mcp-openstack-ops 3.6.0__tar.gz → 3.6.2__tar.gz

{mcp_openstack_ops-3.6.0 → mcp_openstack_ops-3.6.2}/AGENTS.md

@@ -33,10 +33,12 @@ consistent with the resulting implementation and actual verification.
   Label targeted retests as partial; do not extrapolate them to the full toolset.
   Document polling limits and distinguish accepted requests from confirmed final
   resource states. Explain changes in test conditions that affect comparisons.
-- Keep dated reports as historical evidence and link the latest applicable
-  report from README.md. Reports must state verification limits, observed
-  failures, and cleanup results without exposing credentials, private endpoints,
-  or sensitive resource data.
+- Keep `docs/` for reusable user guidance only. Do not create or retain
+  issue-specific reports, dated test results, or evidence JSON in `docs/`, or
+  embed those records in usage guides. Report case-specific verification results,
+  limits, failures, and cleanup in chat unless the user explicitly requests a
+  separate artifact. Never expose credentials, private endpoints, or sensitive
+  resource data. Do not add report links to README.md.
 - Before completion, check summary arithmetic, percentages, tool/action names,
   Status/Notes, source identity, and evidence links for agreement. If README.ko.md
   exists, maintain equivalent information in both README files.

{mcp_openstack_ops-3.6.0 → mcp_openstack_ops-3.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-openstack-ops
-Version: 3.6.0
+Version: 3.6.2
 Summary: OpenStack operations automation MCP server
 Author-email: JungJungIn <call518@gmail.com>
 Requires-Python: >=3.12
@@ -42,7 +42,7 @@ Dynamic: license-file
 ## Features
 
 Experimental per-user remote connections are available for testing with the
-opt-in `--multi-user` mode. See the [phase 1 setup and validation guide](docs/multi-user-phase1.md)
+opt-in `--multi-user` mode. See the [multi-user setup and usage guide](docs/multi-user-guide.md)
 for authentication, client limitations, and the test checklist. Administrator
 cross-project queries are outside this phase.
 
@@ -177,47 +177,18 @@ Post-Action Status:
 ### **Unified Resource Queries**
 New consolidated `get_instance` tool replaces multiple separate tools:
 - ❌ Old: `get_instance_details`, `get_instance_info`, `get_instance_status`, `get_instance_network_info`
-- ✅ New: `get_instance(instance_names="vm1,vm2")` - Single tool, comprehensive information
+- ✅ New: `get_instance(names="vm1,vm2")` - Single tool, comprehensive information
 
 ---
 
 ## 📊 OpenStack CLI vs MCP Tools Mapping
 
-**Validation snapshot — 2026-10-30** (main working tree based on `dd98993`,
-with the uncommitted fixes described in the report):
-
-<table border="1" rules="cols">
-  <thead>
-    <tr><th>Verification type</th><th>Item</th><th>Result</th></tr>
-  </thead>
-  <tbody>
-    <tr><td rowspan="5">Live tool checks</td><td>Registered tools invoked and classified</td><td><strong>105</strong></td></tr>
-    <tr><td>Passed within the exercised live scenarios</td><td><strong>74</strong></td></tr>
-    <tr><td>Implemented, live unverified: service/API unavailable</td><td><strong>28</strong></td></tr>
-    <tr><td>Intentional capability limitations</td><td><strong>3</strong></td></tr>
-    <tr><td>Reproduced code defects / state-check timeouts in the retest</td><td><strong>0 / 0</strong></td></tr>
-    <tr><td>Local unit tests</td><td>Test cases in <code>tests/test_*.py</code></td><td><strong>160/160 (100%)</strong></td></tr>
-  </tbody>
-</table>
-
-State polling allowed 180 seconds; soft reboot completed in 131.66 seconds
-(previously it exceeded the 90-second check). No reboot implementation change
-was needed.
-
-The 10 previously reproduced tool defects were corrected. The 28 unavailable
-paths are **not live-validated successes**: 24 Octavia tools, two Neutron QoS
-tools, one Aodh tool, and one Neutron port-forwarding tool. Each affected table
-row is marked **⚠️ Live unverified**. An absent tool/action is marked **❌ Not
-implemented** rather than presented as an available feature.
-
-✅ means an implemented API path; it does not certify every action or backend.
-The live-pass count covers only the scenarios in the
-[latest retest report](docs/main-live-retest-2026-10-30.md), with
-[sanitized evidence](docs/main-live-retest-2026-10-30.json). API policy, asynchronous
-completion, production HTTPS/client compatibility, load, and guest I/O limits
-are stated there. All test resources were cleaned up; the final audit found zero
-remaining test resources across 24 categories. See also
-[API prerequisites and result semantics](#api-prerequisites-and-result-semantics).
+✅ denotes an implemented API path, not certification of every action or
+OpenStack deployment. **⚠️ Live unverified** identifies paths without successful
+live validation; **❌ Not implemented** identifies unavailable capabilities.
+Service availability, permissions, and asynchronous completion affect results.
+See [API prerequisites and result semantics](#api-prerequisites-and-result-semantics)
+and the [multi-user setup guide](docs/multi-user-guide.md).
 
