of d... |
| status | - | CLOSED | docs/design-decisions.md:732 | ## D-050: RESOLVED / CLOSED (2026-07-06) -- keystone `use-policyd-override=true`... |
| status | - | CLOSED | docs/design-decisions.md:734 | **Status:** RESOLVED / CLOSED 2026-07-06 (recorded 2026-06-17 as an unruled find... |
| status | - | CLOSED | docs/handoff-20260705-open-items.md:168 | > **Current state:** last ops-update window (ops-update-20260705) is CLOSED; fle... |
| status | - | CLOSED | docs/handoff-20260705-open-items.md:21 | - The last jumphost ops-update window (`ops-update-20260705`) is CLOSED; fleet r... |
| status | - | CLOSED | docs/handoff-20260705-open-items.md:65 | - ~~D-050 / list_trusts hardening~~ RESOLVED: D-050 CLOSED via D-051 (ruling |
| status | - | HELD | docs/model-a-fallback-plan.md:75 | (No HELD gate here: the /24 is a ruled literal, not a tfvar.) |
| status | - | CLOSED | docs/script-quality-findings-20260707.md:133 | direction is CLOSED (safe), but a benign stderr warning on a noisy CLI would |
| status | - | CLOSED | docs/security-ledger.md:22 | \| SEC-011 \| 2026-07-16 \| **Node least-connectivity gap (not an L2 breach).** ... |
| status | - | CLOSED | docs/session-ledger.md:1001 | - **quota-vs-capacity: CLOSED** -- operator ACCEPTS as-documented (no quota trim... |
| status | - | BLOCKED | docs/session-ledger.md:1064 | ## NetBox import -- DONE for Office1; DC import BLOCKED on one operator ruling (... |
| status | - | BLOCKED | docs/session-ledger.md:1088 | ### ~~BLOCKED~~ **UNBLOCKED and DONE** -- D-118 ratified the org ULA; both DCs i... |
| status | - | STOPPED | docs/session-ledger.md:1124 | Using it anyway would violate hard rule 2 (never use an inferred value), so the ... |
| status | - | CLOSED | docs/session-ledger.md:119 | tooling gap is CLOSED (dumper + checker now cover both classes). NO apex write -... |
| status | - | CLOSED | docs/session-ledger.md:12 | This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what... |
| status | - | CLOSED | docs/session-ledger.md:192 | **BOOKEND ITEM (a) CLOSED 2026-07-18 -- MEASURED, and the autostart chain PROVED... |
| status | - | CLOSED | docs/session-ledger.md:20 | session narratives. Those streams are CLOSED and reconciled into the one list be... |
| status | - | BLOCKED | docs/session-ledger.md:212 | **!! DC0 OUTER APPLY IS BLOCKED ON NEW DRIFT -- do NOT apply. See |
| status | - | BLOCKED | docs/session-ledger.md:240 | Options (a)-(d) are in the finding. **DC0 IS NOT BLOCKED on the unresolved provi... |
| status | - | COMPLETE | docs/session-ledger.md:281 | **DC0 DEPLOY READINESS -- PREP COMPLETE 2026-07-17 (deploy-ready). See `docs/dc0... |
| status | - | BLOCKED | docs/session-ledger.md:319 | rack transit/30 + rack IP in office1-netbox, feed the 4 tfvars (tofu plan BLOCKE... |
| status | - | CLOSED | docs/session-ledger.md:374 | - **[R-4] SEC-011 CLOSED (operator ruling 2026-07-16, "Keep uniform 6-NIC").** A... |
| status | - | CLOSED | docs/session-ledger.md:377 | `local.vr1_dc0_node_nics`); amend the SEC-011 ledger row to CLOSED / accepted-no... |
| status | - | COMPLETE | docs/session-ledger.md:423 | items COMPLETE. NOTHING applied/committed since 114d392; Phase C/D edits present... |
| status | - | HELD | docs/session-ledger.md:442 | - **No new HELD gate (CORRECTED 2026-07-16):** the vcloud ISP /24 is the SAME `1... |
| status | - | HELD | docs/session-ledger.md:445 | no re-address. D-125 adds NO NetBox object. (An earlier draft's `vr1_dc0_uplink_... |
| status | - | HELD | docs/session-ledger.md:469 | (operator-ratified 2026-07-16): the vcloud ISP /24 is the ruled `172.30.2.0/24` ... |
| status | - | HELD | docs/session-ledger.md:554 | netem HELD (Step 11; mesh bridge = virbr7 measured), stale `vr1_dc1_planes` comm... |
| status | - | HELD | docs/session-ledger.md:554 | netem HELD (Step 11; mesh bridge = virbr7 measured), stale `vr1_dc1_planes` comm... |
| status | - | READY | docs/session-ledger.md:557 | (172.30.2/3.0/24, role edge, site-scoped), DRY-BY-DEFAULT with whole-plan prefli... |
| status | - | COMPLETE | docs/session-ledger.md:612 | **OFFICE1 IS ESSENTIALLY COMPLETE (2026-07-13).** `office1-netbox` (10.10.1.10) ... |
| status | - | CLOSED | docs/session-ledger.md:627 | 1a. **DONE 2026-07-14 -- Office1's LAN IPv6 is LIVE and PROVEN ON THE WIRE. C1 i... |
| status | - | COMPLETE | docs/session-ledger.md:687 | runbook, and **ensure `office1-netbox` holds the COMPLETE validated dataset** (c... |
| status | - | CLOSED | docs/session-ledger.md:699 | **C2 sub-task (ii) DONE 2026-07-15 -> C2 FULLY CLOSED -> STAGE 2 CLOSE-OUT COMPL... |
| status | - | COMPLETE | docs/session-ledger.md:699 | **C2 sub-task (ii) DONE 2026-07-15 -> C2 FULLY CLOSED -> STAGE 2 CLOSE-OUT COMPL... |
| status | - | CLOSED | docs/session-ledger.md:704 | delta (D-115/D-117/D-118/D-120)." Gauntlet ALL GREEN (60). D-120 Step 6 CLOSED (... |
| status | - | CLOSED | docs/session-ledger.md:707 | 3. **`pynetbox` -- CLOSED 2026-07-13.** Installed (7.0.0) on `office1-netbox`, w... |
| status | - | CLOSED | docs/session-ledger.md:713 | 4. **The apparmor rule is now IN THE REPO -- CLOSED 2026-07-13.** |
| status | - | CLOSED | docs/session-ledger.md:721 | 5. **The DEFERRED literals are now ALL ASSIGNED -- item CLOSED 2026-07-14.** The... |
| status | - | CLOSED | docs/session-ledger.md:730 | 6. **D-119 (ADOPTED 2026-07-14) -- THE DC NAMESPACE IS REGION-QUALIFIED. C3/gap ... |
| status | - | CLOSED | docs/session-ledger.md:747 | 6a. **(historical) G5 NetBox site rename -- CLOSED as D-117 (ADOPTED, Option B).... |
| status | - | CLOSED | docs/session-ledger.md:755 | G2 (aggregates) and G3 (ULA /48) are both CLOSED by the same work. |
| status | - | CLOSED | docs/session-ledger.md:761 | 9. **DHCP PROVEN END TO END -- CLOSED 2026-07-13.** `voffice1` (the first client... |
| status | - | CLOSED | docs/session-ledger.md:776 | **VCLOUD POST-RESTART SWEEP + D-126 BASE-LEG + D-128 OPERATING MODEL (2026-07-17... |
| status | - | CLOSED | docs/session-ledger.md:78 | - **VR0 / DC0 testcloud:** fleet fully current (juju 3.6.25, 91 agents); D-011 C... |
| status | - | CLOSED | docs/session-ledger.md:795 | item **20** CLOSED for Office1 + the skill's per-DC discipline). Gauntlet ALL GR... |
| status | - | CLOSED | docs/session-ledger.md:81 | - **STAGE 2 CLOSED AND MERGED (2026-07-15).** All close-out gates C1..C5 met; br... |
| status | - | HELD | docs/session-ledger.md:905 | offboard) are HELD** by the operator until the DOCFIX-126/127 live-verify lands. |
| status | - | CLOSED | docs/session-ledger.md:913 | PROPOSED/OPEN. D-063 is `RESOLVED / CLOSED` in `design-decisions.md` (verified).... |
| status | - | HELD | docs/stage3-adversarial-review-20260716.md:319 | \| **L5** (exit gate "conditionally met at best") \| **CONFIRMED -- still condit... |
| status | - | BLOCKED | docs/stage3-adversarial-review-20260716.md:319 | \| **L5** (exit gate "conditionally met at best") \| **CONFIRMED -- still condit... |
| status | - | BLOCKED | docs/stage3-adversarial-review-20260716.md:61 | \| L1-07 \| `tofu plan`: **BLOCKED** -- 4 required vars unset/no-default (`vr1_d... |
| status | - | HELD | docs/stage3-review-base.patch:1415 | +# netem (runbook Step 11) -- HELD as a comment. It is a POST-apply step that ru... |
| status | - | HELD | docs/stage3-review-base.patch:163 | +  netem HELD as a comment (Step 11, runtime SSH target + unruled params; the vr... |
| status | - | HELD | docs/stage3-review-base.patch:164 | +  bridge is `virbr7`, measured). **HELD pending D-123:** the `vvr1-dc0` headend... |
| status | - | BLOCKED | docs/stage3-review-base.patch:2063 | +  scope is BLOCKED and this pass's real reach is Steps 1-8 (see the GATE |
| status | - | CLOSED | docs/stage3-review-base.patch:537 | +uplink, and LAN role are CLOSED by this entry (build `vr1-dc0-wan`, wire the ed... |
| status | - | HELD | docs/stage3-review-base.patch:564 | +HELD until it lands (assigning IPs by guess would violate hard rule 2). Everyth... |
| status | - | HELD | docs/stage3-review-base.patch:687 | +  HELD until it lands.) |
| status | - | HELD | docs/stage3-review-base.patch:763 | +    netem HELD (Step 11; mesh bridge = virbr7 measured), stale `vr1_dc1_planes`... |
| status | - | HELD | docs/stage3-review-base.patch:763 | +    netem HELD (Step 11; mesh bridge = virbr7 measured), stale `vr1_dc1_planes`... |
| status | - | READY | docs/stage3-review-base.patch:766 | +    (172.30.2/3.0/24, role edge, site-scoped), DRY-BY-DEFAULT with whole-plan p... |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1365 | ## 2026-07-02 (session 2) -- D-067 FIXED live + CLOSED; root cause corrected to ... |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1564 | First live run of d063-apply.sh --audit failed CLOSED at exit 20 with zero mutat... |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1585 | ### 2026-07-03 (addendum 7) -- D-063 RESOLVED/CLOSED: applied + functionally ver... |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1667 | row in docs/security-ledger.md. OPEN/PENDING -> PASS_PENDING_MANUAL(3); CLOSED/R... |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1704 | D-063 header/first-status reconciled to RESOLVED/CLOSED (the closure had been ap... |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:1758 | gauntlet 31. The full-d011 profile is now COMPLETE (all six items exist). REQUIR... |
| status | - | HELD | docs/v1-redeploy-changelog.md:1873 | re-gate on a true PASS) -- the update window is HELD at Section 1.4 until this l... |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:1924 | ### 2026-07-05 (addendum 16, jumphost stream) -- ops-update-20260705 WINDOW CLOS... |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:1929 | WINDOW RESULT: COMPLETE, all gates green. Controller 3.6.24 -> 3.6.25 (single, |
| status | - | HELD | docs/v1-redeploy-changelog.md:1945 | EXCLUSIONS HELD: vault untouched (1.8/stable rev 372; its in-channel 372->714 |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2023 | DOCFIX-089: phase-03 3.3 https/cookie check rewritten FAIL-CLOSED (transport, HT... |
| status | - | HELD | docs/v1-redeploy-changelog.md:2257 | probe.** First live run HELD on the queued VERIFY-LIVE item: admin-side |
| status | - | HELD | docs/v1-redeploy-changelog.md:2271 | half correctly self-HELD (headroom UNKNOWN, fail-closed as designed) on the |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2308 | DOCFIX candidate, not actioned. (2) barbican host_href observation CLOSED |
| status | - | HELD | docs/v1-redeploy-changelog.md:2327 | devteam PINNED next (onboarding HELD on operator snapshot ruling). |
| status | - | HELD | docs/v1-redeploy-changelog.md:2346 | 1 DRIFT / 2 HELD. Harness 10/10 (mock leader deliberately keystone/1; ssh |
| status | - | HELD | docs/v1-redeploy-changelog.md:2378 | instantiation = devteam tenant (HELD on snapshot). Intake questions for the |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2463 | the capi-mgmt net (resolved live by stable name, FAIL-CLOSED on lookup |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:2499 | ### 2026-07-06 (addendum 30, jumphost stream) -- client handover package COMPLET... |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2638 | found-not-fixed since addendum 28, now CLOSED); (d) LB-gone wait counts |
| status | - | HELD | docs/v1-redeploy-changelog.md:2700 | of intake answers (pack instantiation HELD on them); capi-test-1 |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:2842 | 5.3 FAILS-as-anticipated, CLOSED via its own CLI-path clause (API |
| status | - | BLOCKED | docs/v1-redeploy-changelog.md:2946 | -- BLOCKED on the cross-stream ruling that its resize-acceptance role |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:298 | - **DOCFIX-040 COMPLETE.** `pre-flight-checks.sh` and `osd-blank-check.sh` both ... |
| status | - | HELD | docs/v1-redeploy-changelog.md:3001 | - **HELD for operator (morning):** the broad ease-of-use review across ALL |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:318 | ## Phase-02 vault bring-up (as-executed -- COMPLETE 2026-06-27) |
| status | - | CLOSED | docs/v1-redeploy-changelog.md:477 | principals -- reconciles with the handoff's original 31. **PHASE-02 EXIT GATE CL... |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:487 | PHASE-02 COMPLETE -- discrete vault mutations done. Cascade-settle + the post-in... |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:661 | ### Phase-04 EXECUTED -- network carve COMPLETE (2026-06-27) |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:739 | ### Step 5.1 EXECUTED -- configure-resources COMPLETE (2026-06-27) |
| status | - | COMPLETE | docs/v1-redeploy-changelog.md:747 | ### Step 5.2 EXECUTED -- amphora pipeline COMPLETE; PHASE-05 EXIT GATE MET (2026... |
| status | - | BLOCKED | docs/v1-redeploy-changelog.md:932 | ### Phase-06 6.3 BLOCKED -- provider FIP range dark cloud-wide; root-caused as D... |
| status | - | BLOCKED | docs/v1-redeploy-changelog.md:983 | Supersedes the framing of the 2026-06-27 "Phase-06 6.3 BLOCKED ... D-057" entry |
| status (not counted) | - | CLOSED | memory/project-posture-closed-test.md:10 | VR1 (the DC-DC buildout) is a CLOSED IN-HOUSE TEST cloud, not a live/shared/prod... |
| status | - | BLOCKED | runbooks/appendix-A-troubleshooting.md:329 | - Symptom: after authorize-charm, vault stays BLOCKED "Missing CA cert". |
| status | - | HELD | runbooks/d011-batch3-window-DRAFT.md:9 | - Section 3: first --include-disruptive run self-HELD (headroom UNKNOWN) on |
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:100 | ISP uplink -- gap #17 CLOSED for Office1), and the `dc1`/`office1`/`dc2` |
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:144 | CLOSED.** The old fork ("OpenTofu `cloudinit-vm`, blocked pending user_data |
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:167 | 4. **GitBucket: CLOSED, NOT DEFERRED (D-116).** There is NO Office1-local GitBuc... |
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:308 | CLOSED for Office1 via the dedicated `office1-wan` ISP-uplink network. DC1/DC2 |
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:834 | - **Office1-local + office1-wan networks created:** **MET** (gaps #12 and #17-fo... |
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:901 | gap #12 CLOSED). |
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:902 | - [x] Office1 OPNsense edge RESOLVED and BUILT 2026-07-12/13 (gap #16 CLOSED for |
| status | - | CLOSED | runbooks/dc-dc-phase1-office1-standup.md:903 | ownership; gap #17 CLOSED for Office1 via `office1-wan`). |
| status | - | HELD | runbooks/dc-dc-phase2-tofu-dc-substrate.md:192 | ruled for vr1-dc0's edge WAN -- a ruled literal, NOT a HELD tfvar; no new NetBox... |
| status | - | BLOCKED | runbooks/dc-dc-phase2-tofu-dc-substrate.md:294 | scope is BLOCKED and this pass's real reach is Steps 1-8 (see the GATE |
| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:334 | **The script now accepts a `$DC` env var (gap #2's CLI half CLOSED |
| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:436 | **Gap #2's CLI half is CLOSED (2026-07-10, DOCFIX-166):** the script now |
| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:530 | - [x] Gap #2's CLI half CLOSED 2026-07-10 (DOCFIX-166): |
| status | - | CLOSED | runbooks/dc-dc-phase3-maas-enlist-deploy.md:72 | 2. **CLOSED 2026-07-10 (DOCFIX-166), CLI half only.** |
| status | - | BLOCKED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:162 | - **DC2:** BLOCKED until its VIP band exists (see above). Once NetBox |
| status | - | CLOSED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:20 | selector convention, CLOSED 2026-07-09 DOCFIX-151 -- this is the stage that |
| status | - | BLOCKED | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:64 | bundle deploy is BLOCKED on this** -- you cannot pick DC2's VIP band, the |
| status | - | CLOSED | runbooks/dc-dc-phase6-designate-cos-magnum.md:244 | **This step is CLOSED, not a template anymore.** `bundle.yaml` now carries |
| status | - | CLOSED | runbooks/dc-dc-phase6-designate-cos-magnum.md:630 | cert) is CLOSED for this DC. |
| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:211 | * vault/0 BLOCKED "Vault needs to be initialized" (the phase-02 trigger, not a f... |
| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:214 | * octavia BLOCKED "Awaiting configure-resources" (D-021); gss unknown (pre-run). |
| status | - | BLOCKED | runbooks/phase-01-bundle-deploy.md:224 | * magnum/0 BLOCKED "Ports which should be open, but are not: 9501" -- pre-vault ... |
| status | - | BLOCKED | runbooks/phase-02-vault-bringup.md:26 | - vault/0 sits BLOCKED needing initialization (a fresh, uninitialized vault). |
| status | - | BLOCKED | runbooks/phase-03-core-verify.md:7 | Decisions: B5 (IP-only endpoints; no FQDN), D-021 (octavia stays BLOCKED awaitin... |
| status | - | BLOCKED | runbooks/phase-03-core-verify.md:72 | **GATE:** expected non-active/idle = **1** (octavia/0 BLOCKED "Awaiting configur... |
| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:23 | is satisfied. octavia/0 sits BLOCKED "Awaiting ... configure-resources" (the |
| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:3 | Bring Octavia from its post-deploy BLOCKED state to fully enabled: run the |
| status | - | BLOCKED | runbooks/phase-05-octavia-enablement.md:62 | juju status octavia -m openstack \| grep -E 'octavia/0' \|\| true   # expect BLO... |
| status | stage-0 | CLOSED | docs/dc-dc-deployment-workflow.md:873 | \| Stage 0-7 runbooks \| Stage 0 DONE (ratification). **Stages 1-7 ALL WRITTEN 2... |
| status | stage-1 | COMPLETE | docs/changelog-20260709-office1-network-edge.md:42 | Stage 1/2 runbooks) implicitly assume that command is a COMPLETE inventory |
| status | stage-1 | CLOSED | docs/dc-dc-deployment-workflow.md:570 | 9. **Runbook debt -- CLOSED 2026-07-09.** All seven Stage 1-7 runbooks are now |
