CHAT_OUTPUT_BEGIN
COMMAND_ID=HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z
STATUS=OK
RC=0
HOST=pve01
MODE=verify
COMPONENT=cluster-knowledge-base-error-system
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
COMMAND_SHA256=829077ae842686fb1f36e274117ae6385fb6020f21e25b3af48ae632cde78bcc
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=10eeba794a85e13eb9ddc29f821f0e0cf430c57b93acf878eb539e048389d8f6
SANITIZED_OUTPUT_SHA256=11a658e5cc7243e6916e1903b779b9538dded188f7d8c27c775d3f68147adde9
OUTPUT_BEGIN
HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1}
{"blocking_findings":["HANDBOOK_CANDIDATE_AMBIGUOUS","REPOSITORY_TESTS_FAILED","CLUSTER_STATUS_UNREADABLE"],"changes_made":false,"cluster_changed":false,"command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z","command_rc":0,"error_system_assessment":{"deterministic_fingerprint_observed":true,"immutable_error_ledger_observed":false,"mandatory_components":{"linter":{"paths":[],"present":false},"regression_registry":{"paths":["errors/regression-cases.json"],"present":true},"repository_validator":{"paths":["tools/validate_repo.py"],"present":true},"superseded_policy":{"paths":[],"present":false},"tests":{"paths":["tests/fixtures/gitea-legacy-auth-permission.json","tests/test_access_contexts.py","tests/test_cr_2026_0005.py","tests/test_cr_2026_0006.py","tests/test_cr_2026_0006_vm160_task.py","tests/test_cr_2026_0007_skladchik_reauth.py","tests/test_cr_2026_0007_skladchik_semantic_repair.py","tests/test_cr_2026_0008_skladchik_snapshot_integrity.py","tests/test_cr_2026_0009_skladchik_concurrency_guard.py","tests/test_cr_2026_0011_skladchik_cookie_jar_reset.py","tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py","tests/test_cr_2026_0013_vm160_worker_bootstrap_transition.py","tests/test_cr_2026_0015_pve03_r8152_rx_ring_canary.py","tests/test_cr_2026_0018_execution_boundary_preparation.py","tests/test_inventory_foundation.py","tests/test_live_verification.py","tests/test_no_repeat_policy.py","tests/test_reg_014_015.py","tests/test_repository.py"],"present":true}},"missing_mandatory_components":["linter","superseded_policy"],"observed_error_artifact_count":160,"pre_command_gate_observed":false,"proposed_v2":{"command_evidence_basis":"Каждая задача закрепляется на точном Gitea commit и SHA исходных файлов. Команда без evidence_basis или с устаревшим commit блокируется до нового READ_ONLY probe.","deterministic_fingerprint":"SHA256 нормализованного набора component + operation + phase + rc + error_type + stable evidence; секреты и переменные значения исключаются до хеширования.","error_ledger":"Одна неизменяемая JSON-запись на каждый доказанный отказ: error_id, command_id, capsule_sha256, component, operation, target, exact evidence, root cause, fixed_by, prevention_test, supersedes, first_seen, last_seen.","exact_result_ingestion":"После exact-result автоматически формируется candidate incident; запись принимается только после сверки command_id, capsule_sha256, runner_json_sha256, wrapper/document RC и отсутствия truncation.","pre_command_gate":"Перед выпуском любой капсулы обязательный поиск fingerprint/component/operation в реестре. Повтор известной ошибки блокируется, пока капсула не содержит подтверждённое prevention_test или документированное исключение.","quality_metrics":"Счётчики: first-pass success rate, repeated-error rate, rollback rate, unknown-state commands, commands without exact-result verification. Цель — repeated-error rate = 0.","regression_tests":"Каждая исправленная ошибка обязана иметь воспроизводимый тест в tests/errors; лinter запрещает закрывать ошибку без теста и ссылки fixed_by.","supersession":"Старые задачи и обходные пути не удаляются молча: они получают статус superseded с заменой, причиной и запретом повторного запуска."},"requires_v2":true},"gitea":{"default_head_archive":{"archive_sha256":"8f595e76a5baa7b2d8d2148f1a694e9acd22a90accb6e55f962fc47ff1432a5a","branch":"main","bytes":376932,"commit":"fe1221b06643db3b00a621b0230f92a46a4edc2b","files":125},"discovery_evidence":[{"id":"aa350cac62aa","kind":"podman-probe","paths_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","rc":126,"stderr":"Error: crun: capset: Operation not permitted: OCI permission denied\n"},{"kind":"network-ls-remote","rc":0,"stderr":"","stdout_sha256":"b6697044d593fdddb9d66bc35bd58267cc6d07a31b756330aac2f147bc98bc6c"},{"kind":"network-mirror","rc":0,"stderr":"Cloning into bare repository '/tmp/homelab-kb-network-fallback-k4x0gd1r/homelab-ops.git'...\n","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}],"identity":{"access_method":"authenticated-network-mirror","default_branch":"main","head":"fe1221b06643db3b00a621b0230f92a46a4edc2b","ref_count":13,"refs":[{"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","committer_date":"2026-07-31T10:40:00Z","ref":"refs/heads/site-gram1-ru-baseline-canonical-20260731","subject":"gram1.ru: publish verified baseline pointer"},{"commit":"f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49","committer_date":"2026-07-31T10:37:56+03:00","ref":"refs/heads/site-gram1-ru-baseline-20260731","subject":"GRAM1: capture initial site baseline 20260731T071400Z"},{"commit":"fe1221b06643db3b00a621b0230f92a46a4edc2b","committer_date":"2026-07-29T09:33:11Z","ref":"refs/heads/main","subject":"docs: mark Skladchik moderator assistant as