 **Detailed Mapping by Category**
 
@@ -225,10 +196,10 @@ remaining test resources across 24 categories. See also
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| `openstack server list` | `get_instance` | ✅ | **NEW UNIFIED** - Pagination, filtering support |
-| `openstack server show` | `get_instance` | ✅ | **ENHANCED** - Replaces get_instance_by_name, get_instance_by_id |
+| `openstack server list` | `get_instance` | ✅ | Separate reader projects each returned exactly ten owned VMs; bounded lab validation only |
+| `openstack server show` | `get_instance` | ✅ | Own fixture queries completed; foreign private ID returned no details; no 16-owned-ID batch claim |
 | `openstack server create` | `set_instance` (action="create") | ✅ | **ENHANCED** - Bulk creation support |
-| `openstack server start/stop/reboot` | `set_instance` | ✅ | **ENHANCED** - Bulk operations with filtering |
+| `openstack server start/stop/reboot` | `set_instance` | ✅ | Bulk stop/start final states verified for two test VMs per project; reboot not retested in this round |
 | `openstack server delete` | `set_instance` (action="delete") | ✅ | **ENHANCED** - Bulk deletion with name_contains filtering |
 | `openstack server backup create` | `set_server_backup` | ✅ | Nova backup action with rotation; asynchronous, no custom metadata |
 | `openstack server image create` | `set_instance` (action="snapshot") | ✅ | Image/snapshot creation |
@@ -258,33 +229,33 @@ remaining test resources across 24 categories. See also
 | `openstack server remove fixed ip` | `set_server_fixed_ip` (action="remove") | ✅ | Fixed IP removal |
 | `openstack server add security group` | `set_server_security_group` (action="add") | ✅ | Security group addition |
 | `openstack server remove security group` | `set_server_security_group` (action="remove") | ✅ | Security group removal |
-| `openstack server add volume` | `set_server_volume` (action="attach") | ✅ | Volume attachment |
-| `openstack server remove volume` | `set_server_volume` (action="detach") | ✅ | Volume detachment |
+| `openstack server add volume` | `set_server_volume` (action="attach") | ✅ | Member attach reached in-use via set_server_volume; guest I/O not tested |
+| `openstack server remove volume` | `set_server_volume` (action="detach") | ✅ | Member detach reached available via set_server_volume |
 | `openstack server set` | `set_server_properties` (action="set") | ✅ | Server property setting |
 | `openstack server unset` | `set_server_properties` (action="unset") | ✅ | Server property unsetting |
 | `openstack server dump create` | `set_server_dump` | ❌ Unsupported | Returns an explicit unsupported result; no dump is created |
-| `openstack server event list` | `get_server_events` | ✅ | Server event tracking |
+| `openstack server event list` | `get_server_events` | ✅ | Pass the server name or UUID via `instance_name`, not `server_id`; event visibility follows Nova policy |
 | `openstack server group list` | `get_server_groups` | ✅ | Server group listing |
 | `openstack server group create/delete` | `set_server_group` | ✅ | Server group management |
 | `openstack flavor list` | `set_flavor` (action="list") | ✅ | Requires modification tools to be enabled for registration |
 | `openstack flavor create/delete` | `set_flavor` | ✅ | Flavor management |
-| `openstack keypair list` | `get_keypair_list` | ✅ | Keypair listing |
-| `openstack keypair create/delete` | `set_keypair` | ✅ | Keypair management |
-| `openstack hypervisor list` | `get_hypervisor_details` | ✅ | Hypervisor querying |
-| `openstack availability zone list` | `get_availability_zones` | ✅ | Availability zone listing |
+| `openstack keypair list` | `get_keypair_list` | ✅ | Empty scoped read completed; member keypair creation/deletion read-back tested separately |
+| `openstack keypair create/delete` | `set_keypair` | ✅ | Explicit member MCP create/delete read-back passed; no successful Claude write workflow claimed |
+| `openstack hypervisor list` | `get_hypervisor_details` | ⚠️ Live unverified | Reader policy denial; successful administrator MCP lookup was not obtained in this round |
+| `openstack availability zone list` | `get_availability_zones` | ⚠️ Live unverified | Only policy-limited composite requests in this round; individual result not independently attributed |
 
