code: drop internal-doc references and stale ops/range mode names from comments

Public-repo hygiene: remove references to internal docs (PAI, current-activity-list, memory slugs, finding ids) from code and test comments, and sweep the stale "ops mode" and "range mode" wording to offense and defense. Fix the deploy.sh usage header to point at the root deploy.tfvars. Comments and docstrings only, no behavior change.

Author: BaddKharma

frontend/src/vulns.js

@@ -147,7 +147,7 @@ export const VULN_LABEL = Object.fromEntries(
 // tests/test_vuln_providers_sync.py) filters a host's declared vulns by this
 // same map before planting them, so a template can declare an id everywhere and
 // have it silently no-op on a provider it cannot land on; the canvas greys the
-// checkbox the same way. See current-activity-list (provider-aware toggles).
+// checkbox the same way.
 export const VULN_PROVIDERS = Object.fromEntries(
   VULN_CATALOG.flatMap((g) => g.items)
     .filter((i) => i.providers)

src/redstackpro/ansible.py

@@ -59,7 +59,7 @@
 # local Administrator into the domain Administrator with the same password, so
 # the connection survives the promotion. The password is never written into the
 # export: it is supplied at run time from the terraform output, read from the
-# environment. See goad-native-recreation.
+# environment.
 RANGE_WINDOWS_CONNECTION = {
     "ansible_connection": "psrp",
     "ansible_port": 5986,
@@ -93,8 +93,7 @@ class GenerationError(Exception):
 # before planting them, so a template can declare an id on every host and have
 # it silently no-op on a provider it cannot land on -- the same id the canvas
 # greys out there. Kept in sync with the `providers` field in
-# frontend/src/vulns.js by tests/test_vuln_providers_sync.py. See
-# current-activity-list (provider-aware toggles) and goad-fidelity-build.
+# frontend/src/vulns.js by tests/test_vuln_providers_sync.py.
 VULN_PROVIDERS = {
     # The relay payoff (mitm6/WPAD, or coercion into a CVE-2019-1040-vulnerable
     # relay) needs a real L2 broadcast/multicast domain. Proxmox/ESXi put the
@@ -366,7 +365,7 @@ def _host_vars(self):
                 # hosts-file play can give each host a friendly alias -- the id
                 # the user set (and can rename) on the canvas, not a hardcoded
                 # mythic/sliver. AD hosts also get an FQDN below. See the
-                # redstackpro.hosts role and range-access-model.
+                # redstackpro.hosts role.
                 "redstackpro_host_shortname": nid,
                 # The host's PRIVATE address, for the /etc/hosts block -- NOT
                 # ansible_host, which is the public address for a jumpbox or
@@ -388,7 +387,7 @@ def _host_vars(self):
             # list and pins the listen port so Ansible and Terraform agree on it.
             # Per-operator peers and client credentials are generated at apply from
             # redstackpro_jumpbox_operators, which the overlay already emitted. See
-            # vpn-multiuser-spec and plan.vpn_access.
+            # plan.vpn_access.
             if node["kind"] == "jumpbox":
                 self._jumpbox_vpn_vars(node, vars_)
 
@@ -397,7 +396,7 @@ def _host_vars(self):
             # member (the dc role seeds the domain side). Note the local account
             # no longer opens an SSH session -- sshd here is key-only as of
             # 2026-09-10 -- but the account is still what makes the breach real on
-            # this host. See range-access-model and P2.5.
+            # this host.
             if self._is_range() and node["kind"] == "jumpbox":
                 breach = [u["username"] for u in self._assumed_breach_users()]
                 if breach:
@@ -422,9 +421,9 @@ def _host_vars(self):
                 # And it carries the offensive toolchain by default, because in a
                 # range this host IS the assumed-breach foothold the solution is
                 # run from: leaving it bare would mean every operator hand-installs
-                # the same tools before step one. An ops-mode bastion gets nothing,
+                # the same tools before step one. An offense bastion gets nothing,
                 # since there the tooling belongs on the operator box. The overlay
-                # wins if it says either way. Opens no ports. See PZ-2.
+                # wins if it says either way. Opens no ports.
                 vars_.setdefault("redstackpro_jumpbox_offensive_toolkit", True)
 
