addendum 22: H1 tenant-assert.sh + harness (7/7 green), clientdocs/ package (DOCFIX-092), A2 + structure + sequencing rulings recorded ...

Gauntlet ALL GREEN (32 harnesses incl. new tenant-assert). repo-lint 0 fail.
No cloud state touched; tenant-assert is read-only by design and its two
admin-listing calls are VERIFY-LIVE flagged for the foil onboarding run.

Revert: per addendum-22 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

handoff section 6 + ledger: onboarding completion package adopted as pre-v1-close tasks (A1.3/A1.4 rulings) ...

H1-H5 + Horizon GUI probe + client-facing draft package + live end-to-end
validation added to the v1-close checklist. Tracking-register update only;
no scripts changed, no cloud state touched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 21: DOCFIX-091 tenant onboarding contract (A1 rulings) ...

New docs/tenant-onboarding-contract.md: operator/tenant boundary + rationale,
explicit role table (manager persona, never admin), tenant intake list,
stage dangers, onboarding confirmation set, hardening register H1-H5
(proposals logged, none implemented). v2-DRAFT banner defers to it.

Revert: per addendum-21 REVERT line (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 20: operator ruling sweep -- D-050 closed via D-051, D-073 adopted (list_trusts hardening, impl pending), SEC re-triggers, D-072 upstream bug withdrawn ...

Also fixes a self-inflicted scan poisoning: the 2026-07-05 ledger finding note
quoted high-numbered decoy identifiers literally, inflating ledger-scan's
DOCFIX/BUNDLEFIX next-free; tokens de-fanged + standing rule recorded. D-050
block Status line made scan-closable (D-063 precedent, keywords avoided).

Scan verified post-change: open = D-068, D-071; next-free D-074/DOCFIX-091/
BUNDLEFIX-012; fences 4/0/0; files ASCII.

Revert: git revert this commit (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

session-ledger: 2026-07-05 resume reconcile (jumphost lane) ...

- machine-derived block re-seeded from today's ledger-scan (DOCFIX next-free
  090 -> 091 was stale; now D-073 / DOCFIX-091 / BUNDLEFIX-012, all sources agree)
- shared section: appended stale-facts correction per handoff reconcile item
  (ops-update-20260705 CLOSED; D-068 1.16 ruled out, off-EOL remains OPEN)
- jumphost section: post-window resume note + repo-lint L5 next-free inflation
  finding logged (DOCFIX candidate, no number consumed)

Revert: git revert this commit (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Create handoff-20260705-open-items.md

clearing queue

D-072 dashboard TLS repair (executed) + DOCFIX-089 fail-closed check + BUNDLEFIX-011 ...

Identifiers consumed: D-072, DOCFIX-089, BUNDLEFIX-011.

Since-deploy dashboard VIP TLS defect fixed: cluster binding -> metal-admin
(live bind + durable bundle edit); https 200 CA-verified on both reachable
VIPs, all gates green, post-fix BOM committed. phase-03 3.3 rewritten
fail-closed; appendix-A symptom entry added; Launchpad bug draft ready for
operator submission.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

follow-on refreshes: magnum 96 + vault 714 (diff-verified); fleet fully current ...

No identifiers consumed. Vault refresh = operator-ruled Section 0 exception
(keys on hand, seal-detect gates, never sealed; still reactive/V0 per diff
-- D-068 fence intact). Appendix-B re-baselined from asbuilt/20260705-201118;
zero residual can-upgrade-to. Addendum 17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-20260705 window close: runbook as-executed corrections (DOCFIX-088) + D-071 amendment ...

Identifiers consumed: DOCFIX-088. D-071 AMENDMENT recorded (no new number).

Window complete: controller + 91 agents at 3.6.25, 17 apps refreshed,
all gates green, guests untouched. Runbook fold-back per first execution:
juju-status version sweep, create-backup as standard 2.1 step
(admin/controller), no separate controller-model upgrade, G3 probe on the
D-044 http leg with the VIP-TLS since-deploy defect cross-referenced,
mid-window target-drift expectation row. D-071 risk premise corrected
(supported backup exists; restore rehearsal -> Roosevelt open questions).
Ledger window section closed; post-window queue recorded (addendum 16).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-20260705: post-change BOM + appendix-B B.1 full re-baseline ...

Post-window validated state: asbuilt/20260705-194617 (CLOUD-ASSERT: PASS,
controller+91 agents 3.6.25, 17 apps at new in-channel revisions). B.1
regenerated from the BOM; absorbs stale non-window rows missed at the
prior rebuild's re-baseline (logged in addendum 16). No identifiers consumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

vault bundle revert to 1.8/stable (BUNDLEFIX-010) + D-068 AMENDMENT + G2/G3 close (ops-update-20260705) ...

Identifiers consumed: BUNDLEFIX-010. Also records the operator's D-068
AMENDMENT (no new D number) and window addendum 15.

- bundle.yaml: vault channel 1.16/stable -> 1.8/stable, comment replaced
  with amendment rationale (1.16 = incompatible charm line for this
  reactive cloud). Gates: provider-bundle-check PASS, channel_assert PASS
  (29 pins), repo-lint 0 fail.
- docs/design-decisions.md: D-068 AMENDMENT (2026-07-05) verbatim from
  operator; 1.16 ruled out, off-EOL-1.8 remains OPEN; D-002 item-3
  supersession withdrawn. Evidence: docs/D-068-vault-1.8-vs-1.16-analysis.md.
- changelog addendum 15: G2 (octavia 542) + G3 (dashboards 750/122/168)
  complete; dashboard-VIP-HTTPS RCA = since-deploy build defect (haproxy
  L4-masked vhost-less backend), phase-03 3.3 check fails open; G3 stands,
  no revert; upstream bug + DOCFIX candidates queued post-window.
- session-ledger: jumphost fence updated; machine-derived reseeded
  (BUNDLEFIX next-free 011).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

Create D-068-vault-1.8-vs-1.16-analysis.md

session-ledger: checkpoint - G0+G1 complete (12 charms refreshed, all gates green) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

session-ledger: fence jumphost stream section (delimited-sections convention) ...

Applies the cross-stream ledger convention: jumphost stream edits stay
inside its SECTION/END fence. No identifiers consumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

session-ledger: checkpoint - controller + agents at 3.6.25, entering charm stage ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

session-ledger: jumphost stream checkpoint (ops-update-20260705 at Section 2 entry) ...

Cross-stream sync checkpoint per operator instruction: Active window section
added for the in-flight update window (S1 done, backup taken, S2.2 next,
4 findings logged for close-out). No identifiers consumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-20260705: pre-change BOM (cloud-assert PASS) + session index row ...

Pre-change baseline for the first ops-update-procedure execution:
asbuilt/20260705-102951 captured on a full CLOUD-ASSERT: PASS (post
DOCFIX-087 A7 fix). Controller 3.6.24, all 91 agents 3.6.24, worklist
17 apps (magnum excluded: name-mismatch gate + Charmhub s390x-only
channel state; vault excluded: D-068). No new identifiers consumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

cloud-assert A7: read PO: marker from status JSON (DOCFIX-087) ...

Identifier consumed: DOCFIX-087. juju 3.6 --format=line omits workload
messages, so A7's line-format grep false-FAILed a healthy policy override
(found live at ops-update-20260705 pre-flight; window HELD on operator
Option B ruling until this true-PASS fix landed). A7 now greps the
application-status message + all unit workload messages from --format=json;
fail-closed on parse failure. Harness: truthful JSON fixtures replace the
line-format fiction; new T10 regression case; 10/10, gauntlet 31/31.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

Delete openstack-cloud-ops.skill

Merge branch 'main' of https://git.baldurkeep.com/git/OpenStack/openstack-caracal-ipv4

claude skill update

ops-update-procedure runbook + D-071 update policy (jumphost stream) ...

Identifiers consumed by this push: D-071, DOCFIX-086. No BUNDLEFIX consumed
(BUNDLEFIX-010 remains next-free; see addendum-11 FINDING 2 on the scan's
wrapped-pointer over-report).

- NEW runbooks/ops-update-procedure.md (DOCFIX-086): routine update window,
  gated: controller patch -> model agents -> in-channel charm refreshes.
  Vault explicitly excluded (D-068 unruled). Not yet as-executed.
- docs/design-decisions.md: D-071 PROPOSED (update cadence + controller
  patch policy, explicit no-backup single-controller risk section).
- runbooks/README.md: index ops-update-procedure + missing ops-restart entry.
- docs/v1-redeploy-changelog.md: addendum 11 (what/why/revert + 2 findings).
- docs/session-ledger.md: numbering re-seeded (D=072, DOCFIX=087,
  BUNDLEFIX=010); D-071 contention resolved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

script patch

patches

test scripts

test patches

doc patch

test patched

Doc patch