docs: update status — cfg files clean, no pending working-tree changes

README.md

@@ -301,6 +301,20 @@ Detailed setup docs, cluster procedures, and host-specific notes should live in
 
 Knoe is an actively evolving platform stack aimed at practical self-hosted, edge, and cloud operation.
 
+**As of 2026-05-23** the following work has shipped:
+- `fix(cfg)` — `_validate_cfg_values` prevents MagicMock reprs from leaking into `conf/*.cfg` (`ef20c8a`)
+- `feat(env)` — `gke_` kubecontext prefix auto-detected as `prod`; `status.py` context helpers (`da0fd2c`)
+- `refactor(mock_val)` — `prole_*` shell lib and cfg tooling renamed to `knoe_*` namespace (`11064cb`)
+- `feat(mock_val)` — init scripts rewritten; 10+ new service init scripts added (`3f96f66`)
+- `feat(mock_val)` — diagnostics, utilities, certs, and operational scripts added (`3943d1b`)
+- `feat(scripts)` — upstream knoe-db sync script + procedure doc (`decb9a5`)
+- `feat(infrastructure)` — Pi-hole DNS flush Ansible playbook (`3ada16c`)
+- `docs` — shipped briefs moved to `docs/completed/`; `conf/service/knoe.cfg` added (`73dce03`)
+- `feat(mock_val)` — `common_core_lib` mode-aware config path helper (`d806905`)
+- `fix(conf)` — MagicMock contamination removed from `conf/k3d.cfg` and `conf/k3s.cfg` (`568f03b`)
+
+All working-tree changes committed. `conf/k3d.cfg` and `conf/k3s.cfg` cleaned of MagicMock contamination (`568f03b`).
+
 Expect the architecture to continue being refined toward:
 - cleaner bootstrapping
 - better shard isolation

docs/plans/junie/README.md

@@ -44,7 +44,7 @@ in TODO" note). When Junie lands a brief:
 2. Don't delete the brief from this directory — it stays as the design
    record.
 
-## Current briefs (as of 2026-05-23)
+## Current briefs (as of 2026-05-23, post-commit)
 
 ### Active (in flight)
 
@@ -52,23 +52,9 @@ in TODO" note). When Junie lands a brief:
 |---|---|---|
 | [`k3d-knoe-auth-pod-deploy.md`](k3d-knoe-auth-pod-deploy.md) | TODO §"In progress"; parent [`../k3d-gke-mirror.md`](../k3d-gke-mirror.md) §6 Phase 3 | Phase 3 of k3d-mirror-of-GKE: build the knoe-auth image, `k3d image import`, run as a pod inside the cluster. Pre-merge smoke loop with `make k3d-knoe-{deploy,redeploy,undeploy}`. |
 
-### Pending commit (working-tree changes not yet staged)
+### Pending (working-tree only)
 
-The following changes are uncommitted as of 2026-05-23. They should be reviewed, cleaned up (especially the MagicMock-contaminated cfg files), and committed in logical batches:
+No pending working-tree changes as of 2026-05-23.
-
-| Area | Files | Summary |
-|---|---|---|
-| **cfg-save bug (fixed)** | `conf/k3d.cfg`, `conf/k3s.cfg`, `conf/knoe.cfg` | Fix shipped 2026-05-23 (`_validate_cfg_values` in `cfg.py`). The three cfg files still contain stale MagicMock values from before the fix and must be regenerated cleanly before committing. |
-| **`knoe_conf.py` patch** | `knoe/knoe_conf.py` | `normalize_environment()` now recognises `gke_` kubecontext prefix as `prod` (e.g. `gke_plenary-truck-485623-p7_us-west3_knoe-dev-0`). |
-| **`status.py` enhancements** | `status.py` | Added `_current_kubecontext()` and `_cfg_path_from_kubecontext()` helpers so `status.py` auto-selects the right cfg file based on the active kubectl context. |
-| **`mock_val/` shell lib rename** | `mock_val/lib/shell/prole_*.sh` → `mock_val/lib/shell/knoe_*.sh` | Deleted six `prole_*` shell library files; added `knoe_*` equivalents (`knoe_cmd.sh`, `knoe_env.sh`, `knoe_guardrails.sh`, `knoe_secrets.sh`, `knoe_string.sh`, `knoe_yaml.sh`). Mirrors the broader `prole` → `knoe` rename. |
-| **`mock_val/` init script churn** | Many `mock_val/init_*.sh` files | Large rewrites to `init_gitlab.sh`, `init_kong.sh`, `init_cnpg_backup.sh`, `init_monitoring.sh`, `init_garage_store.sh`, `init_gitea.sh`, `init_kdc.sh`, `init_openbao.sh`, and others. `init_cloudnative_pg.sh` deleted (superseded). New scripts added: `init_cnpg_gke.sh`, `init_knoe_auth.sh`, `init_knoe_users.sh`, `init_redis.sh`, `init_oauth2_proxy.sh`, `init_grafana_oauth.sh`, `init_1password.sh`, `init_min.sh`, and more. |
-| **`mock_val/` cfg tooling** | `mock_val/prole_cfg.sh` deleted; `mock_val/knoe_cfg.sh` + `mock_val/sync-knoe-cfg.py` added | Config sync tooling renamed from `prole` to `knoe` namespace. `sync-prole-cfg.py` deleted. |
-| **`mock_val/` diagnostics** | `mock_val/diag_gitlab_boot.sh`, `mock_val/diag_gitlab_webservice_oom.sh`, `mock_val/diag_gke_storage.sh` | New diagnostic scripts for GitLab boot, OOM, and GKE storage issues. |
-| **`mock_val/` misc** | `mock_val/ensure_default_storage_class.sh`, `mock_val/preflight_kubecontext.sh`, `mock_val/onboard_engineer.sh`, `mock_val/gen_oidc_signing_key.sh`, `mock_val/fetch_prole_secrets.sh`, `mock_val/set-k3s-token-1password.sh`, `mock_val/krb5.local.conf`, `mock_val/knoe-db-ca.crt` | New utility scripts and config files. |
-| **`conf/service/knoe.cfg`** | `conf/service/knoe.cfg` (untracked) | New unattended deploy config for the service/k3s environment. |
-| **Upstream sync tooling** | `scripts/sync_upstream_knoe_db.sh`, `docs/upstream-knoe-db-sync.md` | New script + procedure for syncing from upstream `git@git.knoe.dev:knoe-dev/knoe-db.git`. See [`../../upstream-knoe-db-sync.md`](../../upstream-knoe-db-sync.md). |
-| **Infrastructure** | `infrastructure/playbooks/pihole_flush_dns.yml`, `infrastructure/logs/` | New Ansible playbook for Pi-hole DNS flush; log directory. |
 
 ### Shipped