- runbook + inspector agent: ipaddresses.ipam.cluster.x-k8s.io (plain `ipaddresses` is the built-in networking.k8s.io type on k8s 1.35) - inspector RBAC: get/list CRDs so clusterctl describe works read-only - phase-1 Step 3 ticked; session note with the first lab1 review Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>