addendum 37: D-075 ADOPTED+EXECUTED -- dashboard VIP root redirect(/->302 /horizon)+no-autoindex via conf-enabled override (RedirectMatch backend-port leak caught in verify, replaced with per-dir rewrite); DOCFIX-118 phase-03 PER-REBUILD block + appendix-A "Index of /" entry ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 36: devteam package dashboard URL corrected to /horizon (webroot measured); tenant-facing VIP root autoindex FINDING logged, options presented (unruled) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 35: devteam intake collected + quota applied + FIRST clientdocs pack instantiation (17 files -> ~/devteam-package, tokens verified zero); CA copy + delivery staged to operator; day2-operations {{THIS}}-prose DOCFIX candidate logged ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 34: devteam onboarding window EXECUTED -- stages 0-4 + tenant-assert 15/15 + canary ALL first-try on 10.100.0.0/24 (D-074 fallback, first client-facing run); pack instantiation held on intake; capi-test-1 delete staged to operator ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 33: script-quality fix batch DOCFIX-112..117 -- anti-escalation guard fail-closed (SECURITY), tenant-offboard hardening cluster, validate/juju-spaces fail-opens, pipefail sweep, guard-hook extension; deferred-findings register; ledger REMAINING-OPEN-WORK block ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 32: DOCFIX-111 lint excludes .claude/ session worktrees; orphan-sweep first live audit (0 orphans, 3 protected, verify-live OK-paths cleared) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 31: DOCFIX-110 clientdocs pre-handover polish + RELEASED banner ruling (package handover-ready) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 30: client handover package complete -- DOCFIX-108 starter kit + DOCFIX-109 tenant AI skill (union-merged, deduped), L7 coverage recursive, receipt 29 files, gauntlet 37/37 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 29: D-074 ADOPTED+EXECUTED -- overlap-allowed tenant CIDRs (Phase 0 gates proven live: exact-overlap subnet + Magnum cluster via API-LB), stage-4 guard rewritten with real overlap math (DOCFIX-106), repo_lint L5 numbering print removed (DOCFIX-107), D-016 amended, contract/runbook/intake aligned ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

Create repo-lint-nextfree-bug-FINDING.md

Create tenant-cidr-overlap-correction-PLAN.md

session-ledger: devteam gate satisfied (snapshot + controller backup); onboarding deferred to next session ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

asbuilt/20260706-224851: pre-devteam baseline WITH controller backup (first live --with-controller-backup run; 1.1GB archive jumphost-local; supersedes 224606 as the devteam gate anchor) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

as-executed index: ops-snapshot-devteam-gate entry ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

asbuilt/20260706-224606: pre-devteam-onboarding cloud snapshot (D-070 baseline; first live DOCFIX-102 run; 12 redactions verified) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 28: operator-away batch integrated -- DOCFIX-098..105 (H4 drift detector, offboard orphan sweep + E0 guard, handover pack, cloud-snapshot, tenant-acceptance harness, lint L7 sweep rule, ledger-scan 099-boundary fix) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 27: d011-batch3 window EXECUTED -- D-073 APPLIED, foil1 onboarded, d011-04/05 PASS, D-011 closed-except-item-6; DOCFIX-095/096/097 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 26: DOCFIX-094 stderr-separation fixes (cloud-assert fail-open closed) + vault snap-track measurements + juju auth-expiry blocker ...

Gauntlet ALL GREEN (32 harnesses; cloud-assert 12/12 incl. new fail-open
proof cases). Read-only vault measurements landed before the juju macaroon
expired; operator needs interactive 'juju login' for the remaining reads.

Revert: per addendum-26 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 25: DOCFIX-093 batch-3 window do-doc + OpenBao research draft + H5 embed + stderr-sweep inventory ...

Operator-away autonomous batch complete (addenda 23-25). Repo-side queue
empty except H4 (main-chat backlog coordination) ; all remaining work is
the operator-present live window per the new do-doc.

Revert: per addendum-25 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 24: D-073 implementation staged -- identity:list_trusts hardening (38->39 rules), zip rebuilt, drift check PASS ...