planned"},{"commit":"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17","committer_date":"2026-07-20T00:37:03+03:00","ref":"refs/heads/cr-2026-0017-inventory-foundation","subject":"CR-2026-0017: model access contexts and discover guest management"},{"commit":"60f53ea6fe6724196802a46de3de19c7889a51cc","committer_date":"2026-07-19T17:57:23+03:00","ref":"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary","subject":"CR-2026-0015: add pve03 r8152 RX ring canary"},{"commit":"25b275f96b54551e26f07516c72651d85f235ad0","committer_date":"2026-07-18T16:27:33+03:00","ref":"refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition","subject":"CR-2026-0013: allow VM160 worker bootstrap transition"},{"commit":"f5b22d867ea467987008408e3fb1fb0e17fa7b2e","committer_date":"2026-07-18T14:17:33+03:00","ref":"refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook","subject":"CR-2026-0012: add one-command Skladchik Cookie refresh runbook"},{"commit":"bb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9","committer_date":"2026-07-18T13:11:46+03:00","ref":"refs/heads/cr-2026-0011-skladchik-cookie-jar-reset","subject":"CR-2026-0011: force fresh Skladchik Cookie before jar persistence"},{"commit":"7bd1b050f8d64c7b55dfd51ead63f0adda87f2df","committer_date":"2026-07-18T10:34:25+03:00","ref":"refs/heads/cr-2026-0009-skladchik-concurrency-guard","subject":"CR-2026-0010: separate current and target Skladchik edge SHAs"},{"commit":"1f7abe5acf856ad2a2abe10ef2a9452485edb073","committer_date":"2026-07-18T09:26:07+03:00","ref":"refs/heads/cr-2026-0008-skladchik-snapshot-integrity","subject":"CR-2026-0008: repair Skladchik rollback snapshot integrity"},{"commit":"d399d24440f948b518761ecfd516521993861b43","committer_date":"2026-07-18T08:57:02+03:00","ref":"refs/heads/cr-2026-0007-skladchik-controlled-reauth","subject":"CR-2026-0007: add controlled Skladchik reauthentication task"},{"commit":"16e84298035f5e4ec7e2b7d39967ad5e40ea3d4b","committer_date":"2026-07-18T07:43:14+03:00","ref":"refs/heads/cr-2026-0006-cluster-cloud-quorum","subject":"CR-2026-0006: add VM160 cloud quorum canary task"},{"commit":"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc","committer_date":"2026-07-18T03:57:33+03:00","ref":"refs/heads/cr-2026-0005-codex-bootstrap-activation","subject":"CR-2026-0005 prepare reviewed logrotate bootstrap clearance"}],"refs_sha256":"1349b9021de5d4f1bb0406fd4895b3e0d1fd5c674f3686bad730a3e7a0695fb3","repo_url":"https://git.gram1.ru/homelab-admin/homelab-ops","source":{"kind":"direct","path":"/tmp/homelab-kb-network-fallback-k4x0gd1r/homelab-ops.git"}},"scan":{"canonical_candidate":{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},"canonical_candidate_ambiguous":true,"error_artifacts":[{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":1079183,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":102,"coverage":{"access_and_admin":["access","login","admin","ssh","console","url"],"backup_and_restore":["backup","бэкап","restore","восстанов","recovery","retention"],"change_safety":["rollback","sha256","atomic"],"error_learning":["regression","incident","superseded"],"external_services":["внешн","public","reverse proxy","nginx"],"guests_and_workloads":["vmid","container","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["внутренн","lan"],"monitoring_and_logs":["monitor","alert","log","journal","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","tls","certificate"],"repair_and_troubleshooting":["repair","troubleshoot","diagnostic","failure"],"storage":["storage","thin","disk"]},"excerpt":"<OMITTED_SENSITIVE_CONTENT><BOUNDED_PROJECTION><BOUNDED_PROJECTION><BOUNDED_PROJECTION>","headings":[],"json_top_level_size":1000,"json_top_level_type":"list","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["url-userinfo"],"sha256":"aeb92358514ec5cd67d557f15ea295b3ae4f25df5f17a14556dae750b8496d1b","total_score":102},{"bytes":9499,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":88,"coverage":{"access_and_admin":["access","login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","internet"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["internal service","lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","grafana","prometheus"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"excerpt":"# DR from zero runbook, 2026-06-22\n\nChecked at UTC: `2026-06-22T09:00:38Z`.\n\nMarker: **DR from zero runbook, 2026-06-22**\n\n## Purpose\n\nThis runbook describes how to rebuild a minimum viable homelab from zero after a serious failure.\n\nIt is not a restore execution log. It is a step-by-step operator procedure.\n\n## Scope\n\nThe goal is to recover enough infrastructure to regain access, documentation, identity, routing, secrets, Git, backup visibility, and then stateful applications.\n\nMinimum viable homelab means:\n\n- SSH access works;\n- VPN/Tailscale/NetBird access works or has a known temporary replacement;\n- Git repository is available;\n- SOPS/age secrets can be decrypted;\n- MkDocs documentation is published;\n- NPMplus routes can be restored;\n- Authentik, Gitea, Vaultwarden, NetBox, and Uptime Kuma can be restored;\n- backup/offhost locations are visible;\n- health checks prove the restored state.\n\n## Current known source-of-truth commits\n\n- Backup coverage closure: completed before this runbook.\n- MkDocs publish hardening: completed.