# Handoff -- open items register (2026-07-05 session close) **Supersedes** `docs/handoff-20260703-open-items.md` (kept for history). This is the active handoff. **Repo HEAD at close:** `f28de74` ("clearing queue"). **Next-free:** D-073, DOCFIX-091, BUNDLEFIX-012. **Start every new session by:** reading this file + `docs/session-ledger.md`, then running `bash scripts/ledger-scan.sh` AND `bash scripts/ledger-scan.sh --fences`, and reconciling. --- ## 0. Current state (as-built) - Multi-tenant buildout is functionally complete through the beta tenant acceptance tests. - `validate.sh` D-011 acceptance suite is modular and the **gauntlet is ALL GREEN (31 harnesses)**. - **Vault decision recorded (D-068 amendment):** bundle pins vault `1.8/stable` (reactive charm, integration-compatible); the `1.16` operator lineage is RULED OUT (certs interface V0->V1 breaks the 18 `vault:certificates` relations, Raft-only drops the mysql backend, no upgrade path, BUSL, community-broken with Ceph). "Get off EOL vault 1.8.8" stays OPEN under D-068. Evidence: `docs/D-068-vault-1.8-vs-1.16-analysis.md`. Live vault is `1.8/stable` rev 714 (in-channel current). - **Session-ledger is fenced** (delimited-section convention: machine-derived / main-chat / jumphost / shared), and `ledger-scan.sh --fences` validates it (4 sections, 0 errors). Stay in your lane. - The last jumphost ops-update window (`ops-update-20260705`) is CLOSED; fleet refreshed to current in-channel revisions; controllers/agents at juju 3.6.25; appendix-B re-baselined. **Minor reconcile item for the next session:** the ledger "State facts" bullet still reads "ops-update-20260705 in flight" and "D-068 unruled" -- both stale (window closed; D-068 ruled). It's in the append-only shared section, so append a correction rather than rewrite another stream's line. ## 1. Immediate (small, well-defined; good first tasks) - Batch-3 live validation of the D-011 checks (see the verify-live queue below) -- the main thing standing between here and a clean D-011 acceptance close. - `offboard` v2: `--sweep-magnum-orphans` mode (orphan per-cluster trustee in the magnum domain); stage-3 app-cred idempotency re-run guard. (Both logged-not-actioned.) - DOCFIX candidate: sweep the repo for other `-f json ... 2>&1` stderr-merge hazards (DOCFIX-085 class). - `host_href=None` barbican observation (exercised fine in stage 6; probably closeable after a look). ## 2. Verify-live queue (read-only/gated CHECKs; run on the real cloud before trusting) - **d011-04** `amphora_headroom()` field parsing (`server show` .flavor; `hypervisor list --long` vcpu/ram). Safe default HOLDs on any parse miss -- confirm the OK path live. - **d011-04** OCCM LB-name-contains-service-name assumption; agnhost `/hostname` round-robin behavior. - **d011-04** sequence: run non-disruptively first (RR + member failover), THEN `--include-disruptive` once N+1 amphora headroom is confirmed (a cloud at its scheduler ceiling cannot heal its own LBs). - **d011-05** needs a FOIL (2nd) tenant for the P3 isolation check -- onboard one or set `VR_FOIL_APPCRED` (acme, the former foil, was offboarded). ## 3. Operator rulings pending (nothing proceeds without these) - **D-071** (controller update cadence / patch policy) -- stays **PROPOSED**; ratification is GATED on the pre-DC-DC controller HA/backup planning session (see section 6). Do NOT ratify without it. Backups are confirmed to exist (juju 3.6 `create-backup`); the open half is single-controller HA. - **D-068 item 1** vault modernization -- `1.16` is ruled out; the OPEN question is HOW to get off EOL vault 1.8.8 for production. Candidate paths (none adopted): wait for the OpenStack service charms to gain tls-certificates V1 support, evaluate OpenBao (MPL fork), or explicit EOL risk-acceptance for VR0 with a production remediation deadline. Plus D-068 items 2 (Vault listener TLS for Roosevelt -- vault_url is cleartext http today) and 3 (AppRole secret_id TTL audit + proactive auth health probe). - **D-050** keystone `use-policyd-override=true` with no policy zip (FINDING-1) -- and the D-063-adjacent `identity:list_trusts=""` hardening -- remain PROPOSED/OPEN, not actioned. ## 4. Open security-ledger rows - **SEC-001** OPEN -- rotate credentials after the current rebuild completes. - **SEC-003** OPEN -- assign unseal-key custodians + rehearse the second-person unseal (D-069). - **SEC-004** OPEN -- flip repo visibility to PRIVATE at v1 close (currently public for web_fetch). ## 5. The deploy path (the reason for all of the above) Execute the Roosevelt bare-metal multi-datacenter deployment using the Omega Cloud v1 runbooks as the template; the guiding constraint remains minimizing delta to Roosevelt. D-011 (amended per D-019) acceptance validation is the near-term gate -- confirm all criteria post multi-tenant work, which is what the batch-3 verify-live queue closes out. ## 6. v1-close / project-completion checklist (execute after D-011 passes) - Consolidate the 10 per-phase do-documents into a single `docs/v1-deploy-runbook.md`; drop the per-phase files; preserve the 10-doc structure in git history via the consolidation commit. - Set repo visibility PRIVATE (SEC-004). - Hold the pre-DC-DC controller HA/backup planning session -> then rule D-071. ## 7. Deferred, with explicit revisit triggers - **GitBucket SSH** (System Settings -> Integrations; bind 0.0.0.0:29418, public git.baldurkeep.com:29418) -- verify the deployment topology (Docker port map vs systemd vs firewall) before declaring it works. v1 uses HTTPS basic auth. Trigger: v2 / DC-DC phase. - **IPv6 dual-stack** integration + **NetBox restructure/import** -- deferred to DC-DC / v2. - **Roosevelt hardware sheets** needed to resolve the four-NIC collapse path (D-059, parked). - **SpryLogin / identity platform** decision (FreeIPA vs Keycloak vs Authentik). --- ## 8. Startup prompt -- NEW MAIN CHAT (claude.ai stream) > You are resuming the Omega Cloud v1 / Baldurkeep project (commercial multi-tenant Charmed OpenStack > Caracal 2024.1). You are the **main claude.ai chat stream**. A parallel **Claude Code (jumphost)** > stream runs concurrently -- coordinate, do not collide. > > **First, orient (do this before anything else):** pull the repo; read > `docs/handoff-20260705-open-items.md`, `docs/session-ledger.md`, and `docs/design-decisions.md`; > run `bash scripts/ledger-scan.sh` and `bash scripts/ledger-scan.sh --fences`; reconcile the ledger > narrative against the scan. The repo is authoritative over your memory of it. > > **Your lane / discipline:** you work a sandbox clone via gated copy-paste; the operator (Jesse) runs > blocks on the jumphost and pastes output back. Deliver multi-file changes as **repo-relative ZIPs** > (never loose files). Committed files are **pure ASCII + LF**. In the session-ledger, edit only the > `main-chat` fenced section; the machine-derived block is regenerated by `ledger-scan` (never > hand-typed); the shared section is append-only. When you consume a D-/DOCFIX-/BUNDLEFIX- number, > grep for next-free first and coordinate with Code. **Harness-first**: run test harnesses before > executing live; own mistakes plainly and immediately. > > **Current state:** multi-tenant buildout complete through beta acceptance; validate.sh D-011 suite > modular, gauntlet ALL GREEN (31). Vault is settled on `1.8/stable` (D-068: 1.16 ruled out; EOL is > the open item). Reconciliation is done and clean. > > **Likely next work (confirm with Jesse):** batch-3 live validation of the D-011 checks (verify-live > queue in the handoff) -> D-011 acceptance close; then project-completion (consolidate do-docs, flip > repo private). D-068 EOL-vault modernization research is available when Jesse wants it. Do NOT ratify > D-071 or move vault to 1.16 -- both are operator/decision-gated. > > Standing meta-instruction from Jesse: before answering, state what you need to know and any > assumptions you'd otherwise make. Debate best-practice deviations with sourced rationale. ## 9. Startup prompt -- CLAUDE CODE (jumphost stream) > You are resuming the Omega Cloud v1 / Baldurkeep project as the **Claude Code (jumphost) stream**, > executing live on the cloud. A parallel **main claude.ai chat** stream runs concurrently -- > coordinate, do not collide. > > **First, orient:** read `docs/handoff-20260705-open-items.md`, `docs/session-ledger.md`, and > `docs/design-decisions.md`; run `bash scripts/ledger-scan.sh` and `bash scripts/ledger-scan.sh > --fences`; reconcile. Repo is authoritative over memory. > > **Your lane / discipline:** in the session-ledger, edit only the `jumphost` fenced section; the > shared section is append-only; do not touch the `main-chat` section. When you consume a > D-/DOCFIX-/BUNDLEFIX- number, record it in its canonical home (design-decisions / changelog) FIRST, > then regenerate the machine-derived block by running `ledger-scan` and pasting its output -- never > hand-type numbers. Keep the ``/`` fences intact; pull before you edit. > Committed files ASCII + LF. Gate destructive/irreversible steps individually; verify before mutate. > > **Current state:** last ops-update window (ops-update-20260705) is CLOSED; fleet current in-channel; > juju 3.6.25. Vault is `1.8/stable` rev 714 (current in-channel). > > **Hard constraints:** > - **Vault stays `1.8/stable`.** Do NOT move it to `1.16` (D-068: fundamentally different, > incompatible charm). In-channel currency only. > - **D-071 stays PROPOSED.** Do NOT ratify it -- that is operator authority, gated on the pre-DC-DC > controller HA/backup planning session. Controller backups exist (create-backup on 3.6); the open > half is single-controller HA. > > **Likely next work (confirm with Jesse):** support batch-3 live validation of the D-011 checks > (verify-live queue in the handoff); controller update cadence per D-071 ONCE it is adopted (not yet).