 ### 2. 🌐 **Network (Neutron)**
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| `openstack network list` | `get_network_details` | ✅ | Detailed network information |
-| `openstack network show` | `get_network_details` (name param) | ✅ | Specific network query |
-| `openstack network create` | `set_networks` (action="create") | ✅ | **ENHANCED** - Bulk network creation |
-| `openstack network delete` | `set_networks` (action="delete") | ✅ | **ENHANCED** - Bulk deletion with filtering |
+| `openstack network list` | `get_network_details` | ✅ | Two owned private networks plus one policy-visible shared external network per reader; no other test project private networks |
+| `openstack network show` | `get_network_details` (network_name) | ⚠️ Live unverified | Foreign-ID negative checked; dual-project positive named reader lookup not independently asserted |
+| `openstack network create` | `set_networks` (action="create") | ✅ | Default mtu=0 omits the wire field: backend MTU 1450 verified; explicit 1400 retained in both member projects |
+| `openstack network delete` | `set_networks` (action="delete") | ✅ | Both default/explicit-MTU test networks removed through actual TCP MCP, API absence confirmed |
 | `openstack network set` | `set_networks` (action="update") | ✅ | **ENHANCED** - Bulk updates |
-| `openstack subnet list` | `get_network_details` (includes subnets) | ✅ | Subnet information included |
-| `openstack subnet create/delete` | `set_subnets` | ✅ | Subnet management |
-| `openstack router list` | `get_routers` | ✅ | Router listing |
+| `openstack subnet list` | `get_network_details` (includes subnets) | ✅ | Owned and shared external network subnets returned; three visible subnets per test reader |
+| `openstack subnet create/delete` | `set_subnets` | ✅ | Member TCP MCP subnet create read back; deletion allowed parent network removal in both projects |
+| `openstack router list` | `get_routers` | ⚠️ Live unverified | Only part of composite error requests in this round; no independent reader result attribution |
 | `openstack router create/delete` | `set_routers` | ✅ | Project-owned routers; attached interfaces are not removed automatically |
 | `openstack floating ip list` | `get_floating_ips` | ✅ | Floating IP listing |
 | `openstack floating ip create` | `set_floating_ip` (action="create") | ✅ | Floating IP creation |
@@ -292,38 +263,38 @@ remaining test resources across 24 categories. See also
 | `openstack floating ip set` | `set_floating_ip` (action="set") | ✅ | Floating IP property setting |
 | `openstack floating ip show` | `set_floating_ip` (action="show") | ✅ | Floating IP details |
 | `openstack floating ip unset` | `set_floating_ip` (action="unset") | ✅ | Floating IP property clearing |
-| `openstack floating ip pool list` | `get_floating_ip_pools` | ✅ | Floating IP pool listing |
+| `openstack floating ip pool list` | `get_floating_ip_pools` | ⚠️ Live unverified | Composite result not independently attributed; available global pool capacity remains unknown |
 | `openstack floating ip port forwarding create` | `set_floating_ip_port_forwarding` (action="create") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
 | `openstack floating ip port forwarding delete` | `set_floating_ip_port_forwarding` (action="delete") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
 | `openstack floating ip port forwarding list` | `set_floating_ip_port_forwarding` (action="list") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
 | `openstack floating ip port forwarding set` | `set_floating_ip_port_forwarding` (action="set") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
 | `openstack floating ip port forwarding show` | `set_floating_ip_port_forwarding` (action="show") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
-| `openstack security group list` | `get_security_groups` | ✅ | Security group listing |
+| `openstack security group list` | `get_security_groups` | ✅ | Scoped reader list completed; default and test groups visible |
 | `openstack security group create/delete` | `set_security_groups` | ✅ | Project-owned security groups |
-| `openstack port list` | `get_network_details` (includes ports) | ✅ | Port information included |
+| `openstack port list` | `set_network_ports` (action="list") | ⚠️ Live unverified | Implemented list action requires modification-tool registration; not exercised in this round |
 | `openstack port create/delete` | `set_network_ports` | ✅ | Port management |
 | `openstack network qos policy list` | `get_network_qos_policies` | ⚠️ Live unverified | Implemented; test platform QoS endpoint returns HTTP 404 |
 | `openstack network qos policy create` | `set_network_qos_policies` | ⚠️ Live unverified | Implemented; test platform QoS endpoint returns HTTP 404. Policy containers only; no bandwidth rules |
-| `openstack network agent list` | `get_service_status` (includes agents) | ✅ | Network agents |
+| `openstack network agent list` | `get_service_status` (includes agents) | ⚠️ Live unverified | Reader service-policy restrictions; partial data is not proof of global health |
 | `openstack network agent set` | `set_network_agents` | ✅ | Enable/disable cloud-wide agents; usually admin-only |
 
 ### 3. 💾 **Storage (Cinder)**
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| `openstack volume list` | `get_volume_list` | ✅ | Volume listing |
-| `openstack volume show` | `get_volume_list` (filtering) | ✅ | Specific volume query |
+| `openstack volume list` | `get_volume_list` | ✅ | Exactly ten owned volumes per reader; no other test project volume IDs returned |
+| `openstack volume show` | `get_volume_list` | ✅ | Listing-based client filtering; no dedicated get_volume_list filter argument |
 | `openstack volume create/delete` | `set_volume` | ✅ | Volume creation/deletion |
-| `openstack volume set` | `set_volume` (action="modify") | ✅ | Volume property modification |
+| `openstack volume set` | — | ❌ Not implemented | set_volume has no modify/update action; do not send this unsupported action |
 | `openstack volume type list` | `get_volume_types` | ✅ | Volume type listing |
 | `openstack volume type create/delete` | `set_volume_types` | ✅ | Volume type management; usually admin-only |
-| `openstack volume snapshot list` | `get_volume_snapshots` | ✅ | Snapshot listing |
-| `openstack volume snapshot create/delete` | `set_snapshot` | ✅ | Snapshot management |
-| `openstack backup list` | `get_volume_backups` | ✅ | Current-project backup listing |
+| `openstack volume snapshot list` | `get_volume_snapshots` | ✅ | Two owned base snapshots per reader; API final states checked |
+| `openstack volume snapshot create/delete` | `set_snapshot` | ✅ | Explicit member MCP snapshots reached available and were deleted; no restore/I/O claim |
+| `openstack backup list` | `get_volume_backups` | ✅ | Three owned available backups per reader; base backup creation used real Cinder APIs |
 | `openstack backup create/delete` | `set_volume_backups` | ✅ | Volume backup management |
 | `openstack volume transfer request list` | `get_volume_transfers` | ✅ | Request listing only; authorization keys are excluded |
 | `openstack server volume list` | `get_server_volumes` | ✅ | Server volume listing |
-| `openstack server add/remove volume` | `set_server_volume` | ✅ | Server volume attach/detach |
+| `openstack server add/remove volume` | `set_server_volume` / `set_volume` (action="attach"/"detach") | ✅ | Both paths reached in-use then available in both member projects; foreign endpoints rejected; guest I/O not tested |
 | `openstack volume group list` | `get_volume_groups` | ✅ | Requires Cinder generic groups (API >= 3.13) |
 | `openstack volume group create` | `set_volume_groups` | ✅ | Create/list/show/delete; create requires group_type and volume_types |
 | `openstack volume qos list` | `get_volume_qos` | ✅ | Cinder QoS specifications; subject to cloud policy |
@@ -349,22 +320,22 @@ remaining test resources across 24 categories. See also
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| `openstack user list` | `get_user_list` | ✅ | User listing |
-| `openstack user show` | `get_user_list` (filtering) | ✅ | Specific user query |
+| `openstack user list` | `get_user_list` | ⚠️ Live unverified | Reader denied by Keystone; explicit MCP failure observed; successful listing not validated in this round |
+| `openstack user show` | `get_user_list` | ⚠️ Live unverified | Depends on policy-limited user listing; not independently validated for the new readers |
 | `openstack user create/delete` | `set_users` | ✅ | Password from a server environment variable; no role grants |
 | `openstack project list` | `get_project_details` | ✅ | Project listing |
 | `openstack project show` | `get_project_details` (name param) | ✅ | Specific project query |
 | `openstack project create/delete` | `set_project` | ✅ | Project management |
 | `openstack role list` | `get_role_assignments` | ✅ | Role listing |
-| `openstack role assignment list` | `get_role_assignments` | ✅ | Role assignment listing |
+| `openstack role assignment list` | `get_role_assignments` | ⚠️ Live unverified | Reader Keystone policy denial; not a successful data lookup |
 | `openstack role create/delete` | `set_roles` | ✅ | Role management |
 | `openstack domain list` | `get_domains` | ✅ | Subject to Keystone policy |
 | `openstack domain create/delete` | `set_domains` | ✅ | Disable explicitly with update before delete |
 | `openstack group list` | `get_identity_groups` | ✅ | Subject to Keystone policy |
 | `openstack group create/delete` | `set_identity_groups` | ✅ | Group management |
-| `openstack service list` | `get_service_status` | ✅ | Service listing |
+| `openstack service list` | `get_service_status` | ⚠️ Live unverified | Reader service-policy restrictions; partial data is not proof of global health |
 | `openstack service create/delete` | `set_services` | ✅ | Service management |
-| `openstack endpoint list` | `get_service_status` (includes endpoints) | ✅ | Endpoint information |
+| `openstack endpoint list` | `get_service_status` (includes endpoints) | ⚠️ Live unverified | Reader service-policy restrictions; partial data is not proof of global health |
 
