addendum 28: operator-away batch integrated -- DOCFIX-098..105 (H4 drift detector, offboard orphan sweep + E0 guard, handover pack, cloud-snapshot, tenant-acceptance harness, lint L7 sweep rule, ledger-scan 099-boundary fix) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 27: d011-batch3 window EXECUTED -- D-073 APPLIED, foil1 onboarded, d011-04/05 PASS, D-011 closed-except-item-6; DOCFIX-095/096/097 ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

addendum 26: DOCFIX-094 stderr-separation fixes (cloud-assert fail-open closed) + vault snap-track measurements + juju auth-expiry blocker ...

Gauntlet ALL GREEN (32 harnesses; cloud-assert 12/12 incl. new fail-open
proof cases). Read-only vault measurements landed before the juju macaroon
expired; operator needs interactive 'juju login' for the remaining reads.

Revert: per addendum-26 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 25: DOCFIX-093 batch-3 window do-doc + OpenBao research draft + H5 embed + stderr-sweep inventory ...

Operator-away autonomous batch complete (addenda 23-25). Repo-side queue
empty except H4 (main-chat backlog coordination) ; all remaining work is
the operator-present live window per the new do-doc.

Revert: per addendum-25 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 24: D-073 implementation staged -- identity:list_trusts hardening (38->39 rules), zip rebuilt, drift check PASS ...

Live apply remains GATED (attach-resource block in the D-073 amendment;
behavioral verify at the batch-3 window). Gauntlet ALL GREEN, lint 0 fail.

Revert: per addendum-24 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 23: H2 stage-3 re-run guards + H3 canary stage7 (tenant-onboard.sh), harness 2->12 cases ...

Gauntlet ALL GREEN. No cloud state touched; stage7 is explicit-only and
self-cleaning, VERIFY-LIVE flags in header for ssh user + flavor.

Revert: per addendum-23 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 22: H1 tenant-assert.sh + harness (7/7 green), clientdocs/ package (DOCFIX-092), A2 + structure + sequencing rulings recorded ...

Gauntlet ALL GREEN (32 harnesses incl. new tenant-assert). repo-lint 0 fail.
No cloud state touched; tenant-assert is read-only by design and its two
admin-listing calls are VERIFY-LIVE flagged for the foil onboarding run.

Revert: per addendum-22 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 21: DOCFIX-091 tenant onboarding contract (A1 rulings) ...

New docs/tenant-onboarding-contract.md: operator/tenant boundary + rationale,
explicit role table (manager persona, never admin), tenant intake list,
stage dangers, onboarding confirmation set, hardening register H1-H5
(proposals logged, none implemented). v2-DRAFT banner defers to it.

Revert: per addendum-21 REVERT line (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 20: operator ruling sweep -- D-050 closed via D-051, D-073 adopted (list_trusts hardening, impl pending), SEC re-triggers, D-072 upstream bug withdrawn ...

Also fixes a self-inflicted scan poisoning: the 2026-07-05 ledger finding note
quoted high-numbered decoy identifiers literally, inflating ledger-scan's
DOCFIX/BUNDLEFIX next-free; tokens de-fanged + standing rule recorded. D-050
block Status line made scan-closable (D-063 precedent, keywords avoided).

Scan verified post-change: open = D-068, D-071; next-free D-074/DOCFIX-091/
BUNDLEFIX-012; fences 4/0/0; files ASCII.

Revert: git revert this commit (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clearing queue

D-072 dashboard TLS repair (executed) + DOCFIX-089 fail-closed check + BUNDLEFIX-011 ...

Identifiers consumed: D-072, DOCFIX-089, BUNDLEFIX-011.

Since-deploy dashboard VIP TLS defect fixed: cluster binding -> metal-admin
(live bind + durable bundle edit); https 200 CA-verified on both reachable
VIPs, all gates green, post-fix BOM committed. phase-03 3.3 rewritten
fail-closed; appendix-A symptom entry added; Launchpad bug draft ready for
operator submission.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

follow-on refreshes: magnum 96 + vault 714 (diff-verified); fleet fully current ...

