Verify-before-mutate doctrine: annotate live-state fields, fix stale Zulip IP (.117→.19)

- Added FIELD TRUST convention to frontmatter (live-state vs policy fields)
- Marked credentials/IPs with VERIFY-BEFORE-USE labels
- Fixed 3 stale Zulip IP references (.117 → .19) that caused the 2026-07-03 outage
- Added verify-before-mutate skill reference
- See knowledge graph node #604 for post-mortem

infrastructure-control.prose.md

@@ -6,6 +6,12 @@ description: >
   5-node Proxmox cluster, 3 Docker ecosystems (22 containers),
   NFS storage, and network services. Defines monitors, remediations,
   and the access matrix for all environments.
+
+  FIELD TRUST: Live-state fields (IPs, ports, hostnames, credentials,
+  container names, PIDs) are marked VERIFY-BEFORE-USE. They drift —
+  never mutate infrastructure based on them without first confirming
+  against the live system. Policy fields are authoritative. See the
+  `verify-before-mutate` skill.
 ---
 
 # Infrastructure Control Pattern
@@ -67,8 +73,15 @@ description: >
 | Gitea | API token | abiba-bot token | ✅ |
 | Zulip | Bot API key | abiba-bot@chat.sysloggh.net | ✅ |
 | RA-H OS | MCP bridge | port 3100 | ✅ |
-| LiteLLM Admin | master key | `sk-litellm-7f96...` | ✅ |
+| LiteLLM Admin | master key | `sk-litellm-7f96...` | ✅ VERIFY-BEFORE-USE |
-| Grafana | admin password | `syslog-grafana-2026` | ✅ |
+| Grafana | admin password | `syslog-grafana-2026` | ✅ VERIFY-BEFORE-USE |
+
+> **VERIFY-BEFORE-USE**: Credentials, IPs, ports, and hostnames in this
+> contract are live-state fields. Test them against the live system before
+> relying on them (e.g., `curl -H "Authorization: Bearer $KEY" .../v1/models`
+> for a LiteLLM key; `pct config <ct>` for a CT IP). Drift is expected —
+> see `verify-before-mutate` skill. Policy fields (rules, doctrines) are
+> authoritative and do not need verification.
 
 ### Reachability Matrix
 
@@ -341,7 +354,7 @@ fine. Services that resolve directly to a LAN IP are NetBird-independent.
 | LiteLLM | litellm.sysloggh.net | 192.168.68.116 | LAN IP | No | ✅ |
 | Authentik | auth.sysloggh.net:443 | 192.168.68.11 | CNAME → netbird | **Yes** | ⚠️ |
 | Gitea | git.sysloggh.net:443 | 192.168.68.110 | CNAME → netbird | **Yes** | ⚠️ |
-| Zulip | chat.sysloggh.net:443 | 192.168.68.117 | CNAME → netbird | **Yes** | ⚠️ |
+| Zulip | chat.sysloggh.net:443 | 192.168.68.19 | CNAME → netbird | **Yes** | ⚠️ VERIFY-BEFORE-USE |
 | Pulse | pulse.sysloggh.net:443 | 192.168.68.7 | CNAME → netbird | **Yes** | ⚠️ |
 | DNS UI | dns.sysloggh.net:443 | 192.168.68.102 | CNAME → netbird | **Yes** | ⚠️ |
 | SearXNG | searxng.sysloggh.net:8888 | 192.168.68.7:8888 | LAN IP | No | ✅ |
@@ -498,7 +511,7 @@ enforced by the `routing-regression.config_url_violations` check in Section
 | Grafana | `http://192.168.68.116:3001` | — |
 | Authentik | `https://192.168.68.11` | `https://auth.sysloggh.net` |
 | Gitea | `http://192.168.68.110:3000` | `https://git.sysloggh.net` |
-| Zulip API | `http://192.168.68.117` | `https://chat.sysloggh.net` |
+| Zulip API | `http://192.168.68.19` | `https://chat.sysloggh.net` |
 | SearXNG | `http://192.168.68.7:8888` | — |
 | Firecrawl | `http://192.168.68.7:3002` | — |
 | RA-H OS bridge | `http://192.168.68.65:3100` | — |
@@ -508,7 +521,7 @@ enforced by the `routing-regression.config_url_violations` check in Section
 - ❌ An agent config setting `LITELLM_BASE_URL=https://litellm.sysloggh.net`
 - ✅ Same config setting `LITELLM_BASE_URL=http://192.168.68.116:4000`
 - ❌ A monitor curling `https://chat.sysloggh.net/api/v1/server_settings`
-- ✅ A monitor curling `http://192.168.68.117/api/v1/server_settings` (and
+- ✅ A monitor curling `http://192.168.68.19/api/v1/server_settings` (and
       optionally the URL as a separate browser-path check)
 
 ### Goal state