| status | stage-1 | CLOSED | docs/security-ledger.md:20 | \| SEC-009 \| 2026-07-15 \| Credential/env SPRAWL + world-readable exposure on v... |
| status | stage-1 | COMPLETE | docs/session-ledger.md:91 | VR1 Stage 1 COMPLETE; Stage 2 was in CLOSE-OUT -- now superseded by the merge ab... |
| status | stage-1 | CLOSED | docs/stage3-review-base.patch:658 | \| SEC-009 \| 2026-07-15 \| Credential/env SPRAWL + world-readable exposure on v... |
| status | stage-2 | COMPLETE | docs/changelog-20260715-d120-load-and-iprange-tooling.md:45 | - Stage 2 close-out (C1..C5) is COMPLETE -> the branch->main merge point is reac... |
| status | stage-2 | COMPLETE | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (... |
| status | stage-2 | CLOSED | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (... |
| status | stage-2 | CLOSED | docs/dc-dc-deployment-workflow.md:384 | which is what forced Stage 2's old Option A / Option B fork -- is **CLOSED |
| status | stage-3 | BLOCKED | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:3 | Closes the collision that BLOCKED Stage 3. **D-119 COMPLETES D-117; it does not ... |
| status | stage-3 | HELD | docs/session-ledger.md:205 | `docs/dc-dc-deployment-workflow.md`'s Stage 3 section still reads "**Blocking to... |
| status | stage-4 | CLOSED | docs/dc-dc-deployment-workflow.md:884 | \| `lib-net.sh` / `lib-hosts.sh` \| `$DC` selector mechanism ADDED 2026-07-09 (D... |
| status | stage-4 | HELD | docs/session-ledger.md:51 | Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned... |
| status | stage-5 | BLOCKED | docs/changelog-20260709-dc-selector-convention.md:5 | which explicitly BLOCKED the Stage 5 "high reuse" claim (`phase-01..08` |
| status | stage-5 | CLOSED | docs/changelog-20260709-dc-selector-convention.md:72 | Tooling gap register item #1 CLOSED. Stage 5's runbook (Juju controller + |
| version | juju | 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki |
| version | juju | 3.6 | docs/design-decisions.md:1611 | policy for either: (a) the Juju controller/agents (patch releases on the 3.6 tra... |
| version | juju | 3.6 | docs/design-decisions.md:1632 | The testcloud controller is SINGLE (non-HA) and Juju 3.6 ships no supported cont... |
| version | juju | 3.6 | docs/design-decisions.md:1677 | ## D-071 -- AMENDMENT (2026-07-05): controller backup EXISTS on juju 3.6; risk s... |
| version | juju | 3.6 | docs/design-decisions.md:1680 | premise "no supported backup in Juju 3.6": `juju create-backup` / `download-back... |
| version | juju | 2.1 | docs/design-decisions.md:1684 | (committed pre-change BOM), a fresh `juju create-backup` archive (now the STANDA... |
| version | juju | 3.6 | docs/design-decisions.md:2043 | - Single-unit (not HA) for VR1, with the confirmed backup posture (juju 3.6 `cre... |
| version | juju | 3.6 | docs/design-decisions.md:994 | `remove-machine` option. Juju 3.6 `remove-machine` reference: a machine can be r... |
| version | juju | 3.6.25 | docs/handoff-20260705-open-items.md:169 | > juju 3.6.25. Vault is `1.8/stable` rev 714 (current in-channel). |
| version | juju | 3.6.25 | docs/handoff-20260705-open-items.md:22 | in-channel revisions; controllers/agents at juju 3.6.25; appendix-B re-baselined... |
| version | juju | 3.6 | docs/handoff-20260705-open-items.md:59 | Backups are confirmed to exist (juju 3.6 `create-backup`); the open half is sing... |
| version | juju | 3.6.25 | docs/session-ledger.md:78 | - **VR0 / DC0 testcloud:** fleet fully current (juju 3.6.25, 91 agents); D-011 C... |
| version | juju | 3.6 | docs/session-ledger.md:989 | `download-backup` DO exist on juju 3.6 -- the original "removed in 3.0" premise ... |
| version | juju | 3.6 | docs/upstream-bug-draft-dashboard-tls.md:14 | Reactive charm generation; juju 3.6. |
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1819 | explicit Risk section: single non-HA controller, no supported backup in Juju 3.6... |
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped `juju status keystone --format=line`, and juju 3.6 line format omits wor... |
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1856 | grepped `juju status keystone --format=line`, and juju 3.6 line format omits wor... |
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1953 | `juju-status` (units do NOT carry `agent-status.version` on juju 3.6); 2.1 |
| version | juju | 3.6 | docs/v1-redeploy-changelog.md:1954 | REWRITTEN -- `juju create-backup` EXISTS on 3.6 and is now the STANDARD gated |
| version | juju | 2.1 | docs/v1-redeploy-changelog.md:424 | Vault's own status agrees with the Juju workload-status. Cleared for 2.1b (vault... |
| version | juju | 3.6 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:289 | Per D-104: scheduled controller backups, confirmed backup posture (juju 3.6 |
| version | juju | 2024.1 | runbooks/dc-dc-phase5-dr-failover-drill.md:153 | juju deploy cinder-backup --channel 2024.1/stable --to lxd:<UNIT_NUMBER_TBD> |
| version | juju | 3.6 | runbooks/dc-dc-phase5-dr-failover-drill.md:448 | against this controller's actual installed juju client (3.6 per D-104) before ru... |
| version | juju | 3.6 | runbooks/ops-update-procedure.md:158 | on juju 3.6 (the "removed in 3.0" authoring assumption was wrong for this |
| version | juju | 3.6 | runbooks/ops-update-procedure.md:8 | controller backup EXISTS on juju 3.6). |
| version | juju | 3.1 | runbooks/phase-03-core-verify.md:10 | backends confirmed LOADED via a functional sweep, NOT juju status; Step 3.1). Tr... |
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/SKILL.md:100 | \| Creating/changing a `libvirt_domain`; anything about nested KVM, a libvirt st... |
| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | `v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk |
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud |
| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... |
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... |
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) |
| version | lxd | 6.7 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:247 | Canonical's own announcement: LXD 6.7 "consolidates some API endpoints" that |
| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:249 | not yet in a MAAS release). Verbatim guidance: "We recommend using LXD <=6.6 |
| version | lxd | 5.21.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:253 | VR0 runs LXD **5.21.4** and is therefore safe by accident of timing; D-114 |
| version | lxd | 5.21 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:254 | makes it a decision. **LXD 5.21 LTS is supported to June 2029** |
| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed ... |
| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed ... |
| version | lxd | 6.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed ... |
| version | lxd | 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 pro... |
| version | lxd | 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \|- voffice1        (L2)  MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea r... |
| version | lxd | 5.21.5 | docs/changelog-20260713-office1-headend-maas-lxd.md:6 | **LXD 5.21.5** are installed on it, that LXD is **registered back into MAAS as a... |
| version | lxd | 5.21 | docs/changelog-20260713-office1-headend-maas-lxd.md:62 | 3. **LXD snap track changes are ONE-WAY.** LXD must be installed DIRECTLY onto `... |
| version | lxd | 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on `latest` first, because MAAS 3.6/3.7 is incompatible wi... |
| version | lxd | 6.7 | docs/changelog-20260713-office1-headend-maas-lxd.md:64 | (pinned pylxd 2.3.5 vs LXD 6.7's consolidated endpoints). Bonus discovered in re... |
| version | lxd | 5.21.5 | docs/dc-dc-deployment-workflow.md:114 | - **DONE (site) -- D-114 IS PROVEN END TO END:** MAAS 3.7.2 region+rack ON `voff... |
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:65 | > LXD (pinned to the 5.21 LTS track) runs ON it**, that LXD is **registered BACK... |
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:84 | \| **Gate** \| Office1 OPNsense edge up (**MET** -- routing, NAT, egress, Kea DH... |
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:85 | \| **Owns** \| **D-114** (site containment VM + MAAS-composed LXD VMs, incl. the... |
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:85 | \| **Owns** \| **D-114** (site containment VM + MAAS-composed LXD VMs, incl. the... |
| version | lxd | 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \| **Reuse vs new** \| NEW infra (Office1 didn't exist for VR0 DC0), but LESS ne... |
| version | lxd | 5.21.4 | docs/dc-dc-deployment-workflow.md:86 | \| **Reuse vs new** \| NEW infra (Office1 didn't exist for VR0 DC0), but LESS ne... |
| version | lxd | 5.21 | docs/dc-dc-deployment-workflow.md:874 | \| **D-114 site containment VM (`voffice1`)** \| **BUILT + RUNNING 2026-07-13.**... |
| version | lxd | 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project `default`,... |
| version | lxd | 5.21.4 | docs/design-decisions.md:2561 | VM that is then REGISTERED BACK INTO MAAS as an LXD KVM host (project `default`,... |
| version | lxd | 5.21 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE... |
| version | lxd | 6.7 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE... |
| version | lxd | 6.7 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to... |
| version | lxd | 6.6 | docs/design-decisions.md:2593 | pylxd >= 2.3.9, not yet in a MAAS release). Canonical's own guidance is "use LXD... |
| version | lxd | 5.21.5 | docs/session-ledger.md:603 | and **LXD 5.21.5**, with that LXD **registered into MAAS as an LXD VM host**. MA... |
| version | lxd | 5.21 | docs/stage3-review-base.patch:2859 | +  # createadmin/apikey/login, LXD (5.21 pin), LXD vm-host registration, compose... |
| version | lxd | 5.21.5 | docs/vr1-office1-as-built.md:43 | \| **voffice1** \| `10.10.0.20` (Kea reservation) \| **MAAS 3.7.2** region+rack ... |
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:116 | REGION CONTROLLER runs ON it. LXD (5.21 LTS) also runs ON it, and that LXD is |
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:186 | D-114's hard LXD 5.21-LTS-track constraint, which IS decided). Each install |
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:46 | including the LXD 5.21 LTS pin), **D-103** as AMENDED by D-114 (OpenTofu owns |
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:488 | ssh <voffice1> 'sudo snap install lxd --channel=5.21/stable' |
| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:491 | cannot talk to LXD >= 6.7 (pylxd 2.3.5 vs LXD's consolidated API endpoints). |
| version | lxd | 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project `default`, LXD 5.21.4. |
| version | lxd | 5.21.4 | runbooks/dc-dc-phase1-office1-standup.md:530 | > an LXD KVM host in project `default`, LXD 5.21.4. |
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the **5.21 LTS track** (D-114). MAAS 3.6/3.7 is |
| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's |
| version | lxd | 6.7 | runbooks/dc-dc-phase1-office1-standup.md:71 | INCOMPATIBLE with LXD >= 6.7: LXD 6.7 consolidated API endpoints and MAAS's |
| version | lxd | 5.21 | runbooks/dc-dc-phase1-office1-standup.md:887 | - [ ] `runbooks/appendix-B-asbuilt-version-lock.md` updated with the LXD 5.21-LT... |
| version | maas | 3.7.2 | .claude/skills/openstack-cloud-ops/references/environment.md:29 | Charmed OpenStack Caracal 2024.1 - Juju 3.6, MAAS 3.7.2, Vault TLS (charm-pki |
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/environment.md:34 | `v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk |
| version | maas | 2.7.2 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:82 | ### `canonical/maas` (pinned `2.7.2`, confirmed 2026-07-09) |
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:20 | \| LXD \| **`5.21` LTS track** \| MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (... |
| version | maas | 3.7.2 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \| MAAS \| 3.7.2 (VR0) \| the LXD ceiling above is a property of MAAS 3.6/3.7 \| |
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:21 | \| MAAS \| 3.7.2 (VR0) \| the LXD ceiling above is a property of MAAS 3.6/3.7 \| |
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:245 | ### 3a. MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114) |
| version | maas | 2.3.5 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:248 | MAAS's pinned **pylxd 2.3.5** cannot speak to (fixed in **pylxd >= 2.3.9**, |
| version | maas | 3.6 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:425 | \| MAAS cannot talk to an LXD VM host after an LXD update \| LXD auto-refreshed ... |
| version | maas | 10.12.8 | docs/D-058-renumber.md:67 | - scripts/phase-00-maas-carve.sh   (METAL_CIDR default 10.12.8 -> 10.12.12; rang... |
| version | maas | 2.7.2 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:54 | hashes: `dmacvicar/libvirt` 0.9.8, `canonical/maas` 2.7.2). |
| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:1 | # changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 pro... |
| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:17 | \|- voffice1        (L2)  MAAS 3.7.2 region+rack + LXD 5.21.5, 10.10.0.20 (Kea r... |
| version | maas | 3.7.2 | docs/changelog-20260713-office1-headend-maas-lxd.md:5 | `voffice1` is a working VR1 site headend. **MAAS 3.7.2** (region+rack, PostgreSQ... |
| version | maas | 3.6 | docs/changelog-20260713-office1-headend-maas-lxd.md:63 | never allowed to land on `latest` first, because MAAS 3.6/3.7 is incompatible wi... |
| version | maas | 3.7 | docs/changelog-20260716-d124-rack-addressing.md:39 | (D-123): disable timesyncd -> install the `maas` snap (3.7/stable) -> `maas init... |
| version | maas | 3.7.2 | docs/dc-dc-deployment-workflow.md:114 | - **DONE (site) -- D-114 IS PROVEN END TO END:** MAAS 3.7.2 region+rack ON `voff... |
| version | maas | 3.7.2 | docs/design-decisions.md:2553 | **Measured as-built evidence (VR0 / `openstack-caracal-ipv4` MAAS 3.7.2, operato... |
| version | maas | 3.6 | docs/design-decisions.md:2591 | 4. **LXD is version-pinned to the 5.21 LTS track.** MAAS 3.6/3.7 is INCOMPATIBLE... |
| version | maas | 2.3.5 | docs/design-decisions.md:2592 | LXD 6.7 consolidated API endpoints and MAAS's pinned pylxd 2.3.5 cannot speak to... |
| version | maas | 3.7.2 | docs/maas-as-built-reference.md:169 | - MAAS 3.7.2; controller `maas.maas`, Region+Rack, Non-HA(3 VLANs). |
| version | maas | 3.7.2 | docs/session-ledger.md:602 | the pool), egress through the OPNsense edge. On it: **MAAS 3.7.2** region+rack (... |
| version | maas | 3.7 | docs/stage3-review-base.patch:261 | +(D-123): disable timesyncd -> install the `maas` snap (3.7/stable) -> `maas ini... |
| version | maas | 3.7 | docs/stage3-review-base.patch:2786 | MAAS_CHANNEL="3.7/stable" |
| version | maas | 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): |
| version | maas | 3.7 | docs/v1-redeploy-changelog.md:226 | - MAAS 3.7 interface CLI confirmed (canonical.com/maas/docs/3.7 reference): |
| version | maas | 3.7.2 | docs/vr1-office1-as-built.md:43 | \| **voffice1** \| `10.10.0.20` (Kea reservation) \| **MAAS 3.7.2** region+rack ... |
| version | maas | 2.7.2 | runbooks/dc-dc-phase0-vcloud-prep.md:339 | fetch `dmacvicar/libvirt` 0.9.8 and `canonical/maas` 2.7.2) |
| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:442 | ssh <voffice1> 'sudo snap install maas --channel=<PENDING VERIFICATION: the curr... |
| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:490 | The `5.21` track is a HARD D-114 constraint, not a preference: MAAS 3.6/3.7 |
| version | maas | 3.6 | runbooks/dc-dc-phase1-office1-standup.md:70 | !!! LXD IS VERSION-PINNED to the **5.21 LTS track** (D-114). MAAS 3.6/3.7 is |
| version | netbox | 4.6.4 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:453 | **Note:** this is an UPSTREAM-only trap so far. The Office1 sandbox NetBox (4.6.... |
| version | netbox | 4.5.8 | docs/changelog-20260710-netbox-roles-aggregates.md:42 | Script previewed (read-only) against live NetBox 4.5.8: correctly reports 12 obj... |
| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Offi... |
| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:1 | # changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Offi... |
| version | netbox | 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:25 | ### 2. NetBox 4.6 v2 API tokens: the wire format is `nbt_<key>.<plaintext>` -- N... |
| version | netbox | 4.6 | docs/changelog-20260713-office1-netbox-deployed.md:29 | NetBox 4.6 **hashes** API tokens. The `Token` model has `key` (a 12-char PREFIX)... |
| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:6 | laid down by MAAS) and runs **NetBox 4.6.4** (netbox-docker, Django 6.0.6). Its ... |
| version | netbox | 4.6.4 | docs/changelog-20260713-office1-netbox-deployed.md:74 | - NetBox **4.6.4** on Django 6.0.6, containers `netbox` + `netbox-worker` + `pos... |
| version | netbox | 10.1 | docs/changelog-20260716-d124-addressing-pin.md:21 | - **`netbox/dc-rack-mgmt-import.py`:** `CONTAINER = "10.12.0.0/16"` -> **`"172.3... |
| version | netbox | 172.31 | docs/changelog-20260716-d124-addressing-pin.md:44 | python3 netbox/dc-rack-mgmt-import.py --transit-cidr 172.31.0.0/30 --rack-ip 10.... |
| version | netbox | 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited ... |
| version | netbox | 4.6 | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:6 | the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited ... |
| version | netbox | 4.6.4 | docs/dc-dc-deployment-workflow.md:116 | machines **COMPOSED BY MAAS** and deployed -- `office1-netbox` (10.10.1.10, NetB... |
| version | netbox | 4.6.4 | docs/dc-dc-netbox-buildout-scope.md:198 | (`10.10.1.10:8000`, NetBox 4.6.4 on the Office1 VM, `docs/changelog-20260713-off... |
