addendum 41: DOCFIX-123 -- new end-to-end Jenkins+Kubernetes guide (single-flow HUB, Pattern A deploy-into-cluster + Pattern B build-agents); flannel-driver hole closed in tenant-skill kubernetes.md; guide leakage-scanned (LEAK_FILES) + README/receipt updated; devteam package instantiated; gauntlet 38/38 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 40: devteam cluster NoValidHost diagnosed (RAM capacity, not quota; operator deleted, 1+1 re-created) + decommission audit -- queued rulings: beta-cluster teardown (cross-stream), lbtest LB reclaim, foil1 offboard (recommended), quota-vs-capacity expectation ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 39: devteam cluster-template 403 diagnosed (Public/Hidden flag -> clustertemplate:publish admin_api, BY DESIGN, no cloud change) -- DOCFIX-121 clientdocs template-creation guidance + DOCFIX-122 appendix-A symptom entry; L7 receipt re-recorded; ~/devteam-package re-rendered; stage5-for-devteam option logged (unruled) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 38: Horizon 3-account walkthrough -- all contract-correct, object storage first live proof; DOCFIX-119 clientdocs GUI-reality alignment (receipt re-recorded) + DOCFIX-120 contract 5.1/5.3 live verdicts; dashboard policy override first apply FAILED acceptance + REVERTED (rework in flight) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 37: D-075 ADOPTED+EXECUTED -- dashboard VIP root redirect(/->302 /horizon)+no-autoindex via conf-enabled override (RedirectMatch backend-port leak caught in verify, replaced with per-dir rewrite); DOCFIX-118 phase-03 PER-REBUILD block + appendix-A "Index of /" entry ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 36: devteam package dashboard URL corrected to /horizon (webroot measured); tenant-facing VIP root autoindex FINDING logged, options presented (unruled) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 35: devteam intake collected + quota applied + FIRST clientdocs pack instantiation (17 files -> ~/devteam-package, tokens verified zero); CA copy + delivery staged to operator; day2-operations {{THIS}}-prose DOCFIX candidate logged ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 34: devteam onboarding window EXECUTED -- stages 0-4 + tenant-assert 15/15 + canary ALL first-try on 10.100.0.0/24 (D-074 fallback, first client-facing run); pack instantiation held on intake; capi-test-1 delete staged to operator ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 33: script-quality fix batch DOCFIX-112..117 -- anti-escalation guard fail-closed (SECURITY), tenant-offboard hardening cluster, validate/juju-spaces fail-opens, pipefail sweep, guard-hook extension; deferred-findings register; ledger REMAINING-OPEN-WORK block ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 32: DOCFIX-111 lint excludes .claude/ session worktrees; orphan-sweep first live audit (0 orphans, 3 protected, verify-live OK-paths cleared) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 31: DOCFIX-110 clientdocs pre-handover polish + RELEASED banner ruling (package handover-ready) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 30: client handover package complete -- DOCFIX-108 starter kit + DOCFIX-109 tenant AI skill (union-merged, deduped), L7 coverage recursive, receipt 29 files, gauntlet 37/37 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 29: D-074 ADOPTED+EXECUTED -- overlap-allowed tenant CIDRs (Phase 0 gates proven live: exact-overlap subnet + Magnum cluster via API-LB), stage-4 guard rewritten with real overlap math (DOCFIX-106), repo_lint L5 numbering print removed (DOCFIX-107), D-016 amended, contract/runbook/intake aligned ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

Create repo-lint-nextfree-bug-FINDING.md

Create tenant-cidr-overlap-correction-PLAN.md

session-ledger: devteam gate satisfied (snapshot + controller backup); onboarding deferred to next session ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

asbuilt/20260706-224851: pre-devteam baseline WITH controller backup (first live --with-controller-backup run; 1.1GB archive jumphost-local; supersedes 224606 as the devteam gate anchor) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

as-executed index: ops-snapshot-devteam-gate entry ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

asbuilt/20260706-224606: pre-devteam-onboarding cloud snapshot (D-070 baseline; first live DOCFIX-102 run; 12 redactions verified) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 28: operator-away batch integrated -- DOCFIX-098..105 (H4 drift detector, offboard orphan sweep + E0 guard, handover pack, cloud-snapshot, tenant-acceptance harness, lint L7 sweep rule, ledger-scan 099-boundary fix) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 27: d011-batch3 window EXECUTED -- D-073 APPLIED, foil1 onboarded, d011-04/05 PASS, D-011 closed-except-item-6; DOCFIX-095/096/097 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 26: DOCFIX-094 stderr-separation fixes (cloud-assert fail-open closed) + vault snap-track measurements + juju auth-expiry blocker ...