\n- Backup tiering table: completed.\n- Current repo head when starting this runbook: `adb8c55`.\n\n## P0 restore order\n\n| Order | Component | Why first | Expec<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"DR from zero runbook, 2026-06-22"},{"level":2,"line":7,"title":"Purpose"},{"level":2,"line":13,"title":"Scope"},{"level":2,"line":29,"title":"Current known source-of-truth commits"},{"level":2,"line":36,"title":"P0 restore order"},{"level":2,"line":55,"title":"Critical backup sources"},{"level":2,"line":71,"title":"Phase 0 — stop and preserve evidence"},{"level":2,"line":86,"title":"Phase 1 — base host recovery"},{"level":2,"line":104,"title":"Phase 2 — network access"},{"level":2,"line":119,"title":"Phase 3 — clone repository"},{"level":2,"line":136,"title":"Phase 4 — restore secrets/SOPS"},{"level":2,"line":155,"title":"Phase 5 — restore documentation first"},{"level":2,"line":173,"title":"Phase 6 — recover NPMplus and Uptime Kuma"},{"level":2,"line":197,"title":"Phase 7 — recover Authentik"},{"level":2,"line":215,"title":"Phase 8 — recover Gitea"},{"level":2,"line":230,"title":"Phase 9 — recover Vaultwarden"},{"level":2,"line":244,"title":"Phase 10 — recover NetBox"},{"level":2,"line":270,"title":"Phase 11 — recover Edge VM"},{"level":2,"line":291,"title":"Phase 12 — recover user data services"},{"level":2,"line":306,"title":"Phase 13 — restore monitoring and alerting"},{"level":2,"line":325,"title":"Do not do"},{"level":2,"line":334,"title":"Final DR closure checklist"},{"level":2,"line":353,"title":"Next improvement after this runbook"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f8312cd7cd0a296c60950a60c7866a67b19a70016b93f68b3a76b78d5440cb63","total_score":102},{"bytes":9386,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["qemu"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns"],"repair_and_troubleshooting":["failure"],"storage":["thin","disk"]},"headings":[{"level":1,"line":1,"title":"Disaster Recovery Runbook"},{"level":2,"line":6,"title":"Current verified recovery anchors"},{"level":2,"line":25,"title":"Things that must exist outside the repo"},{"level":2,"line":39,"title":"Recovery priority"},{"level":2,"line":51,"title":"Phase 0: establish a control host"},{"level":2,"line":65,"title":"Phase 1: restore rclone access"},{"level":2,"line":90,"title":"Phase 2: restore the critical/small cloud bundle"},{"level":1,"line":107,"title":"Expected:"},{"level":1,"line":108,"title":"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c"},{"level":2,"line":130,"title":"Phase 3: recover small app/config backups"},{"level":2,"line":163,"title":"Phase 4: recover edge-vm large backup"},{"level":1,"line":194,"title":"Expected size:"},{"level":1,"line":195,"title":"16936767590"},{"level":1,"line":196,"title":"Expected SHA256:"},{"level":1,"line":197,"title":"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001"},{"level":2,"line":202,"title":"Phase 5: restore validation checklist"},{"level":2,"line":218,"title":"Phase 6: re-enable backup and offsite automation"},{"level":2,"line":231,"title":"Known failure lessons"},{"level":2,"line":243,"title":"Vaultwarden isolated restore drill result — 2026-06-18"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e","total_score":100},{"bytes":9386,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["qemu"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns"],"repair_and_troubleshooting":["failure"],"storage":["thin","disk"]},"headings":[{"level":1,"line":1,"title":"Disaster Recovery Runbook"},{"level":2,"line":6,"title":"Current verified recovery anchors"},{"level":2,"line":25,"title":"Things that must exist outside the repo"},{"level":2,"line":39,"title":"Recovery priority"},{"level":2,"line":51,"title":"Phase 0: establish a control host"},{"level":2,"line":65,"title":"Phase 1: restore rclone access"},{"level":2,"line":90,"title":"Phase 2: restore the critical/small cloud bundle"},{"level":1,"line":107,"title":"Expected:"},{"level":1,"line":108,"title":"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c"},{"level":2,"line":130,"title":"Phase 3: recover small app/config backups"},{"level":2,"line":163,"title":"Phase 4: recover edge-vm large backup"},{"level":1,"line":194,"title":"Expected size:"},{"level":1,"line":195,"title":"16936767590"},{"level":1,"line":196,"title":"Expected SHA256:"},{"level":1,"line":197,"title":"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001"},{"level":2,"line":202,"title":"Phase 5: restore validation checklist"},{"level":2,"line":218,"title":"Phase 6: re-enable backup and offsite automation"},{"level":2,"line":231,"title":"Known failure lessons"},{"level":2,"line":243,"title":"Vaultwarden isolated restore drill result — 2026-06-18"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e","total_score":100},{"bytes":16031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["internal service","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"05. Service Catalog"},{"level":2,"line":5,"title":"Edge VM"},{"level":2,"line":12,"title":"NPMplus"},{"level":2,"line":22,"title":"Uptime Kuma"},{"level":2,"line":30,"title":"Gotify"},{"level":2,"line":38,"title":"Vaultwarden"},{"level":2,"line":49,"title":"Dockge"},{"level":2,"line":61,"title":"Homepage"},{"level":2,"line":71,"title":"Gitea"},{"level":2,"line":84,"title":"Nextcloud AIO"},{"level":2,"line":95,"title":"DNS