| version | netbox | 4.5.8 | docs/dc-dc-netbox-buildout-scope.md:45 | `netbox.baldurkeep.com` v4.5.8. Regions: US West -> Eugene (prod); **Virtual Reg... |
| version | netbox | 4.5.8 | docs/design-decisions.md:2893 | **The collision, measured live against `netbox.baldurkeep.com` (4.5.8) on 2026-0... |
| version | netbox | 4.6 | docs/stage3-review-base.patch:1120 | +                die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v... |
| version | netbox | 4.6 | docs/stage3-review-base.patch:897 | +                die("403 'Invalid v1 token' -- NetBox 4.6 wants the ASSEMBLED v... |
| version | netbox | 4.6 | docs/vr1-office1-as-built.md:141 | **NetBox API token format (4.6):** the wire form is `nbt_<key>.<plaintext>`. The... |
| version | netbox | 4.6 | docs/vr1-office1-as-built.md:44 | \| **office1-netbox** \| `10.10.1.10` \| **NetBox 4.6** (netbox-docker; `/opt/ne... |
| version | netbox | 4.6 | runbooks/dc-dc-phase1-office1-standup.md:725 | --draft draft/vr1-draft.json`. It STRUCTURALLY cannot reach upstream. NetBox 4.6 |
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/environment.md:35 | to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud |
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:130 | https://docs.opnsense.org/releases/CE_26.1.html |
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:22 | \| OPNsense \| 26.1 "Witty Woodpecker" \| ISC-DHCP left core in 26.1 -- Kea/dnsm... |
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:322 | ## 4. OPNsense 26.1 edge |
| version | opnsense | 26.1 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:351 | https://docs.opnsense.org/releases/CE_26.1.html |
| version | opnsense | 26.1 | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:108 | **sizing** question, not a regression of this fix -- check OPNsense 26.1's docum... |
| version | opnsense | 26.1 | docs/changelog-20260712-office1-opnsense-edge-build.md:33 | (`opnsense-26.1-nano.qcow2`), so there is no target-path collision. Same conclus... |
| version | opnsense | 26.1 | docs/changelog-20260712-opnsense-prep-bz2-fallback.md:15 | `opnsense-26.1-nano.qcow2` (qcow2, 11 GiB virtual) via the python path. |
| version | opnsense | 26.1 | docs/changelog-20260713-opnsense-api-proven.md:24 | GET  core/firmware/status      -> HTTP 200, OPNsense 26.1 (auth works) |
| version | opnsense | 26.1 | docs/changelog-20260713-opnsense-api-proven.md:8 | An API key was minted for `root` in the GUI. In OPNsense **26.1** this is NOT in... |
| version | opnsense | 26.1 | docs/changelog-20260714-opnsense-set-interface-v6.md:10 | among the API-covered surfaces. **Measured on the live Office1 edge (OPNsense 26... |
| version | opnsense | 26.1 | docs/design-decisions.md:2498 | **MEASURED on the live Office1 edge (2026-07-14), OPNsense 26.1:** |
| version | opnsense | 26.7 | docs/design-decisions.md:4074 | **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock... |
| version | opnsense | 26.7 | docs/design-decisions.md:4074 | **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock... |
| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense **26.1 nano** amd64 (`scripts/opnsense-prep-image.sh 26.1`), p... |
| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:59 | - Image: OPNsense **26.1 nano** amd64 (`scripts/opnsense-prep-image.sh 26.1`), p... |
| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:60 | `/var/lib/libvirt/vr1/office1/opnsense-26.1-nano.qcow2` (11 GiB virtual). |
| version | opnsense | 26.1 | docs/incident-20260712-opnsense-edge-boot-triplefault.md:92 | the real fix, check OPNsense 26.1's documented minimum before picking a number. |
| version | opnsense | 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | **Subject.** `office1-opnsense`, **OPNsense 26.7** (amd64), reviewed for plugin/... |
| version | opnsense | 26.7 | docs/opnsense-edge-addon-review-20260718.md:3 | **Subject.** `office1-opnsense`, **OPNsense 26.7** (amd64), reviewed for plugin/... |
| version | opnsense | 14.3 | docs/session-ledger.md:189 | security pkgs) THEN reboot; (b) office1-opnsense itself is still on 14.3-RELEASE... |
| version | opnsense | 26.1 | docs/session-ledger.md:649 | CANNOT be done via the REST API. Measured on the live edge (OPNsense 26.1): `Int... |
| version | opnsense | 26.7 | docs/session-ledger.md:830 | **OPNsense EDGE 26.7 UPDATE + PLUGIN/ADD-ON REVIEW (2026-07-18).** Operator upda... |
| version | opnsense | 26.1 | docs/stage3-review-base.patch:1373 | +  base_volume_path = "/var/lib/libvirt/vr1/vr1-dc0/opnsense-26.1-nano.qcow2" |
| version | opnsense | 26.7 | docs/vr1-office1-as-built.md:42 | \| **office1-opnsense** \| LAN `10.10.0.1` / WAN `172.30.1.2` \| **OPNsense 26.7... |
| version | tofu | 0.9.8 | .claude/skills/openstack-cloud-ops/references/environment.md:33 | libvirt/KVM via the `dmacvicar/libvirt` OpenTofu provider `0.9.8` on OpenTofu |
| version | tofu | 1.12.3 | .claude/skills/openstack-cloud-ops/references/platform-traps.md:19 | \| OpenTofu \| `v1.12.3` (as-run) \| the binary that actually executed Stage 1 \... |
| version (not counted) | tofu | 1.12.3 | docs/audit/grounding-audit-charter.md:25 | 2026-07-18 session's own findings). README pins tofu 1.12.3; the binary is 1.12.... |
| version | tofu | 1.12.3 | docs/changelog-20260710-opentofu-scaffold-first-validation.md:4 | binary (OpenTofu v1.12.3), on the vcloud host, executing |
| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** |
| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** |
| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:15 | - `install-opentofu.sh` -- OpenTofu `tofu` >= 1.6.0 via the official **deb** |
| version | tofu | 1.6.0 | docs/changelog-20260710-prereq-install-scripts.md:42 | `bash scripts/prereqs/install-opentofu.sh` pointer + the >=1.6.0 floor. |
| version | tofu | 1.12.3 | docs/changelog-20260713-docfix194-opentofu-module-validation.md:19 | This was only findable because a `tofu` binary now exists on the jumphost (OpenT... |
| version | tofu | 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \| gap #2: "UNVALIDATED -- no `tofu` binary available" \| **OpenTofu v1.12.3 IS ... |
| version | tofu | 1.12.3 | docs/changelog-20260713-workflow-doc-status-correction.md:12 | \| gap #2: "UNVALIDATED -- no `tofu` binary available" \| **OpenTofu v1.12.3 IS ... |
| version | tofu | 1.1 | docs/dc-dc-deployment-workflow.md:360 | - **A `tofu` binary EXISTS on the jumphost: OpenTofu v1.12.3.** The tree can |
| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:360 | - **A `tofu` binary EXISTS on the jumphost: OpenTofu v1.12.3.** The tree can |
| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:47 | infrastructure; vcloud host, OpenTofu v1.12.3). As-built: nested KVM already-on; |
| version | tofu | 1.12.3 | docs/dc-dc-deployment-workflow.md:875 | \| `opentofu/` (networks/pools/node-VM PXE/cloud-init-VM patterns) \| **VALIDATE... |
| version | tofu | 1.12.3 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:27 | > **The OpenTofu 1.12.3 -> 1.12.4 bump is COINCIDENTAL, not causal.** The binary... |
| version | tofu | 1.12.4 | docs/session-ledger.md:214 | root (read-only plan, **OpenTofu v1.12.4**) returns **7 add / 2 change / 7 destr... |
| version | tofu | 1.12.4 | docs/session-ledger.md:260 | **Version drift to log:** OpenTofu on the jumphost is now **v1.12.4**; `README.m... |
| version | tofu | 1.12.3 | docs/session-ledger.md:277 | 5/0/6-vs-5/2/6, DOCFIX-196 stale Stage-3 NetBox blocker, README tofu 1.12.3->1.1... |
| version | tofu | 1.12.3 | docs/session-ledger.md:77 | tofu v1.12.3; tree validates (10/10 modules); lock committed. |
| version | tofu | 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \| L1-06 \| `tofu validate`: Success (OpenTofu v1.12.3, 11/11 modules). \| |
| version | tofu | 1.12.3 | docs/stage3-adversarial-review-20260716.md:60 | \| L1-06 \| `tofu validate`: Success (OpenTofu v1.12.3, 11/11 modules). \| |
| version | tofu | 1.12.3 | runbooks/dc-dc-phase0-vcloud-prep.md:3 | > **FIRST EXECUTED 2026-07-10** (vcloud host, OpenTofu v1.12.3) -- run |
| version | tofu | 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \| OpenTofu `tofu` >= 1.6.0 (installs as `/usr/bin/tofu`, not the `opentofu` sna... |
| version | tofu | 1.6.0 | runbooks/dc-dc-phase0-vcloud-prep.md:56 | \| OpenTofu `tofu` >= 1.6.0 (installs as `/usr/bin/tofu`, not the `opentofu` sna... |

## 4. Gate-assertion rows

| word | where | line |
|---|---|---|
| blocking | .claude/skills/openstack-cloud-ops/SKILL.md:142 | whether the stage you're about to run has any open blocking item -> Stage 1 |
| unexercised | .claude/skills/openstack-cloud-ops/SKILL.md:149 | available, and treat every OpenTofu step as reviewed-but-unexercised. **At STAGE |
| verified | .claude/skills/openstack-cloud-ops/SKILL.md:172 | sin - if you have not verified an option name or version, say so and verify. |
| unexercised | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:110 | surfaces. A ledger without this check rots (cf. D-070's unexercised-snapshot cri... |
| unverified | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:133 | practice over the quick fix and will push back hard on unverified claims. |
| verified | .claude/skills/openstack-cloud-ops/references/operating-discipline.md:58 | collisions have happened. State "next-free verified" when you assign. |
| unverified | .claude/skills/openstack-cloud-ops/references/platform-traps.md:181 | - **UNVERIFIED:** the 0.9.4 notes name a `destroy.shutdown.timeout` option |
| verified | .claude/skills/openstack-cloud-ops/references/platform-traps.md:426 | \| a MAAS-composed VM gets a lease MAAS did not issue, or PXEs on the wrong L2 \... |
| imported | README.md:17 | or as a separate repository (TBD when v2 begins). IPv6 prefixes already imported... |
| imported | README.md:56 | \|   \|-- README.md                    what is imported vs. deferred to v2 |
| unverified | docs/D-068-openbao-assessment-DRAFT.md:32 | privileged plugin-catalog access; per-CVE 1.8.8 applicability UNVERIFIED). |
| verified | docs/D-068-openbao-assessment-DRAFT.md:5 | discussion starts from verified facts. Items that could not be confirmed are mar... |
| unverified | docs/D-068-openbao-assessment-DRAFT.md:6 | UNVERIFIED. Companion: docs/D-068-vault-1.8-vs-1.16-analysis.md (the 1.16 ruling... |
| unverified | docs/D-068-openbao-assessment-DRAFT.md:63 | 1.15.6+ (BUSL -- licensing review required). Remaining UNVERIFIED before any |
| verified | docs/D-068-openbao-assessment-DRAFT.md:70 | vault swap. Also verified live 2026-07-06: the charm's Vault-listener TLS |
| blocking | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: |
| unblocked | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: |
| imported | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: |
| verified | docs/audit/grounding-audit-charter.md:100 | ("blocking", "unblocked", "imported", "verified"). Emit a table: |
| verified | docs/audit/grounding-audit-charter.md:128 | verified evidence needed to answer it attached. |
| verified | docs/audit/grounding-audit-charter.md:13 | Measured evidence (verified 2026-07-18 against the pushed repo at `43b29d7`): |
| verified | docs/audit/grounding-audit-charter.md:43 | not a work queue. It gets re-verified and folded into the findings register. |
| verified | docs/changelog-20260703-process-hardening.md:241 | ### 21. Harness-estate findings (pre-existing at HEAD; verified against pristine... |
| verified | docs/changelog-20260703-process-hardening.md:263 | Runbook paste blocks: every `exit` verified nested in a subshell or a remote- |
| verified | docs/changelog-20260703-process-hardening.md:309 | Runbook->script contract cross-check: CLEAN (both automated hits verified |
| verified | docs/changelog-20260703-process-hardening.md:320 | dir -- a live shell with real cloud credentials. Mechanics verified against |
| verified | docs/changelog-20260703-process-hardening.md:37 | points at lib-net.sh / lib-hosts.sh; only verified-current literals remain. |
| verified | docs/changelog-20260703-process-hardening.md:8 | harnesses 33/33 cases, all python compiles. Identifier numbering verified |
| verified | docs/changelog-20260709-adversarial-review-fixes.md:23 | succeeds. Verified empirically (`python3 -c` reproduction): the `else` |
| verified | docs/changelog-20260709-adversarial-review-fixes.md:31 | actually verified: the safety property (rejecting bad input) was still |
| unverified | docs/changelog-20260709-adversarial-review-fixes.md:33 | but "valid input is accepted, not spuriously rejected" was unverified and |
| verified | docs/changelog-20260709-adversarial-review-fixes.md:52 | VERIFIED: re-ran the harness -- the three previously-silent labels now |
| verified | docs/changelog-20260709-adversarial-review-fixes.md:86 | VERIFIED (all three items): `bash scripts/repo-lint.sh` 0 fail, 1 |
| verified | docs/changelog-20260709-adversarial-review-fixes.md:94 | every file that mentions it); the ULA/GUA carve arithmetic (hand-verified |
| verified | docs/changelog-20260709-ceph-replication-tooling.md:106 | ## VERIFIED |
| verified | docs/changelog-20260709-ceph-replication-tooling.md:114 | 11.4b(promote RECOVERING), verified by grepping actual line numbers in |
| blocking | docs/changelog-20260709-ceph-replication-tooling.md:119 | dry-run-informational/apply-blocking split, the `--apply`/typed- |
| blocking | docs/changelog-20260709-ceph-replication-tooling.md:82 | BLOCKING immediately before any `--apply` execution (refuses to mutate an |
| verified | docs/changelog-20260709-dc-dc-design.md:4 | `openstack-caracal-dc-dc` HEAD 8813efc (seed-verified). All decisions PROPOSED -... |
| verified | docs/changelog-20260709-dc-dc-phase0-runbook.md:58 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn |
| verified | docs/changelog-20260709-dc-dc-phase1-runbook.md:45 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. |
| verified | docs/changelog-20260709-dc-dc-phase2-runbook.md:52 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn (no |
| verified | docs/changelog-20260709-dc-dc-phase3-runbook.md:62 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn (no |
| blocking | docs/changelog-20260709-dc-dc-phase4-runbook.md:47 | plausible-looking option names, Step 6 names this as blocking work with |
| unverified | docs/changelog-20260709-dc-dc-phase4-runbook.md:50 | 2. **D-109's IPv6-SAN cert-issuance requirement is an unverified charm- |
| verified | docs/changelog-20260709-dc-dc-phase4-runbook.md:61 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. |
| verified | docs/changelog-20260709-dc-dc-phase4-runbook.md:71 | stage's own "Ceph-over-v6 and geneve-over-v6 verified" gate criterion and |
| verified | docs/changelog-20260709-dc-dc-phase5-runbook.md:53 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn (no |
| verified | docs/changelog-20260709-dc-dc-phase6-runbook.md:57 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn (no |
| verified | docs/changelog-20260709-dc-selector-convention.md:38 | VERIFIED: |
| blocking | docs/changelog-20260709-dc-selector-convention.md:43 | messages cite the correct blocking reason (NetBox gap vs. no-enrollment), |
| verified | docs/changelog-20260709-final-consolidation.md:54 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. |
| blocking | docs/changelog-20260709-final-consolidation.md:90 | Genuinely open items still blocking real progress, in rough execution |
| verified | docs/changelog-20260709-ipv6-family-matrix-overlay.md:58 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. |
| verified | docs/changelog-20260709-ipv6-family-matrix-overlay.md:69 | over-v6 verified" gate: (a) confirm the 8 inferred-by-pattern charms' |
| verified | docs/changelog-20260709-maas-scripts-dc-param.md:48 | maas-reset.md` (see VERIFIED below). |
| verified | docs/changelog-20260709-maas-scripts-dc-param.md:56 | VERIFIED (this workstation; no jq installed, no live jumphost/MAAS/juju |
| verified | docs/changelog-20260709-maas-scripts-dc-param.md:84 | this delivery's. Instead, correctness was verified directly (the |
| verified | docs/changelog-20260709-maas-scripts-dc-param.md:98 | bypassing the harness's own jq gate, per the VERIFIED bullet above). |
| verified | docs/changelog-20260709-mtu-ceph-budget-calculators.md:41 | VERIFIED: |
| blocking | docs/changelog-20260709-mtu-ceph-budget-calculators.md:7 | arithmetic in prose today, not a script -- blocking the Stage 1 Phase-0 |
| verified | docs/changelog-20260709-mtu-ceph-budget-calculators.md:98 | VERIFIED: |
| verified | docs/changelog-20260709-netbox-dc-dc-pipeline.md:68 | VERIFIED, not just asserted: |
| verified | docs/changelog-20260709-netem-ula-gua-proposal.md:39 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. |
| blocking | docs/changelog-20260709-office1-network-edge.md:127 | blocking dependency for instantiating ANY of the three sites' |
| verified | docs/changelog-20260709-office1-network-edge.md:52 | VERIFIED: |
| verified | docs/changelog-20260709-office1-network-edge.md:97 | VERIFIED: `bash scripts/repo-lint.sh`: 0 fail (module block is commented |
| unverified | docs/changelog-20260709-opentofu-audit.md:10 | ### 1. DOCFIX-148 -- audited every flagged UNVERIFIED/inferred/assumed note |
| unverified | docs/changelog-20260709-opentofu-audit.md:15 | METHOD: grepped the entire `opentofu/` tree for every "UNVERIFIED"/"NOT |
| unverified | docs/changelog-20260709-opentofu-audit.md:57 | remains unverified. |
| unverified | docs/changelog-20260709-opentofu-cloudinit-vm.md:64 | then `tofu providers schema -json` to confirm the remaining unverified |
| verified | docs/changelog-20260709-opentofu-scaffold.md:48 | interfaces, filesystems, graphics, etc.) could not be verified with enough |
| verified | docs/changelog-20260709-opentofu-scaffold.md:62 | all before this, since none existed) -- verified this introduces no new |