             # A redirector carries two things for its cover site, and the split
@@ -498,8 +497,7 @@ def _host_vars(self):
                 # anyway would look like a management path that works. See 0019.
                 # A range's Windows host is provisioned over psrp as the local
                 # Administrator; an ops range's Windows box self-provisions and
-                # is only ever reached by the winrm_ca bootstrap. See
-                # goad-native-recreation.
+                # is only ever reached by the winrm_ca bootstrap.
                 vars_.update(RANGE_WINDOWS_CONNECTION if self._is_range()
                              else WINDOWS_CONNECTION)
                 # A Windows operator is internal and reached at its private
@@ -528,7 +526,7 @@ def _host_vars(self):
                 # it by fully-qualified name as well as by its canvas alias
                 # (redstackpro_host_shortname, set for every host above). The
                 # address is a placeholder resolved at apply, carried in
-                # ansible_host; here we only need the name. See range-access-model.
+                # ansible_host; here we only need the name.
                 fqdn = self._host_fqdn(node)
                 if fqdn:
                     vars_["redstackpro_host_fqdn"] = fqdn
@@ -581,7 +579,7 @@ def _assumed_breach_users(self):
         """Every domain user flagged assumed_breach: the range's patient-zero
         foothold identities. Each is a low-priv domain user (seeded by the dc
         role) the jumpbox also creates as a local admin so an operator can SSH in
-        as it. See range-access-model and P2.5."""
+        as it."""
         out = []
         for node in self.ctx.nodes.values():
             if node.get("kind") != "domain":
@@ -956,7 +954,6 @@ def _group_vars(self):
             "{{ lookup('env', 'REDSTACKPRO_LAB_PASSWORD') }}"
         if self._is_range():
             # The account the range's Windows hosts are provisioned as.
-            # See goad-native-recreation.
             all_["redstackpro_range_admin_user"] = "Administrator"
             # Per-user passwords, for a lab that seeds real per-account
             # credentials (GOAD's documented passwords). A task that logs on as,
@@ -986,7 +983,7 @@ def _group_vars(self):
             # differ by platform branch on this rather than sharing one path, so
             # a fix proven on one provider cannot regress another. Defaults to
             # "generic" when the compile did not name a provider. See
-            # goad-native-recreation and the dc role's promotion branch.
+            # the dc role's promotion branch.
             all_["redstackpro_platform"] = self.provider or "generic"
             # The SIEM addresses a Windows host's agents report to. A host reports
             # to every SIEM box the range has, so this maps each SIEM box's
@@ -1281,8 +1278,7 @@ def _render_site(plan):
         # (the account, the password, and RDP are set at first boot), so a group
         # that holds one excludes it from the play. A range inverts this: its
         # Windows hosts are the domain controllers and members the play exists to
-        # provision, so they stay in and are driven over psrp. See 0019, 0022 and
-        # goad-native-recreation.
+        # provision, so they stay in and are driven over psrp. See 0019, 0022.
         host_pattern = group
         if group_windows and not range_mode:
             host_pattern = "%s:!windows" % group
@@ -1377,7 +1373,7 @@ def _render_site(plan):
     # self-provisions at boot), so it is NOT an ansible recipient -- its hosts
     # block rides the boot script instead (operator_setup.ps1 / RSP_HOSTS). That
     # is why the Windows play is range-only: only a range's Windows hosts are
-    # reachable over psrp. See range-access-model and the /etc/hosts PAI item.
+    # reachable over psrp.
     ad_groups = [g for g in ("domain_controllers", "servers", "workstations")
                  if g in plan.groups]
     ad_hosts = set().union(*(set(plan.groups[g]) for g in ad_groups)) \

src/redstackpro/assets/ansible/roles/redstackpro.collector/tasks/dashboards.yml

@@ -7,7 +7,7 @@
 # first login rather than after an afternoon of building panels.
 #
 # It binds on the private address only. The collector has no public address --
-# EXP002 forbids one -- and in ops mode every network in the plan is internally
+# EXP002 forbids one -- and in offense mode every network in the plan is internally
 # open (d6a00cc), so the jumpbox reaches it without a rule of its own and the
 # internet cannot reach it at all. The operator arrives through the portal's 443,
 # which is the one public door the range already had.

src/redstackpro/assets/ansible/roles/redstackpro.collector/templates/opensearch-dashboards.yml.j2

@@ -1,7 +1,7 @@
 # {{ ansible_managed }}
 #
 # Bound to every interface, which is safe here and only here: the collector holds
-# no public address (EXP002 forbids one) and in ops mode the plan's networks are
+# no public address (EXP002 forbids one) and in offense mode the plan's networks are
 # internally open, so the reachable set is the operator's own stack. The operator
 # arrives through the portal on the jumpbox, which proxies this under /dashboards.
 server.host: "0.0.0.0"

src/redstackpro/assets/ansible/roles/redstackpro.host_vulns/tasks/endpoint_telemetry.yml

@@ -3,8 +3,7 @@
 # detections need. A default range ships none of this (quieter, GOAD parity), so
 # a Wazuh/ELK agent sees only the native Security log and is blind to
 # process/command-line and object-change activity. Opting in here installs Sysmon
-# and turns on command-line (4688) and directory-service (5136) auditing. See the
-# goad-wazuh detection page and PAI F-wazuh-telemetry.
+# and turns on command-line (4688) and directory-service (5136) auditing.
 