Live apply remains GATED (attach-resource block in the D-073 amendment;
behavioral verify at the batch-3 window). Gauntlet ALL GREEN, lint 0 fail.

Revert: per addendum-24 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 23: H2 stage-3 re-run guards + H3 canary stage7 (tenant-onboard.sh), harness 2->12 cases ...

Gauntlet ALL GREEN. No cloud state touched; stage7 is explicit-only and
self-cleaning, VERIFY-LIVE flags in header for ssh user + flavor.

Revert: per addendum-23 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 22: H1 tenant-assert.sh + harness (7/7 green), clientdocs/ package (DOCFIX-092), A2 + structure + sequencing rulings recorded ...

Gauntlet ALL GREEN (32 harnesses incl. new tenant-assert). repo-lint 0 fail.
No cloud state touched; tenant-assert is read-only by design and its two
admin-listing calls are VERIFY-LIVE flagged for the foil onboarding run.

Revert: per addendum-22 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

handoff section 6 + ledger: onboarding completion package adopted as pre-v1-close tasks (A1.3/A1.4 rulings) ...

H1-H5 + Horizon GUI probe + client-facing draft package + live end-to-end
validation added to the v1-close checklist. Tracking-register update only;
no scripts changed, no cloud state touched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 21: DOCFIX-091 tenant onboarding contract (A1 rulings) ...

New docs/tenant-onboarding-contract.md: operator/tenant boundary + rationale,
explicit role table (manager persona, never admin), tenant intake list,
stage dangers, onboarding confirmation set, hardening register H1-H5
(proposals logged, none implemented). v2-DRAFT banner defers to it.

Revert: per addendum-21 REVERT line (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 20: operator ruling sweep -- D-050 closed via D-051, D-073 adopted (list_trusts hardening, impl pending), SEC re-triggers, D-072 upstream bug withdrawn ...

Also fixes a self-inflicted scan poisoning: the 2026-07-05 ledger finding note
quoted high-numbered decoy identifiers literally, inflating ledger-scan's
DOCFIX/BUNDLEFIX next-free; tokens de-fanged + standing rule recorded. D-050
block Status line made scan-closable (D-063 precedent, keywords avoided).

Scan verified post-change: open = D-068, D-071; next-free D-074/DOCFIX-091/
BUNDLEFIX-012; fences 4/0/0; files ASCII.

Revert: git revert this commit (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

session-ledger: 2026-07-05 resume reconcile (jumphost lane) ...

- machine-derived block re-seeded from today's ledger-scan (DOCFIX next-free
  090 -> 091 was stale; now D-073 / DOCFIX-091 / BUNDLEFIX-012, all sources agree)
- shared section: appended stale-facts correction per handoff reconcile item
  (ops-update-20260705 CLOSED; D-068 1.16 ruled out, off-EOL remains OPEN)
- jumphost section: post-window resume note + repo-lint L5 next-free inflation
  finding logged (DOCFIX candidate, no number consumed)

Revert: git revert this commit (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Create handoff-20260705-open-items.md

clearing queue

D-072 dashboard TLS repair (executed) + DOCFIX-089 fail-closed check + BUNDLEFIX-011 ...

Identifiers consumed: D-072, DOCFIX-089, BUNDLEFIX-011.

Since-deploy dashboard VIP TLS defect fixed: cluster binding -> metal-admin
(live bind + durable bundle edit); https 200 CA-verified on both reachable
VIPs, all gates green, post-fix BOM committed. phase-03 3.3 rewritten
fail-closed; appendix-A symptom entry added; Launchpad bug draft ready for
operator submission.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

follow-on refreshes: magnum 96 + vault 714 (diff-verified); fleet fully current ...

No identifiers consumed. Vault refresh = operator-ruled Section 0 exception
(keys on hand, seal-detect gates, never sealed; still reactive/V0 per diff
-- D-068 fence intact). Appendix-B re-baselined from asbuilt/20260705-201118;
zero residual can-upgrade-to. Addendum 17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz