diff --git a/clientdocs/README.md b/clientdocs/README.md
index f030dcb..50a163e 100644
--- a/clientdocs/README.md
+++ b/clientdocs/README.md
@@ -22,16 +22,47 @@
     TEMPLATE NOTE banner).
   - `ci-integration-guide.md` -- with the handover pack for any client that
     connects CI/automation (Jenkins etc.); same instantiation rule.
-- **Templates.** `handover-pack.md`, `ci-integration-guide.md`, and
-  `acceptance-checklist.md` are reusable templates: `{{PLACEHOLDER}}` fields
-  are operator-filled at instantiation; a delivered copy contains none.
+  - `scripts/` (the tenant starter kit) -- WITH the handover pack:
+    `tenancy-audit.sh`, `smoke-test.sh`, `acceptance-run.sh`, and
+    `ci-cleanup-sweep.sh` go to every client; `clouds.yaml.template` and
+    `Jenkinsfile.example` go only to clients that connect CI/automation
+    (with the CI guide). The .sh files are generic (auth via the client's
+    own OS_* environment, nothing to instantiate); `clouds.yaml.template`
+    follows the `{{PLACEHOLDER}}` instantiation rule below.
+  - `tenant-skill/` + `ai-assistant-guide.md` -- AT handover, with the
+    pack, for any client whose team uses an AI assistant (Claude Code /
+    claude.ai). `tenant-skill/` is a Claude Agent Skill (SKILL.md +
+    references/): instantiate every `{{PLACEHOLDER}}` across all its
+    files, remove the TEMPLATE NOTE banner, deliver the directory as a
+    copy. `ai-assistant-guide.md` is the client-facing install/usage
+    page for it (no placeholders). Install on the client side: copy the
+    directory into their project as `.claude/skills/omega-cloud-tenant/`
+    (Claude Code), or add the files to their claude.ai project; the
+    installed directory name must match the skill name
+    `omega-cloud-tenant`. The skill's routing table references the
+    starter-kit scripts by name; keep them in sync.
+- **Templates.** `handover-pack.md`, `ci-integration-guide.md`,
+  `acceptance-checklist.md`, `scripts/clouds.yaml.template`, and every file
+  under `tenant-skill/` are reusable templates: `{{PLACEHOLDER}}` fields are
+  operator-filled at instantiation; a delivered copy contains none. The
+  tenant-skill placeholder set is exactly: `{{TENANT_SHORT_NAME}}`,
+  `{{AUTH_URL}}`, `{{DASHBOARD_URL}}`, `{{REGION}}`, `{{ACCOUNT_CONTACT}}`
+  -- enforced by `tests/clientdocs-skill/run-tests.sh`, which also gates
+  internal-term leakage and routing-table reachability for the skill.
 - **ASCII + LF**, like everything committed.
 - **Sweep-on-change is enforced.** `sweep-receipt.txt` (INTERNAL, never
-  shipped) pins the reviewed state of every tenant-facing file; repo lint
-  fails when any of them drifts, until this directory has been reviewed for
-  staleness and the receipt is re-recorded:
+  shipped) pins the reviewed state of every tenant-facing file (including
+  everything under `scripts/`, which is auto-covered like the *.md files);
+  repo lint fails when any of them drifts, until this directory has been
+  reviewed for staleness and the receipt is re-recorded:
   `bash scripts/repo-lint.sh --record-clientdocs-sweep`.
+- **Starter-kit scripts are tested offline.** Any change to `scripts/*.sh`
+  ships with `tests/clientdocs-scripts/run-tests.sh` green (mock CLI, no
+  cloud access).
 
 Contents: `intake-form.md`, `welcome.md`, `self-service-guide.md`,
-`handover-pack.md`, `ci-integration-guide.md`, `acceptance-checklist.md`;
-internal-only: `sweep-receipt.txt`.
+`handover-pack.md`, `ci-integration-guide.md`, `acceptance-checklist.md`,
+`ai-assistant-guide.md`, `tenant-skill/` (SKILL.md + references/),
+`scripts/` (starter kit: `tenancy-audit.sh`, `smoke-test.sh`,
+`acceptance-run.sh`, `ci-cleanup-sweep.sh`, `clouds.yaml.template`,
+`Jenkinsfile.example`); internal-only: `sweep-receipt.txt`.
diff --git a/clientdocs/ai-assistant-guide.md b/clientdocs/ai-assistant-guide.md
new file mode 100644
index 0000000..67e6a5d
--- /dev/null
+++ b/clientdocs/ai-assistant-guide.md
@@ -0,0 +1,82 @@
+# Omega Cloud -- Using Your AI Assistant Skill (DRAFT)
+
+With your handover pack you received `tenant-skill/`, a skill package for
+Claude (Anthropic's AI assistant). Installed into your own project, it
+teaches your assistant how to operate your Omega Cloud environment
+correctly: which of your three accounts to use for which job, which
+permission errors are deliberate platform boundaries, and how to behave
+safely on a live environment. This page explains how to install it and
+how to get the most out of it.
+
+## What the skill is
+
+A folder of plain-text instructions your AI assistant loads when you ask
+it to do cloud work:
+
+- `SKILL.md` -- the core: account selection, the boundary model,
+  authentication, safety rules, and a routing table.
+- `references/` -- detailed, on-demand pages the assistant loads per
+  topic: day-2 operations (networks, VMs, volumes, load balancers),
+  Kubernetes, CI/automation, and troubleshooting.
+
+Your copy was instantiated for you at handover: it already contains your
+short name, endpoints, and region. It contains NO credentials -- it tells
+the assistant how to authenticate, never what your secrets are.
+
+## Installing it
+
+- **Claude Code** (terminal / IDE): copy the delivered `tenant-skill/`
+  directory into your project as `.claude/skills/omega-cloud-tenant/`
+  (the directory name must be exactly `omega-cloud-tenant`). The skill
+  is picked up automatically; asking "what skills are available?" should
+  list it.
+- **claude.ai** (web): add the skill files to your project so they are
+  part of its knowledge, or use your organization's skill-upload feature
+  where available. Claude Code with terminal access is the better fit
+  for hands-on cloud work, since the assistant can run the OpenStack
+  CLI itself.
+
+Give the assistant a working CLI environment: the OpenStack client
+installed, your `clouds.yaml` configured per the CI/Automation
+Integration Guide, and the delivered CA bundle on disk. Credential
+secrets belong in your environment (or your secret store), never pasted
+into the chat.
+
+## Getting the best out of it
+
+1. **Just describe the task.** "Create a VM reachable from our office
+   network", "why did the pipeline get a permission error", "stand up a
+   Kubernetes cluster for staging". The skill triggers on cloud work by
+   itself; you do not need to name it.
+2. **Let it read before it writes.** The skill instructs the assistant
+   to audit current state with list/show commands before changing
+   anything, and to ask your confirmation before anything destructive.
+   Expect (and welcome) those confirmation questions.
+3. **Expect it to respect boundaries.** If you ask for something the
+   platform deliberately refuses -- raising your own quota, creating a
+   cluster from an automation credential, granting `admin` -- a
+   correctly working assistant will decline the workaround and point
+   you at the request path instead. That is the skill doing its job.
+4. **Never paste secrets into the conversation.** Passwords, credential
+   secrets, kubeconfig contents, and private keys stay out of the chat.
+   The assistant is instructed never to print them; help it by never
+   supplying them in-line. When a password login is needed, it will
+   have you enter it at a prompt.
+5. **Keep the companions nearby.** The Handover Pack, Self-Service
+   Guide, CI/Automation Integration Guide, and Acceptance Checklist are
+   the authoritative long-form documents; the skill is the operating
+   layer over them. If the assistant's answer and a delivered document
+   ever disagree, the document wins -- and we would like to hear about
+   it via your account contact.
+6. **A good first test.** Ask the assistant to run the delivered
+   read-only audit script (`bash scripts/tenancy-audit.sh` from your
+   document pack). It proves authentication, the CA bundle, endpoint
+   discovery, and the skill itself in one pass, and changes nothing.
+
+## Keeping it current
+
+The skill is versioned with your document pack. When we ship an updated
+pack, replace the installed skill directory with the new copy -- do not
+hand-edit it, or your edits will be lost at the next update. Requests to
+change what the skill teaches go through your account contact like any
+other document feedback.
diff --git a/clientdocs/scripts/Jenkinsfile.example b/clientdocs/scripts/Jenkinsfile.example
new file mode 100644
index 0000000..2169933
--- /dev/null
+++ b/clientdocs/scripts/Jenkinsfile.example
@@ -0,0 +1,69 @@
+// Jenkinsfile.example -- declarative pipeline skeleton for your Omega Cloud
+// environment, following the CI/Automation Integration Guide.
+//
+// What: smoke test -> the guide's worked sequence (via acceptance-run.sh)
+//       -> an always-runs cleanup, all authenticated with your application
+//       credential injected from the Jenkins credential store.
+// Setup (once, in Manage Jenkins > Credentials): add a "Username with
+//       password" credential with id 'omega-cloud-app-credential', where
+//       username = the application credential id and password = its secret,
+//       both from the credential file delivered to your custodians. Never
+//       put them in this file or any repository.
+// Notes: adjust the script paths to wherever you keep the delivered starter
+//       kit scripts in your repository. Keep the delivered CA bundle in your
+//       repository or agent image and point OS_CACERT at it -- do not
+//       disable certificate verification instead.
+
+pipeline {
+    agent any
+
+    options {
+        timestamps()
+        // Load balancers take minutes; the acceptance sequence is not fast.
+        timeout(time: 60, unit: 'MINUTES')
+    }
+
+    environment {
+        // credentials() injects OMEGA_USR (the id) and OMEGA_PSW (the
+        // secret) and masks them in the build log.
+        OMEGA = credentials('omega-cloud-app-credential')
+
+        // Environment-variable auth form from the integration guide.
+        OS_AUTH_TYPE            = 'v3applicationcredential'
+        OS_AUTH_URL             = 'FILL-ME: auth url from your Handover Pack'
+        OS_IDENTITY_API_VERSION = '3'
+        OS_REGION_NAME          = 'FILL-ME: region from your Handover Pack'
+        OS_CACERT               = "${WORKSPACE}/FILL-ME-delivered-ca-bundle.pem"
+        OS_APPLICATION_CREDENTIAL_ID     = "${OMEGA_USR}"
+        OS_APPLICATION_CREDENTIAL_SECRET = "${OMEGA_PSW}"
+    }
+
+    stages {
+        stage('Smoke test') {
+            steps {
+                // Token, catalog, quota -- fail fast before building anything.
+                sh 'bash clientdocs-starter-kit/smoke-test.sh'
+            }
+        }
+
+        stage('Worked sequence') {
+            steps {
+                // The guide section-7 sequence with automatic teardown.
+                // Replace this with your own deployment steps once you have
+                // them; keep a trimmed version as a recurring smoke test.
+                sh 'bash clientdocs-starter-kit/acceptance-run.sh'
+            }
+        }
+    }
+
+    post {
+        // Cleanup runs on success, failure, and abort alike, so a broken
+        // build cannot leak quota. This deletes THIS kit's leftovers
+        // (ci-accept-*) of any age; run the sweep with its defaults
+        // (--prefix ci- --hours 24) as a separate scheduled job to catch
+        // everything else your pipelines leak.
+        always {
+            sh 'bash clientdocs-starter-kit/ci-cleanup-sweep.sh --prefix ci-accept- --hours 0 --apply'
+        }
+    }
+}
diff --git a/clientdocs/scripts/acceptance-run.sh b/clientdocs/scripts/acceptance-run.sh
new file mode 100644
index 0000000..d20f50e
--- /dev/null
+++ b/clientdocs/scripts/acceptance-run.sh
@@ -0,0 +1,485 @@
+#!/usr/bin/env bash
+# acceptance-run.sh -- automated run of the self-service Acceptance Checklist rows
+# that your automation (application) credential can prove on its own.
+#
+# What: builds the checklist's worked sequence with every resource named
+#       ci-accept-*, checks each row, then tears everything down again in
+#       reverse order -- teardown is guaranteed by an exit trap, so it runs
+#       even when a row fails or the script is interrupted.
+#
+#       Rows run here:   A1 A4 A5 A6(expected refusal) C1 C2 C3 C4
+#                        D1 D2 E1 E2 F1 F2 G1
+#       Rows skipped:    A2 A3 B1 B2 (need a password login)
+#                        D3 (needs interactive SSH)
+#                        H1 H2 H3 (need the -cluster password login)
+#                        I1 (object storage -- confirm with your account contact)
+#                        J1 J2 (request drills through your account contact)
+#       Manual instructions for the skipped rows are printed at the end.
+#
+# Why:  run once at onboarding to sign off your environment, and re-run any
+#       time you suspect a problem. "Expected refusal" rows MUST fail -- the
+#       script counts a refusal as PASS and an unexpected success as FAIL,
+#       because those refusals are the platform protecting you.
+# Safety: creates only resources named ci-accept-* inside your own project,
+#       and deletes exactly what it created. Waits use the CLI --wait flags
+#       or 10-second polling, per the integration guide's pacing rules.
+#
+# Two deliberate adaptations of the checklist text (noted on their rows):
+#   - D2 boots with a throwaway keypair ci-accept-key created by this run,
+#     because your handover keypair belongs to the -cluster account and
+#     keypairs are per-account. The keypair is deleted at teardown.
+#   - C2/D2 build a dedicated network ci-accept-net (default range
+#     192.168.199.0/24, override with CI_ACCEPT_CIDR=<range> if that would
+#     collide with something you plan to route). It is not attached to any
+#     router, so it cannot conflict with your handover network.
+#
+# Auth: your normal OpenStack client environment (OS_CLOUD or the OS_*
+#       variables), as the application credential. No arguments needed.
+#       Optional: CI_ACCEPT_IMAGE / CI_ACCEPT_FLAVOR override the automatic
+#       pick of a shared base image and the smallest machine size.
+# Exit: 0 all automated rows passed and teardown is clean | 1 otherwise
+#       | 2 environment not set up.
+set -uo pipefail
+
+command -v openstack >/dev/null 2>&1 || {
+  echo "SETUP: the 'openstack' client is not installed (pip install python-openstackclient)"; exit 2; }
+command -v python3 >/dev/null 2>&1 || { echo "SETUP: python3 is required"; exit 2; }
+if [ -z "${OS_CLOUD:-}" ] && [ -z "${OS_AUTH_URL:-}" ]; then
+  echo "SETUP: no OpenStack environment found."
+  echo "  Either: export OS_CLOUD=<your cloud name from clouds.yaml>"
+  echo "  Or:     export the OS_* variables from the CI/Automation Integration Guide."
+  exit 2
+fi
+
+CIDR="${CI_ACCEPT_CIDR:-192.168.199.0/24}"
+IMAGE="${CI_ACCEPT_IMAGE:-}"
+FLAVOR="${CI_ACCEPT_FLAVOR:-}"
+POLL_TRIES=30            # x10s = up to 5 minutes per wait loop
+
+WORK="$(mktemp -d)"
+OS_ERR="$WORK/stderr.txt"
+FAILED=0; AUTH_OK=0
+ROWS_ID=(); ROWS_ST=(); ROWS_NOTE=()
+
+# Structured captures take stdout ONLY; stderr goes to a file so client
+# warnings and notices can never corrupt the parsed output.
+cap() { # cap <var> <openstack args...>
+  local __v="$1"; shift
+  local out rc
+  out=$(openstack "$@" </dev/null 2>"$OS_ERR"); rc=$?
+  printf -v "$__v" '%s' "$out"
+  return "$rc"
+}
+oerr() { head -1 "$OS_ERR" 2>/dev/null || true; }
+jget() { # jget <json> <key> [subkey] -> value (empty + rc 1 when absent)
+  printf '%s' "$1" | python3 -c '
+import json,sys
+try:
+    v=json.load(sys.stdin)
+    for k in sys.argv[1:]: v=v[k]
+    if v is None: raise KeyError
+    print(v)
+except Exception:
+    sys.exit(1)' "${@:2}"
+}
+row() { # row <id> <PASS|FAIL|SKIP> <note>
+  ROWS_ID+=("$1"); ROWS_ST+=("$2"); ROWS_NOTE+=("$3")
+  [ "$2" = "FAIL" ] && FAILED=1
+  printf '  [%s] %-3s %s\n' "$2" "$1" "$3"
+}
+
+# ---- teardown: guaranteed, reverse order, only what this run created -------
+MADE_SECRET=""; SECRET_DONE=0
+MADE_LB=0; MADE_FIP=""; MADE_VM=0; MADE_KEY=0
+MADE_VOL=0; MADE_SG=0; MADE_SUBNET=0; MADE_NET=0; LEAKED_USER=0
+TD_FAIL=0; FINISHED=0
+
+td() { # td <label> <openstack args...> -- one teardown deletion, verified
+  local label="$1"; shift
+  if openstack "$@" </dev/null >"$WORK/td-out.txt" 2>"$OS_ERR"; then
+    echo "  removed $label"
+  else
+    echo "  TEARDOWN FAIL: $label -- $(oerr)"
+    TD_FAIL=1
+  fi
+}
+leftover() { # leftover <label> <list args...> -- nothing ci-accept-* may remain
+  local label="$1"; shift
+  local out
+  if ! cap out "$@"; then
+    echo "  TEARDOWN WARN: could not verify $label ($(oerr))"; TD_FAIL=1; return
+  fi
+  if printf '%s' "$out" | grep -q 'ci-accept'; then
+    echo "  TEARDOWN FAIL: leftover ci-accept-* still listed in $label"
+    TD_FAIL=1
+  fi
+}
+
+finish() {
+  [ "$FINISHED" = 1 ] && return
+  FINISHED=1
+  echo
+  echo "=== teardown (reverse order; runs even after a failure) ==="
+  if [ "$AUTH_OK" = 1 ]; then
+    [ -n "$MADE_SECRET" ] && [ "$SECRET_DONE" = 0 ] && td "secret ci-accept-secret" secret delete "$MADE_SECRET"
+    [ "$MADE_LB" = 1 ]     && td "load balancer ci-accept-lb (cascade: member/pool/listener)" \
+                                 loadbalancer delete ci-accept-lb --cascade --wait
+    [ -n "$MADE_FIP" ]     && td "floating ip $MADE_FIP (released)" floating ip delete "$MADE_FIP"
+    [ "$MADE_VM" = 1 ]     && td "server ci-accept-vm" server delete ci-accept-vm --wait
+    [ "$MADE_KEY" = 1 ]    && td "keypair ci-accept-key" keypair delete ci-accept-key
+    [ "$MADE_VOL" = 1 ]    && td "volume ci-accept-vol" volume delete ci-accept-vol
+    [ "$MADE_SG" = 1 ]     && td "security group ci-accept-sg" security group delete ci-accept-sg
+    [ "$MADE_SUBNET" = 1 ] && td "subnet ci-accept-subnet" subnet delete ci-accept-subnet
+    [ "$MADE_NET" = 1 ]    && td "network ci-accept-net" network delete ci-accept-net
+    if [ "$LEAKED_USER" = 1 ]; then
+      td "unexpected user ci-accept-probe (should never have been created)" user delete ci-accept-probe
+    fi
+    echo "  --- leftover check (the checklist's sign-off step) ---"
+    leftover "server list" server list -f json
+    leftover "volume list" volume list -f json
+    leftover "loadbalancer list" loadbalancer list -f json
+    leftover "network list" network list -f json
+    leftover "security group list" security group list -f json
+  else
+    echo "  (nothing was created -- authentication never succeeded)"
+  fi
+  [ "$TD_FAIL" = 0 ] && echo "  teardown: CLEAN" || echo "  teardown: NOT CLEAN (see failures above)"
+
+  echo
+  echo "=== scoreboard ==="
+  local i npass=0 nfail=0 nskip=0
+  for i in "${!ROWS_ID[@]}"; do
+    printf '  %-4s %-4s %s\n' "${ROWS_ID[$i]}" "${ROWS_ST[$i]}" "${ROWS_NOTE[$i]}"
+    case "${ROWS_ST[$i]}" in PASS) npass=$((npass+1));; FAIL) nfail=$((nfail+1));; *) nskip=$((nskip+1));; esac
+  done
+  echo "  rows: $npass PASS, $nfail FAIL, $nskip SKIP; teardown $( [ "$TD_FAIL" = 0 ] && echo clean || echo NOT-CLEAN )"
+
+  echo
+  echo "=== rows to run manually (need a password login or a human) ==="
+  echo "  A2: as your -cluster account (password): openstack token issue"
+  echo "  A3: log in to the web dashboard as your -domain-admin account"
+  echo "  B1: as -domain-admin: create a test user in your domain, grant it"
+  echo "      member on your project, then delete it"
+  echo "  B2: as -domain-admin: try to grant admin to one of your users --"
+  echo "      the grant MUST be refused (expected refusal)"
+  echo "  D3: attach a floating ip to a test server and SSH in with your"
+  echo "      keypair (allow TCP/22 in its security group first)"
+  echo "  H1-H3: as your -cluster account (password): show your cluster"
+  echo "      template, create/delete a test cluster, and confirm the same"
+  echo "      create is REFUSED with the application credential"
+  echo "  I1: ask your account contact whether object storage is enabled"
+  echo "      for you before testing it"
+  echo "  J1/J2: quota-change and escalation drills through your account contact"
+
+  echo
+  if [ "$FAILED" = 0 ] && [ "$TD_FAIL" = 0 ]; then
+    echo "RESULT: ACCEPTANCE (automated rows) PASS -- teardown clean"
+    rm -rf "$WORK"
+    exit 0
+  fi
+  echo "RESULT: ACCEPTANCE (automated rows) FAIL"
+  echo "  If a failure looks like a platform fault, send the exact command"
+  echo "  and exact error text to your account contact."
+  rm -rf "$WORK"
+  exit 1
+}
+trap finish EXIT
+
+echo "=== Omega Cloud acceptance run ($(date -u +%Y-%m-%dT%H:%M:%SZ)) ==="
+echo "  resources will be named ci-accept-*; teardown is automatic"
+echo
+
+# ---- A. sign-in and discovery ----------------------------------------------
+PROJECT_ID=""
+if cap TOK token issue -f json && PROJECT_ID=$(jget "$TOK" project_id); then
+  AUTH_OK=1
+  row A1 PASS "token issued, scoped to your project ($PROJECT_ID)"
+else
+  row A1 FAIL "authentication failed: $(oerr) -- check for a revoked/expired credential or a missing CA bundle (OS_CACERT)"
+  for r in A4 A5 A6 C1 C2 C3 C4 D1 D2 E1 E2 F1 F2 G1; do
+    row "$r" SKIP "blocked: authentication (A1) failed"
+  done
+  exit 1   # trap prints teardown (nothing made) + scoreboard
+fi
+
+if cap CAT catalog list -f json; then
+  MISSING=$(printf '%s' "$CAT" | python3 -c '
+import json,sys
+need={"identity":["identity"],"compute":["compute"],"image":["image"],
+      "network":["network"],"block storage":["volumev3","block-storage","volume"],
+      "load balancer":["load-balancer"],"secrets":["key-manager"]}
+try: types={r.get("Type","") for r in json.load(sys.stdin)}
+except Exception: print("(unparseable catalog)"); sys.exit(0)
+print(" ".join(sorted(k for k,alts in need.items() if not any(a in types for a in alts))))')
+  if [ -z "$MISSING" ]; then
+    row A4 PASS "catalog lists every service this checklist uses"
+  else
+    row A4 FAIL "catalog is missing: $MISSING"
+  fi
+else
+  row A4 FAIL "catalog list failed: $(oerr)"
+fi
+
+if cap LIM limits show --absolute -f json; then
+  LIMSUM=$(printf '%s' "$LIM" | python3 -c '
+import json,sys
+try: d={r.get("Name"): r.get("Value") for r in json.load(sys.stdin)}
+except Exception: sys.exit(1)
+print("instances %s, cores %s, ram %s MB" % (d.get("maxTotalInstances","?"),
+      d.get("maxTotalCores","?"), d.get("maxTotalRAMSize","?")))') \
+    && row A5 PASS "limits visible ($LIMSUM) -- compare with your agreed quota" \
+    || row A5 FAIL "limits output unparseable: $(oerr)"
+else
+  row A5 FAIL "limits show failed: $(oerr)"
+fi
+
+# A6 is an EXPECTED REFUSAL: the create MUST fail with a permission error.
+if cap PROBE user create ci-accept-probe -f json; then
+  LEAKED_USER=1
+  row A6 FAIL "user create unexpectedly SUCCEEDED -- the identity boundary did not hold; report this to your account contact as an incident"
+else
+  if grep -qiE 'forbidden|not authorized|403|policy' "$OS_ERR"; then
+    row A6 PASS "identity create refused as expected (the boundary is protecting you)"
+  else
+    row A6 FAIL "user create failed, but not with a permission error: $(oerr)"
+  fi
+fi
+
+# ---- C. networking ----------------------------------------------------------
+# C1: check the handover network/router. Your name prefix is discovered from
+# your project name (<prefix>-prod); if that lookup is refused, the row is
+# skipped with the manual command instead.
+TENANT=""
+if cap PRJ project show "$PROJECT_ID" -f json; then
+  PNAME=$(jget "$PRJ" name || true)
+  TENANT="${PNAME%-prod}"
+fi
+if [ -n "$TENANT" ]; then
+  C1_OK=1; C1_WHY=""
+  cap HNET network show "${TENANT}-net" -f json || { C1_OK=0; C1_WHY="network ${TENANT}-net: $(oerr)"; }
+  GWNET=""
+  if cap HRTR router show "${TENANT}-router" -f json; then
+    GWNET=$(jget "$HRTR" external_gateway_info network_id || true)
+  else
+    C1_OK=0; C1_WHY="${C1_WHY:+$C1_WHY; }router ${TENANT}-router: $(oerr)"
+  fi
+  EXT_ID=""
+  cap EXTNET network show provider-ext -f json && EXT_ID=$(jget "$EXTNET" id || true)
+  if [ "$C1_OK" = 1 ] && [ -n "$GWNET" ] && [ "$GWNET" = "$EXT_ID" ]; then
+    row C1 PASS "handover network and router intact; gateway is on provider-ext"
+  elif [ "$C1_OK" = 1 ]; then
+    row C1 FAIL "router exists but its external gateway is not provider-ext"
+  else
+    row C1 FAIL "$C1_WHY"
+  fi
+else
+  row C1 SKIP "could not discover your name prefix; run manually: openstack network show <prefix>-net; openstack router show <prefix>-router"
+fi
+
+if cap NET network create ci-accept-net -f json; then
+  MADE_NET=1
+  if cap SUB subnet create ci-accept-subnet --network ci-accept-net --subnet-range "$CIDR" -f json; then
+    MADE_SUBNET=1
+    row C2 PASS "network + subnet created ($CIDR); their deletion is verified at teardown"
+  else
+    row C2 FAIL "subnet create failed: $(oerr)"
+  fi
+else
+  row C2 FAIL "network create failed: $(oerr)"
+fi
+
+if cap SG security group create ci-accept-sg -f json; then
+  MADE_SG=1
+  if cap SGR security group rule create ci-accept-sg --protocol tcp --dst-port 22 --remote-ip 0.0.0.0/0 -f json; then
+    row C3 PASS "security group with a TCP/22 rule created; deletion verified at teardown"
+  else
+    row C3 FAIL "rule create failed: $(oerr)"
+  fi
+else
+  row C3 FAIL "security group create failed: $(oerr)"
+fi
+
+if cap FIP floating ip create provider-ext --description ci-accept-fip -f json; then
+  MADE_FIP=$(jget "$FIP" id || true)
+  FIP_ADDR=$(jget "$FIP" floating_ip_address || true)
+  if [ -n "$MADE_FIP" ]; then
+    row C4 PASS "floating ip allocated (${FIP_ADDR:-address hidden}); released at teardown"
+  else
+    row C4 FAIL "floating ip created but its id could not be parsed: $(oerr)"
+  fi
+else
+  row C4 FAIL "floating ip create failed: $(oerr)"
+fi
+
+# ---- D. compute -------------------------------------------------------------
+NIMG=0; NFLV=0
+if cap IMGS image list -f json && cap FLVS flavor list -f json; then
+  NIMG=$(printf '%s' "$IMGS" | python3 -c 'import json,sys
+try: print(len(json.load(sys.stdin)))
+except Exception: print(0)')
+  NFLV=$(printf '%s' "$FLVS" | python3 -c 'import json,sys
+try: print(len(json.load(sys.stdin)))
+except Exception: print(0)')
+  if [ "$NIMG" -gt 0 ] && [ "$NFLV" -gt 0 ]; then
+    [ -n "$IMAGE" ] || IMAGE=$(printf '%s' "$IMGS" | python3 -c '
+import json,sys
+rows=[r for r in json.load(sys.stdin) if str(r.get("Status","")).lower()=="active"]
+rows.sort(key=lambda r: (0 if "ubuntu" in str(r.get("Name","")).lower() else 1, str(r.get("Name",""))))
+print(rows[0]["Name"] if rows else "")')
+    [ -n "$FLAVOR" ] || FLAVOR=$(printf '%s' "$FLVS" | python3 -c '
+import json,sys
+rows=json.load(sys.stdin)
+rows.sort(key=lambda r: (r.get("RAM") or 0, r.get("VCPUs") or 0))
+print(rows[0]["Name"] if rows else "")')
+    row D1 PASS "$NIMG shared images, $NFLV machine sizes visible (using image '$IMAGE', size '$FLAVOR')"
+  else
+    row D1 FAIL "image list ($NIMG) or flavor list ($NFLV) came back empty"
+  fi
+else
+  row D1 FAIL "image/flavor listing failed: $(oerr)"
+fi
+
+VM_IP=""
+if [ "$MADE_SUBNET" = 1 ] && [ "$MADE_SG" = 1 ] && [ -n "$IMAGE" ] && [ -n "$FLAVOR" ]; then
+  # The checklist boots with your handover keypair; that keypair belongs to
+  # the -cluster account and keypairs are per-account, so this run creates
+  # (and later deletes) its own throwaway keypair instead. The keypair
+  # output (a private key) is deliberately discarded, never printed.
+  if openstack keypair create ci-accept-key </dev/null >/dev/null 2>"$OS_ERR"; then
+    MADE_KEY=1
+    if cap SRV server create ci-accept-vm --image "$IMAGE" --flavor "$FLAVOR" \
+         --network ci-accept-net --security-group ci-accept-sg \
+         --key-name ci-accept-key --wait -f json; then
+      MADE_VM=1
+      ST=$(jget "$SRV" status || true)
+      if [ "$ST" = "ACTIVE" ]; then
+        cap SRVSHOW server show ci-accept-vm -f json || true
+        VM_IP=$(printf '%s' "$SRVSHOW" | python3 -c '
+import json,sys
+try:
+    for ips in json.load(sys.stdin).get("addresses",{}).values():
+        for ip in ips: print(ip); sys.exit(0)
+except Exception: pass' || true)
+        row D2 PASS "ci-accept-vm reached ACTIVE (booted with throwaway keypair ci-accept-key -- see header note)"
+      else
+        row D2 FAIL "server created but status is '$ST', not ACTIVE"
+      fi
+    else
+      MADE_VM=1   # a failed --wait may still have left the server; teardown handles it
+      row D2 FAIL "server create failed: $(oerr)"
+      MADE_VM_FAILED=1
+    fi
+  else
+    row D2 FAIL "keypair create failed: $(oerr)"
+  fi
+else
+  row D2 SKIP "blocked: needs the C2 network, the C3 security group, and D1 image/size"
+fi
+# if the create itself failed, do not try to delete a server that never existed
+if [ "${MADE_VM_FAILED:-0}" = 1 ]; then
+  if ! cap CHK server show ci-accept-vm -f json; then MADE_VM=0; fi
+fi
+
+# ---- E. block storage -------------------------------------------------------
+wait_vol() { # wait_vol <want-status> -> 0 when reached
+  local want="$1" st="" i
+  for i in $(seq 1 "$POLL_TRIES"); do
+    cap VS volume show ci-accept-vol -f json || return 1
+    st=$(jget "$VS" status || true)
+    [ "$st" = "$want" ] && return 0
+    case "$st" in error*) echo "    volume entered '$st'"; return 1;; esac
+    sleep 10   # pacing rule: poll at 10-second intervals or slower
+  done
+  echo "    volume stuck at '$st' (wanted '$want')"; return 1
+}
+if cap VOL volume create --size 1 ci-accept-vol -f json; then
+  MADE_VOL=1
+  if wait_vol available; then
+    row E1 PASS "1 GB volume created and reached 'available'"
+  else
+    row E1 FAIL "volume never reached 'available': $(oerr)"
+  fi
+else
+  row E1 FAIL "volume create failed: $(oerr)"
+fi
+
+if [ "$MADE_VOL" = 1 ] && [ "$MADE_VM" = 1 ]; then
+  E2_OK=1
+  openstack server add volume ci-accept-vm ci-accept-vol </dev/null >/dev/null 2>"$OS_ERR" || E2_OK=0
+  [ "$E2_OK" = 1 ] && { wait_vol in-use || E2_OK=0; }
+  if [ "$E2_OK" = 1 ]; then
+    openstack server remove volume ci-accept-vm ci-accept-vol </dev/null >/dev/null 2>"$OS_ERR" || E2_OK=0
+    [ "$E2_OK" = 1 ] && { wait_vol available || E2_OK=0; }
+  fi
+  if [ "$E2_OK" = 1 ]; then
+    row E2 PASS "attach -> in-use -> detach -> available all succeeded"
+  else
+    row E2 FAIL "attach/detach sequence failed: $(oerr)"
+  fi
+else
+  row E2 SKIP "blocked: needs both the E1 volume and the D2 server"
+fi
+
+# ---- F. load balancers ------------------------------------------------------
+if [ "$MADE_SUBNET" = 1 ]; then
+  if cap LB loadbalancer create --name ci-accept-lb --vip-subnet-id ci-accept-subnet --wait -f json; then
+    MADE_LB=1
+    PS=$(jget "$LB" provisioning_status || true)
+    OPS=$(jget "$LB" operating_status || true)
+    if [ "$PS" = "ACTIVE" ]; then
+      row F1 PASS "load balancer ACTIVE (operating status: ${OPS:-unknown}); cascade-deleted at teardown"
+    else
+      row F1 FAIL "load balancer finished with provisioning status '$PS', not ACTIVE"
+    fi
+  else
+    F1_ERR="$(oerr)"
+    MADE_LB=1   # a failed --wait may still have left the balancer; check
+    if ! cap CHK loadbalancer show ci-accept-lb -f json; then MADE_LB=0; fi
+    row F1 FAIL "load balancer create failed: $F1_ERR"
+  fi
+else
+  row F1 SKIP "blocked: needs the C2 subnet"
+fi
+
+if [ "$MADE_LB" = 1 ] && [ -n "$VM_IP" ]; then
+  F2_OK=1
+  cap LSN loadbalancer listener create --name ci-accept-listener \
+      --protocol TCP --protocol-port 80 --wait ci-accept-lb -f json || F2_OK=0
+  [ "$F2_OK" = 1 ] && { cap POOL loadbalancer pool create --name ci-accept-pool \
+      --lb-algorithm ROUND_ROBIN --listener ci-accept-listener --protocol TCP --wait -f json || F2_OK=0; }
+  [ "$F2_OK" = 1 ] && { cap MEM loadbalancer member create --name ci-accept-member \
+      --address "$VM_IP" --protocol-port 80 --subnet-id ci-accept-subnet --wait ci-accept-pool -f json || F2_OK=0; }
+  if [ "$F2_OK" = 1 ]; then
+    row F2 PASS "listener (TCP/80), pool, and server member all created"
+  else
+    row F2 FAIL "listener/pool/member sequence failed: $(oerr)"
+  fi
+else
+  row F2 SKIP "blocked: needs the F1 load balancer and the D2 server's address"
+fi
+
+# ---- G. secrets and certificates --------------------------------------------
+PAYLOAD="ci-accept-check-$(date +%s)"
+if cap SEC secret store --name ci-accept-secret --payload "$PAYLOAD" -f json; then
+  MADE_SECRET=$(jget "$SEC" "Secret href" || true)
+  if [ -n "$MADE_SECRET" ]; then
+    GOT=""
+    cap GOT secret get "$MADE_SECRET" --payload -f value -c Payload || true
+    if [ "$GOT" = "$PAYLOAD" ]; then
+      if openstack secret delete "$MADE_SECRET" </dev/null >/dev/null 2>"$OS_ERR"; then
+        SECRET_DONE=1
+        row G1 PASS "secret stored, retrieved intact, and deleted (your TLS certificate store works)"
+      else
+        row G1 FAIL "secret stored and read back, but delete failed: $(oerr)"
+      fi
+    else
+      row G1 FAIL "retrieved payload did not match what was stored"
+    fi
+  else
+    row G1 FAIL "secret stored but its reference could not be parsed: $(oerr)"
+  fi
+else
+  row G1 FAIL "secret store failed: $(oerr)"
+fi
+
+exit 0   # verdict and final exit code come from the teardown trap
diff --git a/clientdocs/scripts/ci-cleanup-sweep.sh b/clientdocs/scripts/ci-cleanup-sweep.sh
new file mode 100644
index 0000000..692599e
--- /dev/null
+++ b/clientdocs/scripts/ci-cleanup-sweep.sh
@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+# ci-cleanup-sweep.sh -- delete leftover pipeline resources (yours to run/schedule).
+#
+# What: the periodic sweep recommended in section 6 of the CI/Automation
+#       Integration Guide: finds resources in your project whose NAME starts
+#       with a prefix (default: ci-) and that are OLDER than a cutoff
+#       (default: 24 hours), and deletes them in a safe order:
+#         servers -> load balancers -> floating ips -> volumes
+#         -> security groups -> networks
+#       Volumes are only deleted when detached ('available'); floating ips
+#       only when detached AND their description starts with the prefix
+#       (floating ips have no name -- tag yours via --description when you
+#       create them, as acceptance-run.sh does).
+# Why:  leaked CI resources quietly eat your quota -- floating ips count even
+#       when detached. A scheduled sweep older-than-your-longest-pipeline is
+#       the cheapest way to keep headroom.
+# Safety: DRY-RUN BY DEFAULT -- prints what it WOULD delete and touches
+#       nothing until you pass --apply. It never touches a resource whose
+#       name (or floating ip description) does not start with the prefix.
+#
+# Usage: ci-cleanup-sweep.sh [--prefix ci-] [--hours 24] [--apply]
+# Auth:  your normal OpenStack client environment (OS_CLOUD or OS_* variables).
+# Exit:  0 sweep completed (dry-run or applied) | 1 a delete or listing failed
+#        | 2 environment/usage problem.
+set -uo pipefail
+
+PREFIX="ci-"; HOURS=24; APPLY=0
+usage() { echo "usage: ci-cleanup-sweep.sh [--prefix ci-] [--hours 24] [--apply]"; }
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --prefix) [ $# -ge 2 ] || { usage; exit 2; }; PREFIX="$2"; shift 2 ;;
+    --hours)  [ $# -ge 2 ] || { usage; exit 2; }; HOURS="$2";  shift 2 ;;
+    --apply)  APPLY=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "unknown argument: $1"; usage; exit 2 ;;
+  esac
+done
+case "$HOURS" in ''|*[!0-9.]*) echo "--hours must be a number"; exit 2 ;; esac
+[ -n "$PREFIX" ] || { echo "--prefix must not be empty"; exit 2; }
+
+command -v openstack >/dev/null 2>&1 || {
+  echo "SETUP: the 'openstack' client is not installed (pip install python-openstackclient)"; exit 2; }
+command -v python3 >/dev/null 2>&1 || { echo "SETUP: python3 is required"; exit 2; }
+if [ -z "${OS_CLOUD:-}" ] && [ -z "${OS_AUTH_URL:-}" ]; then
+  echo "SETUP: no OpenStack environment found (set OS_CLOUD or the OS_* variables)."
+  exit 2
+fi
+
+WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+OS_ERR="$WORK/stderr.txt"
+SWEEP_FAIL=0; N_DEL=0; N_KEPT=0
+
+# Structured captures take stdout ONLY; stderr goes to a file so client
+# warnings and notices can never corrupt the parsed output.
+cap() { # cap <var> <openstack args...>
+  local __v="$1"; shift
+  local out rc
+  out=$(openstack "$@" </dev/null 2>"$OS_ERR"); rc=$?
+  printf -v "$__v" '%s' "$out"
+  return "$rc"
+}
+oerr() { head -1 "$OS_ERR" 2>/dev/null || true; }
+ids_names() { # stdin: list JSON -> lines "<id>\t<name>" (key casing varies per service)
+  python3 -c '
+import json,sys
+try: rows=json.load(sys.stdin)
+except Exception: sys.exit(1)
+for r in rows:
+    i=r.get("ID") or r.get("Id") or r.get("id") or ""
+    n=r.get("Name") or r.get("name") or ""
+    print("%s\t%s" % (i,n))'
+}
+jget() { # jget <json> <key>... -> first present key value (or empty, rc 1)
+  printf '%s' "$1" | python3 -c '
+import json,sys
+try: d=json.load(sys.stdin)
+except Exception: sys.exit(1)
+for k in sys.argv[1:]:
+    if d.get(k) not in (None,""):
+        print(d[k]); sys.exit(0)
+sys.exit(1)' "${@:2}"
+}
+is_older() { # is_older <iso-timestamp> -> 0 when age >= HOURS
+  python3 -c '
+import sys,datetime
+ts=sys.argv[1].strip().replace("Z","+00:00")
+try: d=datetime.datetime.fromisoformat(ts)
+except ValueError: sys.exit(2)
+if d.tzinfo is None: d=d.replace(tzinfo=datetime.timezone.utc)
+age=(datetime.datetime.now(datetime.timezone.utc)-d).total_seconds()/3600.0
+sys.exit(0 if age >= float(sys.argv[2]) else 1)' "$1" "$HOURS"
+}
+act() { # act <label> <openstack delete args...>
+  local label="$1"; shift
+  if [ "$APPLY" = 1 ]; then
+    if openstack "$@" </dev/null >/dev/null 2>"$OS_ERR"; then
+      echo "  DELETED $label"; N_DEL=$((N_DEL+1))
+    else
+      echo "  DELETE FAILED $label: $(oerr)"; SWEEP_FAIL=1
+    fi
+  else
+    echo "  WOULD DELETE $label"; N_DEL=$((N_DEL+1))
+  fi
+}
+keep() { echo "  keep $1"; N_KEPT=$((N_KEPT+1)); }
+
+MODE="DRY-RUN (pass --apply to act)"; [ "$APPLY" = 1 ] && MODE="APPLY"
+echo "=== CI leftover sweep: prefix '$PREFIX', older than ${HOURS}h -- $MODE ==="
+
+sweep_class() { # sweep_class <label> <list args -- json> ; per-item hook via CB
+  local label="$1"; shift
+  local LIST id name
+  echo "--- $label ---"
+  if ! cap LIST "$@"; then
+    echo "  LIST FAILED: $(oerr)"; SWEEP_FAIL=1; return
+  fi
+  while IFS=$'\t' read -r id name; do
+    [ -n "$id" ] || continue
+    case "$name" in "$PREFIX"*) ;; *) continue ;; esac
+    "$CB" "$id" "$name"
+  done < <(printf '%s' "$LIST" | ids_names)
+}
+
+cb_server() {
+  local SHOW created
+  cap SHOW server show "$1" -f json || { echo "  show failed for server $2: $(oerr)"; SWEEP_FAIL=1; return; }
+  created=$(jget "$SHOW" created created_at || true)
+  is_older "$created" || { keep "server $2 (younger than ${HOURS}h)"; return; }
+  act "server $2" server delete "$1" --wait
+}
+cb_lb() {
+  local SHOW created
+  cap SHOW loadbalancer show "$1" -f json || { echo "  show failed for load balancer $2: $(oerr)"; SWEEP_FAIL=1; return; }
+  created=$(jget "$SHOW" created_at || true)
+  is_older "$created" || { keep "load balancer $2 (younger than ${HOURS}h)"; return; }
+  act "load balancer $2 (cascade)" loadbalancer delete "$1" --cascade --wait
+}
+cb_volume() {
+  local SHOW created status
+  cap SHOW volume show "$1" -f json || { echo "  show failed for volume $2: $(oerr)"; SWEEP_FAIL=1; return; }
+  status=$(jget "$SHOW" status || true)
+  [ "$status" = "available" ] || { keep "volume $2 (status '$status', not detached)"; return; }
+  created=$(jget "$SHOW" created_at || true)
+  is_older "$created" || { keep "volume $2 (younger than ${HOURS}h)"; return; }
+  act "volume $2" volume delete "$1"
+}
+cb_sg() {
+  local SHOW created
+  cap SHOW security group show "$1" -f json || { echo "  show failed for security group $2: $(oerr)"; SWEEP_FAIL=1; return; }
+  created=$(jget "$SHOW" created_at || true)
+  is_older "$created" || { keep "security group $2 (younger than ${HOURS}h)"; return; }
+  act "security group $2" security group delete "$1"
+}
+cb_network() {
+  local SHOW created
+  cap SHOW network show "$1" -f json || { echo "  show failed for network $2: $(oerr)"; SWEEP_FAIL=1; return; }
+  created=$(jget "$SHOW" created_at || true)
+  is_older "$created" || { keep "network $2 (younger than ${HOURS}h)"; return; }
+  act "network $2 (and its subnets)" network delete "$1"
+}
+
+CB=cb_server;  sweep_class "servers" server list -f json
+CB=cb_lb;      sweep_class "load balancers" loadbalancer list -f json
+
+# Floating ips have no name: match on description, and only when detached.
+echo "--- floating ips (matched by description; detached only) ---"
+if cap FIPS floating ip list -f json; then
+  while IFS=$'\t' read -r id _; do
+    [ -n "$id" ] || continue
+    cap SHOW floating ip show "$id" -f json || { echo "  show failed for floating ip $id: $(oerr)"; SWEEP_FAIL=1; continue; }
+    desc=$(jget "$SHOW" description || true)
+    case "$desc" in "$PREFIX"*) ;; *) continue ;; esac
+    addr=$(jget "$SHOW" floating_ip_address || true)
+    port=$(jget "$SHOW" port_id || true)
+    [ -z "$port" ] || { keep "floating ip ${addr:-$id} (still attached)"; continue; }
+    created=$(jget "$SHOW" created_at || true)
+    is_older "$created" || { keep "floating ip ${addr:-$id} (younger than ${HOURS}h)"; continue; }
+    act "floating ip ${addr:-$id} (released)" floating ip delete "$id"
+  done < <(printf '%s' "$FIPS" | ids_names)
+else
+  echo "  LIST FAILED: $(oerr)"; SWEEP_FAIL=1
+fi
+
+CB=cb_volume;  sweep_class "volumes (detached only)" volume list -f json
+CB=cb_sg;      sweep_class "security groups" security group list -f json
+CB=cb_network; sweep_class "networks" network list -f json
+
+echo
+VERB="would be deleted"; [ "$APPLY" = 1 ] && VERB="deleted"
+echo "SWEEP SUMMARY: $N_DEL resource(s) $VERB, $N_KEPT kept (prefix '$PREFIX', ${HOURS}h cutoff)"
+if [ "$SWEEP_FAIL" = 1 ]; then
+  echo "RESULT: SWEEP FAIL (one or more listings or deletions failed above)"
+  exit 1
+fi
+echo "RESULT: SWEEP OK"
+exit 0
diff --git a/clientdocs/scripts/clouds.yaml.template b/clientdocs/scripts/clouds.yaml.template
new file mode 100644
index 0000000..b73d81d
--- /dev/null
+++ b/clientdocs/scripts/clouds.yaml.template
@@ -0,0 +1,26 @@
+# clouds.yaml.template -- OpenStack client configuration for your pipelines.
+#
+# What: the clouds.yaml entry from section 3 of the CI/Automation Integration
+#       Guide, as a ready-to-copy file. The OpenStack CLI, Terraform/OpenTofu,
+#       Ansible, and the OpenStack SDK all read this format.
+# How:  copy to clouds.yaml (the client looks in the current directory, then
+#       ~/.config/openstack/, then /etc/openstack/), fill the fields below,
+#       then select it with:  export OS_CLOUD={{TENANT_SHORT_NAME}}
+#
+# Fields written in double curly braces are filled in by us before delivery.
+# Fields in angle brackets are yours to fill from the delivered credential
+# file -- and the secret should be injected at job runtime from your CI
+# secret store, not written to disk in a repository.
+#
+# Never commit a filled-in copy of this file to a repository.
+
+clouds:
+  {{TENANT_SHORT_NAME}}:
+    auth_type: v3applicationcredential
+    auth:
+      auth_url: {{AUTH_URL}}
+      application_credential_id: <id from the delivered credential file>
+      application_credential_secret: <injected from your CI secret store>
+    region_name: {{REGION}}
+    identity_api_version: 3
+    cacert: <path to the delivered CA bundle {{CA_BUNDLE_FILE}}>
diff --git a/clientdocs/scripts/smoke-test.sh b/clientdocs/scripts/smoke-test.sh
new file mode 100644
index 0000000..bd16ec0
--- /dev/null
+++ b/clientdocs/scripts/smoke-test.sh
@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# smoke-test.sh -- Omega Cloud environment health check (yours to run; read-only).
+#
+# What: proves your automation credential and environment work end to end:
+#         1. issue a token (authentication)
+#         2. list the service catalog (endpoint discovery)
+#         3. read your quota/limits envelope (capacity visibility)
+#       These are rows A1/A4/A5 of the Acceptance Checklist and the first
+#       triage steps of the CI/Automation Integration Guide.
+# Why:  authentication and quota explain most sudden pipeline breakage --
+#       run this first whenever automation against your environment fails,
+#       and as the opening stage of every pipeline.
+# Safety: READ-ONLY. This script creates, changes, and deletes nothing.
+#
+# Auth: your normal OpenStack client environment -- either OS_CLOUD (from a
+#       clouds.yaml) or the OS_* variables from the CI/Automation Integration
+#       Guide. No arguments needed.
+# Exit: 0 all checks passed | 1 a check failed | 2 environment not set up.
+set -uo pipefail
+
+command -v openstack >/dev/null 2>&1 || {
+  echo "SETUP: the 'openstack' client is not installed (pip install python-openstackclient)"; exit 2; }
+command -v python3 >/dev/null 2>&1 || { echo "SETUP: python3 is required"; exit 2; }
+if [ -z "${OS_CLOUD:-}" ] && [ -z "${OS_AUTH_URL:-}" ]; then
+  echo "SETUP: no OpenStack environment found."
+  echo "  Either: export OS_CLOUD=<your cloud name from clouds.yaml>"
+  echo "  Or:     export the OS_* variables from the CI/Automation Integration Guide."
+  exit 2
+fi
+
+WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+OS_ERR="$WORK/stderr.txt"
+FAILED=0
+
+# Structured captures take stdout ONLY; stderr goes to a file so client
+# warnings and notices can never corrupt the parsed output.
+cap() { # cap <var> <openstack args...>
+  local __v="$1"; shift
+  local out rc
+  out=$(openstack "$@" </dev/null 2>"$OS_ERR"); rc=$?
+  printf -v "$__v" '%s' "$out"
+  return "$rc"
+}
+oerr() { head -1 "$OS_ERR" 2>/dev/null || true; }
+
+echo "=== Omega Cloud smoke test ($(date -u +%Y-%m-%dT%H:%M:%SZ)) ==="
+
+# ---- 1/3 authentication --------------------------------------------------
+if cap TOK token issue -f json; then
+  PROJECT_ID=$(printf '%s' "$TOK" | python3 -c '
+import json,sys
+try: print(json.load(sys.stdin).get("project_id",""))
+except Exception: pass')
+  if [ -n "$PROJECT_ID" ]; then
+    echo "  [PASS] 1/3 token issued, scoped to your project ($PROJECT_ID)"
+  else
+    echo "  [FAIL] 1/3 token issue returned output the client could not parse"
+    [ -s "$OS_ERR" ] && echo "         client said: $(oerr)"
+    FAILED=1
+  fi
+else
+  echo "  [FAIL] 1/3 authentication failed"
+  echo "         client said: $(oerr)"
+  echo "         Most common causes (check in this order):"
+  echo "           - the application credential was revoked or has expired"
+  echo "             (whoever rotates credentials on your side will know)"
+  echo "           - the CA bundle is missing from this environment"
+  echo "             (OS_CACERT, or 'cacert' in clouds.yaml -- do not disable"
+  echo "              certificate verification instead)"
+  echo "           - the credential id/secret were not injected into this job"
+  FAILED=1
+fi
+
+# ---- 2/3 endpoint discovery ----------------------------------------------
+if [ "$FAILED" -eq 0 ]; then
+  if cap CAT catalog list -f json; then
+    SUMMARY=$(printf '%s' "$CAT" | python3 -c '
+import json,sys
+try: rows=json.load(sys.stdin)
+except Exception: sys.exit(1)
+types=sorted({r.get("Type","?") for r in rows})
+print("%d services: %s" % (len(rows), ", ".join(types)))') || SUMMARY=""
+    if [ -n "$SUMMARY" ]; then
+      echo "  [PASS] 2/3 service catalog visible ($SUMMARY)"
+    else
+      echo "  [FAIL] 2/3 catalog list returned unparseable output: $(oerr)"
+      FAILED=1
+    fi
+  else
+    echo "  [FAIL] 2/3 catalog list failed: $(oerr)"
+    FAILED=1
+  fi
+else
+  echo "  [SKIP] 2/3 catalog list (blocked: authentication failed)"
+fi
+
+# ---- 3/3 quota envelope ---------------------------------------------------
+if [ "$FAILED" -eq 0 ]; then
+  if cap LIM limits show --absolute -f json; then
+    USAGE=$(printf '%s' "$LIM" | python3 -c '
+import json,sys
+try: d={r.get("Name"): r.get("Value") for r in json.load(sys.stdin)}
+except Exception: sys.exit(1)
+def g(k): return d.get(k, "?")
+print("instances %s/%s, cores %s/%s, ram %s/%s MB" % (
+  g("totalInstancesUsed"), g("maxTotalInstances"),
+  g("totalCoresUsed"), g("maxTotalCores"),
+  g("totalRAMUsed"), g("maxTotalRAMSize")))') || USAGE=""
+    if [ -n "$USAGE" ]; then
+      echo "  [PASS] 3/3 quota envelope visible (used/limit: $USAGE)"
+      echo "         Quota-exceeded errors in pipelines are actionable, not"
+      echo "         retryable: clean up leaked resources or request a raise."
+    else
+      echo "  [FAIL] 3/3 limits show returned unparseable output: $(oerr)"
+      FAILED=1
+    fi
+  else
+    echo "  [FAIL] 3/3 limits show failed: $(oerr)"
+    FAILED=1
+  fi
+else
+  echo "  [SKIP] 3/3 limits show (blocked by an earlier failure)"
+fi
+
+echo
+if [ "$FAILED" -eq 0 ]; then
+  echo "RESULT: SMOKE TEST PASS (authentication, catalog, quota all healthy)"
+  exit 0
+fi
+echo "RESULT: SMOKE TEST FAIL"
+echo "  Reminders from the integration guide:"
+echo "  - A permission error on identity, quota, or cluster operations is the"
+echo "    platform working as designed, not an outage."
+echo "  - Anything that looks like a platform fault: send the EXACT command"
+echo "    and the EXACT error text to your account contact. Verbatim errors"
+echo "    get fast answers; paraphrased ones do not."
+exit 1
diff --git a/clientdocs/scripts/tenancy-audit.sh b/clientdocs/scripts/tenancy-audit.sh
new file mode 100644
index 0000000..247447e
--- /dev/null
+++ b/clientdocs/scripts/tenancy-audit.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# tenancy-audit.sh -- read-only snapshot of your Omega Cloud tenancy.
+#
+# Changes NOTHING. Lists every resource class you own plus your quota
+# envelope. Run it as your automation credential (export OS_CLOUD=<name>,
+# per the CI/Automation Integration Guide) any time you want a picture of
+# current state -- and always before making changes. This is also the
+# recommended first test of a new tool or AI-assistant setup: it proves
+# authentication, the CA bundle, and endpoint discovery in one pass.
+#
+# Usage: bash tenancy-audit.sh
+# Exit: 0 every listing answered | 1 one or more listings failed.
+set -uo pipefail
+fail=0
+list() {
+  echo "== openstack $*"
+  if ! openstack "$@"; then
+    echo "   FAILED -- triage order: token, quota, boundary (see the skill's troubleshooting reference)"
+    fail=1
+  fi
+  echo
+}
+list network list
+list subnet list
+list router list
+list security group list
+list server list
+list volume list
+list floating ip list
+list loadbalancer list
+list coe cluster list
+echo "== quota envelope and current consumption"
+if ! openstack limits show --absolute; then
+  echo "   FAILED to read limits"; fail=1
+fi
+echo
+if [ "$fail" -eq 0 ]; then echo "AUDIT: PASS (read-only; nothing was changed)"; else echo "AUDIT: FAIL"; fi
+exit "$fail"
diff --git a/clientdocs/sweep-receipt.txt b/clientdocs/sweep-receipt.txt
index 570c4dd..c470f00 100644
--- a/clientdocs/sweep-receipt.txt
+++ b/clientdocs/sweep-receipt.txt
@@ -3,17 +3,30 @@
 # Each entry pins the reviewed state of one tenant-facing file:
 #   <sha256>  <repo-relative-path>
 # The path list IS the tenant-facing manifest (tenant scripts, clientdocs/
-# and the onboarding contract are auto-covered; runbooks/policy files are
-# manual lines -- add a line with any hash and recording fixes it).
+# incl. its scripts/ subdir, and the onboarding contract are auto-covered;
+# runbooks/policy files are manual lines -- add a line with any hash and
+# recording fixes it).
 # Repo lint fails when any pinned file drifts, until clientdocs/ has been
 # reviewed for staleness and this receipt is re-recorded with:
 #   bash scripts/repo-lint.sh --record-clientdocs-sweep
-d333a3a261960cc7186c260f8e9350feabbefd2a9484088225afc07f9be6d742  clientdocs/README.md
+91860cb337bd8a807f73418ede2365425e8f73ea4704f64e25146d3f0acba244  clientdocs/README.md
 d8595b7a1bb339af0a05ea547a814d63d906dc17e5a51609aa041bb56d637fd8  clientdocs/acceptance-checklist.md
+c94cb2de99c84e0cc649ecef40a81860537c7209ae5a6bea339daedac0767a05  clientdocs/ai-assistant-guide.md
 a7dcdd137fcf8f38fb32716a70c1d988c5365d379d6a450722e29fff99effb1c  clientdocs/ci-integration-guide.md
 5d3cc5597b550fdcadb3f084062479ddd4f1b22576a154c855bcb64f5cecc727  clientdocs/handover-pack.md
 307967ca80a0daf168e295b3a4fba0ff71b08e208932070bdb83b81a0f4b0ef9  clientdocs/intake-form.md
+96a077bb2e5732a0443683755bcefa044a603fe323024ca887165177e05c390b  clientdocs/scripts/Jenkinsfile.example
+4d63def4b32566507e5bc1da21670fcfe7622f0927d4886b179e17cbaac5690a  clientdocs/scripts/acceptance-run.sh
+c2a2ff7ad719cb5866b1b58f5ca2cac930ccc99b96efaf8a3f12301d645727d3  clientdocs/scripts/ci-cleanup-sweep.sh
+d45eb3738d7fb2742ea1a3abb5af464df8a96bfd4e6c2f56b7182b42f997b289  clientdocs/scripts/clouds.yaml.template
+3dd17ab9e95d99bea0c9f36a2662e77d25ea9d691f8c60d1d314f237c7c3f655  clientdocs/scripts/smoke-test.sh
+7667bb1d2ff1e315f8ecaa2b4f680d04978a79ceeeb8cc3f5e16de2b295b2205  clientdocs/scripts/tenancy-audit.sh
 c084b45c2dbe3d3430f0428b1aa55e4563787a88f59598938b024fdcd3f12a47  clientdocs/self-service-guide.md
+e7dbe2aeb654463522cf1050470bf99a0a443f6c5813519fde63021da4c376bb  clientdocs/tenant-skill/SKILL.md
+6bd33aa16d0bfd140a7fd6d2efe2bf84b3a46c8f1bba7b33814a25554bf81063  clientdocs/tenant-skill/references/ci-automation.md
+5858a30c2cd70e9c25f7f435271a04863e5a1ca257ff1e07a3b05021a80382cd  clientdocs/tenant-skill/references/day2-operations.md
+69bd29f8c20d6a57cc5240e0fed6e8f5022683bf3ea687e74c761552993468a4  clientdocs/tenant-skill/references/kubernetes.md
+d1a01b19650efb0caf14a992590b7606da3ddf76820a613096a296c6a5e2fd6d  clientdocs/tenant-skill/references/troubleshooting.md
 488bda3e51ca1ddd6adb51bb317fccd5ee04731687fa7975e41a4043efe87adb  clientdocs/welcome.md
 04c0a08df9168448740514ae9763968eb7ea706cef58533c51c7448a5b0329c3  docs/tenant-onboarding-contract.md
 64f99b638a1855b02180e907c9535db8bddc5847a502759a9e0d63c513b63077  policies/domain-manager-policy.yaml
diff --git a/clientdocs/tenant-skill/SKILL.md b/clientdocs/tenant-skill/SKILL.md
new file mode 100644
index 0000000..97aa693
--- /dev/null
+++ b/clientdocs/tenant-skill/SKILL.md
@@ -0,0 +1,194 @@
+---
+name: omega-cloud-tenant
+description: "Operate this organization's Omega Cloud tenancy correctly. Use this skill for ANY work against the Omega Cloud environment: creating or managing virtual machines, private networks, routers, security groups, public (floating) IPs, storage volumes, load balancers, Kubernetes clusters, application secrets and TLS certificates, CI/CD pipelines that talk to the cloud, quota questions, and team user management. Use it even for seemingly simple OpenStack commands: this platform has a three-account model and deliberate permission boundaries that make generic OpenStack advice wrong here."
+---
+
+# omega-cloud-tenant
+
+You are operating a private, isolated environment (a "domain") on Omega
+Cloud, a managed OpenStack platform. Everything inside the domain is
+self-service; the platform around it is managed by the operator. This
+skill tells you which account to use for which job, which permission
+errors are correct behavior, and how to behave on a live environment.
+
+TEMPLATE NOTE (removed before delivery): fields written as {{THIS}} are
+filled in per client at handover. A delivered copy contains none.
+
+Your identifiers (from the Handover Pack):
+
+- Client short name (prefix on everything): `{{TENANT_SHORT_NAME}}`
+- Identity endpoint (auth URL): `{{AUTH_URL}}`
+- Web dashboard: `{{DASHBOARD_URL}}`
+- Region: `{{REGION}}`
+- Account contact (for anything the platform will not let you do):
+  {{ACCOUNT_CONTACT}}
+
+## Step 0 - pick the right account (the #1 source of failures)
+
+Three accounts exist. Using the wrong one for a job is the most common
+self-inflicted failure on this platform. Before running ANY command,
+decide which account the job belongs to:
+
+| Account | Signs in with | Use it for | Never for |
+|---|---|---|---|
+| `{{TENANT_SHORT_NAME}}-domain-admin` | password | team users, projects, role grants inside your domain | workloads, automation |
+| `{{TENANT_SHORT_NAME}}-cluster` | password | Kubernetes cluster create/delete; it OWNS the SSH keypair `{{TENANT_SHORT_NAME}}-key` | general automation, team logins |
+| `{{TENANT_SHORT_NAME}}-svc` | its application credential (`{{TENANT_SHORT_NAME}}-svc-cred`) | everything else: networks, VMs, volumes, floating IPs, load balancers, secrets, all scripted and day-2 work | Kubernetes cluster create/delete, identity work |
+
+Three rules that prevent the three most common outages:
+
+1. Kubernetes clusters are created and deleted ONLY by the `-cluster`
+   account, signed in with its PASSWORD. The platform's cluster
+   machinery cannot operate through an application credential; a
+   cluster create attempted with the `-svc` credential fails every
+   time. This is a platform constraint, not a setting.
+2. The SSH keypair `{{TENANT_SHORT_NAME}}-key` belongs to the
+   `-cluster` account. Never delete it or recreate it under another
+   account; clusters refuse to build with a key owned by anyone else.
+3. The `-domain-admin` account does identity work ONLY. Never run
+   workloads or automation with it, and never hand out its password;
+   create individual users for people instead.
+
+## The boundary model - refusals that are BY DESIGN
+
+The platform enforces hard boundaries. When one of these operations is
+refused, the refusal is CORRECT BEHAVIOR: do not retry, do not switch
+accounts to work around it, do not treat it as an outage, and never
+try to "fix" it. Report the need to a human instead.
+
+Expected refusals:
+
+- Identity operations (create user, grant role) attempted with the
+  application credential: denied. Identity work belongs to
+  `-domain-admin` only.
+- Kubernetes cluster create/delete attempted with the application
+  credential: denied. Use the `-cluster` account with its password.
+- Any quota change from any of your accounts: denied. Quotas are set
+  by the operator; an authorized requester asks via {{ACCOUNT_CONTACT}}.
+- Any grant of `admin` to any user: denied by design. If an `admin`
+  grant ever SUCCEEDS or appears in your domain, stop and report it
+  to {{ACCOUNT_CONTACT}} as urgent -- that is a platform incident.
+- Changes to the shared substrate (the external network
+  `provider-ext`, the public floating IP pool, shared base images,
+  machine sizes): denied. Requests go through {{ACCOUNT_CONTACT}}.
+- Anything touching another domain or the platform's own
+  infrastructure: denied, always.
+
+The full table, with triage order, is in
+`references/troubleshooting.md`.
+
+## Authenticating
+
+Tools authenticate against the identity endpoint `{{AUTH_URL}}` and
+discover every other service from the catalog. Two equivalent forms:
+
+`clouds.yaml` (preferred for interactive work):
+
+    clouds:
+      {{TENANT_SHORT_NAME}}:
+        auth_type: v3applicationcredential
+        auth:
+          auth_url: {{AUTH_URL}}
+          application_credential_id: <id from the delivered credential file>
+          application_credential_secret: <injected at runtime, never written to a repo>
+        region_name: {{REGION}}
+        identity_api_version: 3
+        cacert: <path to the delivered CA bundle>
+
+    export OS_CLOUD={{TENANT_SHORT_NAME}}
+    openstack token issue        # smoke test: a token scoped to your project
+
+Environment-variable form (no file needed): `OS_AUTH_TYPE`,
+`OS_AUTH_URL`, `OS_IDENTITY_API_VERSION=3`, `OS_CACERT`,
+`OS_APPLICATION_CREDENTIAL_ID`, `OS_APPLICATION_CREDENTIAL_SECRET`.
+Password logins (for `-domain-admin` and `-cluster`) use
+`OS_AUTH_TYPE=password` with `OS_USERNAME`, `OS_PASSWORD`,
+`OS_USER_DOMAIN_NAME={{TENANT_SHORT_NAME}}`,
+`OS_PROJECT_NAME={{TENANT_SHORT_NAME}}-prod`,
+`OS_PROJECT_DOMAIN_NAME={{TENANT_SHORT_NAME}}` -- prompt the human for
+the password; never read it from a file into your context.
+
+Rules that always apply:
+
+- Never hardcode a service endpoint. Authenticate against
+  `{{AUTH_URL}}` and let the client discover the rest
+  (`openstack catalog list` shows what it sees).
+- Always point tools at the delivered CA bundle (`cacert` /
+  `OS_CACERT`). Never disable TLS verification instead.
+- The dashboard at {{DASHBOARD_URL}} is the human-facing path; your
+  work goes through the CLI/API, which always has the full
+  capability set.
+
+## Routing - where to go for what
+
+Load the reference file BEFORE doing work in its area; each carries
+the runnable command sequences and the traps.
+
+| Task | Read first |
+|---|---|
+| Networks, routers, security groups, VMs, volumes, floating IPs, load balancers, secrets/TLS | `references/day2-operations.md` |
+| Anything Kubernetes: create/delete clusters, kubeconfig, deploying, Services of type LoadBalancer | `references/kubernetes.md` |
+| CI pipelines, automation credentials, credential rotation, pipeline hygiene | `references/ci-automation.md` |
+| Any failure, error message, or permission denial | `references/troubleshooting.md` |
+| Team users and role grants | Step 0 above (as `-domain-admin`); user-create commands in `references/day2-operations.md` |
+| Read-only audit, CI smoke test, leftover sweep | the delivered starter scripts (see "Starter scripts" below) |
+| Quota raise, password reset, custodian change, shared substrate | not self-service -- an authorized requester contacts {{ACCOUNT_CONTACT}} |
+
+## Starter scripts (delivered with your document pack)
+
+Your document pack includes a `scripts/` directory of READ-ONLY
+helpers; run them with `bash` from wherever your team keeps the pack:
+
+- `bash scripts/tenancy-audit.sh` -- full read-only snapshot of the
+  tenancy plus the quota envelope. The recommended first command of
+  any session, and the standard proof that authentication, the CA
+  bundle, and endpoint discovery all work.
+- `bash scripts/smoke-test.sh` -- CI smoke test (token, catalog,
+  quota headroom); make it the first step of every pipeline.
+- `bash scripts/ci-cleanup-sweep.sh --prefix ci-` -- reports
+  pipeline-created leftovers and detached floating IPs (dry-run by
+  default; deletes NOTHING without `--apply` -- deletion stays a
+  deliberate, human-confirmed choice).
+- `bash scripts/acceptance-run.sh` -- the automated acceptance
+  checklist rows (self-service ones); also your recurring deep smoke
+  test.
+
+All three change nothing. If your copy of the pack does not include
+them, the inline commands in the reference files cover the same
+ground.
+
+## Operating discipline (you are acting on a LIVE environment)
+
+1. Read-only before mutate. Audit current state with `list`/`show`
+   commands before any create, change, or delete.
+2. Confirm before destroy. Never delete, detach, or replace a
+   resource without explicit human confirmation naming the resource.
+   Never batch destructive operations.
+3. Never print credential material. No password, application
+   credential secret, kubeconfig content, or private key ever goes to
+   the screen, a log, or your output. Verify a credential file by
+   length or format from a script, never by displaying it.
+4. Quota errors are actionable, not retryable. A quota-exceeded error
+   means: clean up leaked resources, or have an authorized requester
+   ask {{ACCOUNT_CONTACT}} for a raise. Retrying will not help.
+5. Expected refusals are not bugs (see the boundary model above).
+   Never escalate privileges or switch accounts to bypass a denial.
+6. Pace your polling. Waiting for a resource to build: poll at
+   10-second intervals or slower, or use the CLI `--wait` flags.
+   Load balancers take minutes and clusters take tens of minutes --
+   that is normal, not a hang.
+7. Name what you create. Tag or name resources with a purpose or job
+   id so they can be found and cleaned up; delete what you no longer
+   need (floating IPs count against quota even when detached).
+8. On anything that looks like a platform fault, capture the exact
+   command and the verbatim error text for {{ACCOUNT_CONTACT}}.
+   Verbatim errors get fast answers; paraphrased ones do not.
+
+## Companion documents
+
+The Welcome letter, Self-Service Guide, Handover Pack, Acceptance
+Checklist, and CI/Automation Integration Guide delivered at handover
+are the authoritative long-form references; this skill is the
+operating layer over them. If this skill and a delivered document
+disagree, the delivered document wins -- flag the divergence to
+{{ACCOUNT_CONTACT}}.
diff --git a/clientdocs/tenant-skill/references/ci-automation.md b/clientdocs/tenant-skill/references/ci-automation.md
new file mode 100644
index 0000000..87bde0b
--- /dev/null
+++ b/clientdocs/tenant-skill/references/ci-automation.md
@@ -0,0 +1,126 @@
+# CI and automation against your tenancy
+
+Distilled from the CI/Automation Integration Guide delivered at
+handover; that guide is authoritative if they ever disagree.
+
+## The one rule: pipelines use the application credential
+
+ALL automation authenticates as the `-svc` account's application
+credential (`{{TENANT_SHORT_NAME}}-svc-cred`). Never a password. Why:
+
+- Scoped: it acts only inside your project, with exactly the `-svc`
+  rights. It cannot touch identity, quotas, or anything outside your
+  domain -- a leaked pipeline credential is contained by design.
+- Revocable without collateral: delete the credential and every
+  pipeline using it stops, but the account and your other credentials
+  are untouched. Rotation never needs the operator.
+- No interactive dependency: it does not expire with a password
+  change.
+
+Platform-enforced corollaries (expected refusals, not bugs): the
+application credential cannot create/delete Kubernetes clusters
+(see `references/kubernetes.md`), cannot create users or grant roles,
+and cannot change quotas.
+
+## Secret-store handling
+
+The credential's `id` and `secret` live in your CI system's native
+secret store (Jenkins credentials, GitLab CI variables, GitHub
+Actions secrets), injected into jobs as environment variables. Never:
+
+- commit them to a repository (including a private one),
+- bake them into a container or VM image,
+- echo them in build output (mask them in the CI configuration).
+
+When asked to verify a credential, check length/format in a script;
+never print the value.
+
+## Pipeline authentication
+
+`clouds.yaml` and `OS_*` environment-variable forms are in SKILL.md;
+the same values work for Terraform/OpenTofu's OpenStack provider,
+Ansible's openstack.cloud collection, and the OpenStack SDK. In a
+pipeline step:
+
+    export OS_CLOUD={{TENANT_SHORT_NAME}}
+    openstack token issue        # smoke test: token scoped to your project
+
+The delivered starter script `bash scripts/smoke-test.sh` wraps
+the full smoke test (token, catalog, quota headroom) as one
+pipeline-ready step.
+
+Never hardcode service endpoints; authenticate against `{{AUTH_URL}}`
+and let the client discover the rest from the catalog. Always ship
+the delivered CA bundle to the job environment and point `cacert` /
+`OS_CACERT` at it.
+
+## Least privilege: one credential per pipeline, with expiry
+
+Use the handover credential only as the "root" automation credential.
+Sign in as `{{TENANT_SHORT_NAME}}-svc` (password, interactively --
+not from CI) and mint a narrower credential per pipeline:
+
+    openstack application credential create pipeline-nightly \
+      --role member --expiration <YYYY-MM-DDTHH:MM:SS>
+
+One credential per pipeline means you can revoke one without stopping
+the others, and the audit trail says which pipeline did what.
+Revocation is immediate and self-service:
+
+    openstack application credential delete pipeline-nightly
+
+Rotate by creating the new credential first, cutting the pipeline
+over, then deleting the old one.
+
+## The worked 9-step sequence (canonical pipeline order)
+
+The same order the Acceptance Checklist proves at onboarding. Name
+everything with your build id (e.g. `ci-<build>-web`).
+
+1. Authenticate + discover: `openstack token issue`, then
+   `openstack catalog list`.
+2. Network build-out: network, subnet (non-overlapping range), router
+   gatewayed to `provider-ext`, attach subnet -- or reuse the
+   handover network for simple runs.
+3. Security group with exactly the ports the deployment needs.
+4. Compute: boot a server from a shared base image with the keypair;
+   wait for ACTIVE.
+5. Block storage: create a volume, attach, verify `in-use`, detach.
+6. Public access: allocate a floating IP from `provider-ext`, attach,
+   verify reachability.
+7. Load balancer: create on your subnet with listener, pool, and the
+   server as member; wait for ACTIVE/ONLINE.
+8. Secrets: store, retrieve, delete a test secret.
+9. Teardown in REVERSE order -- member/pool/listener/load balancer,
+   floating IP (release it), server, volume, security group, router
+   interface/router/subnet/network -- then verify with the `list`
+   commands that nothing is left.
+
+Command sequences for each step are in
+`references/day2-operations.md`. Keep a trimmed version of the
+sequence as the pipeline's recurring smoke test.
+
+## Cleanup and pacing discipline
+
+- Quota is the hard envelope; every create is checked server-side.
+  Treat quota-exceeded as an expected, actionable failure (clean up
+  leaked resources or request a raise via an authorized requester),
+  never as a retryable platform fault. A pre-flight
+  `openstack limits show --absolute` in long pipelines is cheap
+  insurance.
+- Poll at 10-second intervals or slower, or use `--wait`.
+- Serialize heavyweight creates (load balancers, clusters).
+- Make teardown a step that runs ON FAILURE TOO. A periodic sweep job
+  deleting `ci-*` resources older than your longest pipeline is the
+  cheapest way to keep quota headroom. Floating IPs count against
+  quota even when detached -- release them. The delivered starter
+  script `bash scripts/ci-cleanup-sweep.sh` reports leftovers and
+  detached floating IPs (dry-run by default -- it deletes nothing
+  unless you pass `--apply`); schedule the dry-run and act on its
+  report, or schedule `--apply` once you trust the prefix filter.
+
+## When a pipeline call fails
+
+Triage in order -- see `references/troubleshooting.md`. Short form:
+token first, quota second, boundary third, verbatim error to
+{{ACCOUNT_CONTACT}} last.
diff --git a/clientdocs/tenant-skill/references/day2-operations.md b/clientdocs/tenant-skill/references/day2-operations.md
new file mode 100644
index 0000000..c740ff0
--- /dev/null
+++ b/clientdocs/tenant-skill/references/day2-operations.md
@@ -0,0 +1,151 @@
+# Day-2 operations: networks, VMs, volumes, floating IPs, security groups, load balancers
+
+Account: everything on this page runs as the `-svc` account's
+application credential (`export OS_CLOUD={{TENANT_SHORT_NAME}}` per
+SKILL.md), EXCEPT team-user management, which runs as
+`-domain-admin`. Values in `<angle brackets>` are yours to fill;
+`{{THIS}}` fields were filled at handover.
+
+Your handover environment already contains a working network
+(`{{TENANT_SHORT_NAME}}-net` / `{{TENANT_SHORT_NAME}}-subnet`), a
+router (`{{TENANT_SHORT_NAME}}-router`) gatewayed to the shared
+external network `provider-ext`, and the keypair
+`{{TENANT_SHORT_NAME}}-key`. Reuse them for simple work; build new
+networks only when you need separation.
+
+## Audit first (read-only, safe anytime)
+
+The delivered starter script `bash scripts/tenancy-audit.sh` runs all
+of the below in one pass; the individual commands:
+
+    openstack network list
+    openstack router list
+    openstack security group list
+    openstack server list
+    openstack volume list
+    openstack floating ip list
+    openstack loadbalancer list
+    openstack limits show --absolute     # quota envelope + current consumption
+
+## Building a new network (first-time order matters)
+
+1. Network, then a subnet on it. Choose a range inside your recorded
+   allocation (see your Handover Pack) that does NOT overlap
+   `{{TENANT_SHORT_NAME}}-subnet` or any on-premises/VPN range you may
+   later interconnect.
+
+       openstack network create <name>-net
+       openstack subnet create --network <name>-net \
+         --subnet-range <your-range> <name>-subnet
+
+2. Router, gateway to the shared external network, attach the subnet:
+
+       openstack router create <name>-router
+       openstack router set --external-gateway provider-ext <name>-router
+       openstack router add subnet <name>-router <name>-subnet
+
+3. Security group: open only what you need (SSH from your ranges,
+   your application ports):
+
+       openstack security group create <name>-sg
+       openstack security group rule create --proto tcp --dst-port 22 \
+         --remote-ip <your-office-or-vpn-range> <name>-sg
+       openstack security group rule create --proto tcp --dst-port <app-port> \
+         --remote-ip 0.0.0.0/0 <name>-sg
+
+Teardown is the exact reverse: remove the router interface, then
+router, subnet, network. The platform refuses to delete a network
+that still has ports in use -- delete the servers and load balancers
+on it first.
+
+## Virtual machines
+
+Boot from the shared base images with your keypair; password logins
+are disabled on the base images.
+
+    openstack image list          # shared base images
+    openstack flavor list         # machine sizes
+    openstack server create --image <image> --flavor <flavor> \
+      --network {{TENANT_SHORT_NAME}}-net \
+      --key-name {{TENANT_SHORT_NAME}}-key \
+      --security-group <name>-sg \
+      --wait <server-name>
+
+`--wait` returns when the server is ACTIVE. You can also upload your
+own private images (`openstack image create`); they are visible only
+inside your project.
+
+Delete (confirm with the human first, by name):
+
+    openstack server delete <server-name>
+
+## Volumes (data that outlives the instance)
+
+    openstack volume create --size <GB> <vol-name>          # wait for: available
+    openstack server add volume <server-name> <vol-name>    # then: in-use
+    openstack server remove volume <server-name> <vol-name>
+    openstack volume delete <vol-name>
+
+Root disks vanish with the server; put anything you care about on a
+volume.
+
+## Public (floating) IPs
+
+    openstack floating ip create provider-ext
+    openstack server add floating ip <server-name> <address>
+    openstack server remove floating ip <server-name> <address>
+    openstack floating ip delete <address>
+
+Floating IPs count against your quota even when detached -- release
+what you are not using.
+
+## Load balancers
+
+Your accounts already hold the required load-balancer role. Builds
+take several minutes; that is normal -- use `--wait`.
+
+    openstack loadbalancer create --name <lb-name> \
+      --vip-subnet-id {{TENANT_SHORT_NAME}}-subnet --wait
+    openstack loadbalancer listener create --name <lb-name>-listener \
+      --protocol TCP --protocol-port 80 <lb-name>
+    openstack loadbalancer pool create --name <lb-name>-pool \
+      --lb-algorithm ROUND_ROBIN --listener <lb-name>-listener --protocol TCP
+    openstack loadbalancer member create --subnet-id {{TENANT_SHORT_NAME}}-subnet \
+      --address <server-private-ip> --protocol-port 80 <lb-name>-pool
+
+Give the load balancer a floating IP the same way as a server
+(allocate from `provider-ext`, attach to the load balancer's VIP
+port). Delete with `--cascade` to remove listeners/pools/members in
+one step:
+
+    openstack loadbalancer delete --cascade <lb-name>
+
+Serialize heavyweight creates: launching many load balancers
+concurrently mostly makes them queue.
+
+## Secrets and TLS certificates
+
+The platform's secrets service stores application secrets and the
+TLS certificates that load balancer listeners use:
+
+    openstack secret store --name <secret-name> --payload <value>
+    openstack secret list
+    openstack secret get <secret-href>
+    openstack secret delete <secret-href>
+
+For a TLS-terminating listener, upload the certificate bundle to the
+secrets service under your project and reference it from the
+listener. Never echo secret payloads into logs or your output.
+
+## Team users (as `-domain-admin` -- the ONLY job for that account)
+
+    openstack user create --domain {{TENANT_SHORT_NAME}} --password-prompt <username>
+    openstack role add --user <username> --user-domain {{TENANT_SHORT_NAME}} \
+      --project {{TENANT_SHORT_NAME}}-prod member
+
+Grant `load-balancer_member` the same way for users who manage load
+balancers. Each person gets their own user -- never share logins.
+Granting `admin` is refused by design; do not attempt it. If a
+dashboard identity page refuses an action this account should be able
+to do, use the CLI for that step and mention it to
+{{ACCOUNT_CONTACT}} -- the API always has the full capability set.
diff --git a/clientdocs/tenant-skill/references/kubernetes.md b/clientdocs/tenant-skill/references/kubernetes.md
new file mode 100644
index 0000000..11b2244
--- /dev/null
+++ b/clientdocs/tenant-skill/references/kubernetes.md
@@ -0,0 +1,95 @@
+# Kubernetes clusters on Omega Cloud
+
+## The one non-negotiable: the `-cluster` account, with its PASSWORD
+
+Cluster create and delete run ONLY as `{{TENANT_SHORT_NAME}}-cluster`,
+signed in with its password. The platform's cluster machinery cannot
+operate through an application credential -- a cluster create
+attempted with the `-svc` credential fails every time, no matter how
+it is phrased. This is a platform constraint, not a configuration you
+(or the operator) can change. Do not "simplify" cluster automation to
+the application credential; it will never work.
+
+Sign in (prompt the human for the password -- never read it from a
+file into your context, never store it in CI):
+
+    export OS_AUTH_TYPE=password
+    export OS_AUTH_URL={{AUTH_URL}}
+    export OS_IDENTITY_API_VERSION=3
+    export OS_CACERT=<path to the delivered CA bundle>
+    export OS_USERNAME={{TENANT_SHORT_NAME}}-cluster
+    export OS_USER_DOMAIN_NAME={{TENANT_SHORT_NAME}}
+    export OS_PROJECT_NAME={{TENANT_SHORT_NAME}}-prod
+    export OS_PROJECT_DOMAIN_NAME={{TENANT_SHORT_NAME}}
+    read -rs -p "password for {{TENANT_SHORT_NAME}}-cluster: " OS_PASSWORD && export OS_PASSWORD
+    openstack token issue        # smoke test
+
+## The keypair-ownership trap
+
+The SSH keypair `{{TENANT_SHORT_NAME}}-key` is OWNED by the
+`-cluster` account, and the platform validates keypair ownership in
+the cluster creator's context. Consequences:
+
+- Never delete `{{TENANT_SHORT_NAME}}-key` or recreate it under
+  another account. A key with the same name owned by `-svc` or a team
+  user will make every cluster create fail.
+- "Keypair not found" at cluster create almost always means you are
+  signed in as the wrong account -- check `OS_USERNAME` before
+  anything else.
+
+## Cluster lifecycle
+
+Your cluster template was delivered at handover:
+
+    openstack coe cluster template show {{TENANT_SHORT_NAME}}-k8s
+
+Create (node counts are limited by your quota; builds take TENS OF
+MINUTES -- poll slowly or just wait):
+
+    openstack coe cluster create <cluster-name> \
+      --cluster-template {{TENANT_SHORT_NAME}}-k8s \
+      --keypair {{TENANT_SHORT_NAME}}-key \
+      --master-count 1 --node-count <N>
+
+    openstack coe cluster show <cluster-name>   # poll >=10s apart
+    # done when status = CREATE_COMPLETE
+
+Fetch the kubeconfig (treat it as a credential -- never print its
+contents; store it like any other secret):
+
+    openstack coe cluster config <cluster-name> --dir <secure-dir>
+    export KUBECONFIG=<secure-dir>/config
+    kubectl get nodes
+
+Delete (confirm with the human first, by name):
+
+    openstack coe cluster delete <cluster-name>
+
+## Deploying workloads: Services of type LoadBalancer
+
+The cluster gets its own load balancer for the Kubernetes API, and it
+can publish `Service` objects of `type: LoadBalancer` through the
+same platform mechanism -- no extra setup needed:
+
+    kubectl expose deployment <app> --type=LoadBalancer --port=80
+
+The Service's external address is allocated from the platform. Each
+such Service consumes a load balancer (and typically a floating IP)
+from YOUR quota -- prefer a single ingress controller of type
+LoadBalancer fronting many Services over one LoadBalancer per app.
+
+## Clusters and CI (the recommended split)
+
+- Create long-lived clusters manually (or on a controlled schedule)
+  as `-cluster`, OUTSIDE CI.
+- Pipelines then deploy INTO the cluster using its kubeconfig, stored
+  in the CI secret store like any other credential.
+- Do NOT put the `-cluster` password into CI so pipelines can create
+  clusters. If your workflow genuinely needs cluster-per-run, raise
+  it with {{ACCOUNT_CONTACT}} first -- there are capacity and quota
+  implications.
+
+Day-2 cloud work around the cluster (networks, floating IPs, volumes,
+extra load balancers) still runs as `-svc` per
+`references/day2-operations.md`; only cluster create/delete needs the
+`-cluster` password login.
diff --git a/clientdocs/tenant-skill/references/troubleshooting.md b/clientdocs/tenant-skill/references/troubleshooting.md
new file mode 100644
index 0000000..d602b32
--- /dev/null
+++ b/clientdocs/tenant-skill/references/troubleshooting.md
@@ -0,0 +1,98 @@
+# Troubleshooting: triage in this order
+
+Work the list top to bottom; most failures are caught by step 1 or 2.
+Never guess past a step -- verify it, then move on.
+
+## 1. Token first
+
+    openstack token issue
+
+Authentication failures explain most sudden breakage. If this fails,
+check in order:
+
+- Revoked or expired application credential (per-pipeline credentials
+  are often minted with `--expiration` -- check the date with
+  `openstack application credential show <name>` from the `-svc`
+  account).
+- Missing CA bundle in the environment (`OS_CACERT` / `cacert` not
+  set, or the file absent from the job environment). The fix is
+  supplying the bundle, never disabling TLS verification.
+- Wrong account for the job (see SKILL.md Step 0). Check
+  `OS_USERNAME` / `OS_CLOUD` before anything else.
+- A password was changed or the credential file is stale: a custodian
+  requests a reset via {{ACCOUNT_CONTACT}} -- there is deliberately
+  no self-service password recovery.
+
+## 2. Quota second
+
+    openstack limits show --absolute
+
+The second most common cause. Quota-exceeded errors are expected,
+actionable failures, NOT retryable platform faults:
+
+- First: look for leaked resources and clean them up (servers,
+  volumes, load balancers, and especially detached floating IPs --
+  they count against quota too).
+- If consumption is legitimate: an authorized requester asks
+  {{ACCOUNT_CONTACT}} for a raise. Your accounts cannot raise quotas;
+  do not try.
+
+## 3. Is this a boundary? (expected refusals)
+
+Before treating a permission error as a fault, check this table. A
+match means the platform is working AS DESIGNED: do not retry, do not
+switch accounts to bypass it, and never attempt to "fix" the denial.
+
+| Operation attempted | As | Result | Why it is correct |
+|---|---|---|---|
+| `openstack user create` / any role grant | application credential | DENIED | identity work belongs to `-domain-admin` only |
+| `openstack coe cluster create` / `delete` | application credential | DENIED | cluster machinery requires the `-cluster` password login |
+| grant `admin` to any user | any account | DENIED | the platform refuses admin on client accounts by design |
+| any quota change | any of your accounts | DENIED | quotas are operator-set; request via an authorized requester |
+| modify `provider-ext`, the floating IP pool, shared images, machine sizes | any of your accounts | DENIED | shared substrate is operator-managed |
+| anything in another domain | any of your accounts | DENIED / not visible | that is your isolation working |
+
+Two inversions of this table are INCIDENTS -- report to
+{{ACCOUNT_CONTACT}} urgently, investigate second:
+
+- An operation in this table SUCCEEDS (e.g. an `admin` grant lands).
+- One of your accounts appears to hold rights beyond those listed in
+  your Handover Pack.
+
+## 4. Known failure signatures (check before escalating)
+
+- "Keypair not found" at cluster create: you are signed in as the
+  wrong account -- the keypair belongs to `-cluster`. See
+  `references/kubernetes.md`.
+- Cluster create fails instantly with the `-svc` credential: boundary
+  (table above), not an outage.
+- Subnet create rejected for overlap: pick a range that does not
+  collide with `{{TENANT_SHORT_NAME}}-subnet` or your other networks.
+- Network delete refused: it still has ports -- delete the servers
+  and load balancers on it first, detach the router interface last.
+- Load balancer sitting in PENDING_CREATE for minutes: normal build
+  time. Poll >=10s or use `--wait`; only escalate after it goes to
+  ERROR.
+- Cluster build running for tens of minutes: normal. Only escalate on
+  a FAILED status.
+- Dashboard refuses an identity action that `-domain-admin` should be
+  able to do: use the CLI for that step (the API has the full
+  capability set) and mention it to {{ACCOUNT_CONTACT}}.
+- SSH to a new VM times out: check (in order) the security group
+  allows TCP/22 from your source range, the floating IP is attached,
+  and you are using the right private key for
+  `{{TENANT_SHORT_NAME}}-key`.
+
+## 5. Escalate with the verbatim error
+
+Anything left looks like a platform fault. Capture:
+
+1. The exact command you ran (with the account/credential type used,
+   never the secret itself).
+2. The exact, unedited error text.
+3. What step 1 and step 2 showed (token OK? quota headroom?).
+
+Send that to {{ACCOUNT_CONTACT}} -- marked urgent for outages or
+anything security-shaped. Verbatim errors get fast answers;
+paraphrased ones do not. While waiting, do not repeat mutating
+commands; repeated half-failed creates leak quota.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 36ec434..d5998ec 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -31,8 +31,8 @@
 - **OPEN security rows:** SEC-001 (rotate at v1 close, re-ruled 2026-07-06),
   SEC-003 (custodians + second-person unseal -- DEFERRED; keeps d011-06 MANUAL),
   SEC-004 (flip repo to private at v1 close -- deferral reaffirmed).
-- **Next-free numbers:** D = 075, DOCFIX = 108, BUNDLEFIX = 012.
-  (Scan and the addendum-29 changelog next-free pointer agree.)
+- **Next-free numbers:** D = 075, DOCFIX = 110, BUNDLEFIX = 012.
+  (Scan and the addendum-30 changelog next-free pointer agree.)
 
 ---
 
@@ -271,6 +271,13 @@
 - **Open (small):** Horizon manual checks on foil1 (operator, browser,
   non-blocking); capi-test-1 CREATE_FAILED leftover (orphan-sweep candidate);
   beta-cluster lbtest leftover; repo-lint worktree-exclusion DOCFIX candidate.
+- **CLIENT PACKAGE COMPLETE (addendum 30):** starter kit (DOCFIX-108, 6
+  deliverables incl. tenancy-audit from the skill delivery; pipeline-smoke +
+  leftover-check deduped away) + tenant AI skill omega-cloud-tenant
+  (DOCFIX-109, leakage-gated) integrated; L7 coverage recursive; receipt 29
+  files; gauntlet 37/37. REMAINING before handover: operator-requested
+  polish pass over the final clientdocs set (in flight), then devteam
+  onboarding next session instantiates the pack.
 - **D-074 EXECUTED (addendum 29):** operator ADOPTED the main-chat CIDR
   correction PLAN same-day (overlap-allowed tenant CIDRs; client-choice +
   10.100.0.0/24 fallback; capi-mgmt stays reserved; L5 print removed).
diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md
index cbc76a1..64eef9d 100644
--- a/docs/v1-redeploy-changelog.md
+++ b/docs/v1-redeploy-changelog.md
@@ -2495,3 +2495,61 @@
   per operator ruling.
 
 Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-108, BUNDLEFIX-012.
+
+### 2026-07-06 (addendum 30, jumphost stream) -- client handover package COMPLETE: DOCFIX-108 starter kit + DOCFIX-109 tenant AI skill
+
+Two operator-approved client-facing deliverables integrated from worktree
+drafts (union-merged: both touched the L7 coverage, README, and receipt; the
+skill's second delivery added three scripts overlapping the kit's -- deduped
+at integration, skill routing re-pointed).
+
+- **DOCFIX-108 -- clientdocs/scripts/ tenant starter kit.** smoke-test.sh
+  (read-only health: token/catalog/limits, checklist rows A1/A4/A5, triage
+  hints); acceptance-run.sh (automated self-service checklist rows,
+  ci-accept-* naming, EXIT-trap reverse teardown, expected-refusal rows must
+  fail-to-PASS, scoreboard); ci-cleanup-sweep.sh (leftover sweep: --prefix/
+  --hours, DRY-RUN default, --apply gated); tenancy-audit.sh (read-only
+  tenancy snapshot + quota envelope -- from the skill delivery, kept in the
+  dedupe); clouds.yaml.template; Jenkinsfile.example (credentials()
+  injection, smoke -> acceptance -> always-runs sweep). All client-voice,
+  fully generic (client's own OS_* env, catalog discovery, zero internal
+  values). Harness tests/clientdocs-scripts/run-tests.sh: 47 checks (incl.
+  teardown-on-midway-failure trap proof, dry-run-vs-apply, prefix isolation,
+  stderr-noise truthful mocks). DEDUPE: the skill delivery's
+  pipeline-smoke.sh and leftover-check.sh were DROPPED as duplicates of
+  smoke-test.sh / ci-cleanup-sweep.sh (dry-run); skill + guide references
+  re-pointed. Known adaptations documented in-script: D2 boots a throwaway
+  keypair (handover key is -cluster-owned; app-cred cannot use it -- the
+  checklist text carries the same latent nuance, polish-pass candidate); C2
+  uses an unrouted default range with CI_ACCEPT_CIDR override.
+- **DOCFIX-109 -- clientdocs/tenant-skill/ (Claude Agent Skill
+  omega-cloud-tenant) + clientdocs/ai-assistant-guide.md.** SKILL.md
+  (three-account model, by-design-refusal boundary table, auth patterns,
+  routing table incl. starter-kit rows, 8-point live-tenancy discipline for
+  an AI assistant) + references/ (day2-operations, kubernetes,
+  ci-automation, troubleshooting). Client install: copy as
+  .claude/skills/omega-cloud-tenant/. Placeholder set exactly
+  {{TENANT_SHORT_NAME}} {{AUTH_URL}} {{DASHBOARD_URL}} {{REGION}}
+  {{ACCOUNT_CONTACT}}. Harness tests/clientdocs-skill/run-tests.sh: 8 gates
+  incl. internal-term LEAKAGE scan (operator tooling, component code names,
+  internal hosts/CIDRs, identifier shapes -- self-tested against planted
+  leaks) and routing reachability.
+- **L7 auto-coverage extended (rides 108/109):** repo_lint.py sweep_auto now
+  covers clientdocs RECURSIVELY (*.md anywhere incl. tenant-skill/, *.sh,
+  scripts/*); repo-lint harness 17->22 cases (subdir .md/.sh
+  covered/recorded/drift). Receipt re-recorded: 29 files pinned.
+- **Gates:** clientdocs-scripts 47/47; clientdocs-skill 8/8; repo-lint
+  harness 22/22; gauntlet ALL GREEN (37 harnesses, 2 new); lint 0 fail /
+  1 legacy warn (session worktrees pruned post-commit).
+- REVERT (per item): DOCFIX-108: git rm -r clientdocs/scripts
+  tests/clientdocs-scripts + drop the README kit sections + re-record
+  receipt. DOCFIX-109: git rm -r clientdocs/tenant-skill
+  tests/clientdocs-skill clientdocs/ai-assistant-guide.md + drop the README
+  skill sections + re-record receipt. L7 recursion: git checkout HEAD~ --
+  scripts/repo_lint.py tests/repo-lint/run-tests.sh.
+
+Next up (queued): operator-requested polish pass over the FINAL clientdocs
+set before handover; then devteam onboarding (next session; D-074 guard,
+10.100.0.0/24 fallback) with handover-pack instantiation.
+
+Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-110, BUNDLEFIX-012.
diff --git a/scripts/repo_lint.py b/scripts/repo_lint.py
index 9631b91..c7fe029 100644
--- a/scripts/repo_lint.py
+++ b/scripts/repo_lint.py
@@ -27,8 +27,8 @@
   L7  clientdocs    client-docs sweep-on-change (DOCFIX-104): tenant-facing
                     files are hash-pinned in clientdocs/sweep-receipt.txt (the
                     path list IS the manifest; scripts/tenant-*.sh, clientdocs/
-                    *.md and docs/tenant-onboarding-contract.md are auto-
-                    covered). Any pinned file drifting from its recorded hash
+                    *.md, clientdocs/scripts/* and docs/tenant-onboarding-
+                    contract.md are auto-covered). Any pinned file drifting from its recorded hash
                     FAILS until the operator reviews clientdocs/ for staleness
                     and re-records: bash scripts/repo-lint.sh
                     --record-clientdocs-sweep (the ONLY thing this flag
@@ -50,8 +50,9 @@
 # Each entry pins the reviewed state of one tenant-facing file:
 #   <sha256>  <repo-relative-path>
 # The path list IS the tenant-facing manifest (tenant scripts, clientdocs/
-# and the onboarding contract are auto-covered; runbooks/policy files are
-# manual lines -- add a line with any hash and recording fixes it).
+# incl. its scripts/ subdir, and the onboarding contract are auto-covered;
+# runbooks/policy files are manual lines -- add a line with any hash and
+# recording fixes it).
 # Repo lint fails when any pinned file drifts, until clientdocs/ has been
 # reviewed for staleness and this receipt is re-recorded with:
 #   bash scripts/repo-lint.sh --record-clientdocs-sweep
@@ -69,7 +70,11 @@
     receipt = cdir / "sweep-receipt.txt"
 
     def sweep_auto():  # files the manifest MUST cover (existence-driven, no guesses)
-        out = sorted(cdir.glob("*.md")) + sorted((R / "scripts").glob("tenant-*.sh"))
+        # recursive over clientdocs/: *.md anywhere (incl. tenant-skill/) and
+        # everything under scripts/ (kit .sh + .template/.example deliverables)
+        cd = set(cdir.rglob("*.md")) | set(cdir.rglob("*.sh")) | set(cdir.glob("scripts/*"))
+        cd.discard(receipt)
+        out = sorted(cd) + sorted((R / "scripts").glob("tenant-*.sh"))
         contract = R / "docs" / "tenant-onboarding-contract.md"
         if contract.is_file():
             out.append(contract)
diff --git a/tests/clientdocs-scripts/run-tests.sh b/tests/clientdocs-scripts/run-tests.sh
new file mode 100644
index 0000000..9824d3f
--- /dev/null
+++ b/tests/clientdocs-scripts/run-tests.sh
@@ -0,0 +1,323 @@
+#!/usr/bin/env bash
+# tests/clientdocs-scripts/run-tests.sh -- offline harness for the client
+# starter kit under clientdocs/scripts/ (smoke-test.sh, acceptance-run.sh,
+# ci-cleanup-sweep.sh, clouds.yaml.template).
+#
+# A fake openstack CLI on PATH replays fixture behavior and logs every call
+# to $FAKELOG; resource existence lives as files under a per-case $STATE dir
+# so creates/deletes/lists stay consistent (the acceptance teardown leftover
+# check reads post-teardown reality). Several fakes deliberately emit notices
+# ON STDERR, so the happy paths prove the scripts' stdout-only JSON captures.
+# A fake sleep compresses the 10s poll loops. No cloud access; mutates
+# NOTHING outside mktemp dirs.
+#
+# Cases: smoke pass / auth-fail triage / missing env; acceptance happy path
+# (expected-refusal A6 passes, teardown clean + reverse-ordered), broken
+# refusal boundary (A6 fails, leaked user removed), midway server failure
+# (dependent rows SKIP, EXIT-trap teardown still runs); sweep dry-run vs
+# --apply, age filter, detached-only volume rule, floating-ip description
+# matching, prefix isolation; clouds.yaml.template placeholder inventory
+# matches the CI integration guide.
+# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+KIT="$REPO/clientdocs/scripts"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0; CN=0
+BIN="$TMP/bin"; mkdir -p "$BIN"
+
+# ---------------- fake openstack (stateful; logs every call) ----------------
+cat > "$BIN/openstack" <<'FB'
+#!/usr/bin/env bash
+set -u
+echo "$*" >> "$FAKELOG"
+err(){ echo "$1" >&2; exit 1; }
+meta(){ cat "$STATE/$1" 2>/dev/null || true; }
+names_json(){ # names_json <kind> <idkey> <namekey> -- list JSON from state files
+  local k="$1" ik="$2" nk="$3" first=1 f n
+  printf '['
+  for f in "$STATE/$k".*; do
+    [ -e "$f" ] || continue
+    n="${f##*/}"; n="${n#"$k".}"
+    [ "$first" = 1 ] || printf ','
+    first=0
+    printf '{"%s":"%s","%s":"%s"}' "$ik" "$n" "$nk" "$n"
+  done
+  printf ']\n'
+}
+case "$*" in
+  "token issue -f json")
+      echo "SDK notice: fake always writes this line on stderr" >&2
+      [ -e "$FIXDIR/fail-auth" ] && err "The request you have made requires authentication. (HTTP 401)"
+      printf '{"expires":"2027-01-01T00:00:00+0000","id":"gAAAAfaketoken","project_id":"b0000000000000000000000000000001","user_id":"u0000000000000000000000000000001"}\n' ;;
+  "catalog list -f json")
+      echo "WARNING: fake deprecation-style notice on stderr" >&2
+      printf '[{"Name":"keystone","Type":"identity"},{"Name":"nova","Type":"compute"},{"Name":"glance","Type":"image"},{"Name":"neutron","Type":"network"},{"Name":"cinderv3","Type":"volumev3"},{"Name":"octavia","Type":"load-balancer"},{"Name":"barbican","Type":"key-manager"},{"Name":"placement","Type":"placement"}]\n' ;;
+  "limits show --absolute -f json")
+      printf '[{"Name":"maxTotalInstances","Value":10},{"Name":"totalInstancesUsed","Value":1},{"Name":"maxTotalCores","Value":20},{"Name":"totalCoresUsed","Value":2},{"Name":"maxTotalRAMSize","Value":51200},{"Name":"totalRAMUsed","Value":2048}]\n' ;;
+  "user create ci-accept-probe -f json")
+      if [ -e "$FIXDIR/refusal-broken" ]; then
+        : > "$STATE/user.ci-accept-probe"
+        printf '{"id":"u-probe","name":"ci-accept-probe"}\n'
+      else
+        err "You are not authorized to perform the requested action: identity:create_user. (HTTP 403)"
+      fi ;;
+  "user delete ci-accept-probe") rm -f "$STATE/user.ci-accept-probe" ;;
+  "project show b0000000000000000000000000000001 -f json")
+      printf '{"id":"b0000000000000000000000000000001","name":"testco-prod"}\n' ;;
+  "network show testco-net -f json")
+      printf '{"id":"net-handover0001","name":"testco-net","created_at":"2026-01-01T00:00:00Z"}\n' ;;
+  "router show testco-router -f json")
+      printf '{"id":"rtr-handover0001","name":"testco-router","external_gateway_info":{"network_id":"extnet0000000001"}}\n' ;;
+  "network show provider-ext -f json")
+      printf '{"id":"extnet0000000001","name":"provider-ext"}\n' ;;
+  "network create ci-accept-net -f json")
+      : > "$STATE/network.ci-accept-net"
+      printf '{"id":"net-ci-accept0001","name":"ci-accept-net"}\n' ;;
+  "subnet create ci-accept-subnet --network ci-accept-net --subnet-range "*" -f json")
+      : > "$STATE/subnet.ci-accept-subnet"
+      printf '{"id":"sub-ci-accept0001","name":"ci-accept-subnet"}\n' ;;
+  "security group create ci-accept-sg -f json")
+      : > "$STATE/secgroup.ci-accept-sg"
+      printf '{"id":"sg-ci-accept0001","name":"ci-accept-sg"}\n' ;;
+  "security group rule create ci-accept-sg "*)
+      printf '{"id":"sgr-ci-accept0001"}\n' ;;
+  "floating ip create provider-ext --description ci-accept-fip -f json")
+      printf 'now|ci-accept-fip|-' > "$STATE/fip.fip0001"
+      printf '{"id":"fip0001","floating_ip_address":"203.0.113.10","description":"ci-accept-fip"}\n' ;;
+  "image list -f json")
+      printf '[{"ID":"img1","Name":"fedora-40","Status":"active"},{"ID":"img2","Name":"ubuntu-24.04","Status":"active"}]\n' ;;
+  "flavor list -f json")
+      printf '[{"ID":"f1","Name":"m1.small","RAM":2048,"VCPUs":1},{"ID":"f0","Name":"m1.tiny","RAM":512,"VCPUs":1}]\n' ;;
+  "keypair create ci-accept-key")
+      : > "$STATE/keypair.ci-accept-key"
+      printf -- '-----BEGIN FAKE PRIVATE KEY-----\nnot-a-real-key\n-----END FAKE PRIVATE KEY-----\n' ;;
+  "keypair delete ci-accept-key") rm -f "$STATE/keypair.ci-accept-key" ;;
+  "server create ci-accept-vm "*)
+      [ -e "$FIXDIR/fail-server" ] && err "Quota exceeded for instances: Requested 1, but already used 10 of 10 instances (HTTP 403)"
+      : > "$STATE/server.ci-accept-vm"
+      printf '{"id":"srv-ci-accept0001","name":"ci-accept-vm","status":"ACTIVE"}\n' ;;
+  "server show ci-accept-vm -f json")
+      [ -e "$STATE/server.ci-accept-vm" ] || err "No server with a name or ID of 'ci-accept-vm' exists."
+      printf '{"id":"srv-ci-accept0001","name":"ci-accept-vm","status":"ACTIVE","created":"2026-07-06T00:00:00Z","addresses":{"ci-accept-net":["192.168.199.11"]}}\n' ;;
+  "volume create --size 1 ci-accept-vol -f json")
+      echo creating > "$STATE/volstatus"
+      printf 'now|creating' > "$STATE/volume.ci-accept-vol"
+      printf '{"id":"vol-ci-accept0001","name":"ci-accept-vol","status":"creating"}\n' ;;
+  "volume show ci-accept-vol -f json")
+      [ -e "$STATE/volume.ci-accept-vol" ] || err "No volume with a name or ID of 'ci-accept-vol' exists."
+      ST=$(cat "$STATE/volstatus")
+      [ "$ST" = "creating" ] && echo available > "$STATE/volstatus"  # progresses next call
+      printf '{"id":"vol-ci-accept0001","name":"ci-accept-vol","status":"%s"}\n' "$ST" ;;
+  "server add volume ci-accept-vm ci-accept-vol")    echo in-use > "$STATE/volstatus" ;;
+  "server remove volume ci-accept-vm ci-accept-vol") echo available > "$STATE/volstatus" ;;
+  "loadbalancer create --name ci-accept-lb --vip-subnet-id ci-accept-subnet --wait -f json")
+      echo "octavia client notice on stderr" >&2
+      : > "$STATE/lb.ci-accept-lb"
+      printf '{"id":"lb-ci-accept0001","name":"ci-accept-lb","provisioning_status":"ACTIVE","operating_status":"ONLINE"}\n' ;;
+  "loadbalancer show ci-accept-lb -f json")
+      [ -e "$STATE/lb.ci-accept-lb" ] || err "Unable to locate load balancer ci-accept-lb"
+      printf '{"id":"lb-ci-accept0001","name":"ci-accept-lb","provisioning_status":"ACTIVE","created_at":"2026-07-06T00:00:00Z"}\n' ;;
+  "loadbalancer listener create --name ci-accept-listener "*) printf '{"id":"lsn0001","name":"ci-accept-listener"}\n' ;;
+  "loadbalancer pool create --name ci-accept-pool "*)         printf '{"id":"pool0001","name":"ci-accept-pool"}\n' ;;
+  "loadbalancer member create --name ci-accept-member "*)     printf '{"id":"mem0001","name":"ci-accept-member"}\n' ;;
+  "secret store --name ci-accept-secret --payload "*" -f json")
+      PREV=""; PAY=""
+      for a in "$@"; do [ "$PREV" = "--payload" ] && PAY="$a"; PREV="$a"; done
+      printf '%s\n' "$PAY" > "$STATE/secretpayload"
+      : > "$STATE/secret.ci-accept-secret"
+      printf '{"Secret href":"https://secrets.example/v1/secrets/href0001"}\n' ;;
+  "secret get https://secrets.example/v1/secrets/href0001 --payload -f value -c Payload")
+      cat "$STATE/secretpayload" ;;
+  "secret delete https://secrets.example/v1/secrets/href0001")
+      rm -f "$STATE/secret.ci-accept-secret" ;;
+  # ---- deletes (shared by acceptance teardown and the sweep) ----
+  "loadbalancer delete "*" --cascade --wait") rm -f "$STATE/lb.$3" ;;
+  "floating ip delete "*)                     rm -f "$STATE/fip.$4" ;;
+  "server delete "*" --wait")                 rm -f "$STATE/server.$3" ;;
+  "volume delete "*)                          rm -f "$STATE/volume.$3" ;;
+  "security group delete "*)                  rm -f "$STATE/secgroup.$4" ;;
+  "subnet delete "*)                          rm -f "$STATE/subnet.$3" ;;
+  "network delete "*)                         rm -f "$STATE/network.$3" ;;
+  # ---- lists (built from state so post-teardown reality is truthful) ----
+  "server list -f json")         names_json server ID Name ;;
+  "volume list -f json")         names_json volume ID Name ;;
+  "network list -f json")        names_json network ID Name ;;
+  "security group list -f json") names_json secgroup ID Name ;;
+  "loadbalancer list -f json")   names_json lb id name ;;   # octavia lists use lowercase keys
+  "floating ip list -f json")    names_json fip ID Name ;;
+  # ---- generic shows (sweep age/status checks; state file carries metadata) ----
+  "server show "*" -f json")
+      [ -e "$STATE/server.$3" ] || err "No server with a name or ID of '$3' exists."
+      printf '{"id":"%s","name":"%s","status":"ACTIVE","created":"%s"}\n' "$3" "$3" "$(meta "server.$3")" ;;
+  "loadbalancer show "*" -f json")
+      printf '{"id":"%s","name":"%s","provisioning_status":"ACTIVE","created_at":"%s"}\n' "$3" "$3" "$(meta "lb.$3")" ;;
+  "volume show "*" -f json")
+      IFS='|' read -r TS VST < "$STATE/volume.$3" || true
+      printf '{"id":"%s","name":"%s","status":"%s","created_at":"%s"}\n' "$3" "$3" "$VST" "$TS" ;;
+  "floating ip show "*" -f json")
+      IFS='|' read -r TS DESC PORT < "$STATE/fip.$4" || true
+      [ "${PORT:-}" = "-" ] && PORT=""
+      if [ -n "${PORT:-}" ]; then PJ="\"$PORT\""; else PJ=null; fi
+      printf '{"id":"%s","floating_ip_address":"203.0.113.5","description":"%s","port_id":%s,"created_at":"%s"}\n' "$4" "${DESC:-}" "$PJ" "$TS" ;;
+  "security group show "*" -f json")
+      printf '{"id":"%s","name":"%s","created_at":"%s"}\n' "$4" "$4" "$(meta "secgroup.$4")" ;;
+  "network show "*" -f json")
+      printf '{"id":"%s","name":"%s","created_at":"%s"}\n' "$3" "$3" "$(meta "network.$3")" ;;
+  *) echo "fake-openstack: unmatched: $*" >&2; exit 1 ;;
+esac
+exit 0
+FB
+chmod +x "$BIN/openstack"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$BIN/sleep"; chmod +x "$BIN/sleep"
+
+# ---------------- harness helpers ----------------
+newcase() { CN=$((CN+1)); CASEDIR="$TMP/case$CN"; mkdir -p "$CASEDIR/fix" "$CASEDIR/state"
+            FAKELOG="$CASEDIR/fakelog"; : > "$FAKELOG"; }
+run_kit() { # run_kit <script> [args...] -> OUT/RC
+  OUT=$(env OS_CLOUD=testco FIXDIR="$CASEDIR/fix" STATE="$CASEDIR/state" FAKELOG="$FAKELOG" \
+        PATH="$BIN:$PATH" bash "$KIT/$1" "${@:2}" 2>&1); RC=$?
+}
+check() { # check <want_rc> <regex> <label>
+  if [ "$RC" = "$1" ] && grep -qE "$2" <<<"$OUT"; then echo "  PASS  $3"; PASS=$((PASS+1))
+  else echo "  FAIL  $3 (rc=$RC want=$1)"; echo "$OUT" | tail -8 | sed 's/^/        /'; FAIL=$((FAIL+1)); fi
+}
+check_not() { # check_not <regex> <label> -- OUT must NOT match
+  if grep -qE "$1" <<<"$OUT"; then echo "  FAIL  $2 (forbidden match)"
+    grep -E "$1" <<<"$OUT" | head -2 | sed 's/^/        /'; FAIL=$((FAIL+1))
+  else echo "  PASS  $2"; PASS=$((PASS+1)); fi
+}
+log_has() { # log_has <regex> <label>
+  if grep -qE "$1" "$FAKELOG"; then echo "  PASS  $2"; PASS=$((PASS+1))
+  else echo "  FAIL  $2 (no '$1' in fake log)"; FAIL=$((FAIL+1)); fi
+}
+log_not() { # log_not <regex> <label>
+  if grep -qE "$1" "$FAKELOG"; then echo "  FAIL  $2 (forbidden call in fake log)"
+    grep -E "$1" "$FAKELOG" | head -2 | sed 's/^/        /'; FAIL=$((FAIL+1))
+  else echo "  PASS  $2"; PASS=$((PASS+1)); fi
+}
+
+# ---------------- smoke-test.sh ----------------
+newcase; run_kit smoke-test.sh
+check 0 'RESULT: SMOKE TEST PASS' "S1 smoke happy path passes (stderr noise tolerated)"
+check 0 'instances 1/10, cores 2/20' "S2 smoke reports the quota envelope"
+
+newcase; : > "$CASEDIR/fix/fail-auth"; run_kit smoke-test.sh
+check 1 'revoked or has expired' "S3 smoke auth failure fails with triage hints"
+check 1 'EXACT command' "S4 smoke failure points at the verbatim-error rule"
+
+newcase
+OUT=$(env OS_CLOUD= OS_AUTH_URL= FIXDIR="$CASEDIR/fix" STATE="$CASEDIR/state" FAKELOG="$FAKELOG" \
+      PATH="$BIN:$PATH" bash "$KIT/smoke-test.sh" 2>&1); RC=$?