stack"},{"level":2,"line":102,"title":"Backup"},{"level":2,"line":109,"title":"Edge applications added 2026-06-15/16"},{"level":2,"line":132,"title":"Backup health proxy"},{"level":2,"line":155,"title":"Edge VM capacity note"},{"level":2,"line":366,"title":"Homepage grouped dashboard update, 2026-06-22"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a","total_score":95},{"bytes":106031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":92,"coverage":{"access_and_admin":["access","login","admin","web ui","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","lxc","qemu","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["локальн","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"99. Current state summary"},{"level":2,"line":5,"title":"Git repository"},{"level":2,"line":12,"title":"Operating rules"},{"level":2,"line":21,"title":"Current verified backup health"},{"level":2,"line":32,"title":"Backup scripts and services"},{"level":2,"line":41,"title":"Proxmox and network layout"},{"level":2,"line":58,"title":"NPMplus state"},{"level":2,"line":81,"title":"DNS rewrites"},{"level":2,"line":101,"title":"Edge applications"},{"level":2,"line":118,"title":"Uptime Kuma"},{"level":2,"line":131,"title":"Cloudflare token rotation"},{"level":2,"line":139,"title":"Known working URLs"},{"level":2,"line":166,"title":"Pending after this documentation update"},{"level":2,"line":181,"title":"Edge application setup checkpoint — 2026-06-16T10:26:57Z"},{"level":2,"line":194,"title":"Immich media storage checkpoint — 2026-06-16T11:01:32Z"},{"level":2,"line":204,"title":"Immich media backup checkpoint — 2026-06-16T11:24:22Z"},{"level":2,"line":219,"title":"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z"},{"level":2,"line":231,"title":"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z"},{"level":2,"line":245,"title":"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z"},{"level":2,"line":257,"title":"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z"},{"level":2,"line":266,"title":"Closed validation checkpoint — 2026-06-16T16:51:40Z"},{"level":2,"line":278,"title":"Disk Space Health checkpoint — 2026-06-16T17:06:06Z"},{"level":2,"line":298,"title":"Memos backup checkpoint — 2026-06-16T17:33:39Z"},{"level":2,"line":319,"title":"Paperless backup checkpoint — 2026-06-16T17:50:49Z"},{"level":2,"line":350,"title":"Application restore validation checkpoint — 2026-06-16T18:01:17Z"},{"level":2,"line":364,"title":"Final full baseline checkpoint — 2026-06-16T18:10:15Z"},{"level":2,"line":407,"title":"Daily cluster status report"},{"level":2,"line":420,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":447,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":482,"title":"Контейнерная волна обновлений, 2026-06-19"},{"level":2,"line":498,"title":"CVE root-cause analysis, 2026-06-19"},{"level":2,"line":514,"title":"Browser / Chromium risk analysis, 2026-06-19"},{"level":2,"line":527,"title":"Base OS package CVE analysis, 2026-06-19"},{"level":2,"line":541,"title":"Go runtime/dependency CVE analysis, 2026-06-19"},{"level":2,"line":555,"title":"Node/NPM dependency CVE analysis, 2026-06-19"},{"level":2,"line":569,"title":"Dockge / Karakeep candidate tag scan, 2026-06-19"},{"level":2,"line":583,"title":"Karakeep production update, 2026-06-19"},{"level":2,"line":605,"title":"Uptime Kuma candidate tag scan, 2026-06-19"},{"level":2,"line":622,"title":"Uptime Kuma production update, 2026-06-19"},{"level":2,"line":644,"title":"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19"},{"level":2,"line":663,"title":"Linkding candidate tag scan, 2026-06-19"},{"level":2,"line":678,"title":"Linkding production update, 2026-06-19"},{"level":2,"line":698,"title":"Current Trivy leaderboard after Linkding, 2026-06-19"},{"level":2,"line":717,"title":"Batch candidate scan, 2026-06-19"},{"level":2,"line":744,"title":"Disk cleanup and Git push recovery, 2026-06-19"},{"level":2,"line":758,"title":"Next update candidates from batch scan, 2026-06-19"},{"level":2,"line":770,"title":"IT-Tools production update, 2026-06-19"},{"level":2,"line":789,"title":"NPMplus production update, 2026-06-19"},{"level":2,"line":812,"title":"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19"},{"level":2,"line":827,"title":"Paperless stable candidate scan, 2026-06-19"},{"level":2,"line":852,"title":"Immich app stable pair candidate scan, 2026-06-19"},{"level":2,"line":878,"title":"Immich app pair candidate scan result, 2026-06-19"},{"level":2,"line":896,"title":"Home Assistant stable candidate scan, 2026-06-19"},{"level":2,"line":919,"title":"MinIO release candidate scan, 2026-06-19"},{"level":2,"line":942,"title":"Mealie stable candidate scan, 2026-06-19"},{"level":2,"line":965,"title":"Authentik server image candidate scan, 2026-06-19"},{"level":2,"line":988,"title":"Karakeep Meilisearch candidate scan, 2026-06-19"},{"level":2,"line":1011,"title":"Karakeep Chrome candidate scan, 2026-06-19"},{"level":2,"line":1034,"title":"Vaultwarden stable candidate scan, 2026-06-19"},{"level":2,"line":1057,"title":"Vaultwarden production update, 2026-06-20"},{"level":2,"line":1083,"title":"Current Trivy leaderboard after Vaultwarden, 2026-06-20"},{"level":2,"line":1098,"title":"n8n stable candidate scan, 2026-06-20"},{"level":2,"line":1121,"title":"n8n latest tag restore, 