| verified | docs/changelog-20260709-opnsense-config-design.md:44 | real behavior -- happy path, well-formed-XML output (verified with |
| verified | docs/changelog-20260709-opnsense-edge-module.md:38 | path -- not independently verified. |
| unverified | docs/changelog-20260709-opnsense-edge-module.md:53 | disk, not over the network, so the field flagged UNVERIFIED in |
| unverified | docs/changelog-20260709-opnsense-edge-module.md:91 | against a real OPNsense instance rather than sourced-but-unverified research. |
| verified | docs/changelog-20260709-opnsense-research.md:54 | (`genisoimage`/`xorriso` -- exact tool/flags not yet verified against a |
| verified | docs/changelog-20260709-repo-agnostic-sweep.md:38 | entirely. Verified no new L1 findings from widening scope (checked non-ASCII/ |
| verified | docs/changelog-20260709-repo-lint-crlf-fix.md:24 | VERIFIED: re-ran `--record-clientdocs-sweep` after the fix; `sweep-receipt.txt` |
| blocking | docs/changelog-20260709-stage0-ratification.md:4 | of `docs/dc-dc-deployment-workflow.md`, the gate blocking real Phase-0/1/2 |
| verified | docs/changelog-20260709-stage0-ratification.md:64 | VERIFIED, not just asserted: `bash scripts/ledger-scan.sh`'s "PROPOSED / OPEN |
| blocking | docs/changelog-20260710-carve-gua-hang-fix.md:29 | any FUTURE blocking regression in this Python test self-aborts after 30s with a |
| verified | docs/changelog-20260710-opentofu-state-file-security.md:31 | OUTPUT -- verified against HashiCorp's own current documentation (not |
| verified | docs/changelog-20260710-phase01-bundle-staleness-fix.md:48 | VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. |
| verified | docs/changelog-20260710-sweep-bundle-fixes.md:7 | DOCFIX-167 edit, since that edit only added/verified the 5 new charms. |
| verified | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:42 | those step BODIES (verified by reading them) still showed only raw |
| verified | docs/changelog-20260710-sweep-script-fixes.md:20 | instead, verified via the same reproduction technique before committing. |
| verified | docs/changelog-20260710-sweep-script-fixes.md:45 | Fixed with the verified `if pipeline; then :; fi` idiom (see the process |
| verified | docs/changelog-20260710-sweep-script-fixes.md:82 | convention. Re-verified `bash scripts/ledger-scan.sh` still reports the |
| verified | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:62 | targeting-risk warning text) was verified against HashiCorp's own current |
| verified | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:97 | verified clean of the self-inflicted false positive before this number was |
| verified | docs/changelog-20260711-ula-gen-command-fix.md:12 | `s/\(..\)\(....\)\(....\)/\1:\2:\3/` -> `fdXX:XXXX:XXXX::/48`. Verified: the |
| unverified | docs/changelog-20260712-docfix189-max-context-session-audit.md:56 | - **"OPNsense's 3 GB min" is UNVERIFIED** (incident report, ranked step 3). No s... |
| verified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:110 | Proposed durable fix (NOT yet implemented/verified): have the runbook/module pre... |
| verified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:85 | `172.30.1.2` / LAN `10.10.0.1`. The config ISO is **verified well-formed** -- it... |
| unverified | docs/changelog-20260712-libvirt-acpi-kernel-panic.md:90 | This is the mechanism `modules/opnsense-edge`'s own header has always flagged UN... |
| unverified | docs/changelog-20260712-libvirt-memory-unit-rootcause.md:109 | minimum RAM (the incident report's "3 GB" is UNVERIFIED) and bump to 4096 if war... |
| unexercised | docs/changelog-20260712-office1-opnsense-edge-build.md:5 | this repo -- reviewed-but-unexercised module + image chain. This records the rep... |
| verified | docs/changelog-20260713-docfix194-opentofu-module-validation.md:29 | Verified against the provider's own schema (`tofu providers schema -json`, dmacv... |
| verified | docs/changelog-20260713-office1-dhcp-apply.md:30 | NOT yet verified end-to-end: an actual client DHCPDISCOVER->lease. No client exi... |
| verified | docs/changelog-20260713-office1-headend-maas-lxd.md:56 | `raw.dnsmasq="port=0"`. Verified after the fact: dnsmasq runs but holds **zero**... |
| imported | docs/changelog-20260713-office1-netbox-deployed.md:88 | - The D-115 carve is NOT yet imported into this NetBox (it is the next step). |
| blocking | docs/changelog-20260713-opnsense-api-client.md:39 | ## Not done yet -- the blocking step |
| verified | docs/changelog-20260713-opnsense-apikey-bootstrap.md:18 | OPNsense stores API secrets as `crypt(secret, '$6$')` -- SHA-512 with an EMPTY s... |
| verified | docs/changelog-20260713-opnsense-apikey-bootstrap.md:33 | ## VERIFIED END TO END on the live edge (2026-07-12/13) |
| verified | docs/changelog-20260713-workflow-doc-status-correction.md:14 | \| gap #17: "no per-site ISP-uplink network exists anywhere, for ANY site" \| **... |
| verified | docs/changelog-20260714-d119-tofu-apply.md:21 | Verified ON THE HOST, not just in state: |
| verified | docs/changelog-20260715-creds-audit.md:32 | `*-creds/`). **Reads NO secret values -- metadata only** (stat/size), verified b... |
| verified | docs/changelog-20260715-creds-audit.md:49 | the SEC-009 sandbox-token gap is now closed and tool-verified. |
| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:1 | # 2026-07-15 -- C2 sub-task (ii): D-120 bands loaded + verified; sandbox loop ex... |
| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:16 | Verified live: the endpoints dump (0/0 before the load). |
| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:42 | validated VR1 dataset, verified by a fidelity check that covers every object cla... |
| verified | docs/changelog-20260715-d120-load-and-iprange-tooling.md:9 | fidelity check. This closes that gap and then does the load, verified. |
| verified | docs/changelog-20260715-d120-office1-service-reip.md:12 | No wipe. Both services verified on the wire: |
| blocking | docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md:6 | `runbooks/dc-dc-phase2-tofu-dc-substrate.md` to surface its blocking decisions b... |
| imported | docs/changelog-20260715-d121-d122-stage3-ha-nodelayout.md:77 | assigned (D-115 `10.12.64.0/19`, imported to office1-netbox); it stays out of sc... |
| verified | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:36 | D-120 child ranges + service IPs), verified by (i) a hardened-fidelity-check re-... |
| verified | docs/changelog-20260715-docfix195-c2-netbox-of-record.md:58 | D-120 load cannot be machine-verified until they are extended (each with its har... |
| verified | docs/changelog-20260715-fidelity-check-scope-correctness.md:1 | # 2026-07-15 -- C2 sub-task (i): sandbox re-verified faithful; fidelity checker ... |
| unverified | docs/changelog-20260715-stage3-prereqs-prep.md:77 | (the `to:` list-replace merge is the one unverified overlay mechanism). |
| unexercised | docs/changelog-20260716-d126-durable-forward.md:63 | ## Forward layer -- reviewed-but-UNEXERCISED (operator completes if/when wanted) |
| verified | docs/changelog-20260716-review-sweep-phaseAB.md:32 | reads the ADOPTED token cleanly (R3-F09; verified -- D-115 no longer flagged PRO... |
| blocking | docs/changelog-20260716-review-sweep-phaseAB.md:6 | ruled the review's blocking decisions step-by-step (R-1..R-4, logged in `docs/se... |
| blocking | docs/changelog-20260716-review-sweep-phaseC.md:57 | - Agent cross-check of the two-root reshape: FAITHFUL, no BLOCKING. |
| blocking | docs/changelog-20260716-review-sweep-phaseC.md:8 | the two-root implementation was cross-checked by a second agent (verdict: FAITHF... |
| verified | docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md:29 | **HARD GATE verified:** `tofu plan` shows the two EXISTING Office1 domains (voff... |
| verified | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:15 | services (netbox, netbox-worker, postgres, redis, redis-cache) -- verified via `... |
| verified | docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md:20 | ## Apex writes (Block A -- gated, dry-run-verified then committed) |
| verified | docs/dc-dc-buildout-design.md:129 | controller backup taken and stored; Ceph-over-v6 and geneve-over-v6 verified. |
| verified | docs/dc-dc-buildout-design.md:13 | `openstack-caracal-dc-dc` (verified). Six-plane values are `scripts/lib-net.sh` |
| verified | docs/dc-dc-buildout-design.md:92 | Gate: nested KVM verified; disk budget computed and the Ceph size decision recor... |
| verified | docs/dc-dc-deployment-workflow.md:132 | the COMPLETE validated dataset, NOT by any upstream write. See C2 for what "comp... |
| verified | docs/dc-dc-deployment-workflow.md:141 | \| C2 \| `office1-netbox` (10.10.1.10) is the VR1 IPAM apex -- a working draft (... |
| blocking | docs/dc-dc-deployment-workflow.md:163 | **Rulings landed (through 2026-07-16; supersedes the earlier "two blocking rulin... |
| blocking | docs/dc-dc-deployment-workflow.md:187 | **Blocking to EXECUTE (all operator-gated):** the HELD NetBox addressing -- **D-... |
| verified | docs/dc-dc-deployment-workflow.md:216 | \| **Gate** \| `preflight.sh` PASS before add-model; post-deploy `cloud-assert.s... |
| blocking | docs/dc-dc-deployment-workflow.md:219 | \| **Authoring status** \| **Runbook WRITTEN 2026-07-09: `runbooks/dc-dc-phase4-... |
| unverified | docs/dc-dc-deployment-workflow.md:219 | \| **Authoring status** \| **Runbook WRITTEN 2026-07-09: `runbooks/dc-dc-phase4-... |
| verified | docs/dc-dc-deployment-workflow.md:27 | per-DC. Verified via `bash scripts/ledger-scan.sh`: none of D-100..D-110 |
| verified | docs/dc-dc-deployment-workflow.md:331 | > longer takes `config_iso_path` (verified -- no `config_seed`/`config_iso_path`... |
| verified | docs/dc-dc-deployment-workflow.md:41 | \| **Gate** \| Nested KVM verified; disk budget computed + Ceph size decision re... |
| unverified | docs/dc-dc-deployment-workflow.md:432 | UNVERIFIED in `node-vm/main.tf`, an inference by pattern not a confirmed |
| blocking | docs/dc-dc-deployment-workflow.md:542 | that were manual arithmetic in prose, not a script, blocking the Stage 1 |
| verified | docs/dc-dc-deployment-workflow.md:721 | is verified (0.0% loss). So the topology question is ANSWERED and the |
| verified | docs/dc-dc-deployment-workflow.md:767 | `var.maas_api_key` in plaintext (verified against HashiCorp's own docs, |
| unexercised | docs/dc-dc-deployment-workflow.md:875 | \| `opentofu/` (networks/pools/node-VM PXE/cloud-init-VM patterns) \| **VALIDATE... |
| verified | docs/dc-dc-netbox-buildout-scope.md:288 | IPAM apex) holds the COMPLETE validated dataset AND it is VERIFIED. Two sub-task... |
| verified | docs/dc0-deploy-readiness.md:117 | - `voffice1` + `office1-opnsense` are BOTH `autostart=enable` (set 2026-07-17, e... |
| verified | docs/dc0-deploy-readiness.md:120 | `virsh shutdown`s the guests first so the reboot exercises the verified **cold-b... |
| verified | docs/dc0-deploy-readiness.md:21 | ## A. Readiness ESTABLISHED (done, verified this session) |
| blocking | docs/dc0-deploy-readiness.md:32 | - **Blocking design rulings LANDED** -- D-121/122/123/124 ADOPTED; R-1 Model B, ... |
| verified | docs/dc0-deploy-readiness.md:35 | ## B. The outer-root plan -- VERIFIED SAFE (this is the apply gate) |
| verified | docs/dc0-deploy-readiness.md:37 | `tofu -chdir=opentofu plan` => **5 add / 2 in-place / 6 destroy**, decomposed an... |
| verified | docs/dc0-deploy-readiness.md:39 | -- an **update-in-place** (verified: NOT replacement; replacement would destroy ... |
| non-blocking | docs/dc0-deploy-readiness.md:75 | (D-100 gap #11) is DEFERRED. Non-blocking for the outer apply. |
| non-blocking | docs/dc0-deploy-readiness.md:86 | ### C4. IPAM record hygiene (parallel, NON-blocking -- now runnable via `ssh off... |
| non-blocking | docs/dc0-deploy-readiness.md:93 | ### C5. Record-hygiene sweep (NON-blocking; queued from the Stage-3 adversarial ... |
| verified | docs/design-decisions.md:1063 | **Status:** PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-0... |
| verified | docs/design-decisions.md:1124 | ### D-063 -- RESOLVED / CLOSED (2026-07-03): applied and functionally verified |
| verified | docs/design-decisions.md:1172 | **Status:** RESOLVED / CLOSED (applied + functionally verified 2026-07-03). Supe... |
| unblocked | docs/design-decisions.md:1262 | create_trust with identity:create_trust 403 -- AFTER D-064 unblocked create_user... |
| verified | docs/design-decisions.md:1504 | D-011 item 6 read "Vault unseal + auto-unseal-after-reboot pattern verified". Th... |
| verified | docs/design-decisions.md:1508 | verified (sealed-on-restart is BY DESIGN, not a fault)". The acceptance bar and ... |
| unexercised | docs/design-decisions.md:1584 | mentions in the repo are dated as-built value captures. An adopted-but-unexercis... |
| verified | docs/design-decisions.md:1710 | https 200 on 10.12.4.58 and 10.12.8.58 (vault-CA-verified, csrftoken cookie pres... |
| verified | docs/design-decisions.md:1769 | (evidence-gated per D-064: code-guarded, and no verified shipped-default strings... |
| imported | docs/design-decisions.md:209 | **Deferred to v2 (per Q2):** VR0 DC0-VLANs group additions beyond VID 240 (alrea... |
| verified | docs/design-decisions.md:2162 | - The DC-DC decision series starts at D-100 in the repo `openstack-caracal-dc-dc... |
| verified | docs/design-decisions.md:223 | 6. Vault unseal + auto-unseal-after-reboot pattern verified |
| verified | docs/design-decisions.md:2279 | but comes up on FACTORY DEFAULTS. The config ISO is well-formed and correctly at... |
| unverified | docs/design-decisions.md:2310 | nano image -- and it does not. The module header has always flagged this exact m... |
| unverified | docs/design-decisions.md:2317 | importer, no ISO, no boot-time interactivity. RISK/UNVERIFIED: writing FreeBSD U... |
| verified | docs/design-decisions.md:2349 | 2. **VyOS LTS binaries are subscription-gated** (verified 2026-07-13, vyos.net/g... |
| verified | docs/design-decisions.md:2468 | the internet, serves DHCP, managed over SSH with a verified push pipeline). Edge... |
| verified | docs/design-decisions.md:3069 | CSPRNG-generated. That claim originates in an earlier session and **cannot be re... |
| imported | docs/design-decisions.md:3170 | break the already-imported sandbox prefixes. |
| verified | docs/design-decisions.md:3260 | Re-IP executed on the two running services, no wipe, verified on the wire: |
| blocking | docs/design-decisions.md:3306 | Stage 3's `modules/node-vm` sizing/count (was blocking phase2 runbook Step 6 -- ... |
| unblocked | docs/design-decisions.md:3306 | Stage 3's `modules/node-vm` sizing/count (was blocking phase2 runbook Step 6 -- ... |
| verified | docs/design-decisions.md:3376 | leans on the already-3-unit mysql-innodb-cluster. Must be verified against the d... |
| verified | docs/design-decisions.md:361 | **What is lost vs. graceful path:** verified-clean release path for CAPI workloa... |
| unexercised | docs/design-decisions.md:3794 | continue that"). Tooling delivered (`scripts/site-forward.sh` + harness, reviewe... |
| unexercised | docs/design-decisions.md:3850 | met. The systemd FORWARD layer (`site-forward.sh`) remains reviewed-but-unexerci... |
| verified | docs/design-decisions.md:3918 | settings are applied AFTER a verified clean cold boot (operator sequencing). |
| verified | docs/design-decisions.md:3931 | - **office1-opnsense -> AUTOSTART, but enable only AFTER one verified post-fix c... |
| unverified | docs/design-decisions.md:3934 | boot post-fix is unverified ("live boot verification is the remaining gated step... |
| verified | docs/design-decisions.md:3947 | `office1-opnsense` after its verified cold boot); runs as jessea123 via the libv... |
| verified | docs/design-decisions.md:3954 | matrix against drift (auto-booting the 416 GiB container / MAAS nodes is the exa... |
| verified | docs/design-decisions.md:428 | **Finding (verified 2026-06-05):** k8s-keystone-auth 1.5.1 exposes no keystone-C... |
| verified | docs/design-decisions.md:45 | **Verification source:** Caracal channel matrix per Canonical Charmed OpenStack ... |
| blocking | docs/design-decisions.md:565 | - `magnum-shared-db` missing colon ? causes a relation endpoint syntax error, de... |
| verified | docs/design-decisions.md:584 | \| 2026-05-22 \| D-002 hacluster row added (channel `2.4/stable`) per Canonical ... |
| verified | docs/design-decisions.md:666 | **Status:** Adopted + APPLIED 2026-06-11; re-verified 2026-06-16 post phase-05. |
| verified | docs/design-decisions.md:712 | **Rationale:** (1) FINDING-3 -- glance's web-download plugin fetches with urllib... |
| verified | docs/design-decisions.md:755 | **Why this approach (and NOT enforce_scope):** Charmed OpenStack deliberately do... |
| non-blocking | docs/design-decisions.md:761 | **base_* alignment (open verification, non-blocking):** the base_* rules in `dom... |
| verified | docs/design-decisions.md:769 | **Status:** ADOPTED 2026-06-25 (operator-approved). AUTHORITATIVE; SUPERSEDES th... |
| verified | docs/design-decisions.md:789 | - Ceph control relations (ceph-mon client/mon/osd/mds/radosgw/rbd-mirror/bootstr... |
| verified | docs/design-decisions.md:928 | **No re-CIDR.** The live MAAS is already on D-052/D-053 (verified 2026-06-29: ju... |
| verified | docs/design-decisions.md:947 | restored). The bundle diff `bf7de5a..HEAD` was verified to be PURELY D-057/D-058... |
| verified | docs/design-decisions.md:957 | `scripts/d057-bundle-check.py`. Verified PASS against the reverted bundle. |
| verified | docs/docfix-draft-20260702.md:177 | pattern verified"; phase-08 D-011.6 rules MANUAL unseal is the v1 standard (auto... |