+check 2 'no OpenStack environment' "S5 smoke without an environment exits 2"
+
+# ---------------- acceptance-run.sh ----------------
+newcase; run_kit acceptance-run.sh
+check 0 'RESULT: ACCEPTANCE \(automated rows\) PASS' "A1 acceptance happy path passes end-to-end"
+check 0 'A6 +PASS +identity create refused as expected' "A2 expected-refusal row fails-to-PASS"
+check 0 'C1 +PASS +handover network and router intact' "A3 handover check discovered from project name"
+check 0 'teardown: CLEAN' "A4 teardown reports clean"
+check 0 'rows: 15 PASS, 0 FAIL, 0 SKIP' "A5 all 15 automated rows pass"
+check_not 'TEARDOWN FAIL|leftover ci-accept' "A6 no teardown failure or leftover"
+L_LB=$(grep -n '^loadbalancer delete ci-accept-lb' "$FAKELOG" | cut -d: -f1 | head -1)
+L_SRV=$(grep -n '^server delete ci-accept-vm' "$FAKELOG" | cut -d: -f1 | head -1)
+L_NET=$(grep -n '^network delete ci-accept-net' "$FAKELOG" | cut -d: -f1 | head -1)
+if [ -n "$L_LB" ] && [ -n "$L_SRV" ] && [ -n "$L_NET" ] && [ "$L_LB" -lt "$L_SRV" ] && [ "$L_SRV" -lt "$L_NET" ]; then
+  echo "  PASS  A7 teardown runs in reverse order (lb < server < network)"; PASS=$((PASS+1))
+else
+  echo "  FAIL  A7 teardown order wrong (lb=$L_LB server=$L_SRV net=$L_NET)"; FAIL=$((FAIL+1))
+fi
+log_has '^secret delete ' "A8 stored secret is deleted (G1 includes its own delete)"
+
+newcase; : > "$CASEDIR/fix/refusal-broken"; run_kit acceptance-run.sh
+check 1 'A6 +FAIL +user create unexpectedly SUCCEEDED' "A9 broken boundary makes A6 FAIL (fail-to-pass inverted correctly)"
+log_has '^user delete ci-accept-probe' "A10 leaked probe user is removed at teardown"
+
+newcase; : > "$CASEDIR/fix/fail-server"; run_kit acceptance-run.sh
+check 1 'D2 +FAIL +server create failed: Quota exceeded' "A11 midway server failure marks D2 FAIL, run continues"
+check 1 'E2 +SKIP +blocked' "A12 dependent row E2 SKIPs instead of crashing"
+check 1 'F2 +SKIP +blocked' "A13 dependent row F2 SKIPs instead of crashing"
+check 1 'teardown: CLEAN' "A14 teardown still clean after midway failure"
+log_has '^network delete ci-accept-net' "A15 EXIT trap tears the network down despite the failure"
+log_has '^keypair delete ci-accept-key' "A16 EXIT trap removes the keypair created before the failure"
+log_not '^server delete ci-accept-vm' "A17 no delete attempted for the server that never existed"
+
+newcase; : > "$CASEDIR/fix/fail-auth"; run_kit acceptance-run.sh
+check 1 'blocked: authentication \(A1\) failed' "A18 auth failure blocks the remaining rows"
+log_not ' delete ' "A19 nothing is deleted when nothing was created"
+
+# ---------------- ci-cleanup-sweep.sh ----------------
+seed_sweep() { # aged fixture population; ci-* old and new, plus non-matching names
+  local S="$CASEDIR/state" OLD NEW
+  OLD=$(date -u -d "-36 hours" +%Y-%m-%dT%H:%M:%SZ)
+  NEW=$(date -u -d "-1 hours" +%Y-%m-%dT%H:%M:%SZ)
+  printf '%s' "$OLD" > "$S/server.ci-old-vm"
+  printf '%s' "$OLD" > "$S/server.prod-db"
+  printf '%s' "$NEW" > "$S/server.ci-new-vm"
+  printf '%s' "$OLD" > "$S/lb.ci-old-lb"
+  printf '%s|available' "$OLD" > "$S/volume.ci-old-vol"
+  printf '%s|in-use'    "$OLD" > "$S/volume.ci-busy-vol"
+  printf '%s|ci-accept-fip|-' "$OLD"        > "$S/fip.fipA"   # matching desc, detached, old
+  printf '%s||port-in-use-01' "$OLD"        > "$S/fip.fipB"   # no description: never touched
+  printf '%s|ci-accept-fip|port-in-use-02' "$OLD" > "$S/fip.fipC"  # matching but attached
+  printf '%s' "$OLD" > "$S/secgroup.ci-old-sg"
+  printf '%s' "$OLD" > "$S/secgroup.default"
+  printf '%s' "$OLD" > "$S/network.ci-old-net"
+  printf '%s' "$OLD" > "$S/network.testco-net"
+}
+
+newcase; seed_sweep; run_kit ci-cleanup-sweep.sh
+check 0 'WOULD DELETE server ci-old-vm' "W1 dry-run reports the aged ci- server"
+check 0 'keep server ci-new-vm \(younger' "W2 dry-run keeps the young ci- server (age filter)"
+check 0 'keep volume ci-busy-vol \(status .in-use' "W3 dry-run keeps the attached volume"
+check_not 'DELETE.*(prod-db|testco-net|default|fipB)' "W4 dry-run never proposes non-matching names"
+log_not ' delete ' "W5 dry-run issues no delete calls at all"
+
+newcase; seed_sweep; run_kit ci-cleanup-sweep.sh --apply
+check 0 'DELETED server ci-old-vm' "W6 --apply deletes the aged ci- server"
+check 0 'DELETED load balancer ci-old-lb \(cascade\)' "W7 --apply cascade-deletes the aged ci- load balancer"
+check 0 'DELETED floating ip .* \(released\)' "W8 --apply releases the matching detached floating ip"
+check 0 'keep floating ip .* \(still attached\)' "W9 --apply keeps the attached floating ip"
+check 0 'RESULT: SWEEP OK' "W10 --apply run ends OK"
+log_has '^server delete ci-old-vm --wait' "W11 server delete issued with --wait"
+log_has '^floating ip delete fipA' "W12 floating ip delete targets only fipA"
+log_not '(delete prod-db|delete testco-net|delete default|delete ci-new-vm|delete ci-busy-vol|delete fipB|delete fipC)' \
+        "W13 prefix/age/attachment isolation: nothing else deleted"
+
+newcase; seed_sweep; run_kit ci-cleanup-sweep.sh --prefix nomatch- --apply
+check 0 'SWEEP SUMMARY: 0 resource\(s\) deleted' "W14 non-matching prefix deletes nothing"
+log_not ' delete ' "W15 non-matching prefix issues no delete calls"
+
+newcase; run_kit ci-cleanup-sweep.sh --hours notanumber
+check 2 'hours must be a number' "W16 bad --hours value is a usage error (2)"
+newcase; run_kit ci-cleanup-sweep.sh --bogus
+check 2 'unknown argument' "W17 unknown flag is a usage error (2)"
+
+# ---------------- clouds.yaml.template placeholder inventory ----------------
+TPL="$KIT/clouds.yaml.template"
+GUIDE="$REPO/clientdocs/ci-integration-guide.md"
+GOT=$(grep -o '{{[A-Z_]*}}' "$TPL" | sort -u | tr '\n' ' ')
+WANT="{{AUTH_URL}} {{CA_BUNDLE_FILE}} {{REGION}} {{TENANT_SHORT_NAME}} "
+if [ "$GOT" = "$WANT" ]; then echo "  PASS  P1 template placeholder set is exactly the guide's four"; PASS=$((PASS+1))
+else echo "  FAIL  P1 placeholder set mismatch (got: $GOT)"; FAIL=$((FAIL+1)); fi
+P_OK=1
+for ph in '{{TENANT_SHORT_NAME}}' '{{AUTH_URL}}' '{{REGION}}' '{{CA_BUNDLE_FILE}}'; do
+  grep -qF "$ph" "$GUIDE" || { echo "  FAIL  P2 $ph missing from the CI guide"; FAIL=$((FAIL+1)); P_OK=0; }
+done
+[ "$P_OK" = 1 ] && { echo "  PASS  P2 every template placeholder appears in the CI guide"; PASS=$((PASS+1)); }
+if grep -qF '<id from the delivered credential file>' "$TPL" \
+   && grep -qF '<injected from your CI secret store>' "$TPL"; then
+  echo "  PASS  P3 credential id/secret stay client-filled (never operator-prefilled)"; PASS=$((PASS+1))
+else
+  echo "  FAIL  P3 credential id/secret markers missing from the template"; FAIL=$((FAIL+1))
+fi
+
+# ---------------- static sanity: the kit scripts parse ----------------
+for s in smoke-test.sh acceptance-run.sh ci-cleanup-sweep.sh; do
+  if bash -n "$KIT/$s" 2>/dev/null; then echo "  PASS  N1 $s parses (bash -n)"; PASS=$((PASS+1))
+  else echo "  FAIL  N1 $s does not parse"; FAIL=$((FAIL+1)); fi
+done
+
+echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1
diff --git a/tests/clientdocs-skill/run-tests.sh b/tests/clientdocs-skill/run-tests.sh
new file mode 100644
index 0000000..dc16bc1
--- /dev/null
+++ b/tests/clientdocs-skill/run-tests.sh
@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+# tests/clientdocs-skill/run-tests.sh -- content gate for the tenant AI-assistant
+# skill package (clientdocs/tenant-skill/). Read-only; mutates nothing.
+#
+# Gates, in order:
+#   T1  layout: SKILL.md + references/ exist
+#   T2  frontmatter present and parses (name: omega-cloud-tenant, description)
+#   T3  zero internal-term leakage (identifiers, tooling names, component code
+#       names, internal hosts/CIDRs) across every skill file
+#   T4  placeholder inventory is EXACTLY the documented set (clientdocs/README.md)
+#   T5  routing: every references/*.md is reachable from SKILL.md, and every
+#       references/ path mentioned anywhere in the skill exists
+#   T6  ASCII + LF (belt and braces; repo lint L1 also covers this)
+#   T7  expected-refusal table present in troubleshooting.md
+#   T8  starter-script references: every *.sh named in the skill/guide exists
+#       in clientdocs/scripts/, and every starter script parses (bash -n)
+# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+SKILL="$REPO/clientdocs/tenant-skill"
+PASS=0; FAIL=0
+ok()  { echo "  PASS  $1"; PASS=$((PASS+1)); }
+bad() { echo "  FAIL  $1"; shift; for l in "$@"; do echo "        $l"; done; FAIL=$((FAIL+1)); }
+
+# ---- T1 layout ----
+if [[ -f "$SKILL/SKILL.md" && -d "$SKILL/references" ]]; then
+  ok "T1 layout: SKILL.md + references/ present"
+else
+  bad "T1 layout missing (SKILL.md or references/)"; echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"; exit 1
+fi
+mapfile -t FILES < <(find "$SKILL" -name '*.md' | sort)
+
+# ---- T2 frontmatter ----
+FM_OUT="$(python3 - "$SKILL/SKILL.md" <<'PY' 2>&1
+import sys
+t = open(sys.argv[1], encoding="ascii").read()
+if not t.startswith("---\n"):
+    raise SystemExit("no opening frontmatter fence")
+end = t.find("\n---\n", 4)
+if end < 0:
+    raise SystemExit("no closing frontmatter fence")
+fm = t[4:end]
+fields = {}
+for ln in fm.splitlines():
+    if ":" in ln:
+        k, v = ln.split(":", 1)
+        fields[k.strip()] = v.strip().strip('"')
+if fields.get("name") != "omega-cloud-tenant":
+    raise SystemExit("name is %r, want omega-cloud-tenant" % fields.get("name"))
+if len(fields.get("description", "")) < 80:
+    raise SystemExit("description missing or too short to trigger on")
+print("frontmatter ok")
+PY
+)"
+if [[ "$FM_OUT" == "frontmatter ok" ]]; then
+  ok "T2 frontmatter parses (name=omega-cloud-tenant, description present)"
+else
+  bad "T2 frontmatter" "$FM_OUT"
+fi
+
+# ---- T3 internal-term leakage: must return NOTHING ----
+# Internal identifiers, operator tooling, component code names, internal
+# hosts/CIDRs. No sanctioned exceptions inside the skill package. The
+# client-facing usage page for the skill is scanned too.
+LEAK_RX='D-0[0-9]{2}|DOCFIX|BUNDLEFIX|juju|charm|maas|vault|ceph|ovn[^a-z]|magnum|octavia|barbican|keystone|horizon|glance|cinder|neutron|nova[^a-z]|amphora|capi|caracal|runbook|10\.12\.|baldurkeep|vopenstack|neumatrix|jumphost'
+LEAK_FILES=("${FILES[@]}")
+[[ -f "$REPO/clientdocs/ai-assistant-guide.md" ]] && LEAK_FILES+=("$REPO/clientdocs/ai-assistant-guide.md")
+for s in "$REPO"/clientdocs/scripts/*.sh; do [[ -f "$s" ]] && LEAK_FILES+=("$s"); done
+LEAKS="$(grep -rniE "$LEAK_RX" "${LEAK_FILES[@]}" 2>/dev/null)"
+if [[ -z "$LEAKS" ]]; then
+  ok "T3 zero internal-term leakage"
+else
+  bad "T3 internal-term LEAK(s):" "$(echo "$LEAKS" | head -5)"
+fi
+
+# ---- T4 placeholder inventory ----
+# Documented set (clientdocs/README.md). {{THIS}} is the TEMPLATE NOTE
+# meta-token shared with the other clientdocs templates, not a placeholder.
+WANT="ACCOUNT_CONTACT AUTH_URL DASHBOARD_URL REGION TENANT_SHORT_NAME"
+GOT="$(grep -ohE '\{\{[A-Za-z0-9_]+\}\}' "${FILES[@]}" | tr -d '{}' | grep -v '^THIS$' | sort -u | tr '\n' ' ' | sed 's/ $//')"
+if [[ "$GOT" == "$WANT" ]]; then
+  ok "T4 placeholder inventory matches documented set"
+else
+  bad "T4 placeholder inventory drift" "want: $WANT" "got:  $GOT"
+fi
+
+# ---- T5 routing reachability ----
+T5_FAILS=()
+for f in "$SKILL"/references/*.md; do
+  b="references/$(basename "$f")"
+  grep -q "$b" "$SKILL/SKILL.md" || T5_FAILS+=("MISS $b not referenced from SKILL.md")
+done
+while read -r ref; do
+  [[ -f "$SKILL/$ref" ]] || T5_FAILS+=("MISS $ref referenced but absent")
+done < <(grep -ohE 'references/[a-z0-9-]+\.md' "${FILES[@]}" | sort -u)
+if [[ "${#T5_FAILS[@]}" -eq 0 ]]; then
+  ok "T5 routing table reachability (SKILL.md <-> references/)"
+else
+  bad "T5 routing gaps:" "${T5_FAILS[@]}"
+fi
+
+# ---- T6 ASCII + LF ----
+T6_FAILS=()
+for f in "${FILES[@]}"; do
+  if LC_ALL=C grep -q $'\r' "$f"; then T6_FAILS+=("CR bytes in ${f#$REPO/}"); fi
+  if LC_ALL=C grep -qP '[^\x00-\x7F]' "$f"; then T6_FAILS+=("non-ASCII in ${f#$REPO/}"); fi
+done
+if [[ "${#T6_FAILS[@]}" -eq 0 ]]; then
+  ok "T6 ASCII + LF clean"
+else
+  bad "T6 encoding:" "${T6_FAILS[@]}"
+fi
+
+# ---- T7 expected-refusal table ----
+TS="$SKILL/references/troubleshooting.md"
+if grep -qi 'expected refusal' "$TS" && grep -q '| Operation attempted |' "$TS"; then
+  ok "T7 expected-refusal table present in troubleshooting.md"
+else
+  bad "T7 expected-refusal table missing from troubleshooting.md"
+fi
+
+# ---- T8 starter-script references + syntax ----
+T8_FAILS=()
+GUIDE="$REPO/clientdocs/ai-assistant-guide.md"
+while read -r sh; do
+  [[ -f "$REPO/clientdocs/scripts/$sh" ]] || T8_FAILS+=("MISS clientdocs/scripts/$sh referenced but absent")
+done < <(grep -ohE 'scripts/[a-z0-9-]+\.sh' "${FILES[@]}" "$GUIDE" 2>/dev/null | sed 's|^scripts/||' | sort -u)
+for s in "$REPO"/clientdocs/scripts/*.sh; do
+  [[ -f "$s" ]] || continue
+  bash -n "$s" 2>/dev/null || T8_FAILS+=("SYNTAX ${s#$REPO/} fails bash -n")
+done
+if [[ "${#T8_FAILS[@]}" -eq 0 ]]; then
+  ok "T8 starter-script references exist and parse (bash -n)"
+else
+  bad "T8 starter-script gaps:" "${T8_FAILS[@]}"
+fi
+
+echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1
diff --git a/tests/repo-lint/run-tests.sh b/tests/repo-lint/run-tests.sh
index c59561d..124dd41 100644
--- a/tests/repo-lint/run-tests.sh
+++ b/tests/repo-lint/run-tests.sh
@@ -76,5 +76,27 @@
 D=$(mkcd l7h); rec "$D"; printf 'not-a-hash-line\n' >> "$D/clientdocs/sweep-receipt.txt"
                               run 1 'L7 .*malformed line' "T17 L7 malformed receipt line FAILS" "$D"
 
+# clientdocs/scripts/* is auto-covered like clientdocs/*.md (starter-kit files)
+D=$(mkcd l7i); rec "$D"; mkdir -p "$D/clientdocs/scripts"
+printf '#!/usr/bin/env bash\necho smoke\n' > "$D/clientdocs/scripts/smoke.sh"
+                              run 1 'L7 tenant-facing clientdocs/scripts/smoke.sh is not in the sweep receipt' \
+                                    "T18 L7 uncovered clientdocs/scripts file FAILS" "$D"
+D=$(mkcd l7j); mkdir -p "$D/clientdocs/scripts"
+printf '#!/usr/bin/env bash\necho smoke\n' > "$D/clientdocs/scripts/smoke.sh"; rec "$D"
+                              run 0 'PASS: repo lint' "T19 L7 recorded clientdocs/scripts file PASSES" "$D"
+D=$(mkcd l7k); mkdir -p "$D/clientdocs/scripts"
+printf '#!/usr/bin/env bash\necho smoke\n' > "$D/clientdocs/scripts/smoke.sh"; rec "$D"
+printf 'echo changed\n' >> "$D/clientdocs/scripts/smoke.sh"
+                              run 1 'L7 clientdocs/scripts/smoke.sh changed since the recorded clientdocs sweep' \
+                                    "T20 L7 clientdocs/scripts drift FAILS" "$D"
+# *.md in ANY clientdocs subdir is auto-covered (tenant-skill/ package)
+D=$(mkcd l7l); rec "$D"; mkdir -p "$D/clientdocs/tenant-skill/references"
+printf '# skill ref\n' > "$D/clientdocs/tenant-skill/references/ops.md"
+                              run 1 'L7 tenant-facing clientdocs/tenant-skill/references/ops.md is not in the sweep receipt' \
+                                    "T21 L7 uncovered clientdocs subdir .md FAILS" "$D"
+D=$(mkcd l7m); mkdir -p "$D/clientdocs/tenant-skill/references"
+printf '# skill ref\n' > "$D/clientdocs/tenant-skill/references/ops.md"; rec "$D"
+                              run 0 'PASS: repo lint' "T22 L7 recorded subdir .md PASSES" "$D"
+
 echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
 [[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1