refactor: rename preflight role to validate_environment

GLOSSARY.md

@@ -0,0 +1,27 @@
+# Glossary
+
+Domain vocabulary for the openshift-virtualization-migration collection.
+
+## Environment validation
+
+The pre-migration validation pass (role `validate_environment`, playbook `vmf_validate_environment.yml`). Validates the migration environment before seeding AAP and running a migration: OpenShift API authentication, OpenShift Virtualization and MTV operator health, AAP access, vCenter connectivity, and VDDK init image configuration. Read-only probes; fails the play with an actionable message per failed check.
+
+## Migration validation
+
+The post-migration validation pass (role `validate_migration`, playbook `vmf_validate_migration.yml`). Runs as a standalone playbook after `vmf_migrate` completes — the operator or an AAP job template invokes it; it is not wired into the MTV pipeline (the in-pipeline hook path is `mtv_hook_invoke_aap`). Validates migration outcomes and performs the source power-off.
+
+## Source VM
+
+The original VMware virtual machine being migrated to OpenShift Virtualization. Queried read-only via the vCenter API.
+
+## Migrated VM
+
+The OpenShift Virtualization virtual machine produced by a migration; the counterpart of one source VM. Verified via the Kubernetes API (VirtualMachine / VirtualMachineInstance status).
+
+## Migration plan
+
+The MTV (Forklift) Plan custom resource that groups source VMs with network and storage maps and drives the migration. Referenced by name and namespace (`mtv_migrate_plan_name`, `mtv_migrate_plan_namespace`).
+
+## Source power-off
+
+The post-migration cutover step of powering off source VMs whose migrated counterparts passed validation — a hard stop via the vCenter API. Performed by validate_migration, controlled by a toggle (default: on), gated per-VM and fail-closed — see docs/adr/0001-validate-migration-fail-closed-power-off.md.

README.md

@@ -51,10 +51,10 @@ This collection includes the following roles for managing OpenShift Virtualizati
 * [mtv_provider](roles/mtv_provider/README.md) - Ensure host OpenShift provider and source provider CRs exist on target clusters. Designed to run from AAP with credential injection.
 * [mtv_query_inventory](roles/mtv_query_inventory/README.md) - Queries MTV inventory.
 * [pre_migration_vm](roles/pre_migration_vm/README.md) - Perform VM related activities prior to a migration
-* [preflight](roles/preflight/README.md) - Validate the migration environment before seeding AAP — OpenShift API authentication, OpenShift Virtualization and MTV operator health, AAP access, vCenter connectivity, and VDDK init image configuration.
 * [utility_aap_deploy](roles/utility_aap_deploy/README.md) - Deploys an instance of Ansible Automation Platform.
 * [utility_openshift_target_credential](roles/utility_openshift_target_credential/README.md) - A utility role to manage OpenShift target cluster credentials for migration
 * [utility_registry_credentials](roles/utility_registry_credentials/README.md) - Manages registry credentials in an OpenShift namespace.
+* [validate_environment](roles/validate_environment/README.md) - Validate the migration environment before seeding AAP — OpenShift API authentication, OpenShift Virtualization and MTV operator health, AAP access, vCenter connectivity, and VDDK init image configuration.
 <!--ROLES_LIST_END-->
 
 ## Requirements

changelogs/fragments/110-validate-environment-role.yml

@@ -0,0 +1,6 @@
+---
+minor_changes:
+  - Add validate_environment role to validate the migration environment before seeding AAP and running a migration — OpenShift API auth, OpenShift Virtualization and MTV operator health, AAP access, vCenter connectivity, and VDDK init image configuration (playbook vmf_validate_environment.yml).
+bugfixes:
+  - Preserve an explicit false for validate_certs in the validate_environment role's vCenter and AAP TLS-verification cascade — the previous fallback converted it to true.
+...

changelogs/fragments/121-pin-range-safety.yml

@@ -0,0 +1,2 @@
+trivial:
+  - Add pin-range safety notes to the community.vmware module justification in validate_environment.