| verified | docs/docfix-draft-20260702.md:192 | IMPLEMENTED in the delivered ZIP (numbers verified next-free at HEAD 690779a; |
| verified | docs/docfix-draft-20260702.md:4 | Numbers are PROVISIONAL from next-free DOCFIX-066 (verified against HEAD |
| verified | docs/docfix-draft-20260702.md:64 | scripts/lib-hosts.sh (host identity); retain only verified-current literals. |
| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:124 | each DC containment VM, so it scales badly. **Mechanism -- partially verified:**... |
| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:125 | is **NO provider-level knob** for the staging path (VERIFIED via |
| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:129 | `os.TempDir()`, i.e. **`$TMPDIR` for the tofu process** -- **UNVERIFIED by |
| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:138 | verified empirically against live state: |
| verified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:147 | **VERIFIED AGAINST PRIMARY SOURCE** (provider v0.9.8, |
| blocking | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:3 | **Class:** deploy-blocking drift, discovered during pre-apply re-verification. |
| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:58 | ## The seed-volume replacement (root cause; danger UNVERIFIED) |
| unverified | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:86 | **UNVERIFIED -- do not treat as established:** what provider 0.9.8 actually does... |
| non-blocking | docs/handoff-20260705-open-items.md:53 | live tenant -- operator, browser; non-blocking. |
| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:66 | ## What was tried -- ALL applied and verified in the domain XML, NONE resolved i... |
| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:69 | 2. **`machine` q35 -> i440fx** (`pc-i440fx-noble`, verified). No change. (Note: ... |
| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:72 | 3. **Disk: COW overlay -> direct per-VM copy** of the nano (verified 11 GiB / 2.... |
| verified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:74 | 4. **CPU `host-passthrough`** (verified). No change. |
| unverified | docs/incident-20260712-opnsense-edge-boot-triplefault.md:91 | UNVERIFIED (no source given); do not propagate it. If 2 GiB proves insufficient ... |
| imported | docs/netbox-vip-queue.md:3 | **Status:** Queued. To be imported after successful cloud deployment + validatio... |
| unblocked | docs/netbox-vip-queue.md:81 | ## Execution path (when unblocked) |
| blocking | docs/netbox-vip-queue.md:9 | under workstream 2 (2026-05-22) to avoid blocking the rebuild on the engineer |
| verified | docs/phase-00-maas-standup-notes.md:14 | script refuses to build onto a CIDR the wrong plane occupies. Verified idempoten... |
| verified | docs/security-ledger.md:21 | \| SEC-010 \| 2026-07-16 \| **metal-admin DC-LOCAL invariant (D-052/D-100) is PR... |
| unblocked | docs/session-findings-2026-07-02.md:11 | 1. D-064 (prior): create_user template fix unblocked trustee-user creation. |
| verified | docs/session-ledger.md:1053 | is **jumbo, underlay_mtu=9000** (operator ruling; verified on all 10 nets). |
| verified | docs/session-ledger.md:1070 | Idempotent, and **verified FIELD-BY-FIELD** against the upstream draft |
| unblocked | docs/session-ledger.md:1088 | ### ~~BLOCKED~~ **UNBLOCKED and DONE** -- D-118 ratified the org ULA; both DCs i... |
| imported | docs/session-ledger.md:1088 | ### ~~BLOCKED~~ **UNBLOCKED and DONE** -- D-118 ratified the org ULA; both DCs i... |
| imported | docs/session-ledger.md:1096 | **Imported into the sandbox:** six-plane roles + 2 RIRs + 5 aggregates, then **V... |
| blocking | docs/session-ledger.md:1136 | ### Also open (recorded, not blocking) |
| verified | docs/session-ledger.md:118 | --commit` and VERIFIED by the (now-extended) fidelity check -> exit 0. The `ip-r... |
| verified | docs/session-ledger.md:128 | 10.10.1.0/24 via 10.10.0.20 dev virbr2` in a real terminal; verified HTTP 302 at... |
| unexercised | docs/session-ledger.md:138 | the guard/classifier). The systemd FORWARD layer stays reviewed-but-unexercised ... |
| verified | docs/session-ledger.md:142 | Both blocks COMMITTED (gated, dry-run-verified; token server-side, sandbox-only)... |
| verified | docs/session-ledger.md:155 | vvr1-dc0/nodes=FALSE); opentofu T11-T15 pin it; HARD GATE verified (voffice1/off... |
| verified | docs/session-ledger.md:162 | build). D-127 RULED: voffice1 autostarts; office1-opnsense autostarts AFTER one ... |
| verified | docs/session-ledger.md:176 | (graceful ACPI `virsh shutdown` -> confirmed `shut off` -> `virsh start`) and VE... |
| verified | docs/session-ledger.md:178 | gw + egress 0% loss, netbox 302 + tailscale reachable behind it. That satisfies ... |
| verified | docs/session-ledger.md:181 | stay MANUAL and do not exist yet). **LXD service-VM autostart VERIFIED (2026-07-... |
| blocking | docs/session-ledger.md:205 | `docs/dc-dc-deployment-workflow.md`'s Stage 3 section still reads "**Blocking to... |
| blocking | docs/session-ledger.md:210 | blocker; the workflow doc's Stage-3 "Blocking to EXECUTE" line needs a DOCFIX (n... |
| unverified | docs/session-ledger.md:222 | state drift, not a config change (the volume-replace CONSEQUENCE on a running do... |
| verified | docs/session-ledger.md:252 | **Mechanism correction:** there is **NO provider knob** for this (VERIFIED via `... |
| unverified | docs/session-ledger.md:254 | almost certainly **`$TMPDIR`** for the tofu process (Go `os.TempDir()`), UNVERIF... |
| verified | docs/session-ledger.md:261 | evidence say **v1.12.3**. Presumed to have arrived with the host patch (not veri... |
| verified | docs/session-ledger.md:265 | ESTABLISHED: (1) An autostart-ONLY diff **bounces the guest** -- VERIFIED FROM P... |
| verified | docs/session-ledger.md:287 | clean). Outer-root `tofu plan` RUN + VERIFIED SAFE: 5 add (`vvr1-dc0` 416GiB/108... |
| verified | docs/session-ledger.md:288 | 0 change / 6 destroy (the six EMPTY vr1-dc0 planes relocating to the inner root ... |
| blocking | docs/session-ledger.md:312 | hard-gate grounds (substrate design is sound). BLOCKING headline: **2 decisions ... |
| unverified | docs/session-ledger.md:347 | `vault-hacluster` VIP. Still 3x manual unseal (SEC-003). **HARD FEASIBILITY GATE... |
| verified | docs/session-ledger.md:352 | - **[R-2 FEASIBILITY GATE FAILED -- verified 2026-07-16.]** `bundle.yaml:133-138... |
| verified | docs/session-ledger.md:414 | applied+verified on vvr1-dc0. |
| blocking | docs/session-ledger.md:426 | - **Model B cross-check (agent) = FAITHFUL, no BLOCKING**; fixes applied: 32-GiB... |
| verified | docs/session-ledger.md:43 | but stays OPEN until applied + verified on vvr1-dc0. SEC-008 -- the vcloud re-en... |
| imported | docs/session-ledger.md:49 | record. Also: D-124 transit addressing PINNED (172.31.0.0/24) + imported to offi... |
| blocking | docs/session-ledger.md:512 | Walked the phase2 runbook and surfaced its blocking decisions; the operator rule... |
| imported | docs/session-ledger.md:592 | supernet" -- D-115 ALREADY assigned it (`10.12.64.0/19`, imported to office1-net... |
| imported | docs/session-ledger.md:622 | upstream draft and PROVEN faithful field-by-field; carve + six-plane roles + BOT... |
| verified | docs/session-ledger.md:628 | Address `2602:f3e2:f01:100::1/64` on the edge LAN (kernel-verified) + radvd adve... |
| verified | docs/session-ledger.md:703 | (`--commit`, operator-approved) and VERIFIED: re-dump + fidelity check -> exit 0... |
| verified | docs/session-ledger.md:72 | `tofu apply`: **11 added, 0 changed, 11 destroyed**; `tofu plan` now reports "No... |
| verified | docs/session-ledger.md:723 | **ORG_ULA_48 = `fd50:840e:74e2::/48`** (**D-118 ADOPTED** -- RFC 4193 valid, and... |
| imported | docs/session-ledger.md:727 | All are IMPORTED and fidelity-checked in the sandbox. |
| verified | docs/session-ledger.md:818 | ABSENT on all three), idempotent grep-guarded append, verified 2 keys each. This... |
| verified | docs/session-ledger.md:835 | only `os-git-backup` installed, and **UNCONFIGURED** (php-verified no config nod... |
| verified | docs/session-ledger.md:852 | **INSTALL VERIFIED 2026-07-18 (operator ran the firmware POSTs via `!`):** `os-q... |
| verified | docs/session-ledger.md:897 | -- VERIFIED still open), then use the combined gate to regenerate the stale rest... |
| verified | docs/session-ledger.md:900 | watch + D-066-evidence wrapper. NOT STARTED (verified absent). |
| verified | docs/session-ledger.md:913 | PROPOSED/OPEN. D-063 is `RESOLVED / CLOSED` in `design-decisions.md` (verified).... |
| blocking | docs/stage3-adversarial-review-20260716.md:111 | - **Contested (severity):** A1 argues MAJOR-not-BLOCKING for D-123 -- a status L... |
| blocking | docs/stage3-adversarial-review-20260716.md:113 | (L1-07). Adjudication: kept BLOCKING because (i) the prompt frames C2 as BLOCKIN... |
| blocking | docs/stage3-adversarial-review-20260716.md:113 | (L1-07). Adjudication: kept BLOCKING because (i) the prompt frames C2 as BLOCKIN... |
| blocking | docs/stage3-adversarial-review-20260716.md:262 | deploy-BLOCKING: a status label is not a value "entering a command" (hard-rule-2... |
| blocking | docs/stage3-adversarial-review-20260716.md:265 | specific inference. Code's adjudication keeps R3-F01 BLOCKING on decision-record... |
| verified | docs/stage3-adversarial-review-20260716.md:294 | run). Integration -- with one A4 claim verified-and-rejected (I check agent cita... |
| verified | docs/stage3-adversarial-review-20260716.md:300 | Verified: the runbook does NOT -- at `:507` it cites "D-123 (PROPOSED, recommend... |
| blocking | docs/stage3-adversarial-review-20260716.md:329 | Blocking conditions to clear (each operator-gated, applied in a post-acceptance ... |
| verified | docs/stage3-adversarial-review-20260716.md:50 | claims hold independently, but specific benchmark/control identifiers should be ... |
| blocking | docs/stage3-adversarial-review-20260716.md:73 | ### R3-F01 -- BLOCKING -- Two ADOPTED rulings rest on inferred/agent-authored op... |
| verified | docs/stage3-adversarial-review-20260716.md:79 | sub-ruling. Code verified the second case directly against the transcript (L1-13... |
| blocking | docs/stage3-review-base.patch:12 | +`runbooks/dc-dc-phase2-tofu-dc-substrate.md` to surface its blocking decisions ... |
| imported | docs/stage3-review-base.patch:1320 | +# imported to office1-netbox), superseding the old "wait for NetBox" premise. I... |
| imported | docs/stage3-review-base.patch:1897 | +    that carve is imported to `office1-netbox`. So the blocker is no longer a |
| unblocked | docs/stage3-review-base.patch:1928 | +    used to block Step 6; it is now UNBLOCKED. Still open (one sub-ruling |
| unverified | docs/stage3-review-base.patch:205 | +   (the `to:` list-replace merge is the one unverified overlay mechanism). |
| unblocked | docs/stage3-review-base.patch:2187 | -**GATE:** base image path and (if unblocked) config ISO path recorded as real |
| unblocked | docs/stage3-review-base.patch:2285 | -ends at whatever the last unblocked step was (Step 5 or wherever Step 4 left |
| verified | docs/stage3-review-base.patch:2544 | -honestly rather than declaring edge routing verified when it is not. |
| verified | docs/stage3-review-base.patch:2547 | +record that honestly rather than declaring edge routing verified when it is |
| blocking | docs/stage3-review-base.patch:325 | +**Two blocking rulings landed 2026-07-15** (from a walk of the runbook's decisi... |
| blocking | docs/stage3-review-base.patch:364 | +Stage 3's `modules/node-vm` sizing/count (was blocking phase2 runbook Step 6 --... |
| unblocked | docs/stage3-review-base.patch:364 | +Stage 3's `modules/node-vm` sizing/count (was blocking phase2 runbook Step 6 --... |
| verified | docs/stage3-review-base.patch:434 | +     leans on the already-3-unit mysql-innodb-cluster. Must be verified against... |
| blocking | docs/stage3-review-base.patch:660 | +\| SEC-011 \| 2026-07-16 \| **Node least-connectivity gap (not an L2 breach).**... |
| blocking | docs/stage3-review-base.patch:721 | +Walked the phase2 runbook and surfaced its blocking decisions; the operator rul... |
| imported | docs/stage3-review-base.patch:801 | +  supernet" -- D-115 ALREADY assigned it (`10.12.64.0/19`, imported to office1-... |
| imported | docs/stage3-review-base.patch:83 | +  assigned (D-115 `10.12.64.0/19`, imported to office1-netbox); it stays out of... |
| verified | docs/tenant-onboarding-contract.md:94 | VERIFIED LIVE 2026-07-07 (devteam, full three-account walkthrough): login |
| verified | docs/upstream-bug-draft-dashboard-tls.md:29 | (verified: plain-HTTP GET to :433 answers 200). TLS clients fail handshake |
| verified | docs/upstream-bug-draft-dashboard-tls.md:41 | Bind `cluster` to the same space as the application default binding. Verified: |
| imported | docs/v1-pre-deploy-fixes.md:654 | The IPv6 prefixes already imported into NetBox (and marked Reservation status) i... |
| verified | docs/v1-redeploy-changelog.md:1028 | core-verified cloud -- mysql clustered, Vault PKI up, cert cascade settled, 31/3... |
| verified | docs/v1-redeploy-changelog.md:117 | practice (D-054): tested scripts committed to the repo, verified by sha256 on th... |
| verified | docs/v1-redeploy-changelog.md:13 | (Verified by grep of design-decisions.md: max D-053, max DOCFIX-038.) |
| unblocked | docs/v1-redeploy-changelog.md:1312 | identity:create_trust 403 -- AFTER D-064 unblocked create_user (trustee user cre... |
| verified | docs/v1-redeploy-changelog.md:1371 | remote_binding (LP#1895185, verified at vendored commit 6f7848c), so the externa... |
| verified | docs/v1-redeploy-changelog.md:1382 | Also this session: handoff commit 22a1eef verified 7/8 (bundle.yaml was DELETED ... |
| verified | docs/v1-redeploy-changelog.md:1383 | commit pattern; restored + verified in 10e9186 -- diff vs pre-delete is exactly ... |
| verified | docs/v1-redeploy-changelog.md:1400 | template create (stage5) drops --keypair (keypair_id optional, default=None -- v... |
| verified | docs/v1-redeploy-changelog.md:1456 | tests/*/run-tests.sh; both harnesses in this package were verified under it pre-... |
| verified | docs/v1-redeploy-changelog.md:1511 | ### 2026-07-03 (addendum 4) -- 8d verified; V-1 ruled; D-063 measured + adopted ... |
| verified | docs/v1-redeploy-changelog.md:1585 | ### 2026-07-03 (addendum 7) -- D-063 RESOLVED/CLOSED: applied + functionally ver... |
| verified | docs/v1-redeploy-changelog.md:1589 | /32 on 22. VERIFIED through the tightened SG: (R1) TCP handshake magnum/0 -> mgm... |
| verified | docs/v1-redeploy-changelog.md:17 | ## Verified-state checkpoint (measured this session -- authoritative as-built) |
| verified | docs/v1-redeploy-changelog.md:1880 | Identifier consumed: BUNDLEFIX-010 (vault bundle revert; scan-verified next-free... |
| verified | docs/v1-redeploy-changelog.md:2016 | provider-public). VERIFIED: https 200 on 10.12.4.58 + 10.12.8.58 for the FIRST |
| verified | docs/v1-redeploy-changelog.md:2017 | TIME on this build, vault-CA-verified with csrftoken cookie present; http leg |
| verified | docs/v1-redeploy-changelog.md:2037 | readback grep (juju-ssh quoting); the render had in fact succeeded -- verified |
| verified | docs/v1-redeploy-changelog.md:2171 | abort discipline. Check ids verified against validate.sh (--checks, --list). |
| unverified | docs/v1-redeploy-changelog.md:2178 | snap-channel-headroom measurement + Sunbeam parity watch. UNVERIFIED items |
| verified | docs/v1-redeploy-changelog.md:2217 | is **1.12.11**, not 1.14.x. Listener TLS options verified present and empty: |
| verified | docs/v1-redeploy-changelog.md:2253 | teardown verified server/FIP/SG removed). CANARY_SSH_USER verify-live item |
| non-blocking | docs/v1-redeploy-changelog.md:2255 | logged as open, non-blocking per the do-doc. |
| verified | docs/v1-redeploy-changelog.md:2262 | application_credential rules -- verified both sides). Fix (operator-ruled): |
| verified | docs/v1-redeploy-changelog.md:2326 | node_count=2 deliberate), foil1 complete/verified, acme absent (offboarded), |
| verified | docs/v1-redeploy-changelog.md:2355 | orphans only (trusts first, post-delete verified) behind a typed |
| unverified | docs/v1-redeploy-changelog.md:2377 | radosgw tenant enablement UNVERIFIED). {{PLACEHOLDER}}-driven; first |
| verified | docs/v1-redeploy-changelog.md:2384 | (WARN rc 2 + count; benign-placeholder whitelist; scrub re-verified by |
| verified | docs/v1-redeploy-changelog.md:2431 | numbering authority is correct again (verified: highest=104 -> next-free=105 |
| verified | docs/v1-redeploy-changelog.md:2489 | in place with a note (the standing identifier-pollution rule; scan verified |
| verified | docs/v1-redeploy-changelog.md:2573 | Verified-correct non-changes logged by the pass: -svc-appcred.txt |
| verified | docs/v1-redeploy-changelog.md:2580 | it had only read); it re-based onto main and verified its reads against |
| unverified | docs/v1-redeploy-changelog.md:2664 | warns UNVERIFIED on the HOLD path. Harness 8->10. REVERT: git checkout |
| verified | docs/v1-redeploy-changelog.md:2677 | deferred-findings register -- R5/R6/R7/R9/R11 verified with locations, |
| verified | docs/v1-redeploy-changelog.md:268 | the no-DHCP planes never produced a self-lease. Verified: mock self-release path... |
| verified | docs/v1-redeploy-changelog.md:2734 | --ram 51200` applied + re-read verified. Values equal the nova class |
| verified | docs/v1-redeploy-changelog.md:2766 | delivered occurrences in ~/devteam-package corrected by sed + re-verified |
| verified | docs/v1-redeploy-changelog.md:2841 | - **DOCFIX-120 -- contract section 5 live verdicts:** 5.1 VERIFIED (devteam); |
| verified | docs/v1-redeploy-changelog.md:2913 | delivered copies, zero tokens verified); operator pushes tonight. |