 ### 6. 🔥 **Orchestration (Heat)**
 
@@ -479,9 +450,9 @@ remaining test resources across 24 categories. See also
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| Resource monitoring | `get_resource_monitoring` | ✅ | Project allocations, separate quotas and visible hypervisor capacity; no live utilization |
-| Service status | `get_service_status` | ✅ | Service status query |
-| Cluster overview | `get_service_status` + `get_resource_monitoring` | ✅ | Service probes and current inventory |
+| Resource monitoring | `get_resource_monitoring` | ⚠️ Live unverified | Reader physical-capacity policy restrictions; allocations are separate from capacity; no live utilization |
+| Service status | `get_service_status` | ⚠️ Live unverified | Reader service-policy restrictions; partial data is not proof of global health |
+| Cluster overview | `get_service_status` + `get_resource_monitoring` | ⚠️ Live unverified | Reader physical-capacity policy restrictions; allocations are separate from capacity; no live utilization |
 | Service log metadata | `set_service_logs` | Partial | Service listing only; log retrieval is unavailable without a logging backend |
 | Resource metadata | `set_metrics` | Partial | list/summary only; telemetry sample retrieval is unavailable |
 | Alarm management | `set_alarms` | ⚠️ Live unverified | Implemented; Aodh/Gnocchi unavailable in the test platform. Requires services and collected metrics |
@@ -497,13 +468,13 @@ remaining test resources across 24 categories. See also
 | `openstack quota delete` | `set_quota` (action="delete") | ✅ | Resets all three service quotas to defaults; requires modification tools |
 | `openstack usage show` | `get_usage_statistics` | ✅ | Current-project Nova simple tenant usage; not monetary charges |
 | `openstack limits show` | `get_quota` (includes limits) | ✅ | Limits query |
-| Resource allocations | `get_resource_monitoring` | ✅ | Flavor allocations; not CPU load or resident memory samples |
+| Resource allocations | `get_resource_monitoring` | ⚠️ Live unverified | Reader physical-capacity policy restrictions; allocations are separate from capacity; no live utilization |
 
 ---
 
 ### API prerequisites and result semantics
 
-The feature table marks implemented API paths, not verification against every OpenStack deployment. The management and query paths have local mocked API tests. Selected paths also passed live tests on a single-node Kolla Ansible deployment; see [integration validation](docs/integration-validation.md) for coverage and skipped operations. A missing service, extension, required microversion, or permission is an operation failure, not an empty successful result.
+The feature table marks implemented API paths, not verification against every OpenStack deployment. Service and policy requirements must be checked in the target deployment. A missing service, extension, required microversion, or permission is an operation failure, not an empty successful result.
 
 - **Modification tools:** the MCP server registers `set_*` management tools only when `ALLOW_MODIFY_OPERATIONS=true`. Existing action guards also reject writes when disabled. Dedicated read-only `get_*` tools remain available. API authorization is enforced by the target cloud; agent, user, domain, type and QoS administration may require elevated OpenStack roles.
 - **Alarms:** `set_alarms` calls the Keystone catalog's `alarming` endpoint for the configured interface/region. It supports list/create/show/delete of project alarms and creates `gnocchi_resources_threshold` alarms. Aodh, Gnocchi, the specified resource and a collected metric are required. The default metric is `cpu_util`, which is not collected by every deployment. `metric`, `resource_type`, `aggregation_method`, `granularity`, `evaluation_periods`, and `alarm_actions` can be supplied. An empty action list creates an alarm without notifications. There is no simulation fallback.
@@ -705,7 +676,7 @@ unset OPENSTACK_MCP_TOKEN
 ```
 
 This Bearer configuration uses the server's configured OpenStack account. For
-experimental per-user authentication, see the [phase 1 guide](docs/multi-user-phase1.md).
+experimental per-user authentication, see the [multi-user guide](docs/multi-user-guide.md).
 See also the [Claude Code MCP documentation](https://code.claude.com/docs/en/mcp).
 
 ## Server Configuration
@@ -1020,7 +991,7 @@ get_instance_details(limit=50, offset=50)    # Next 50 instances
 get_instance_details(include_all=True)       # All instances (use with caution)
 
 # Optimized search for large datasets
-search_instances("web", "name", limit=20)    # Search with reasonable limit
+search_instances("web", "name", limit=20, offset=0, case_sensitive=False)
 ```
 