 - name: Enable command-line auditing (4688 with the process command line)
   ansible.windows.win_powershell:

src/redstackpro/assets/ansible/roles/redstackpro.jumpbox/tasks/toolkit.yml

@@ -3,7 +3,7 @@
 # assumed-breach foothold and patient zero ([[range-access-model]]), so the operator
 # works FROM here: this is the box the GOAD solution runs from. Arming it is what
 # makes the solution zero-touch. Opt out with `offensive_toolkit: false` on the
-# jumpbox overlay; ops-mode bastions never get it, since there the tooling belongs
+# jumpbox overlay; offense bastions never get it, since there the tooling belongs
 # on the kali/operator box rather than the perimeter host.
 #
 # Nothing here opens a port, so this does not widen the jumpbox's internet surface

src/redstackpro/assets/ansible/roles/redstackpro.jumpbox/templates/guacamole-nginx.conf.j2

@@ -18,7 +18,7 @@ server {
 
 {% if redstackpro_collector_address | default('') | length > 0 %}
     # The collector's dashboard, reached through the portal rather than a second
-    # public door. The collector holds no public address and in ops mode the
+    # public door. The collector holds no public address and in offense mode the
     # plan's networks are internally open, so this hop is jumpbox to collector on
     # a private address and the internet never sees 5601. Dashboards is
     # configured with the matching server.basePath, without which every asset

src/redstackpro/assets/ansible/roles/redstackpro.operator/defaults/main.yml

@@ -91,7 +91,7 @@ redstackpro_operator_git_tools:
 # is the operator's SSH client to every lab box, VS Code the editor. NOTE: the
 # offense win-op01 self-provisions at boot and has no WinRM, so this list only
 # reaches a Windows operator that IS managed (a range operator, or win-op once it
-# gets a WinRM listener); the boot-script port covers win-op01 itself. See PAI.
+# gets a WinRM listener); the boot-script port covers win-op01 itself.
 redstackpro_operator_windows_packages:
   - mobaxterm
   - vscode

src/redstackpro/assets/terraform/modules/aws/host/windows-setup.ps1.tftpl

@@ -40,7 +40,7 @@ Start-Service -Name TermService
 # promoted this local account becomes the domain Administrator with the same
 # password, so the connection survives the promotion. The range is an isolated
 # subnet, so the listener is self signed and the control node does not validate
-# it. See redStackPRO goad-native-recreation.
+# it.
 Set-LocalUser -Name "Administrator" -Password $pass
 Enable-LocalUser -Name "Administrator"
 
@@ -78,7 +78,7 @@ if (-not (Get-NetFirewallRule -Name "redstackpro-winrm-https" -ErrorAction Silen
 # brings the payload to ~5.3KB and the whole thing to ~10KB. GCP carries the
 # same script in a metadata key with a 256KB budget and needs no such trick, so
 # this compression is an AWS-local concern.
-# See operator_setup.ps1 and the /etc/hosts PAI item.
+# See operator_setup.ps1.
 $rspDone = "C:\Windows\Temp\operator-setup.done"
 if (-not (Test-Path $rspDone)) {
     try {

src/redstackpro/assets/terraform/modules/azure/host/main.tf

@@ -200,7 +200,7 @@ resource "azurerm_virtual_machine_extension" "winrm" {
 # is either a range Windows box or the ops operator, never both), so the VM never
 # carries two CustomScript extensions. The script is base64 (it uses PowerShell
 # here-strings), RSP_HOSTS names the range, and RSP_OPERATOR is the account whose
-# profile the kit lands in. See operator_setup.ps1 and the /etc/hosts PAI item.
+# profile the kit lands in. See operator_setup.ps1.
 resource "azurerm_virtual_machine_extension" "operator_setup" {
   count                = (var.windows && var.operator_setup) ? 1 : 0
   name                 = "redstackpro-operator-setup"