| verified | docs/v1-redeploy-changelog.md:3000 | verified); operator pushes with the rest tonight. |
| verified | docs/v1-redeploy-changelog.md:302 | added its sourced-library shellcheck directive. osd-blank verified via mock |
| verified | docs/v1-redeploy-changelog.md:3020 | operator-side; net state verified clean, so no agent delete was needed. |
| verified | docs/v1-redeploy-changelog.md:3022 | created in devteam-prod as devteam-svc app-cred. Verified attributes: |
| verified | docs/v1-redeploy-changelog.md:3123 | both verified name-based). |
| verified | docs/v1-redeploy-changelog.md:3219 | (VERIFIED -- catalog has only glance + product-streams, no registry service); |
| verified | docs/v1-redeploy-changelog.md:322 | Next free numbers at section open: design decision D-056; doc fix DOCFIX-042 (ve... |
| verified | docs/v1-redeploy-changelog.md:3226 | 3. Scaling (2.5 new): `openstack coe cluster resize <cluster> <count>` (VERIFIED |
| unverified | docs/v1-redeploy-changelog.md:3232 | UNVERIFIED, see operator follow-up). |
| verified | docs/v1-redeploy-changelog.md:3418 | (hard-rule #3; Roosevelt = 1 edit not 6). lib-net verified source-safe before wi... |
| non-blocking | docs/v1-redeploy-changelog.md:579 | ALSO (value drift, non-blocking): gss image-stream endpoint is HTTP on metal 10.... |
| non-blocking | docs/v1-redeploy-changelog.md:689 | live + D-052. Non-blocking. |
| non-blocking | docs/v1-redeploy-changelog.md:724 | confirm it reaches internal glance. Non-blocking. |
| verified | docs/v1-redeploy-changelog.md:750 | ec332b438a87c3cc1e38318ced110568392484cc2f33e29c8f4eaf9ecc9de297 verified vs pub... |
| verified | docs/v1-redeploy-changelog.md:883 | ### Phase-06 6.0-BOOT verified + 6.0/6.1 scripted (2026-06-27) |
| imported | docs/v1-redeploy-changelog.md:885 | ubuntu-24.04-noble imported + active, disk_format=raw, checksum 5fa5b05e...1a44 ... |
| verified | docs/v1-redeploy-changelog.md:954 | verified this session. carve-host-interfaces.sh is correct per the as-built |
| blocking | docs/v1-redeploy-changelog.md:963 | ex-lbaas enp11s0 to be REMOVED). OPEN blocking question: the interaction with |
| imported | docs/vr1-office1-as-built.md:11 | and the divergence gets fixed here. **The D-115 carve IS now imported** into the... |
| verified | docs/vr1-office1-as-built.md:110 | self-hosted control server and **verified from the workstation** -- the OPNsense... |
| imported | docs/vr1-office1-as-built.md:167 | ## 6. IPAM -- what NetBox now says about this site (D-115 carve, imported 2026-0... |
| verified | runbooks/appendix-A-troubleshooting.md:253 | - Fix: the four host system_ids are fixed and eyeball-verified |
| non-blocking | runbooks/appendix-A-troubleshooting.md:298 | - Impact: NON-BLOCKING -- systemd-resolved deprioritizes .10 and falls through t... |
| verified | runbooks/appendix-A-troubleshooting.md:442 | provenance-verified path cloud-wide. |
| verified | runbooks/appendix-A-troubleshooting.md:484 | verified blocks: runbooks/ops-capi-recovery.md. |
| verified | runbooks/appendix-A-troubleshooting.md:514 | ~15 seconds on NoValidHost. Verified to the megabyte 2026-06-10. Roosevelt |
| verified | runbooks/appendix-C-identity-rbac.md:122 | - CORRECTION (verified live 2026-07-01): on THIS deployment a domain manager's `... |
| unblocked | runbooks/appendix-D-magnum-trust-model.md:19 | the magnum domain). Unblocked by D-064. PROVEN live. |
| unblocked | runbooks/appendix-D-magnum-trust-model.md:21 | user; impersonation=True; roles = the creator's token roles). Unblocked by D-065... |
| non-blocking | runbooks/d011-batch3-window-DRAFT.md:15 | open, non-blocking per this doc's own clause. |
| blocking | runbooks/dc-dc-office1-service-reip.md:24 | ## Step 0 -- Confirm the recovery backstop FIRST (READ-ONLY, blocking) |
| verified | runbooks/dc-dc-office1-service-reip.md:3 | **EXECUTED 2026-07-15** (D-120 ADOPTED, option (a)). Both services re-IP'd, no w... |
| blocking | runbooks/dc-dc-phase0-vcloud-prep.md:168 | own nested libvirt/OpenStack) is not viable on it. That is a blocking finding |
| unexercised | runbooks/dc-dc-phase0-vcloud-prep.md:406 | STAGE-1-VALIDATED (the Stage 2/3 modules remain unexercised). |
| unverified | runbooks/dc-dc-phase0-vcloud-prep.md:408 | If `validate` surfaces a schema mismatch against the flagged UNVERIFIED |
| verified | runbooks/dc-dc-phase0-vcloud-prep.md:464 | storage (verified against HashiCorp's own docs; see `opentofu/README.md` |
| verified | runbooks/dc-dc-phase0-vcloud-prep.md:500 | **GATE (buildout-design Section 4, Phase 0):** nested KVM verified (Step 2/4); |
| verified | runbooks/dc-dc-phase1-office1-standup.md:157 | command lines are NOT yet verified.** See the PENDING VERIFICATION banner |
| blocking | runbooks/dc-dc-phase1-office1-standup.md:679 | this runbook. Record that as the blocking condition rather than inventing |
| verified | runbooks/dc-dc-phase1-office1-standup.md:835 | - **OpenTofu reaches vcloud host libvirt:** **MET** (Stage 1; re-verified in Ste... |
| imported | runbooks/dc-dc-phase1-office1-standup.md:892 | the D-101 literals were genuinely assigned and imported this run. |
| verified | runbooks/dc-dc-phase1-office1-standup.md:896 | inherits a verified procedure rather than repeating the verification. |
| verified | runbooks/dc-dc-phase2-tofu-dc-substrate.md:176 | the `org.qemu.guest_agent.0` virtio-serial channel** (verified ABSENT 2026-07-18... |
| imported | runbooks/dc-dc-phase2-tofu-dc-substrate.md:57 | that carve is imported to `office1-netbox`. So the blocker is no longer a |
| verified | runbooks/dc-dc-phase2-tofu-dc-substrate.md:674 | record that honestly rather than declaring edge routing verified when it is |
| unblocked | runbooks/dc-dc-phase2-tofu-dc-substrate.md:85 | used to block Step 6; it is now UNBLOCKED. Still open (one sub-ruling |
| unblocked | runbooks/dc-dc-phase3-maas-enlist-deploy.md:104 | is unblocked at this layer (D-101: DC1 inherits DC0's v4 layout |
| imported | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:163 | assigns DC2's real supernet and it's imported via `netbox/dc-dc-prefixes- |
| unverified | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:190 | UNVERIFIED -- check the actual charm config/relation-data schema (e.g. |
| verified | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:315 | Ceph-over-v6 and geneve-over-v6 verified (Step 12, contingent on Step 6). |
| unblocked | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:318 | since only DC1 is unblocked by real address literals today) -> proceed to |
| verified | runbooks/dc-dc-phase5-dr-failover-drill.md:13 | and geneve-over-v6 verified. Do not start this runbook against a DC that hasn't ... |
| verified | runbooks/dc-dc-phase5-dr-failover-drill.md:465 | restore-verified-working as this drill's own RTO data point (control-plane, dist... |
| blocking | runbooks/dc-dc-phase5-dr-failover-drill.md:614 | passed; partial otherwise, with the specific blocking item named). |
| verified | runbooks/dc-dc-teardown-rollback.md:16 | (verified against HashiCorp's own current docs where cited), not invented -- |
| verified | runbooks/dc-dc-teardown-rollback.md:374 | verified: this runbook's commands have never been run against a real `tofu` |
| unexercised | runbooks/dc-dc-teardown-rollback.md:376 | `opentofu/`) -- treat every command here as reviewed-but-unexercised until |
| verified | runbooks/ops-capi-recovery.md:113 | GATE: `cluster status: ready`. Verified convergence on gp.mid: ~20-21 min from |
| verified | runbooks/ops-capi-recovery.md:218 | Verified timing: ~108 s to ACTIVE; op holds ONLINE; VIP+FIP preserved (VIP port |
| verified | runbooks/ops-capi-recovery.md:3 | Status: blocks below are AS-EXECUTED-VERIFIED 2026-06-10 (this is their first |
| verified | runbooks/ops-capi-recovery.md:50 | # (no wtmp shutdown entry; verified 2026-06-10). Accepted for this VM class. |
| verified | runbooks/ops-capi-recovery.md:91 | GATE: SSH-PORT-OK. Timing (verified, gp.mid): ACTIVE ~20 s; sshd ~3.5 min. |
| verified | runbooks/ops-restart-procedure.md:51 | the cloud guests above. FOUNDATIONAL service VMs autostart (`voffice1`; `office1... |
| unverified | runbooks/ops-update-procedure.md:123 | unhealthy or unverified cloud. Commit the `asbuilt/<ts>/` BOM as the |
| verified | runbooks/ops-update-procedure.md:187 | **RUN -- jumphost** (flags per 1.6; form verified as-executed 2026-07-05) |
| verified | runbooks/ops-update-procedure.md:216 | **RUN -- jumphost** (form verified as-executed 2026-07-05) |
| verified | runbooks/ops-update-procedure.md:222 | already brought machine 0's agent to target (verified live; check with |
| verified | runbooks/ops-update-procedure.md:88 | version under `juju-status`, NOT `agent-status` -- verified 2026-07-05; |
| non-blocking | runbooks/phase-01-bundle-deploy.md:199 | clean). FINDING (non-blocking, R15): the unreachable region resolver `10.12.8.10... |
| non-blocking | runbooks/phase-03-core-verify.md:187 | keystone admin on `:35357`). Two non-blocking notes for later: s3/swift is regis... |
| verified | runbooks/phase-05-octavia-enablement.md:102 | This is the verified canonical block (06-03). One `( set -e )` |
| verified | runbooks/phase-05-octavia-enablement.md:161 | echo "[OK] checksum verified ($GOT)" |
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:113 | PROJ_DOMAIN="capi"                                   # as-built, verified live 2... |
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:143 | echo "=== flavors (as-built specs; public -- verified live 2026-06-10 pre-teardo... |
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:173 | echo "[OK] checksum verified ($GOT)" |
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:180 | # as-built (verified live 2026-06-10): visibility=public, os_distro=ubuntu, os_v... |
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:24 | - Charmed OpenStack live and verified (phase-03 done); Keystone reachable on the |
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:77 | Flavor specs are as-built ground truth (2026-06-08 verified-state checkpoint): |
| verified | runbooks/phase-06-incloud-mgmt-cluster.md:94 | AS-BUILT FACTS (verified live 2026-06-10 pre-teardown; supersede the rebuild |
| verified | runbooks/phase-07-conductor-graft.md:246 | # AND symlink /usr/bin/helm -> it (/usr/bin IS on the restricted init PATH). Che... |
| verified | runbooks/phase-07-conductor-graft.md:493 | /etc/magnum/magnum.conf.d"`; verified live via `ps` and the init script `show-ar... |
| verified | runbooks/phase-08-workload-cluster-acceptance.md:138 | echo "[OK] sha512 verified against the azimuth-images 0.28.0 manifest" |
| verified | runbooks/tenant-onboarding-v2-DRAFT.md:34 | [PROCEDURE-PENDING]      design-derived (appendix-D from magnum source); NOT yet... |
| verified | runbooks/tenant-onboarding-v2-DRAFT.md:422 | STATUS: NOT YET LIVE-VERIFIED on the multi-tenant path as of this draft. D-064 f... |

## 5. Reference integrity

### Broken path references
| ref | where |
|---|---|
| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3061 |
| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3072 |
| clientdocs/glossary.md | docs/v1-redeploy-changelog.md:3158 |
| creds-manifests/vr1-dc | docs/dc0-deploy-readiness.md:27 |
| docs/3.7 | docs/v1-redeploy-changelog.md:226 |
| docs/CURRENT-STATE.md | docs/audit/grounding-audit-charter.md:119 |
| docs/CURRENT-STATE.md | docs/audit/skill-additions-proposed.md:11 |
| docs/archive | docs/audit/grounding-audit-charter.md:184 |
| docs/changelog | docs/session-ledger.md:24 |
| docs/changelog-20260709-ceph-replication | runbooks/dc-dc-phase5-dr-failover-drill.md:674 |
| docs/changelog-20260709-designate | docs/dc-dc-deployment-workflow.md:658 |
| docs/changelog-20260710 | runbooks/dc-dc-phase0-vcloud-prep.md:7 |
| docs/changelog-20260716-review | docs/session-ledger.md:407 |
| docs/cli/how-to-use-lxd.html | .claude/skills/openstack-cloud-ops/references/platform-traps.md:310 |
| docs/code | docs/session-ledger.md:407 |
| docs/configuration/storage | docs/D-068-openbao-assessment-DRAFT.md:85 |
| docs/data-sources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:67 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase1-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase2-runbook.md:13 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase3-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase4-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase5-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-dc-dc-phase6-runbook.md:12 |
| docs/dc-dc | docs/changelog-20260709-netem-ula-gua-proposal.md:10 |
| docs/dc-dc | runbooks/dc-dc-phase6-designate-cos-magnum.md:113 |
| docs/dc-dc-D100-D110.append.md | docs/changelog-20260709-dc-dc-design.md:16 |
| docs/dc-dc-D100-D110.append.md | docs/dc-dc-buildout-design.md:230 |
| docs/dc-dc-buildout | .claude/skills/openstack-cloud-ops/references/environment.md:112 |
| docs/dc-dc-buildout | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:4 |
| docs/dc-dc-deployment | docs/changelog-20260709-adversarial-review-fixes.md:34 |
| docs/dc-dc-deployment | docs/changelog-20260709-ceph-replication-tooling.md:142 |
| docs/dc-dc-deployment | docs/changelog-20260709-ceph-replication-tooling.md:4 |
| docs/dc-dc-deployment | docs/changelog-20260709-dc-dc-phase0-runbook.md:13 |
| docs/dc-dc-deployment | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:144 |
| docs/dc-dc-deployment | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:16 |
| docs/dc-dc-deployment | runbooks/dc-dc-phase6-designate-cos-magnum.md:623 |
| docs/dc-dc-ipv6 | docs/changelog-20260709-ipv6-family-matrix-overlay.md:11 |
| docs/dc-dc-ipv6-charm | docs/changelog-20260709-ipv6-family-matrix-overlay.md:61 |
| docs/dc-dc-ipv6-charm | docs/dc-dc-deployment-workflow.md:625 |
| docs/dc-dc-netem-and-ula-gua | docs/dc-dc-deployment-workflow.md:494 |
| docs/design-decisions | docs/v1-pre-deploy-fixes.md:130 |
| docs/design-decisions | docs/v1-pre-deploy-fixes.md:170 |
| docs/design-decisions | docs/v1-pre-deploy-fixes.md:660 |
| docs/discourse | docs/changelog-20260716-d124-rack-addressing.md:46 |
| docs/discourse | docs/stage3-review-base.patch:268 |
| docs/fip-edge-diagnosis-checkpoint-20260627.md | docs/v1-redeploy-changelog.md:968 |
| docs/forum/GitHub | docs/changelog-20260709-opentofu-audit.md:84 |
| docs/forum/GitHub | docs/changelog-20260709-opnsense-research.md:9 |
| docs/guides/migration | docs/D-068-openbao-assessment-DRAFT.md:85 |
| docs/how-to-manage-machines | .claude/skills/openstack-cloud-ops/references/platform-traps.md:283 |
| docs/how-to/virtualisation/enable-nested-virtualisation | .claude/skills/openstack-cloud-ops/references/platform-traps.md:117 |
| docs/index.md | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:88 |
| docs/language/resources/provisioners/local-exec | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:99 |
| docs/language/resources/tf-data | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:101 |
| docs/latest/reference/network_bridge | .claude/skills/openstack-cloud-ops/references/platform-traps.md:274 |
| docs/latest/reference/releases-snap | .claude/skills/openstack-cloud-ops/references/platform-traps.md:263 |
| docs/ledger | memory/review-after-each-step.md:21 |
| docs/netbox-vip-queue | docs/v1-pre-deploy-fixes.md:740 |
| docs/r | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:42 |
| docs/r | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:68 |
| docs/repro-example.md | docs/changelog-20260710-ledger-scan-self-inflicted-falsepositive-fix.md:50 |
| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:42 |
| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:67 |
| docs/resources | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:88 |
| docs/resources | .claude/skills/openstack-cloud-ops/references/platform-traps.md:47 |
| docs/resources | docs/changelog-20260709-opentofu-maas-netem.md:23 |
| docs/resources | docs/changelog-20260709-opentofu-scaffold.md:34 |
| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:182 |
| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:78 |
| docs/resources/domain.md | .claude/skills/openstack-cloud-ops/references/platform-traps.md:92 |
| docs/stage3-adversarial-review | docs/session-ledger.md:309 |
| docs/tenant-cidr-overlap | docs/v1-redeploy-changelog.md:2439 |
| docs/v1-deploy-runbook.md | docs/handoff-20260703-open-items.md:139 |
| docs/v1-deploy-runbook.md | docs/handoff-20260705-open-items.md:84 |
| docs/v1-deploy-runbook.md | docs/session-ledger.md:1060 |
| docs/v1-deploy-runbook.md | runbooks/phase-08-workload-cluster-acceptance.md:357 |
| docs/v1-deploy-runbook.md | runbooks/phase-08-workload-cluster-acceptance.md:379 |
| netbox/MAAS | docs/dc0-deploy-readiness.md:13 |
| netbox/api/authentication.py | docs/changelog-20260713-office1-netbox-deployed.md:30 |
| netbox/dc-dc | docs/dc-dc-netem-and-ula-gua-proposal.md:109 |
| netbox/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:439 |
| netbox/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:806 |
| netbox/dc-dc-prefixes | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:163 |
| netbox/ipv4-prefixes | docs/v1-pre-deploy-fixes.md:694 |
| netbox/ipv4-prefixes | docs/v1-pre-deploy-fixes.md:712 |
| netbox/ipv4-vips-import.py | docs/netbox-vip-queue.md:89 |
| netbox/tailscale | docs/design-decisions.md:3929 |
| netbox/tailscale | docs/design-decisions.md:3959 |
| netbox/tailscale | docs/session-ledger.md:185 |
| netbox/tailscale | docs/vr1-office1-as-built.md:59 |