2026-06-20"},{"level":2,"line":1137,"title":"n8n 2.27.3 smoke-test, 2026-06-20"},{"level":2,"line":1163,"title":"n8n production update, 2026-06-20"},{"level":2,"line":1193,"title":"Gotify stable candidate scan, 2026-06-20"},{"level":2,"line":1213,"title":"Batch remaining open candidate scan, 2026-06-20"},{"level":2,"line":1234,"title":"CrowdSec production update, 2026-06-20"},{"level":2,"line":1262,"title":"Final CVE pass summary, 2026-06-20"},{"level":2,"line":1286,"title":"n8n encryption key rotation, 2026-06-20"},{"level":2,"line":1311,"title":"Audit and backup inventory, 2026-06-20"},{"level":2,"line":1326,"title":"Immich Postgres restore smoke-test, 2026-06-20"},{"level":2,"line":1342,"title":"Immich Postgres candidate scan, 2026-06-20"},{"level":2,"line":1352,"title":"Dockge candidate scan, 2026-06-20"},{"level":2,"line":1362,"title":"Paperless candidate scan, 2026-06-20"},{"level":2,"line":1372,"title":"Karakeep and Immich Server real-tag scan, 2026-06-20"},{"level":2,"line":1382,"title":"Closing high-CVE ledger, 2026-06-20"},{"level":2,"line":1392,"title":"Candidate test directories cleanup, 2026-06-20"},{"level":2,"line":1402,"title":"Old n8n key backup removal preflight, 2026-06-20"},{"level":2,"line":1412,"title":"NetBird peers health hardening, 2026-06-20"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md","path_score":3,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c","total_score":95},{"bytes":16031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["internal service","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"05. Service Catalog"},{"level":2,"line":5,"title":"Edge VM"},{"level":2,"line":12,"title":"NPMplus"},{"level":2,"line":22,"title":"Uptime Kuma"},{"level":2,"line":30,"title":"Gotify"},{"level":2,"line":38,"title":"Vaultwarden"},{"level":2,"line":49,"title":"Dockge"},{"level":2,"line":61,"title":"Homepage"},{"level":2,"line":71,"title":"Gitea"},{"level":2,"line":84,"title":"Nextcloud AIO"},{"level":2,"line":95,"title":"DNS stack"},{"level":2,"line":102,"title":"Backup"},{"level":2,"line":109,"title":"Edge applications added 2026-06-15/16"},{"level":2,"line":132,"title":"Backup health proxy"},{"level":2,"line":155,"title":"Edge VM capacity note"},{"level":2,"line":366,"title":"Homepage grouped dashboard update, 2026-06-22"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a","total_score":95},{"bytes":106031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":92,"coverage":{"access_and_admin":["access","login","admin","web ui","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","lxc","qemu","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["локальн","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"99. Current state summary"},{"level":2,"line":5,"title":"Git repository"},{"level":2,"line":12,"title":"Operating rules"},{"level":2,"line":21,"title":"Current verified backup health"},{"level":2,"line":32,"title":"Backup scripts and services"},{"level":2,"line":41,"title":"Proxmox and network layout"},{"level":2,"line":58,"title":"NPMplus state"},{"level":2,"line":81,"title":"DNS rewrites"},{"level":2,"line":101,"title":"Edge applications"},{"level":2,"line":118,"title":"Uptime Kuma"},{"level":2,"line":131,"title":"Cloudflare token rotation"},{"level":2,"line":139,"title":"Known working URLs"},{"level":2,"line":166,"title":"Pending after this documentation update"},{"level":2,"line":181,"title":"Edge application setup checkpoint — 2026-06-16T10:26:57Z"},{"level":2,"line":194,"title":"Immich media storage checkpoint — 2026-06-16T11:01:32Z"},{"level":2,"line":204,"title":"Immich media backup checkpoint — 2026-06-16T11:24:22Z"},{"level":2,"line":219,"title":"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z"},{"level":2,"line":231,"title":"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z"},{"level":2,"line":245,"title":"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z"},{"level":2,"line":257,"title":"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z"},{"level":2,"line":266,"title":"Closed validation checkpoint — 2026-06-16T16:51:40Z"},{"level":2,"line":278,"title":"Disk Space Health checkpoint — 2026-06-16T17:06:06Z"},{"level":2,"line":298,"title":"Memos backup checkpoint — 2026-06-16T17:33:39Z"},{"level":2,"line":319,"title":"Paperless backup checkpoint — 2026-06-16T17:50:49Z"},{"level":2,"line":350,"title":"Application restore validation checkpoint — 2026-06-16T18:01:17Z"},{"level":2,"line":364,"title":"Final full baseline checkpoint — 2026-06-16T18:10:15Z"},{"level":2,"line":407,"title":"Daily cluster status report"},{"level":2,"line":420,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":447,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":482,"title":"Контейнерная волна обновлений, 2026-06-19"},{"level":2,"line":498,"title":"CVE root-cause analysis, 2026-06-19"},{"level":2,"line":514,"title":"Browser / Chromium risk analysis, 2026-06-19"},{"level":2,"line":527,"title":"Base OS package CVE analysis, 2026-06-19"},{"level":2,"line":541,"title":"Go runtime/dependency CVE analysis, 2026-06-19"},{"level":2,"line":555,"title":"Node/NPM dependency CVE analysis, 2026-06-19"},{"level":2,"line":569,"title":"Dockge / Karakeep candidate tag scan, 2026-06-19"},{"level":2,"line":583,"title":"Karakeep production update, 2026-06-19"},{"level":2,"line":605,"title":"Uptime Kuma candidate tag scan, 