 ---

{mcp_openstack_ops-3.6.0 → mcp_openstack_ops-3.6.2}/README.md

@@ -24,7 +24,7 @@
 ## Features
 
 Experimental per-user remote connections are available for testing with the
-opt-in `--multi-user` mode. See the [phase 1 setup and validation guide](docs/multi-user-phase1.md)
+opt-in `--multi-user` mode. See the [multi-user setup and usage guide](docs/multi-user-guide.md)
 for authentication, client limitations, and the test checklist. Administrator
 cross-project queries are outside this phase.
 
@@ -159,47 +159,18 @@ Post-Action Status:
 ### **Unified Resource Queries**
 New consolidated `get_instance` tool replaces multiple separate tools:
 - ❌ Old: `get_instance_details`, `get_instance_info`, `get_instance_status`, `get_instance_network_info`
-- ✅ New: `get_instance(instance_names="vm1,vm2")` - Single tool, comprehensive information
+- ✅ New: `get_instance(names="vm1,vm2")` - Single tool, comprehensive information
 
 ---
 
 ## 📊 OpenStack CLI vs MCP Tools Mapping
 
-**Validation snapshot — 2026-10-30** (main working tree based on `dd98993`,
-with the uncommitted fixes described in the report):
-
-<table border="1" rules="cols">
-  <thead>
-    <tr><th>Verification type</th><th>Item</th><th>Result</th></tr>
-  </thead>
-  <tbody>
-    <tr><td rowspan="5">Live tool checks</td><td>Registered tools invoked and classified</td><td><strong>105</strong></td></tr>
-    <tr><td>Passed within the exercised live scenarios</td><td><strong>74</strong></td></tr>
-    <tr><td>Implemented, live unverified: service/API unavailable</td><td><strong>28</strong></td></tr>
-    <tr><td>Intentional capability limitations</td><td><strong>3</strong></td></tr>
-    <tr><td>Reproduced code defects / state-check timeouts in the retest</td><td><strong>0 / 0</strong></td></tr>
-    <tr><td>Local unit tests</td><td>Test cases in <code>tests/test_*.py</code></td><td><strong>160/160 (100%)</strong></td></tr>
-  </tbody>
-</table>
-
-State polling allowed 180 seconds; soft reboot completed in 131.66 seconds
-(previously it exceeded the 90-second check). No reboot implementation change
-was needed.
-
-The 10 previously reproduced tool defects were corrected. The 28 unavailable
-paths are **not live-validated successes**: 24 Octavia tools, two Neutron QoS
-tools, one Aodh tool, and one Neutron port-forwarding tool. Each affected table
-row is marked **⚠️ Live unverified**. An absent tool/action is marked **❌ Not
-implemented** rather than presented as an available feature.
-
-✅ means an implemented API path; it does not certify every action or backend.
-The live-pass count covers only the scenarios in the
-[latest retest report](docs/main-live-retest-2026-10-30.md), with
-[sanitized evidence](docs/main-live-retest-2026-10-30.json). API policy, asynchronous
-completion, production HTTPS/client compatibility, load, and guest I/O limits
-are stated there. All test resources were cleaned up; the final audit found zero
-remaining test resources across 24 categories. See also
-[API prerequisites and result semantics](#api-prerequisites-and-result-semantics).
+✅ denotes an implemented API path, not certification of every action or
+OpenStack deployment. **⚠️ Live unverified** identifies paths without successful
+live validation; **❌ Not implemented** identifies unavailable capabilities.
+Service availability, permissions, and asynchronous completion affect results.
+See [API prerequisites and result semantics](#api-prerequisites-and-result-semantics)
+and the [multi-user setup guide](docs/multi-user-guide.md).
 