docs/architecture-v2.md

@@ -22,9 +22,9 @@
 | `aap_cleanup` | **REWRITTEN** | AAP 2.5+ only, simplified dispatch |
 | `aap_machine_credentials` | **DEFERRED** to Phase 3 | Day 2 scope |
 | `mtv_management` | **REWRITTEN** | Error handling, provider lifecycle, `provider` var fix |
-| `mtv_migrate` | **REWRITTEN** | `failure_strategy`, pre-flight, scheduling, cold migration |
+| `mtv_migrate` | **REWRITTEN** | `failure_strategy`, environment validation, scheduling, cold migration |
 | `network_mgmt` | **REWRITTEN** | Bug fixes (typo), error handling, OVN/UDN prep |
-| `validate_migration` | **ENHANCED** | Structured output, pre-flight integration |
+| `validate_migration` | **ENHANCED** | Structured output, environment validation integration |
 | `cluster_healthcheck` | **ENHANCED** | Additional checks for v2 readiness |
 | `operator_management` | **SIMPLIFIED** | Fewer defaults, cleaner config |
 | `ocp_cleanup` | **KEPT** | Enhanced scoping |
@@ -61,7 +61,7 @@ flowchart TD
     end
 
     subgraph Migration["Phase C: Migration Execution"]
-        PreFlight["Pre-flight validation\nstorage, network, provider checks"]
+        EnvValidation["Environment validation\nstorage, network, provider checks"]
         Migrate["mtv_migrate role\nPlan creation + execution"]
         Monitor["Migration monitoring\nfailure_strategy handling"]
         PostVal["Post-migration validation"]
@@ -77,8 +77,8 @@ flowchart TD
     EnvMgr --> Ops
     Ops --> Net
     Net --> MTV
-    MigReq --> PreFlight
-    PreFlight --> Migrate
+    MigReq --> EnvValidation
+    EnvValidation --> Migrate
     Migrate --> Monitor
     Monitor --> PostVal
     Seed -.-> EnvConfig
@@ -183,7 +183,7 @@ One primary orchestration workflow:
 ```
 MF - Full Migration Workflow
 ├── MF - Configure Environment (source + target)
-├── MF - Validate (pre-flight)
+├── MF - Validate (environment)
 ├── MF - Migrate
 └── MF - Validate (post-migration)
 ```
@@ -407,7 +407,7 @@ environment_manager_environments: {}     # same structure as environments.yml
 **New capabilities:**
 
 - `failure_strategy` parameter (MIG-05)
-- Pre-flight validation (MIG-08)
+- Environment validation (MIG-08)
 - Cold migration with shutdown/timeout (MIG-07)
 - Maintenance window scheduling (MIG-09)
 - Structured migration report output
@@ -417,7 +417,7 @@ environment_manager_environments: {}     # same structure as environments.yml
 mtv_migrate_failure_strategy: continue_and_report
     # continue_and_report | continue_and_retry | halt_on_failure
 mtv_migrate_max_retries: 3
-mtv_migrate_pre_flight: true
+mtv_migrate_environment_validation: true
 mtv_migrate_shutdown_timeout: 300
 mtv_migrate_force_shutdown: false
 mtv_migrate_cleanup_source: false
@@ -430,9 +430,9 @@ mtv_migrate_maintenance_window_end: ""    # ISO 8601
 ```yaml
 # tasks/main.yml (conceptual structure)
 - block:
-    - name: Pre-flight validation
-      include_tasks: _pre_flight.yml
-      when: mtv_migrate_pre_flight
+    - name: Environment validation
+      include_tasks: _environment_validation.yml
+      when: mtv_migrate_environment_validation
 
     - name: Wait for maintenance window
       include_tasks: _schedule.yml
@@ -652,7 +652,7 @@ infra.openshift_virtualization_migration/
 │   ├── mtv_migrate/
 │   │   ├── tasks/
 │   │   │   ├── main.yml
-│   │   │   ├── _pre_flight.yml
+│   │   │   ├── _environment_validation.yml
 │   │   │   ├── _schedule.yml
 │   │   │   ├── _plans.yml
 │   │   │   ├── _execute.yml

playbooks/vmf_preflight.yml → playbooks/vmf_validate_environment.yml

@@ -5,7 +5,7 @@
   gather_facts: false
 
   tasks:
-    - name: Run preflight validation checks
+    - name: Run environment validation checks
       ansible.builtin.import_role:
-        name: infra.openshift_virtualization_migration.preflight
+        name: infra.openshift_virtualization_migration.validate_environment
 ...