2026-06-19"},{"level":2,"line":622,"title":"Uptime Kuma production update, 2026-06-19"},{"level":2,"line":644,"title":"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19"},{"level":2,"line":663,"title":"Linkding candidate tag scan, 2026-06-19"},{"level":2,"line":678,"title":"Linkding production update, 2026-06-19"},{"level":2,"line":698,"title":"Current Trivy leaderboard after Linkding, 2026-06-19"},{"level":2,"line":717,"title":"Batch candidate scan, 2026-06-19"},{"level":2,"line":744,"title":"Disk cleanup and Git push recovery, 2026-06-19"},{"level":2,"line":758,"title":"Next update candidates from batch scan, 2026-06-19"},{"level":2,"line":770,"title":"IT-Tools production update, 2026-06-19"},{"level":2,"line":789,"title":"NPMplus production update, 2026-06-19"},{"level":2,"line":812,"title":"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19"},{"level":2,"line":827,"title":"Paperless stable candidate scan, 2026-06-19"},{"level":2,"line":852,"title":"Immich app stable pair candidate scan, 2026-06-19"},{"level":2,"line":878,"title":"Immich app pair candidate scan result, 2026-06-19"},{"level":2,"line":896,"title":"Home Assistant stable candidate scan, 2026-06-19"},{"level":2,"line":919,"title":"MinIO release candidate scan, 2026-06-19"},{"level":2,"line":942,"title":"Mealie stable candidate scan, 2026-06-19"},{"level":2,"line":965,"title":"Authentik server image candidate scan, 2026-06-19"},{"level":2,"line":988,"title":"Karakeep Meilisearch candidate scan, 2026-06-19"},{"level":2,"line":1011,"title":"Karakeep Chrome candidate scan, 2026-06-19"},{"level":2,"line":1034,"title":"Vaultwarden stable candidate scan, 2026-06-19"},{"level":2,"line":1057,"title":"Vaultwarden production update, 2026-06-20"},{"level":2,"line":1083,"title":"Current Trivy leaderboard after Vaultwarden, 2026-06-20"},{"level":2,"line":1098,"title":"n8n stable candidate scan, 2026-06-20"},{"level":2,"line":1121,"title":"n8n latest tag restore, 2026-06-20"},{"level":2,"line":1137,"title":"n8n 2.27.3 smoke-test, 2026-06-20"},{"level":2,"line":1163,"title":"n8n production update, 2026-06-20"},{"level":2,"line":1193,"title":"Gotify stable candidate scan, 2026-06-20"},{"level":2,"line":1213,"title":"Batch remaining open candidate scan, 2026-06-20"},{"level":2,"line":1234,"title":"CrowdSec production update, 2026-06-20"},{"level":2,"line":1262,"title":"Final CVE pass summary, 2026-06-20"},{"level":2,"line":1286,"title":"n8n encryption key rotation, 2026-06-20"},{"level":2,"line":1311,"title":"Audit and backup inventory, 2026-06-20"},{"level":2,"line":1326,"title":"Immich Postgres restore smoke-test, 2026-06-20"},{"level":2,"line":1342,"title":"Immich Postgres candidate scan, 2026-06-20"},{"level":2,"line":1352,"title":"Dockge candidate scan, 2026-06-20"},{"level":2,"line":1362,"title":"Paperless candidate scan, 2026-06-20"},{"level":2,"line":1372,"title":"Karakeep and Immich Server real-tag scan, 2026-06-20"},{"level":2,"line":1382,"title":"Closing high-CVE ledger, 2026-06-20"},{"level":2,"line":1392,"title":"Candidate test directories cleanup, 2026-06-20"},{"level":2,"line":1402,"title":"Old n8n key backup removal preflight, 2026-06-20"},{"level":2,"line":1412,"title":"NetBird peers health hardening, 2026-06-20"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md","path_score":3,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c","total_score":95},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":38408,"commit":"60f53ea6fe6724196802a46de3de19c7889a51cc","content_score":86,"coverage":{"access_and_admin":["login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256","atomic"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["pve01","cluster","node","quorum","corosync"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["network","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary"],"sensitive_findings":[],"sha256":"07c9854ab0232d1f2766cdab114d0d398a4dcc1a5b41ea7fde77646e5f42804e","total_score":86},{"bytes":61327,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["access","login","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","qemu"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","grafana","prometheus"],"network_and_dns":["network","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"Services bootstrap snapshot — 2026-06-17"},{"level":2,"line":3,"title":"Scope"},{"level":2,"line":9,"title":"Edge VM"},{"level":2,"line":19,"title":"NetBird VPS"},{"level":2,"line":34,"title":"NetBird backup status"},{"level":3,"line":37,"title":"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb<BOUNDED_PROJECTION>"},{"level":2,"line":40,"title":"NetBird backup timers"},{"level":2,"line":46,"title":"Important follow-ups"},{"level":2,"line":54,"title":"NetBird Uptime Kuma monitors"},{"level":2,"line":64,"title":"NetBird homelab peers"},{"level":3,"line":69,"title":"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0              UNKNOWN        100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 <BOUNDED_PROJECTION>"},{"level":2,"line":72,"title":"NetBird peers health monitor"},{"level":2,"line":88,"title":"File Browser credential remediation"},{"level":2,"line":98,"title":"Proxmox private SSL via NetBird FQDN"},{"level":2,"line":116,"title":"File Browser backup, offhost sync, and restore validation"},{"level":2,"line":150,"title":"App stacks batch backup