| opentofu/templates/opnsense-config.xml.tmpl | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:116 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260709-opnsense-config-design.md:10 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260709-opnsense-config-design.md:9 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260712-opnsense-edge-real-isp-router.md:15 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260712-opnsense-edge-real-isp-router.md:38 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260713-config-xml-path-deleted.md:29 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/changelog-20260713-opnsense-apikey-bootstrap.md:70 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/dc-dc-deployment-workflow.md:332 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/dc-dc-deployment-workflow.md:474 |
| opentofu/templates/opnsense-config.xml.tmpl | docs/design-decisions.md:2386 |
| references/ci-automation.md | docs/clientdocs-workflow-review-20260708.md:57 |
| references/day2-operations.md | docs/clientdocs-workflow-review-20260708.md:115 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:2987 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:3179 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:3346 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:3366 |
| references/kubernetes.md | docs/v1-redeploy-changelog.md:3400 |
| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:225 |
| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:303 |
| runbooks/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:327 |
| runbooks/01-destroy-model.md | docs/design-decisions.md:367 |
| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:226 |
| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:318 |
| runbooks/01-destroy-model.md | docs/v1-pre-deploy-fixes.md:339 |
| runbooks/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:304 |
| runbooks/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:328 |
| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:227 |
| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:305 |
| runbooks/02-deploy.md | docs/v1-pre-deploy-fixes.md:329 |
| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:228 |
| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:306 |
| runbooks/03-vault-init.md | docs/v1-pre-deploy-fixes.md:330 |
| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:229 |
| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:307 |
| runbooks/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:331 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:147 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:328 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:332 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/design-decisions.md:583 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:230 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:308 |
| runbooks/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:332 |
| runbooks/05-magnum-capi-driver.md | docs/design-decisions.md:138 |
| runbooks/05-magnum-capi-driver.md | docs/design-decisions.md:149 |
| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:231 |
| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:309 |
| runbooks/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:333 |
| runbooks/06-tenant-setup.md | docs/netbox-vip-queue.md:76 |
| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:232 |
| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:310 |
| runbooks/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:334 |
| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:233 |
| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:311 |
| runbooks/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:335 |
| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:234 |
| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:312 |
| runbooks/08-validate.md | docs/v1-pre-deploy-fixes.md:336 |
| runbooks/appendix-B | .claude/skills/openstack-cloud-ops/references/environment.md:89 |
| runbooks/appendix-B | docs/v1-redeploy-changelog.md:2051 |
| runbooks/dc | docs/dc-dc-deployment-workflow.md:500 |
| runbooks/dc-dc-phase0..6 | .claude/skills/openstack-cloud-ops/references/environment.md:114 |
| runbooks/dc-dc-phase1-office1 | docs/changelog-20260715-creds-consolidation.md:30 |
| runbooks/dc-dc-phase2 | docs/changelog-20260713-config-xml-danger-sweep.md:17 |
| runbooks/dc-dc-phase3 | docs/changelog-20260709-maas-scripts-dc-param.md:145 |
| runbooks/dc-dc-phase4-juju | docs/changelog-20260709-ipv6-family-matrix-overlay.md:12 |
| runbooks/dc-dc-phase4-juju-bundle | docs/changelog-20260709-ipv6-family-matrix-overlay.md:62 |
| runbooks/dc-dc-phase5-dr | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:76 |
| runbooks/dc-dc-phase6-designate | docs/changelog-20260709-designate-cinderbackup-rbdmirror.md:55 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:213 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:289 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:293 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:297 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:325 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:327 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:328 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:329 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:330 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:331 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:332 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:333 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:334 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:335 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:336 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:345 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:402 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:803 |
| runbooks/deprecated | docs/v1-pre-deploy-fixes.md:804 |
| runbooks/deprecated/00-pre-deploy.md | docs/v1-pre-deploy-fixes.md:303 |
| runbooks/deprecated/01a-octavia-pki-generation.md | docs/v1-pre-deploy-fixes.md:304 |
| runbooks/deprecated/02-deploy.md | docs/v1-pre-deploy-fixes.md:305 |
| runbooks/deprecated/03-vault-init.md | docs/v1-pre-deploy-fixes.md:306 |
| runbooks/deprecated/04-magnum-domain.md | docs/v1-pre-deploy-fixes.md:307 |
| runbooks/deprecated/04a-capi-bootstrap-cluster.md | docs/v1-pre-deploy-fixes.md:308 |
| runbooks/deprecated/05-magnum-capi-driver.md | docs/v1-pre-deploy-fixes.md:309 |
| runbooks/deprecated/06-tenant-setup.md | docs/v1-pre-deploy-fixes.md:310 |
| runbooks/deprecated/07-dns-zones.md | docs/v1-pre-deploy-fixes.md:311 |
| runbooks/deprecated/08-validate.md | docs/v1-pre-deploy-fixes.md:312 |
| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:293 |
| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:360 |
| runbooks/deprecated/README.md | docs/v1-pre-deploy-fixes.md:364 |
| runbooks/hardening | memory/project-posture-closed-test.md:3 |
| runbooks/jumphost-provider-vip-gateway.md | docs/README-D057-PACK.md:104 |
| runbooks/jumphost-provider-vip-gateway.md | docs/README-D057-PACK.md:54 |
| runbooks/jumphost-provider-vip-gateway.md | docs/design-decisions.md:971 |
| runbooks/opentofu/scripts | docs/changelog-20260710-skill-vr1-awareness.md:35 |
| runbooks/phase-00 | docs/changelog-20260709-dc-dc-phase0-runbook.md:18 |
| runbooks/phase-00-maas-reconfigure.md | docs/design-decisions.md:972 |
| runbooks/phase-00-maas-reconfigure.md | docs/v1-redeploy-changelog.md:1013 |
| runbooks/phase-00-teardown | docs/changelog-20260709-maas-scripts-dc-param.md:47 |
| runbooks/phase-00-teardown | docs/dc-dc-deployment-workflow.md:784 |
| runbooks/phase-00-teardown-release.sh | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:11 |
| runbooks/phase-00-teardown-release.sh | runbooks/dc-dc-teardown-rollback.md:8 |
| runbooks/phase-00..08 | .claude/skills/openstack-cloud-ops/references/environment.md:85 |
| runbooks/phase-00b-host-reenrollment.md | docs/v1-redeploy-changelog.md:193 |
| runbooks/phase-01..08 | docs/dc-dc-deployment-workflow.md:218 |
| runbooks/phase-01..08 | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:6 |
| runbooks/phase-04-network | runbooks/dc-dc-phase4-juju-bundle-per-dc.md:258 |
| runbooks/phase-06 | docs/design-decisions.md:149 |
| runbooks/phase-06 | docs/design-decisions.md:332 |
| runbooks/provider-vip-maas-standup.md | docs/README-D057-PACK.md:49 |
| runbooks/provider-vip-maas-standup.md | docs/design-decisions.md:972 |
| runbooks/tenant-onboarding-runbook.md | docs/tenant-cidr-overlap-correction-PLAN.md:112 |
| scripts/RUN-blocks/skill | .claude/skills/openstack-cloud-ops/references/environment.md:55 |
| scripts/X.sh | docs/v1-redeploy-changelog.md:51 |
| scripts/X.sh | docs/v1-redeploy-changelog.md:692 |
| scripts/X.sh | docs/v1-redeploy-changelog.md:693 |
| scripts/X.sh | docs/v1-redeploy-changelog.md:826 |
| scripts/carve | docs/changelog-20260709-maas-scripts-dc-param.md:110 |
| scripts/carve-host | docs/changelog-20260709-maas-scripts-dc-param.md:8 |
| scripts/clouds.yaml.template | docs/clientdocs-workflow-review-20260708.md:112 |
| scripts/clouds.yaml.template | docs/clientdocs-workflow-review-20260708.md:54 |
| scripts/d057-bundle-check.py | docs/D-057-REVIEW-ITEMS.md:27 |
| scripts/d057-bundle-check.py | docs/D-058-renumber.md:57 |
| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:37 |
| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:39 |
| scripts/d057-bundle-check.py | docs/README-D057-PACK.md:98 |
| scripts/d057-bundle-check.py | docs/design-decisions.md:957 |
| scripts/d057-bundle-check.py | docs/design-decisions.md:970 |
| scripts/dc-dc | .claude/skills/openstack-cloud-ops/references/environment.md:116 |
| scripts/dc-dc | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:19 |
| scripts/dc-dc | docs/changelog-20260710-sweep-dcdc-runbook-fixes.md:46 |
| scripts/dc-dc | docs/changelog-20260714-d119-region-qualified-dc-namespace.md:65 |
| scripts/dc-dc | runbooks/dc-dc-phase5-dr-failover-drill.md:652 |
| scripts/harnesses | docs/changelog-20260709-ceph-replication-tooling.md:126 |
| scripts/lib | docs/changelog-20260709-dc-dc-phase3-runbook.md:70 |
| scripts/opentofu | docs/dc-dc-deployment-workflow.md:588 |
| scripts/opnsense-apply-config.sh | docs/changelog-20260713-office1-dhcp-apply.md:86 |
| scripts/opnsense-apply-config.sh | docs/session-ledger.md:1026 |
| scripts/opnsense-build-config-iso.sh | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:117 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-ceph-replication-tooling.md:17 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opentofu-audit.md:105 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opentofu-audit.md:13 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-config-design.md:23 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:25 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:26 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260709-opnsense-edge-module.md:80 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260713-config-xml-danger-sweep.md:36 |
| scripts/opnsense-build-config-iso.sh | docs/changelog-20260713-config-xml-path-deleted.md:31 |
| scripts/opnsense-build-config-iso.sh | docs/dc-dc-deployment-workflow.md:472 |
| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2274 |
| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2330 |
| scripts/opnsense-build-config-iso.sh | docs/design-decisions.md:2387 |
| scripts/opnsense-prep | docs/changelog-20260709-ceph-replication-tooling.md:16 |
| scripts/opnsense-render-config.sh | .claude/skills/openstack-cloud-ops/references/opentofu-provider-docs.md:117 |
| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:11 |
| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:19 |
| scripts/opnsense-render-config.sh | docs/changelog-20260709-opnsense-config-design.md:70 |
| scripts/opnsense-render-config.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:20 |
| scripts/opnsense-render-config.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:38 |
| scripts/opnsense-render-config.sh | docs/changelog-20260713-config-xml-danger-sweep.md:35 |
| scripts/opnsense-render-config.sh | docs/changelog-20260713-config-xml-path-deleted.md:30 |
| scripts/opnsense-render-config.sh | docs/changelog-20260713-office1-dhcp-apply.md:13 |
| scripts/opnsense-render-config.sh | docs/dc-dc-deployment-workflow.md:477 |
| scripts/opnsense-render-config.sh | docs/design-decisions.md:2386 |
| scripts/phase-00 | docs/changelog-20260709-ceph-replication-tooling.md:72 |
| scripts/phase-00-maas-carve.sh | docs/D-058-renumber.md:67 |
| scripts/phase-00-maas-carve.sh | docs/v1-redeploy-changelog.md:817 |
| scripts/phase-00-maas-recidr.sh | docs/design-decisions.md:969 |
| scripts/phase-00-maas-recidr.sh | docs/v1-redeploy-changelog.md:1012 |
| scripts/phase-00-teardown.sh | docs/changelog-20260703-process-hardening.md:172 |
| scripts/phase-00-teardown.sh | docs/design-decisions.md:961 |
| scripts/phase-00-teardown.sh | docs/docfix-draft-20260702.md:24 |
| scripts/provider | docs/dc-dc-deployment-workflow.md:657 |
| scripts/provider-bundle | docs/dc-dc-deployment-workflow.md:534 |
| scripts/provider-vip-standup.sh | docs/D-057-REVIEW-ITEMS.md:52 |
| scripts/provider-vip-standup.sh | docs/D-057-REVIEW-ITEMS.md:9 |
| scripts/provider-vip-standup.sh | docs/D-058-renumber.md:56 |
| scripts/provider-vip-standup.sh | docs/README-D057-PACK.md:23 |
| scripts/provider-vip-standup.sh | docs/README-D057-PACK.md:99 |
| scripts/provider-vip-standup.sh | docs/design-decisions.md:970 |
| scripts/review-bundle.py | docs/D-057-REVIEW-ITEMS.md:18 |
| scripts/review-bundle.py | docs/D-058-renumber.md:69 |
| scripts/review-bundle.py | docs/changelog-20260703-process-hardening.md:171 |
| scripts/review-bundle.py | docs/changelog-20260703-process-hardening.md:50 |
| scripts/review-bundle.py | docs/docfix-draft-20260702.md:76 |
| scripts/runbooks | docs/design-decisions.md:860 |
| scripts/runbooks/skill | docs/changelog-20260709-repo-agnostic-sweep.md:10 |
| scripts/tenant | docs/v1-redeploy-changelog.md:2406 |
| scripts/tenant-cluster-create.sh | docs/session-ledger.md:899 |
| scripts/tenant-cluster-create.sh | docs/v1-redeploy-changelog.md:1449 |
| scripts/x.sh | docs/docfix-draft-20260702.md:72 |
| tests/-fixture | docs/v1-redeploy-changelog.md:2481 |
| tests/carve-host-interfaces/run | docs/changelog-20260709-maas-scripts-dc-param.md:18 |
| tests/dc-dc | docs/changelog-20260709-ceph-replication-tooling.md:129 |
| tests/dc-dc-prefixes | docs/dc-dc-deployment-workflow.md:445 |
| tests/dc-dc-rbd-mirror/run | docs/changelog-20260709-ceph-replication-tooling.md:40 |
| tests/dc-selector/run | docs/changelog-20260709-adversarial-review-fixes.md:88 |
| tests/opnsense-build-config-iso | docs/changelog-20260709-opnsense-edge-module.md:81 |
| tests/opnsense-build-config-iso | docs/changelog-20260713-config-xml-path-deleted.md:31 |
| tests/opnsense-build-config-iso/run-tests.sh | docs/changelog-20260709-opnsense-edge-module.md:26 |
| tests/opnsense-render-config | docs/changelog-20260709-opnsense-config-design.md:71 |
| tests/opnsense-render-config | docs/changelog-20260713-config-xml-path-deleted.md:30 |
| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260709-opnsense-config-design.md:12 |
| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:21 |
| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:26 |
| tests/opnsense-render-config/run-tests.sh | docs/changelog-20260712-opnsense-edge-real-isp-router.md:39 |
| tests/phase-00-carve | docs/v1-redeploy-changelog.md:822 |
| tests/phase-00-carve/run-tests.sh | docs/D-058-renumber.md:75 |
| tests/phase-00-maas-recidr | docs/changelog-20260703-process-hardening.md:246 |
| tests/phase-00-teardown | docs/changelog-20260703-process-hardening.md:243 |
| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:814 |
| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:835 |
| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:838 |
| tests/phase-03-openrc | docs/v1-redeploy-changelog.md:844 |
| tests/provider-vip-standup | docs/README-D057-PACK.md:42 |
| tests/provider-vip-standup | docs/changelog-20260703-process-hardening.md:245 |
| tests/provider-vip-standup/run-tests.sh | docs/README-D057-PACK.md:107 |
| tests/reenroll | docs/changelog-20260709-maas-scripts-dc-param.md:19 |
| tests/tenant | docs/v1-redeploy-changelog.md:2673 |

### Orphan / unregistered number references
| ref | where | why |
|---|---|---|
| BUNDLEFIX-013 | docs/changelog-20260710-vr1-teardown-rollback-runbook.md:96 | referenced nowhere else |
| BUNDLEFIX-051 | docs/repo-lint-nextfree-bug-FINDING.md:20 | referenced nowhere else |
| D-054 | docs/D-057-DECIDED-append.md:9 | not in design-decisions.md |
| D-054 | docs/D-058-renumber.md:5 | not in design-decisions.md |
| D-054 | docs/v1-redeploy-changelog.md:117 | not in design-decisions.md |
| D-054 | docs/v1-redeploy-changelog.md:12 | not in design-decisions.md |
| D-054 | docs/v1-redeploy-changelog.md:42 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:1119 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:1196 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:1213 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:322 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:491 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:500 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:546 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:775 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:791 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:800 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:801 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:864 | not in design-decisions.md |
| D-056 | docs/v1-redeploy-changelog.md:890 | not in design-decisions.md |
| D-056 | runbooks/phase-04-network-carve.md:79 | not in design-decisions.md |
| D-056 | runbooks/phase-06-incloud-mgmt-cluster.md:13 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:126 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:201 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:216 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:41 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:72 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:81 | not in design-decisions.md |
