addendum 33: script-quality fix batch DOCFIX-112..117 -- anti-escalation guard fail-closed (SECURITY), tenant-offboard hardening cluster, validate/juju-spaces fail-opens, pipefail sweep, guard-hook extension; deferred-findings register; ledger REMAINING-OPEN-WORK block ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 29: D-074 ADOPTED+EXECUTED -- overlap-allowed tenant CIDRs (Phase 0 gates proven live: exact-overlap subnet + Magnum cluster via API-LB), stage-4 guard rewritten with real overlap math (DOCFIX-106), repo_lint L5 numbering print removed (DOCFIX-107), D-016 amended, contract/runbook/intake aligned ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 26: DOCFIX-094 stderr-separation fixes (cloud-assert fail-open closed) + vault snap-track measurements + juju auth-expiry blocker ...

Gauntlet ALL GREEN (32 harnesses; cloud-assert 12/12 incl. new fail-open
proof cases). Read-only vault measurements landed before the juju macaroon
expired; operator needs interactive 'juju login' for the remaining reads.

Revert: per addendum-26 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 23: H2 stage-3 re-run guards + H3 canary stage7 (tenant-onboard.sh), harness 2->12 cases ...

Gauntlet ALL GREEN. No cloud state touched; stage7 is explicit-only and
self-cleaning, VERIFY-LIVE flags in header for ssh user + flavor.

Revert: per addendum-23 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Patches

Documentation deployment

Barbican-Vault fixes

Tenant file updates