Gauntlet ALL GREEN (32 harnesses; cloud-assert 12/12 incl. new fail-open
proof cases). Read-only vault measurements landed before the juju macaroon
expired; operator needs interactive 'juju login' for the remaining reads.

Revert: per addendum-26 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 25: DOCFIX-093 batch-3 window do-doc + OpenBao research draft + H5 embed + stderr-sweep inventory ...

Operator-away autonomous batch complete (addenda 23-25). Repo-side queue
empty except H4 (main-chat backlog coordination) ; all remaining work is
the operator-present live window per the new do-doc.

Revert: per addendum-25 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 24: D-073 implementation staged -- identity:list_trusts hardening (38->39 rules), zip rebuilt, drift check PASS ...

Live apply remains GATED (attach-resource block in the D-073 amendment;
behavioral verify at the batch-3 window). Gauntlet ALL GREEN, lint 0 fail.

Revert: per addendum-24 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 23: H2 stage-3 re-run guards + H3 canary stage7 (tenant-onboard.sh), harness 2->12 cases ...

Gauntlet ALL GREEN. No cloud state touched; stage7 is explicit-only and
self-cleaning, VERIFY-LIVE flags in header for ssh user + flavor.

Revert: per addendum-23 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 22: H1 tenant-assert.sh + harness (7/7 green), clientdocs/ package (DOCFIX-092), A2 + structure + sequencing rulings recorded ...

Gauntlet ALL GREEN (32 harnesses incl. new tenant-assert). repo-lint 0 fail.
No cloud state touched; tenant-assert is read-only by design and its two
admin-listing calls are VERIFY-LIVE flagged for the foil onboarding run.

Revert: per addendum-22 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

handoff section 6 + ledger: onboarding completion package adopted as pre-v1-close tasks (A1.3/A1.4 rulings) ...

H1-H5 + Horizon GUI probe + client-facing draft package + live end-to-end
validation added to the v1-close checklist. Tracking-register update only;
no scripts changed, no cloud state touched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 21: DOCFIX-091 tenant onboarding contract (A1 rulings) ...

New docs/tenant-onboarding-contract.md: operator/tenant boundary + rationale,
explicit role table (manager persona, never admin), tenant intake list,
stage dangers, onboarding confirmation set, hardening register H1-H5
(proposals logged, none implemented). v2-DRAFT banner defers to it.

Revert: per addendum-21 REVERT line (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 20: operator ruling sweep -- D-050 closed via D-051, D-073 adopted (list_trusts hardening, impl pending), SEC re-triggers, D-072 upstream bug withdrawn ...

Also fixes a self-inflicted scan poisoning: the 2026-07-05 ledger finding note
quoted high-numbered decoy identifiers literally, inflating ledger-scan's
DOCFIX/BUNDLEFIX next-free; tokens de-fanged + standing rule recorded. D-050
block Status line made scan-closable (D-063 precedent, keywords avoided).

Scan verified post-change: open = D-068, D-071; next-free D-074/DOCFIX-091/
BUNDLEFIX-012; fences 4/0/0; files ASCII.

Revert: git revert this commit (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

session-ledger: 2026-07-05 resume reconcile (jumphost lane) ...

- machine-derived block re-seeded from today's ledger-scan (DOCFIX next-free
  090 -> 091 was stale; now D-073 / DOCFIX-091 / BUNDLEFIX-012, all sources agree)
- shared section: appended stale-facts correction per handoff reconcile item
  (ops-update-20260705 CLOSED; D-068 1.16 ruled out, off-EOL remains OPEN)
- jumphost section: post-window resume note + repo-lint L5 next-free inflation
  finding logged (DOCFIX candidate, no number consumed)

Revert: git revert this commit (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>