| D-130 | docs/audit/grounding-audit-charter.md:83 | not in design-decisions.md |
| D-130 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:131 | not in design-decisions.md |
| D-130 | docs/finding-20260718-voffice1-cloudinit-seed-replace.md:235 | not in design-decisions.md |
| D-130 | docs/session-ledger.md:255 | not in design-decisions.md |
| D-130 | docs/session-ledger.md:273 | not in design-decisions.md |
| D-130 | docs/session-ledger.md:275 | not in design-decisions.md |
| D-2 | docs/handoff-20260703-open-items.md:123 | referenced nowhere else |
| DOCFIX-017 | runbooks/appendix-A-troubleshooting.md:250 | referenced nowhere else |
| DOCFIX-028 | runbooks/phase-02-vault-bringup.md:160 | referenced nowhere else |
| DOCFIX-029 | runbooks/phase-02-vault-bringup.md:117 | referenced nowhere else |
| DOCFIX-029 | runbooks/phase-02-vault-bringup.md:57 | referenced nowhere else |
| DOCFIX-037 | runbooks/phase-08-workload-cluster-acceptance.md:217 | referenced nowhere else |
| DOCFIX-041 | docs/v1-redeploy-changelog.md:195 | referenced nowhere else |
| DOCFIX-041 | docs/v1-redeploy-changelog.md:323 | referenced nowhere else |
| DOCFIX-043 | docs/v1-redeploy-changelog.md:346 | referenced nowhere else |
| DOCFIX-043 | docs/v1-redeploy-changelog.md:481 | referenced nowhere else |
| DOCFIX-043 | docs/v1-redeploy-changelog.md:493 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:491 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:500 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:502 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:547 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:556 | referenced nowhere else |
| DOCFIX-044 | docs/v1-redeploy-changelog.md:732 | referenced nowhere else |
| DOCFIX-045 | docs/v1-redeploy-changelog.md:546 | referenced nowhere else |
| DOCFIX-045 | docs/v1-redeploy-changelog.md:573 | referenced nowhere else |
| DOCFIX-045 | docs/v1-redeploy-changelog.md:720 | referenced nowhere else |
| DOCFIX-046 | docs/v1-redeploy-changelog.md:1084 | referenced nowhere else |
| DOCFIX-046 | docs/v1-redeploy-changelog.md:608 | referenced nowhere else |
| DOCFIX-046 | docs/v1-redeploy-changelog.md:616 | referenced nowhere else |
| DOCFIX-048 | docs/v1-redeploy-changelog.md:682 | referenced nowhere else |
| DOCFIX-049 | docs/v1-redeploy-changelog.md:697 | referenced nowhere else |
| DOCFIX-049 | docs/v1-redeploy-changelog.md:716 | referenced nowhere else |
| DOCFIX-049 | docs/v1-redeploy-changelog.md:754 | referenced nowhere else |
| DOCFIX-049 | docs/v1-redeploy-changelog.md:757 | referenced nowhere else |
| DOCFIX-050 | docs/v1-redeploy-changelog.md:821 | referenced nowhere else |
| DOCFIX-050 | docs/v1-redeploy-changelog.md:828 | referenced nowhere else |
| DOCFIX-051 | docs/v1-redeploy-changelog.md:831 | referenced nowhere else |
| DOCFIX-052 | docs/v1-redeploy-changelog.md:835 | referenced nowhere else |
| DOCFIX-052 | docs/v1-redeploy-changelog.md:843 | referenced nowhere else |
| DOCFIX-053 | docs/v1-redeploy-changelog.md:873 | referenced nowhere else |
| DOCFIX-056 | docs/v1-redeploy-changelog.md:1023 | referenced nowhere else |
| DOCFIX-058 | docs/v1-redeploy-changelog.md:1083 | referenced nowhere else |
| DOCFIX-079 | docs/changelog-20260703-process-hardening.md:199 | referenced nowhere else |
| DOCFIX-080 | docs/changelog-20260703-process-hardening.md:213 | referenced nowhere else |
| DOCFIX-081 | docs/changelog-20260703-process-hardening.md:222 | referenced nowhere else |
| DOCFIX-090 | docs/v1-redeploy-changelog.md:2040 | referenced nowhere else |
| DOCFIX-092 | docs/v1-redeploy-changelog.md:2093 | referenced nowhere else |
| DOCFIX-092 | docs/v1-redeploy-changelog.md:2095 | referenced nowhere else |
| DOCFIX-092 | docs/v1-redeploy-changelog.md:2116 | referenced nowhere else |
| DOCFIX-103 | docs/v1-redeploy-changelog.md:2392 | referenced nowhere else |
| DOCFIX-108 | docs/v1-redeploy-changelog.md:2497 | referenced nowhere else |
| DOCFIX-108 | docs/v1-redeploy-changelog.md:2499 | referenced nowhere else |
| DOCFIX-108 | docs/v1-redeploy-changelog.md:2506 | referenced nowhere else |
| DOCFIX-108 | docs/v1-redeploy-changelog.md:2544 | referenced nowhere else |
| DOCFIX-109 | docs/v1-redeploy-changelog.md:2499 | referenced nowhere else |
| DOCFIX-109 | docs/v1-redeploy-changelog.md:2525 | referenced nowhere else |
| DOCFIX-109 | docs/v1-redeploy-changelog.md:2546 | referenced nowhere else |
| DOCFIX-109 | docs/v1-redeploy-changelog.md:3168 | referenced nowhere else |
| DOCFIX-110 | docs/v1-redeploy-changelog.md:2555 | referenced nowhere else |
| DOCFIX-110 | docs/v1-redeploy-changelog.md:2557 | referenced nowhere else |
| DOCFIX-110 | docs/v1-redeploy-changelog.md:2559 | referenced nowhere else |
| DOCFIX-117 | docs/v1-redeploy-changelog.md:2670 | referenced nowhere else |
| DOCFIX-119 | docs/v1-redeploy-changelog.md:2814 | referenced nowhere else |
| DOCFIX-119 | docs/v1-redeploy-changelog.md:2816 | referenced nowhere else |
| DOCFIX-119 | docs/v1-redeploy-changelog.md:2831 | referenced nowhere else |
| DOCFIX-119 | docs/v1-redeploy-changelog.md:2859 | referenced nowhere else |
| DOCFIX-124 | docs/v1-redeploy-changelog.md:3031 | referenced nowhere else |
| DOCFIX-124 | docs/v1-redeploy-changelog.md:3071 | referenced nowhere else |
| DOCFIX-125 | docs/v1-redeploy-changelog.md:3074 | referenced nowhere else |
| DOCFIX-125 | docs/v1-redeploy-changelog.md:3078 | referenced nowhere else |
| DOCFIX-125 | docs/v1-redeploy-changelog.md:3093 | referenced nowhere else |
| DOCFIX-127 | docs/v1-redeploy-changelog.md:3096 | referenced nowhere else |
| DOCFIX-127 | docs/v1-redeploy-changelog.md:3113 | referenced nowhere else |
| DOCFIX-127 | docs/v1-redeploy-changelog.md:3129 | referenced nowhere else |
| DOCFIX-128 | docs/v1-redeploy-changelog.md:3132 | referenced nowhere else |
| DOCFIX-128 | docs/v1-redeploy-changelog.md:3157 | referenced nowhere else |
| DOCFIX-129 | docs/v1-redeploy-changelog.md:3160 | referenced nowhere else |
| DOCFIX-129 | docs/v1-redeploy-changelog.md:3193 | referenced nowhere else |
| DOCFIX-129 | docs/v1-redeploy-changelog.md:3345 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3196 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3256 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3339 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3342 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3360 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3362 | referenced nowhere else |
| DOCFIX-130 | docs/v1-redeploy-changelog.md:3385 | referenced nowhere else |
| DOCFIX-131 | docs/v1-redeploy-changelog.md:3259 | referenced nowhere else |
| DOCFIX-131 | docs/v1-redeploy-changelog.md:3284 | referenced nowhere else |
| DOCFIX-132 | docs/v1-redeploy-changelog.md:3287 | referenced nowhere else |
| DOCFIX-132 | docs/v1-redeploy-changelog.md:3297 | referenced nowhere else |
| DOCFIX-133 | docs/v1-redeploy-changelog.md:3300 | referenced nowhere else |
| DOCFIX-133 | docs/v1-redeploy-changelog.md:3316 | referenced nowhere else |
| DOCFIX-133 | docs/v1-redeploy-changelog.md:3427 | referenced nowhere else |
| DOCFIX-134 | docs/v1-redeploy-changelog.md:3319 | referenced nowhere else |
| DOCFIX-134 | docs/v1-redeploy-changelog.md:3331 | referenced nowhere else |
| DOCFIX-134 | docs/v1-redeploy-changelog.md:3437 | referenced nowhere else |
| DOCFIX-136 | docs/v1-redeploy-changelog.md:3360 | referenced nowhere else |
| DOCFIX-136 | docs/v1-redeploy-changelog.md:3387 | referenced nowhere else |
| DOCFIX-136 | docs/v1-redeploy-changelog.md:3393 | referenced nowhere else |
| DOCFIX-143 | docs/changelog-20260709-repo-lint-crlf-fix.md:1 | referenced nowhere else |
| DOCFIX-143 | docs/changelog-20260709-repo-lint-crlf-fix.md:5 | referenced nowhere else |
| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:1 | referenced nowhere else |
| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:25 | referenced nowhere else |
| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:40 | referenced nowhere else |
| DOCFIX-146 | docs/changelog-20260709-opnsense-edge-module.md:9 | referenced nowhere else |
| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:1 | referenced nowhere else |
| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:41 | referenced nowhere else |
| DOCFIX-147 | docs/changelog-20260709-opentofu-maas-netem.md:9 | referenced nowhere else |
| DOCFIX-149 | docs/changelog-20260709-opnsense-config-design.md:1 | referenced nowhere else |
| DOCFIX-149 | docs/changelog-20260709-opnsense-config-design.md:9 | referenced nowhere else |
| DOCFIX-150 | docs/changelog-20260709-stage0-ratification.md:1 | referenced nowhere else |
| DOCFIX-150 | docs/changelog-20260709-stage0-ratification.md:9 | referenced nowhere else |
| DOCFIX-153 | docs/changelog-20260709-dc-dc-phase0-runbook.md:1 | referenced nowhere else |
| DOCFIX-153 | docs/changelog-20260709-dc-dc-phase0-runbook.md:12 | referenced nowhere else |
| DOCFIX-154 | docs/changelog-20260709-dc-dc-phase1-runbook.md:1 | referenced nowhere else |
| DOCFIX-154 | docs/changelog-20260709-dc-dc-phase1-runbook.md:11 | referenced nowhere else |
| DOCFIX-155 | docs/changelog-20260709-dc-dc-phase2-runbook.md:1 | referenced nowhere else |
| DOCFIX-155 | docs/changelog-20260709-dc-dc-phase2-runbook.md:12 | referenced nowhere else |
| DOCFIX-156 | docs/changelog-20260709-dc-dc-phase4-runbook.md:1 | referenced nowhere else |
| DOCFIX-156 | docs/changelog-20260709-dc-dc-phase4-runbook.md:11 | referenced nowhere else |
| DOCFIX-157 | docs/changelog-20260709-dc-dc-phase3-runbook.md:1 | referenced nowhere else |
| DOCFIX-157 | docs/changelog-20260709-dc-dc-phase3-runbook.md:11 | referenced nowhere else |
| DOCFIX-158 | docs/changelog-20260709-dc-dc-phase5-runbook.md:1 | referenced nowhere else |
| DOCFIX-158 | docs/changelog-20260709-dc-dc-phase5-runbook.md:11 | referenced nowhere else |
| DOCFIX-159 | docs/changelog-20260709-dc-dc-phase6-runbook.md:1 | referenced nowhere else |
| DOCFIX-159 | docs/changelog-20260709-dc-dc-phase6-runbook.md:11 | referenced nowhere else |
| DOCFIX-161 | docs/changelog-20260709-final-consolidation.md:1 | referenced nowhere else |
| DOCFIX-161 | docs/changelog-20260709-final-consolidation.md:71 | referenced nowhere else |
| DOCFIX-177 | docs/changelog-20260710-skill-vr1-awareness.md:1 | referenced nowhere else |
| GA-F01 | docs/audit/grounding-audit-charter.md:199 | referenced nowhere else |
| GA-R1 | docs/audit/grounding-audit-charter.md:165 | referenced nowhere else |
| GA-R3 | docs/audit/grounding-audit-charter.md:175 | referenced nowhere else |
| GA-R3 | docs/audit/grounding-audit-charter.md:68 | referenced nowhere else |
| GA-R4 | docs/audit/grounding-audit-charter.md:182 | referenced nowhere else |
| GA-R5 | docs/audit/grounding-audit-charter.md:186 | referenced nowhere else |
| GA-R5 | docs/audit/grounding-audit-charter.md:68 | referenced nowhere else |
| R3-F05 | docs/stage3-adversarial-review-20260716.md:170 | referenced nowhere else |
| R3-F05 | docs/stage3-adversarial-review-20260716.md:306 | referenced nowhere else |
| R3-F07 | docs/stage3-adversarial-review-20260716.md:193 | referenced nowhere else |
| R3-F11 | docs/stage3-adversarial-review-20260716.md:230 | referenced nowhere else |
| R3-F11 | docs/stage3-adversarial-review-20260716.md:317 | referenced nowhere else |
| R3-F13 | docs/stage3-adversarial-review-20260716.md:246 | referenced nowhere else |

### Unknown commit hashes
| hash | where |
|---|---|
| 01ac01a | docs/stage3-review-base.patch:3005 |
| 04d3175865f4 | memory/creds-folder-convention.md:7 |
| 04d3175865f4 | memory/project-posture-closed-test.md:7 |
| 070de108 | docs/v1-redeploy-changelog.md:1142 |
| 070de108 | runbooks/phase-05-octavia-enablement.md:208 |
| 0885dca3 | docs/v1-redeploy-changelog.md:1230 |
| 09199e8 | docs/stage3-review-base.patch:3256 |
| 097e972 | docs/stage3-review-base.patch:1502 |
| 0d00ddc1 | runbooks/phase-06-incloud-mgmt-cluster.md:42 |
| 0d00ddc1 | runbooks/phase-08-workload-cluster-acceptance.md:47 |
| 0dc65fb | docs/stage3-review-base.patch:2874 |
| 0f968008 | runbooks/ops-capi-recovery.md:19 |
| 0f968008 | runbooks/phase-08-workload-cluster-acceptance.md:366 |
| 14c07d77f167 | runbooks/phase-06-incloud-mgmt-cluster.md:42 |
| 14c07d77f167 | runbooks/phase-08-workload-cluster-acceptance.md:47 |
| 15a14c5a | runbooks/phase-05-octavia-enablement.md:208 |
| 193a8915 | runbooks/tenant-onboarding-v2-DRAFT.md:98 |
| 1dedb917e5ea | docs/changelog-20260709-final-consolidation.md:43 |
| 1f260c0 | docs/stage3-review-base.patch:1561 |
| 25e0aa3 | docs/stage3-review-base.patch:1624 |
| 25e6971 | docs/stage3-review-base.patch:316 |
| 26ed1091 | docs/v1-redeploy-changelog.md:1235 |
| 26ed1091 | runbooks/phase-07-conductor-graft.md:487 |
| 2b8e36983072 | docs/v1-redeploy-changelog.md:665 |
| 2cc95d507e2a | memory/review-after-each-step.md:7 |
| 36582e857d7c | runbooks/phase-04-network-carve.md:171 |
| 4262fb9 | docs/stage3-review-base.patch:1658 |
| 438e59088c6c | docs/changelog-20260713-opnsense-api-write-proven.md:9 |
| 452e126982cf | runbooks/phase-08-workload-cluster-acceptance.md:366 |
| 4586faa7 | docs/v1-redeploy-changelog.md:957 |
| 46e7dd7 | docs/stage3-review-base.patch:2666 |
| 48eb444 | docs/stage3-review-base.patch:1306 |
| 4aa5c18 | docs/stage3-review-base.patch:3756 |
| 544afa6a | docs/v1-redeploy-changelog.md:665 |
| 550f5c691bfb | docs/v1-redeploy-changelog.md:664 |
| 550f5c691bfb | docs/v1-redeploy-changelog.md:860 |
| 581022d | docs/stage3-review-base.patch:652 |
| 5fa5b05e | docs/v1-redeploy-changelog.md:885 |
| 627e3f12 | docs/changelog-20260714-office1-lan-ipv6-executed.md:107 |
| 62f7c00 | runbooks/appendix-B-asbuilt-version-lock.md:97 |
| 62f7c00 | runbooks/phase-06-incloud-mgmt-cluster.md:571 |
| 674171fd | runbooks/ops-capi-recovery.md:19 |
| 6de15cf4 | runbooks/phase-08-workload-cluster-acceptance.md:364 |
| 6ed034f7 | docs/v1-redeploy-changelog.md:749 |
| 6f7848c | docs/design-decisions.md:1422 |
| 6f7848c | docs/v1-redeploy-changelog.md:1371 |
| 7072d66e | docs/v1-redeploy-changelog.md:914 |
| 70b34bb2 | runbooks/phase-04-network-carve.md:171 |
| 75c0e0cb | memory/creds-folder-convention.md:7 |
| 75c0e0cb | memory/project-posture-closed-test.md:7 |
| 760bdb3 | docs/design-decisions.md:722 |
| 76aea330 | docs/v1-redeploy-changelog.md:1461 |
| 7efde485 | docs/design-decisions.md:722 |
| 807e3f5b | docs/v1-redeploy-changelog.md:1143 |
| 807e3f5b | runbooks/phase-05-octavia-enablement.md:210 |
| 839ad1a8 | memory/review-after-each-step.md:7 |
| 8592ee35 | docs/v1-redeploy-changelog.md:1463 |
| 8592ee35 | docs/v1-redeploy-changelog.md:1513 |
| 872a43d1 | runbooks/phase-02-vault-bringup.md:173 |
| 899b4b5c | runbooks/phase-05-octavia-enablement.md:213 |
| 899b4b5c | runbooks/phase-06-incloud-mgmt-cluster.md:43 |
| 89e36ff79901 | docs/v1-redeploy-changelog.md:749 |
| 8a11535 | docs/stage3-review-base.patch:1571 |
| 8b7c3c0 | docs/stage3-review-base.patch:1519 |
| 8de2c48d92cf | runbooks/phase-08-workload-cluster-acceptance.md:364 |
| 8ec679e | docs/stage3-review-base.patch:3406 |
| 8f7329f | docs/stage3-review-base.patch:652 |
| 9005515f23a8 | runbooks/phase-04-network-carve.md:173 |
| 91f8bcc | docs/stage3-review-base.patch:1502 |
| 948e7ee | docs/stage3-review-base.patch:316 |
| 979503c | docs/stage3-review-base.patch:2666 |
| 9a08253 | docs/stage3-review-base.patch:3 |
| 9e141708dd6f | docs/v1-redeploy-changelog.md:752 |
| a08a471 | docs/stage3-review-base.patch:344 |
| a11cf69 | docs/v1-redeploy-changelog.md:912 |
| a275f2a0a6fc | docs/changelog-20260714-office1-lan-ipv6-executed.md:107 |
| a360df32 | docs/v1-redeploy-changelog.md:1407 |
| a360df32 | docs/v1-redeploy-changelog.md:1409 |
| a4e1a7fa | docs/v1-redeploy-changelog.md:1095 |
| a4e1a7fa | runbooks/phase-04-network-carve.md:171 |
| a57aa64 | docs/stage3-review-base.patch:1846 |
| a5aa1e1 | docs/stage3-review-base.patch:2923 |
| a9210d0eefe8 | runbooks/phase-06-incloud-mgmt-cluster.md:43 |
| ae90b82f | docs/v1-redeploy-changelog.md:3024 |
| b0d41d1 | docs/stage3-review-base.patch:1001 |
| b4d6c72e8fe9 | memory/multi-workstation-remote-control.md:7 |
| b87023b | docs/stage3-review-base.patch:665 |
| bb386c86 | docs/v1-redeploy-changelog.md:664 |
| bb386c86 | docs/v1-redeploy-changelog.md:860 |
| c53184b | docs/stage3-review-base.patch:665 |
| c8f9f53a | docs/v1-redeploy-changelog.md:752 |
| c954a6a | docs/stage3-review-base.patch:3756 |
| ca5552a5 | runbooks/phase-05-octavia-enablement.md:211 |
| d527847 | runbooks/appendix-B-asbuilt-version-lock.md:98 |
| d527847 | runbooks/phase-06-incloud-mgmt-cluster.md:571 |
| d878c13 | docs/stage3-review-base.patch:219 |
| d8c4033 | docs/stage3-review-base.patch:811 |
| d8ca624 | docs/stage3-review-base.patch:3307 |
| d9d0a4a8 | docs/v1-redeploy-changelog.md:1229 |
| da0d7b8c89b2 | docs/v1-redeploy-changelog.md:2716 |
| da757cb1 | runbooks/phase-05-octavia-enablement.md:208 |
| df0c9a6 | docs/stage3-review-base.patch:125 |
| e3afcbae | runbooks/phase-04-network-carve.md:173 |
| e4bb2db | docs/stage3-review-base.patch:344 |
| e5fa05aa | memory/multi-workstation-remote-control.md:7 |
| e752f6dd | docs/changelog-20260709-final-consolidation.md:43 |
| ed25519 | docs/design-decisions.md:2227 |
| ed25519 | docs/design-decisions.md:2264 |
| ed25519 | docs/session-ledger.md:814 |
| f50888b | docs/stage3-review-base.patch:1608 |
| f66e5bc5 | docs/v1-redeploy-changelog.md:1096 |
| f66e5bc5 | runbooks/phase-04-network-carve.md:173 |
| f75981d | docs/stage3-review-base.patch:1306 |
| fa61feb | docs/stage3-review-base.patch:1846 |
| fae7ec70 | docs/v1-redeploy-changelog.md:2716 |

### file:line references out of range or absent
| ref | line | where | why |
|---|---|---|---|