 **Detailed Mapping by Category**
 
@@ -207,10 +178,10 @@ remaining test resources across 24 categories. See also
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| `openstack server list` | `get_instance` | ✅ | **NEW UNIFIED** - Pagination, filtering support |
-| `openstack server show` | `get_instance` | ✅ | **ENHANCED** - Replaces get_instance_by_name, get_instance_by_id |
+| `openstack server list` | `get_instance` | ✅ | Separate reader projects each returned exactly ten owned VMs; bounded lab validation only |
+| `openstack server show` | `get_instance` | ✅ | Own fixture queries completed; foreign private ID returned no details; no 16-owned-ID batch claim |
 | `openstack server create` | `set_instance` (action="create") | ✅ | **ENHANCED** - Bulk creation support |
-| `openstack server start/stop/reboot` | `set_instance` | ✅ | **ENHANCED** - Bulk operations with filtering |
+| `openstack server start/stop/reboot` | `set_instance` | ✅ | Bulk stop/start final states verified for two test VMs per project; reboot not retested in this round |
 | `openstack server delete` | `set_instance` (action="delete") | ✅ | **ENHANCED** - Bulk deletion with name_contains filtering |
 | `openstack server backup create` | `set_server_backup` | ✅ | Nova backup action with rotation; asynchronous, no custom metadata |
 | `openstack server image create` | `set_instance` (action="snapshot") | ✅ | Image/snapshot creation |
@@ -240,33 +211,33 @@ remaining test resources across 24 categories. See also
 | `openstack server remove fixed ip` | `set_server_fixed_ip` (action="remove") | ✅ | Fixed IP removal |
 | `openstack server add security group` | `set_server_security_group` (action="add") | ✅ | Security group addition |
 | `openstack server remove security group` | `set_server_security_group` (action="remove") | ✅ | Security group removal |
-| `openstack server add volume` | `set_server_volume` (action="attach") | ✅ | Volume attachment |
-| `openstack server remove volume` | `set_server_volume` (action="detach") | ✅ | Volume detachment |
+| `openstack server add volume` | `set_server_volume` (action="attach") | ✅ | Member attach reached in-use via set_server_volume; guest I/O not tested |
+| `openstack server remove volume` | `set_server_volume` (action="detach") | ✅ | Member detach reached available via set_server_volume |
 | `openstack server set` | `set_server_properties` (action="set") | ✅ | Server property setting |
 | `openstack server unset` | `set_server_properties` (action="unset") | ✅ | Server property unsetting |
 | `openstack server dump create` | `set_server_dump` | ❌ Unsupported | Returns an explicit unsupported result; no dump is created |
-| `openstack server event list` | `get_server_events` | ✅ | Server event tracking |
+| `openstack server event list` | `get_server_events` | ✅ | Pass the server name or UUID via `instance_name`, not `server_id`; event visibility follows Nova policy |
 | `openstack server group list` | `get_server_groups` | ✅ | Server group listing |
 | `openstack server group create/delete` | `set_server_group` | ✅ | Server group management |
 | `openstack flavor list` | `set_flavor` (action="list") | ✅ | Requires modification tools to be enabled for registration |
 | `openstack flavor create/delete` | `set_flavor` | ✅ | Flavor management |
-| `openstack keypair list` | `get_keypair_list` | ✅ | Keypair listing |
-| `openstack keypair create/delete` | `set_keypair` | ✅ | Keypair management |
-| `openstack hypervisor list` | `get_hypervisor_details` | ✅ | Hypervisor querying |
-| `openstack availability zone list` | `get_availability_zones` | ✅ | Availability zone listing |
+| `openstack keypair list` | `get_keypair_list` | ✅ | Empty scoped read completed; member keypair creation/deletion read-back tested separately |
+| `openstack keypair create/delete` | `set_keypair` | ✅ | Explicit member MCP create/delete read-back passed; no successful Claude write workflow claimed |
+| `openstack hypervisor list` | `get_hypervisor_details` | ⚠️ Live unverified | Reader policy denial; successful administrator MCP lookup was not obtained in this round |
+| `openstack availability zone list` | `get_availability_zones` | ⚠️ Live unverified | Only policy-limited composite requests in this round; individual result not independently attributed |
 
 ### 2. 🌐 **Network (Neutron)**
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| `openstack network list` | `get_network_details` | ✅ | Detailed network information |
-| `openstack network show` | `get_network_details` (name param) | ✅ | Specific network query |
-| `openstack network create` | `set_networks` (action="create") | ✅ | **ENHANCED** - Bulk network creation |
-| `openstack network delete` | `set_networks` (action="delete") | ✅ | **ENHANCED** - Bulk deletion with filtering |
+| `openstack network list` | `get_network_details` | ✅ | Two owned private networks plus one policy-visible shared external network per reader; no other test project private networks |
+| `openstack network show` | `get_network_details` (network_name) | ⚠️ Live unverified | Foreign-ID negative checked; dual-project positive named reader lookup not independently asserted |
+| `openstack network create` | `set_networks` (action="create") | ✅ | Default mtu=0 omits the wire field: backend MTU 1450 verified; explicit 1400 retained in both member projects |
+| `openstack network delete` | `set_networks` (action="delete") | ✅ | Both default/explicit-MTU test networks removed through actual TCP MCP, API absence confirmed |
 | `openstack network set` | `set_networks` (action="update") | ✅ | **ENHANCED** - Bulk updates |
-| `openstack subnet list` | `get_network_details` (includes subnets) | ✅ | Subnet information included |
-| `openstack subnet create/delete` | `set_subnets` | ✅ | Subnet management |
-| `openstack router list` | `get_routers` | ✅ | Router listing |
+| `openstack subnet list` | `get_network_details` (includes subnets) | ✅ | Owned and shared external network subnets returned; three visible subnets per test reader |
+| `openstack subnet create/delete` | `set_subnets` | ✅ | Member TCP MCP subnet create read back; deletion allowed parent network removal in both projects |
+| `openstack router list` | `get_routers` | ⚠️ Live unverified | Only part of composite error requests in this round; no independent reader result attribution |
 | `openstack router create/delete` | `set_routers` | ✅ | Project-owned routers; attached interfaces are not removed automatically |
 | `openstack floating ip list` | `get_floating_ips` | ✅ | Floating IP listing |
 | `openstack floating ip create` | `set_floating_ip` (action="create") | ✅ | Floating IP creation |
@@ -274,38 +245,38 @@ remaining test resources across 24 categories. See also
 | `openstack floating ip set` | `set_floating_ip` (action="set") | ✅ | Floating IP property setting |
 | `openstack floating ip show` | `set_floating_ip` (action="show") | ✅ | Floating IP details |
 | `openstack floating ip unset` | `set_floating_ip` (action="unset") | ✅ | Floating IP property clearing |
-| `openstack floating ip pool list` | `get_floating_ip_pools` | ✅ | Floating IP pool listing |
+| `openstack floating ip pool list` | `get_floating_ip_pools` | ⚠️ Live unverified | Composite result not independently attributed; available global pool capacity remains unknown |
 | `openstack floating ip port forwarding create` | `set_floating_ip_port_forwarding` (action="create") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
 | `openstack floating ip port forwarding delete` | `set_floating_ip_port_forwarding` (action="delete") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
 | `openstack floating ip port forwarding list` | `set_floating_ip_port_forwarding` (action="list") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
 | `openstack floating ip port forwarding set` | `set_floating_ip_port_forwarding` (action="set") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
 | `openstack floating ip port forwarding show` | `set_floating_ip_port_forwarding` (action="show") | ⚠️ Live unverified | Implemented; test platform port-forwarding endpoint returns HTTP 404 |
-| `openstack security group list` | `get_security_groups` | ✅ | Security group listing |
+| `openstack security group list` | `get_security_groups` | ✅ | Scoped reader list completed; default and test groups visible |
 | `openstack security group create/delete` | `set_security_groups` | ✅ | Project-owned security groups |
-| `openstack port list` | `get_network_details` (includes ports) | ✅ | Port information included |
+| `openstack port list` | `set_network_ports` (action="list") | ⚠️ Live unverified | Implemented list action requires modification-tool registration; not exercised in this round |
 | `openstack port create/delete` | `set_network_ports` | ✅ | Port management |
 | `openstack network qos policy list` | `get_network_qos_policies` | ⚠️ Live unverified | Implemented; test platform QoS endpoint returns HTTP 404 |
 | `openstack network qos policy create` | `set_network_qos_policies` | ⚠️ Live unverified | Implemented; test platform QoS endpoint returns HTTP 404. Policy containers only; no bandwidth rules |
-| `openstack network agent list` | `get_service_status` (includes agents) | ✅ | Network agents |
+| `openstack network agent list` | `get_service_status` (includes agents) | ⚠️ Live unverified | Reader service-policy restrictions; partial data is not proof of global health |
 | `openstack network agent set` | `set_network_agents` | ✅ | Enable/disable cloud-wide agents; usually admin-only |
 
