# d011 batch-3 window -- combined do-document (DRAFT, not yet executed)

One logged operator window that closes out the D-011 batch-3 queue AND live-validates
the onboarding workflow, in the operator-ruled interleave order (2026-07-06):
D-073 live apply -> foil-tenant onboarding (= workflow validation) -> d011-04 ->
d011-05 -> close-out. Every mutation is individually gated; read-only evidence
precedes each. Standing authorizations already ruled (do not re-ask):

- **A2 (2026-07-06):** d011-04 `--include-disruptive` is PRE-APPROVED conditional on
  the live N+1 amphora headroom check passing -- same window, no second ask.
- **D-073 (adopted 2026-07-06):** list_trusts zip staged in repo (addendum 24);
  live attach in this window per the amendment.

Operator inputs needed at window open: foil client short-name (examples below use
`foil1`), a non-colliding /24 for it (stage-4 guard fails closed regardless).

## 0. Window open (operator)

    git -C ~/openstack-caracal-ipv4 pull
    bash scripts/repo-lint.sh                  # expect 0 fail / 1 legacy warn
    bash scripts/run-tests-all.sh              # ALL GREEN expected
    bash scripts/run-logged.sh d011-batch3
    bash scripts/cloud-assert.sh               # baseline MUST PASS before any mutation

## 1. D-073 live apply (GATED mutation: keystone policy resource)

    # stage under $HOME -- the openstack/juju snaps cannot read /tmp
    cp ~/openstack-caracal-ipv4/policies/overrides.zip ~/overrides-d073.zip
    juju attach-resource -m openstack keystone policyd-override=~/overrides-d073.zip
    # wait for keystone workload message to show "PO:" (NOT "PO (broken):")
    juju status -m openstack keystone

Behavioral verify (never trust "PO:" alone):

    # (a) tenant token MUST now be denied trust enumeration (403):
    #     use the beta tenant's -svc app cred context ->  openstack trust list
    # (b) admin context MUST still succeed:  openstack trust list
    # (c) magnum trust machinery unaffected -- implicitly re-proven by d011-05 below.

Rollback if broken: `git show HEAD~:policies/overrides.zip > ~/overrides-prev.zip`
then re-attach that file (same command shape). HOLD the window on any (a)/(b) miss.

## 2. Foil onboarding = live workflow validation

Stages 0-4 (foil needs an app cred for d011-05; stage 4 L3 enables the canary):

    TENANT_CIDR=<ruled /24> bash scripts/tenant-onboard.sh foil1 stage0   # read-only
    bash scripts/tenant-onboard.sh foil1 stage1                           # gated
    bash scripts/tenant-onboard.sh foil1 stage2                           # gated
    bash scripts/tenant-onboard.sh foil1 stage3                           # gated
    TENANT_CIDR=<ruled /24> bash scripts/tenant-onboard.sh foil1 stage4   # gated

Then the H1 verifier -- this run ALSO clears its two VERIFY-LIVE items
(`keypair list --user`, `application credential list --user` as admin):

    bash scripts/tenant-assert.sh foil1        # expect: PASS (topology matches contract)

H2 guard live check (read-only in effect -- re-run stage3, expect double SKIP rc0):

    bash scripts/tenant-onboard.sh foil1 stage3

H3 canary (gated; self-cleaning; VERIFY-LIVE: CANARY_SSH_USER vs image login user):

    bash scripts/tenant-onboard.sh foil1 stage7    # expect: CANARY PASS + teardown done

Horizon checks (contract section 5.1/5.3; manual, browser):
  - login as foil1-domain-admin (domain-scoped) -- expect success;
  - GUI identity probe: create + delete a probe user via Horizon as the manager.
    If the GUI path fails but the API path passed (tenant-assert), LOG it and the
    contract's "CLI is the identity path" fallback stands -- not a window blocker.

## 3. d011-04 octavia (non-disruptive first, then the pre-approved disruptive half)

    bash scripts/validate.sh --checks d011-04-octavia-lb                       # RR + member failover
    # headroom evidence prints from amphora_headroom(); on PASS the A2 pre-approval applies:
    bash scripts/validate.sh --checks d011-04-octavia-lb --include-disruptive  # amphora failover
    # on headroom HOLD: STOP the disruptive half entirely (the pre-approval is conditional).

VERIFY-LIVE items this clears: amphora_headroom() field parsing OK-path; OCCM
LB-name-contains-service-name assumption; agnhost /hostname round-robin behavior.

## 4. d011-05 magnum e2e (+ P3 isolation via the foil)

    VR_FOIL_APPCRED=~/tenant-foil1/foil1-svc-appcred.txt bash scripts/validate.sh --checks d011-05-magnum-e2e

(Check ids per `bash scripts/validate.sh --list`; the full-d011 profile runs the
whole suite if preferred once both new checks stand individually.)

## 5. Close-out

    bash scripts/cloud-assert.sh               # MUST PASS
    # evidence: keep the run-logged transcript; note headroom numbers + canary FIP
    # in the ledger; mark cleared VERIFY-LIVE items in the handoff + contract 5.3.

Repo updates at close (jumphost lane): changelog addendum (as-executed corrections to
THIS draft included -- it is a DRAFT until executed once), session-ledger jumphost
section, handoff section 2/6 item states, D-011 acceptance status. If all of d011-01
through d011-06 now stand (06 stays MANUAL pending SEC-003), record the D-011
batch-3 close and queue the v1-close checklist (handoff section 6).

## Abort discipline

Any cloud-assert FAIL, any tenant-assert HOLD on the foil, or any D-073 behavioral
miss HOLDs the window at that boundary: capture evidence, revert only the failing
step per its rollback line, close the log. No forward progress past a failed gate.