session-ledger: jumphost stream checkpoint (ops-update-20260705 at Section 2 entry) ...

Cross-stream sync checkpoint per operator instruction: Active window section
added for the in-flight update window (S1 done, backup taken, S2.2 next,
4 findings logged for close-out). No identifiers consumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-20260705: pre-change BOM (cloud-assert PASS) + session index row ...

Pre-change baseline for the first ops-update-procedure execution:
asbuilt/20260705-102951 captured on a full CLOUD-ASSERT: PASS (post
DOCFIX-087 A7 fix). Controller 3.6.24, all 91 agents 3.6.24, worklist
17 apps (magnum excluded: name-mismatch gate + Charmhub s390x-only
channel state; vault excluded: D-068). No new identifiers consumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

cloud-assert A7: read PO: marker from status JSON (DOCFIX-087) ...

Identifier consumed: DOCFIX-087. juju 3.6 --format=line omits workload
messages, so A7's line-format grep false-FAILed a healthy policy override
(found live at ops-update-20260705 pre-flight; window HELD on operator
Option B ruling until this true-PASS fix landed). A7 now greps the
application-status message + all unit workload messages from --format=json;
fail-closed on parse failure. Harness: truthful JSON fixtures replace the
line-format fiction; new T10 regression case; 10/10, gauntlet 31/31.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

Delete openstack-cloud-ops.skill

Merge branch 'main' of https://git.baldurkeep.com/git/OpenStack/openstack-caracal-ipv4

claude skill update

ops-update-procedure runbook + D-071 update policy (jumphost stream) ...

Identifiers consumed by this push: D-071, DOCFIX-086. No BUNDLEFIX consumed
(BUNDLEFIX-010 remains next-free; see addendum-11 FINDING 2 on the scan's
wrapped-pointer over-report).

- NEW runbooks/ops-update-procedure.md (DOCFIX-086): routine update window,
  gated: controller patch -> model agents -> in-channel charm refreshes.
  Vault explicitly excluded (D-068 unruled). Not yet as-executed.
- docs/design-decisions.md: D-071 PROPOSED (update cadence + controller
  patch policy, explicit no-backup single-controller risk section).
- runbooks/README.md: index ops-update-procedure + missing ops-restart entry.
- docs/v1-redeploy-changelog.md: addendum 11 (what/why/revert + 2 findings).
- docs/session-ledger.md: numbering re-seeded (D=072, DOCFIX=087,
  BUNDLEFIX=010); D-071 contention resolved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

script patch

patches

test scripts

test patches

doc patch

test patched

Doc patch

doc patch

Patch

Create handoff-20260703-open-items.md

Test patches

Tenant patch

Claude patch

Claude code patch

Test patches

Skill update

Create openstack-cloud-ops.skill

Patches

Merge branch 'main' of https://git.baldurkeep.com/git/OpenStack/openstack-caracal-ipv4

Create appendix-D-magnum-trust-model.md

Create tenant-acceptance.sh

Documentation deployment

Barbican-Vault fixes