chain"},{"level":2,"line":194,"title":"Final backup and health baseline"},{"level":2,"line":202,"title":"Private NPMplus hosts via NetBird"},{"level":2,"line":231,"title":"Homepage VPN Authentik forward-auth"},{"level":2,"line":244,"title":"Homepage Authentik forward-auth rollback"},{"level":2,"line":257,"title":"Private VPN hosts safe baseline after Authentik rollback"},{"level":2,"line":271,"title":"Private VPN Hosts Kuma monitor"},{"level":2,"line":289,"title":"Private VPN Hosts health timer"},{"level":2,"line":304,"title":"Private VPN Hosts timer auto-cycle verified"},{"level":2,"line":314,"title":"Final ops snapshot — private VPN hosts"},{"level":2,"line":326,"title":"NPMplus + Kuma config backup chain"},{"level":2,"line":348,"title":"Corrected NPMplus + Kuma config backup chain"},{"level":2,"line":367,"title":"NPMplus + Kuma backup chain Kuma monitors"},{"level":2,"line":382,"title":"NPMplus + Kuma config backup timer"},{"level":2,"line":398,"title":"Authentik backup chain"},{"level":2,"line":408,"title":"Authentik backup chain Kuma monitors"},{"level":2,"line":417,"title":"Authentik backup timer"},{"level":2,"line":431,"title":"Gitea backup chain"},{"level":2,"line":441,"title":"Gitea backup chain"},{"level":2,"line":445,"title":"Gitea backup chain Kuma monitors"},{"level":2,"line":454,"title":"Gitea backup timer"},{"level":2,"line":465,"title":"Vaultwarden backup chain"},{"level":2,"line":475,"title":"Vaultwarden backup chain Kuma monitors"},{"level":2,"line":484,"title":"Vaultwarden backup timer"},{"level":2,"line":495,"title":"Edge VM manual vzdump backup"},{"level":2,"line":502,"title":"Edge VM vzdump offhost copy"},{"level":2,"line":508,"title":"Edge VM vzdump restore verification"},{"level":2,"line":515,"title":"Edge VM vzdump Kuma monitors"},{"level":2,"line":528,"title":"Edge VM vzdump weekly timer"},{"level":2,"line":543,"title":"Immich media backup existing automation inventory"},{"level":2,"line":553,"title":"Immich media restore verification"},{"level":2,"line":560,"title":"Immich media restore Kuma monitor"},{"level":2,"line":570,"title":"Immich media restore Kuma monitor correction"},{"level":2,"line":577,"title":"P0 backup baseline closure"},{"level":2,"line":589,"title":"P1 Mail.ru Cloud offsite inventory"},{"level":2,"line":651,"title":"P1 Mail.ru Cloud rclone config drift resolved"},{"level":2,"line":667,"title":"P1 Mail.ru Cloud canary"},{"level":2,"line":675,"title":"P1 Mail.ru Cloud production payload inventory"},{"level":2,"line":710,"title":"P1 Mail.ru Cloud critical baseline upload"},{"level":2,"line":720,"title":"P1 Mail.ru Cloud Kuma monitors"},{"level":2,"line":732,"title":"P1 Mail.ru Cloud edge-vm chunked large upload"},{"level":2,"line":742,"title":"P1 Mail.ru Cloud Edge VM Kuma monitor"},{"level":2,"line":753,"title":"P1 Mail.ru Cloud offsite seed closure"},{"level":2,"line":776,"title":"P1 Mail.ru Cloud critical upload automation"},{"level":2,"line":791,"title":"P1 Mail.ru Cloud edge-vm upload automation"},{"level":2,"line":807,"title":"P1 Mail.ru Cloud automation and retention closure"},{"level":2,"line":829,"title":"P1 Mail.ru Cloud restore drill automation"},{"level":2,"line":843,"title":"P2 Disaster Recovery runbook"},{"level":2,"line":853,"title":"P2 Critical bundle bootstrap drill"},{"level":2,"line":870,"title":"P2 Disaster Recovery bootstrap closure"},{"level":2,"line":892,"title":"Vaultwarden isolated restore drill — 2026-06-18"},{"level":2,"line":929,"title":"Daily cluster status report — 2026-06-18"},{"level":2,"line":985,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":1012,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":1047,"title":"Trivy scan mode after 2026-06-19 update wave"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["sensitive-assignment"],"sha256":"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6","total_score":86},{"bytes":89904,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["admin","console","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","grafana","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["troubleshoot"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"P0 alert routing preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab","total_score":86},{"bytes":61327,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["access","login","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","qemu"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","grafana","prometheus"],"network_and_dns":["network","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"Services bootstrap snapshot — 2026-06-17"},{"level":2,"line":3,"title":"Scope"},{"level":2,"line":9,"title":"Edge VM"},{"level":2,"line":19,"title":"NetBird VPS"},{"level":2,"line":34,"title":"NetBird backup status"},{"level":3,"line":37,"title":"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb<BOUNDED_PROJECTION>"},{"level":2,"line":40,"title":"NetBird backup timers"},{"level":2,"line":46,"title":"Important follow-ups"},{"level":2,"line":54,"title":"NetBird Uptime Kuma monitors"},{"level":2,"line":64,"title":"NetBird homelab peers"},{"level":3,"line":69,"title":"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0              UNKNOWN        100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 <BOUNDED_PROJECTION>"},{"level":2,"line":72,"title":"NetBird peers health monitor"},{"level":2,"line":88,"title":"File