 ### 3. 💾 **Storage (Cinder)**
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| `openstack volume list` | `get_volume_list` | ✅ | Volume listing |
-| `openstack volume show` | `get_volume_list` (filtering) | ✅ | Specific volume query |
+| `openstack volume list` | `get_volume_list` | ✅ | Exactly ten owned volumes per reader; no other test project volume IDs returned |
+| `openstack volume show` | `get_volume_list` | ✅ | Listing-based client filtering; no dedicated get_volume_list filter argument |
 | `openstack volume create/delete` | `set_volume` | ✅ | Volume creation/deletion |
-| `openstack volume set` | `set_volume` (action="modify") | ✅ | Volume property modification |
+| `openstack volume set` | — | ❌ Not implemented | set_volume has no modify/update action; do not send this unsupported action |
 | `openstack volume type list` | `get_volume_types` | ✅ | Volume type listing |
 | `openstack volume type create/delete` | `set_volume_types` | ✅ | Volume type management; usually admin-only |
-| `openstack volume snapshot list` | `get_volume_snapshots` | ✅ | Snapshot listing |
-| `openstack volume snapshot create/delete` | `set_snapshot` | ✅ | Snapshot management |
-| `openstack backup list` | `get_volume_backups` | ✅ | Current-project backup listing |
+| `openstack volume snapshot list` | `get_volume_snapshots` | ✅ | Two owned base snapshots per reader; API final states checked |
+| `openstack volume snapshot create/delete` | `set_snapshot` | ✅ | Explicit member MCP snapshots reached available and were deleted; no restore/I/O claim |
+| `openstack backup list` | `get_volume_backups` | ✅ | Three owned available backups per reader; base backup creation used real Cinder APIs |
 | `openstack backup create/delete` | `set_volume_backups` | ✅ | Volume backup management |
 | `openstack volume transfer request list` | `get_volume_transfers` | ✅ | Request listing only; authorization keys are excluded |
 | `openstack server volume list` | `get_server_volumes` | ✅ | Server volume listing |
-| `openstack server add/remove volume` | `set_server_volume` | ✅ | Server volume attach/detach |
+| `openstack server add/remove volume` | `set_server_volume` / `set_volume` (action="attach"/"detach") | ✅ | Both paths reached in-use then available in both member projects; foreign endpoints rejected; guest I/O not tested |
 | `openstack volume group list` | `get_volume_groups` | ✅ | Requires Cinder generic groups (API >= 3.13) |
 | `openstack volume group create` | `set_volume_groups` | ✅ | Create/list/show/delete; create requires group_type and volume_types |
 | `openstack volume qos list` | `get_volume_qos` | ✅ | Cinder QoS specifications; subject to cloud policy |
@@ -331,22 +302,22 @@ remaining test resources across 24 categories. See also
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| `openstack user list` | `get_user_list` | ✅ | User listing |
-| `openstack user show` | `get_user_list` (filtering) | ✅ | Specific user query |
+| `openstack user list` | `get_user_list` | ⚠️ Live unverified | Reader denied by Keystone; explicit MCP failure observed; successful listing not validated in this round |
+| `openstack user show` | `get_user_list` | ⚠️ Live unverified | Depends on policy-limited user listing; not independently validated for the new readers |
 | `openstack user create/delete` | `set_users` | ✅ | Password from a server environment variable; no role grants |
 | `openstack project list` | `get_project_details` | ✅ | Project listing |
 | `openstack project show` | `get_project_details` (name param) | ✅ | Specific project query |
 | `openstack project create/delete` | `set_project` | ✅ | Project management |
 | `openstack role list` | `get_role_assignments` | ✅ | Role listing |
-| `openstack role assignment list` | `get_role_assignments` | ✅ | Role assignment listing |
+| `openstack role assignment list` | `get_role_assignments` | ⚠️ Live unverified | Reader Keystone policy denial; not a successful data lookup |
 | `openstack role create/delete` | `set_roles` | ✅ | Role management |
 | `openstack domain list` | `get_domains` | ✅ | Subject to Keystone policy |
 | `openstack domain create/delete` | `set_domains` | ✅ | Disable explicitly with update before delete |
 | `openstack group list` | `get_identity_groups` | ✅ | Subject to Keystone policy |
 | `openstack group create/delete` | `set_identity_groups` | ✅ | Group management |
-| `openstack service list` | `get_service_status` | ✅ | Service listing |
+| `openstack service list` | `get_service_status` | ⚠️ Live unverified | Reader service-policy restrictions; partial data is not proof of global health |
 | `openstack service create/delete` | `set_services` | ✅ | Service management |
-| `openstack endpoint list` | `get_service_status` (includes endpoints) | ✅ | Endpoint information |
+| `openstack endpoint list` | `get_service_status` (includes endpoints) | ⚠️ Live unverified | Reader service-policy restrictions; partial data is not proof of global health |
 
