addendum 27: d011-batch3 window EXECUTED -- D-073 APPLIED, foil1 onboarded, d011-04/05 PASS, D-011 closed-except-item-6; DOCFIX-095/096/097 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 26: DOCFIX-094 stderr-separation fixes (cloud-assert fail-open closed) + vault snap-track measurements + juju auth-expiry blocker ...

Gauntlet ALL GREEN (32 harnesses; cloud-assert 12/12 incl. new fail-open
proof cases). Read-only vault measurements landed before the juju macaroon
expired; operator needs interactive 'juju login' for the remaining reads.

Revert: per addendum-26 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 23: H2 stage-3 re-run guards + H3 canary stage7 (tenant-onboard.sh), harness 2->12 cases ...

Gauntlet ALL GREEN. No cloud state touched; stage7 is explicit-only and
self-cleaning, VERIFY-LIVE flags in header for ssh user + flavor.

Revert: per addendum-23 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 22: H1 tenant-assert.sh + harness (7/7 green), clientdocs/ package (DOCFIX-092), A2 + structure + sequencing rulings recorded ...

Gauntlet ALL GREEN (32 harnesses incl. new tenant-assert). repo-lint 0 fail.
No cloud state touched; tenant-assert is read-only by design and its two
admin-listing calls are VERIFY-LIVE flagged for the foil onboarding run.

Revert: per addendum-22 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clearing queue

cloud-assert A7: read PO: marker from status JSON (DOCFIX-087) ...

Identifier consumed: DOCFIX-087. juju 3.6 --format=line omits workload
messages, so A7's line-format grep false-FAILed a healthy policy override
(found live at ops-update-20260705 pre-flight; window HELD on operator
Option B ruling until this true-PASS fix landed). A7 now greps the
application-status message + all unit workload messages from --format=json;
fail-closed on parse failure. Harness: truthful JSON fixtures replace the
line-format fiction; new T10 regression case; 10/10, gauntlet 31/31.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

claude skill update

script patch

patches

test scripts

test patches

test patched

Doc patch

Patch

Tenant patch

Test patches

Patches

Create tenant-acceptance.sh

Documentation deployment

Barbican-Vault fixes

Tenant file updates

Phase 7 updates

Script and file updates

Phase end updates

Phase handoff updates

CARVEFIX-001: restore provider-VLAN placement in build_ovs_brex ...

Move enp1s0 onto the provider VLAN before creating br-ex so the bridge inherits it and the host static lands on provider-public; the D-060 Pattern B->A conversion dropped this. Mirrors carve_raw vlan-first.

MAAS scripts

D-060: revert to Pattern A; supersede D-057/D-058 ...

Revert provider NIC to Pattern A (MAAS-built OVS br-ex) on the existing D-052/D-053 scheme. bundle.yaml clean bf7de5a checkout (provider-public x11, VIP triple .4/.8/.12, all 4 br-ex MACs); lib-net.sh + carve back to D-052/D-053; NEW provider-bundle-check.py gate; standup retargeted; teardown.sh + teardown runbook updated. Retire: phase-00-maas-recidr.sh, provider-vip-standup.sh, d057-bundle-check.py, and the 3 provider-vip/reconfigure runbooks.

Teardown scripts

Phase 0 upddates