No identifiers consumed. Vault refresh = operator-ruled Section 0 exception
(keys on hand, seal-detect gates, never sealed; still reactive/V0 per diff
-- D-068 fence intact). Appendix-B re-baselined from asbuilt/20260705-201118;
zero residual can-upgrade-to. Addendum 17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-20260705 window close: runbook as-executed corrections (DOCFIX-088) + D-071 amendment ...

Identifiers consumed: DOCFIX-088. D-071 AMENDMENT recorded (no new number).

Window complete: controller + 91 agents at 3.6.25, 17 apps refreshed,
all gates green, guests untouched. Runbook fold-back per first execution:
juju-status version sweep, create-backup as standard 2.1 step
(admin/controller), no separate controller-model upgrade, G3 probe on the
D-044 http leg with the VIP-TLS since-deploy defect cross-referenced,
mid-window target-drift expectation row. D-071 risk premise corrected
(supported backup exists; restore rehearsal -> Roosevelt open questions).
Ledger window section closed; post-window queue recorded (addendum 16).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

vault bundle revert to 1.8/stable (BUNDLEFIX-010) + D-068 AMENDMENT + G2/G3 close (ops-update-20260705) ...

Identifiers consumed: BUNDLEFIX-010. Also records the operator's D-068
AMENDMENT (no new D number) and window addendum 15.

- bundle.yaml: vault channel 1.16/stable -> 1.8/stable, comment replaced
  with amendment rationale (1.16 = incompatible charm line for this
  reactive cloud). Gates: provider-bundle-check PASS, channel_assert PASS
  (29 pins), repo-lint 0 fail.
- docs/design-decisions.md: D-068 AMENDMENT (2026-07-05) verbatim from
  operator; 1.16 ruled out, off-EOL-1.8 remains OPEN; D-002 item-3
  supersession withdrawn. Evidence: docs/D-068-vault-1.8-vs-1.16-analysis.md.
- changelog addendum 15: G2 (octavia 542) + G3 (dashboards 750/122/168)
  complete; dashboard-VIP-HTTPS RCA = since-deploy build defect (haproxy
  L4-masked vhost-less backend), phase-03 3.3 check fails open; G3 stands,
  no revert; upstream bug + DOCFIX candidates queued post-window.
- session-ledger: jumphost fence updated; machine-derived reseeded
  (BUNDLEFIX next-free 011).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

cloud-assert A7: read PO: marker from status JSON (DOCFIX-087) ...

Identifier consumed: DOCFIX-087. juju 3.6 --format=line omits workload
messages, so A7's line-format grep false-FAILed a healthy policy override
(found live at ops-update-20260705 pre-flight; window HELD on operator
Option B ruling until this true-PASS fix landed). A7 now greps the
application-status message + all unit workload messages from --format=json;
fail-closed on parse failure. Harness: truthful JSON fixtures replace the
line-format fiction; new T10 regression case; 10/10, gauntlet 31/31.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-procedure runbook + D-071 update policy (jumphost stream) ...

Identifiers consumed by this push: D-071, DOCFIX-086. No BUNDLEFIX consumed
(BUNDLEFIX-010 remains next-free; see addendum-11 FINDING 2 on the scan's
wrapped-pointer over-report).

- NEW runbooks/ops-update-procedure.md (DOCFIX-086): routine update window,
  gated: controller patch -> model agents -> in-channel charm refreshes.
  Vault explicitly excluded (D-068 unruled). Not yet as-executed.
- docs/design-decisions.md: D-071 PROPOSED (update cadence + controller
  patch policy, explicit no-backup single-controller risk section).
- runbooks/README.md: index ops-update-procedure + missing ops-restart entry.
- docs/v1-redeploy-changelog.md: addendum 11 (what/why/revert + 2 findings).
- docs/session-ledger.md: numbering re-seeded (D=072, DOCFIX=087,
  BUNDLEFIX=010); D-071 contention resolved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

script patch

patches

test scripts

test patches

doc patch

test patched

Doc patch

doc patch

Patch

Tenant patch

Documentation deployment

Barbican-Vault fixes

Tenant file updates

Trust fix files