 ### 6. 🔥 **Orchestration (Heat)**
 
@@ -461,9 +432,9 @@ remaining test resources across 24 categories. See also
 
 | OpenStack CLI Command | MCP Tool | Status | Notes |
 |---------------------|---------|------|------|
-| Resource monitoring | `get_resource_monitoring` | ✅ | Project allocations, separate quotas and visible hypervisor capacity; no live utilization |
-| Service status | `get_service_status` | ✅ | Service status query |
-| Cluster overview | `get_service_status` + `get_resource_monitoring` | ✅ | Service probes and current inventory |
+| Resource monitoring | `get_resource_monitoring` | ⚠️ Live unverified | Reader physical-capacity policy restrictions; allocations are separate from capacity; no live utilization |
+| Service status | `get_service_status` | ⚠️ Live unverified | Reader service-policy restrictions; partial data is not proof of global health |
+| Cluster overview | `get_service_status` + `get_resource_monitoring` | ⚠️ Live unverified | Reader physical-capacity policy restrictions; allocations are separate from capacity; no live utilization |
 | Service log metadata | `set_service_logs` | Partial | Service listing only; log retrieval is unavailable without a logging backend |
 | Resource metadata | `set_metrics` | Partial | list/summary only; telemetry sample retrieval is unavailable |
 | Alarm management | `set_alarms` | ⚠️ Live unverified | Implemented; Aodh/Gnocchi unavailable in the test platform. Requires services and collected metrics |
@@ -479,13 +450,13 @@ remaining test resources across 24 categories. See also
 | `openstack quota delete` | `set_quota` (action="delete") | ✅ | Resets all three service quotas to defaults; requires modification tools |
 | `openstack usage show` | `get_usage_statistics` | ✅ | Current-project Nova simple tenant usage; not monetary charges |
 | `openstack limits show` | `get_quota` (includes limits) | ✅ | Limits query |
-| Resource allocations | `get_resource_monitoring` | ✅ | Flavor allocations; not CPU load or resident memory samples |
+| Resource allocations | `get_resource_monitoring` | ⚠️ Live unverified | Reader physical-capacity policy restrictions; allocations are separate from capacity; no live utilization |
 
 ---
 
 ### API prerequisites and result semantics
 
-The feature table marks implemented API paths, not verification against every OpenStack deployment. The management and query paths have local mocked API tests. Selected paths also passed live tests on a single-node Kolla Ansible deployment; see [integration validation](docs/integration-validation.md) for coverage and skipped operations. A missing service, extension, required microversion, or permission is an operation failure, not an empty successful result.
+The feature table marks implemented API paths, not verification against every OpenStack deployment. Service and policy requirements must be checked in the target deployment. A missing service, extension, required microversion, or permission is an operation failure, not an empty successful result.
 
 - **Modification tools:** the MCP server registers `set_*` management tools only when `ALLOW_MODIFY_OPERATIONS=true`. Existing action guards also reject writes when disabled. Dedicated read-only `get_*` tools remain available. API authorization is enforced by the target cloud; agent, user, domain, type and QoS administration may require elevated OpenStack roles.
 - **Alarms:** `set_alarms` calls the Keystone catalog's `alarming` endpoint for the configured interface/region. It supports list/create/show/delete of project alarms and creates `gnocchi_resources_threshold` alarms. Aodh, Gnocchi, the specified resource and a collected metric are required. The default metric is `cpu_util`, which is not collected by every deployment. `metric`, `resource_type`, `aggregation_method`, `granularity`, `evaluation_periods`, and `alarm_actions` can be supplied. An empty action list creates an alarm without notifications. There is no simulation fallback.
@@ -687,7 +658,7 @@ unset OPENSTACK_MCP_TOKEN
 ```
 
 This Bearer configuration uses the server's configured OpenStack account. For
-experimental per-user authentication, see the [phase 1 guide](docs/multi-user-phase1.md).
+experimental per-user authentication, see the [multi-user guide](docs/multi-user-guide.md).
 See also the [Claude Code MCP documentation](https://code.claude.com/docs/en/mcp).
 
 ## Server Configuration
@@ -1002,7 +973,7 @@ get_instance_details(limit=50, offset=50)    # Next 50 instances
 get_instance_details(include_all=True)       # All instances (use with caution)
 
 # Optimized search for large datasets
-search_instances("web", "name", limit=20)    # Search with reasonable limit
+search_instances("web", "name", limit=20, offset=0, case_sensitive=False)
 ```
 
 ---