Browser credential remediation"},{"level":2,"line":98,"title":"Proxmox private SSL via NetBird FQDN"},{"level":2,"line":116,"title":"File Browser backup, offhost sync, and restore validation"},{"level":2,"line":150,"title":"App stacks batch backup chain"},{"level":2,"line":194,"title":"Final backup and health baseline"},{"level":2,"line":202,"title":"Private NPMplus hosts via NetBird"},{"level":2,"line":231,"title":"Homepage VPN Authentik forward-auth"},{"level":2,"line":244,"title":"Homepage Authentik forward-auth rollback"},{"level":2,"line":257,"title":"Private VPN hosts safe baseline after Authentik rollback"},{"level":2,"line":271,"title":"Private VPN Hosts Kuma monitor"},{"level":2,"line":289,"title":"Private VPN Hosts health timer"},{"level":2,"line":304,"title":"Private VPN Hosts timer auto-cycle verified"},{"level":2,"line":314,"title":"Final ops snapshot — private VPN hosts"},{"level":2,"line":326,"title":"NPMplus + Kuma config backup chain"},{"level":2,"line":348,"title":"Corrected NPMplus + Kuma config backup chain"},{"level":2,"line":367,"title":"NPMplus + Kuma backup chain Kuma monitors"},{"level":2,"line":382,"title":"NPMplus + Kuma config backup timer"},{"level":2,"line":398,"title":"Authentik backup chain"},{"level":2,"line":408,"title":"Authentik backup chain Kuma monitors"},{"level":2,"line":417,"title":"Authentik backup timer"},{"level":2,"line":431,"title":"Gitea backup chain"},{"level":2,"line":441,"title":"Gitea backup chain"},{"level":2,"line":445,"title":"Gitea backup chain Kuma monitors"},{"level":2,"line":454,"title":"Gitea backup timer"},{"level":2,"line":465,"title":"Vaultwarden backup chain"},{"level":2,"line":475,"title":"Vaultwarden backup chain Kuma monitors"},{"level":2,"line":484,"title":"Vaultwarden backup timer"},{"level":2,"line":495,"title":"Edge VM manual vzdump backup"},{"level":2,"line":502,"title":"Edge VM vzdump offhost copy"},{"level":2,"line":508,"title":"Edge VM vzdump restore verification"},{"level":2,"line":515,"title":"Edge VM vzdump Kuma monitors"},{"level":2,"line":528,"title":"Edge VM vzdump weekly timer"},{"level":2,"line":543,"title":"Immich media backup existing automation inventory"},{"level":2,"line":553,"title":"Immich media restore verification"},{"level":2,"line":560,"title":"Immich media restore Kuma monitor"},{"level":2,"line":570,"title":"Immich media restore Kuma monitor correction"},{"level":2,"line":577,"title":"P0 backup baseline closure"},{"level":2,"line":589,"title":"P1 Mail.ru Cloud offsite inventory"},{"level":2,"line":651,"title":"P1 Mail.ru Cloud rclone config drift resolved"},{"level":2,"line":667,"title":"P1 Mail.ru Cloud canary"},{"level":2,"line":675,"title":"P1 Mail.ru Cloud production payload inventory"},{"level":2,"line":710,"title":"P1 Mail.ru Cloud critical baseline upload"},{"level":2,"line":720,"title":"P1 Mail.ru Cloud Kuma monitors"},{"level":2,"line":732,"title":"P1 Mail.ru Cloud edge-vm chunked large upload"},{"level":2,"line":742,"title":"P1 Mail.ru Cloud Edge VM Kuma monitor"},{"level":2,"line":753,"title":"P1 Mail.ru Cloud offsite seed closure"},{"level":2,"line":776,"title":"P1 Mail.ru Cloud critical upload automation"},{"level":2,"line":791,"title":"P1 Mail.ru Cloud edge-vm upload automation"},{"level":2,"line":807,"title":"P1 Mail.ru Cloud automation and retention closure"},{"level":2,"line":829,"title":"P1 Mail.ru Cloud restore drill automation"},{"level":2,"line":843,"title":"P2 Disaster Recovery runbook"},{"level":2,"line":853,"title":"P2 Critical bundle bootstrap drill"},{"level":2,"line":870,"title":"P2 Disaster Recovery bootstrap closure"},{"level":2,"line":892,"title":"Vaultwarden isolated restore drill — 2026-06-18"},{"level":2,"line":929,"title":"Daily cluster status report — 2026-06-18"},{"level":2,"line":985,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":1012,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":1047,"title":"Trivy scan mode after 2026-06-19 update wave"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["sensitive-assignment"],"sha256":"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6","total_score":86},{"bytes":89904,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["admin","console","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","grafana","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["troubleshoot"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"P0 alert routing preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab","total_score":86},{"bytes":89904,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["admin","console","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","grafana","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["troubleshoot"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"P0 alert routing preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab","total_score":86},{"bytes":8415,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":74,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","prometheus"],"network_and_dns":["firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-05 CrowdSec LAPI monitoring coverage inventory"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Coverage summary"},{"level":2,"line":31,"title":"Runtime monitoring containers"},{"level":2,"line":41,"title":"Repo evidence sample"},{"level":2,"line":69,"title":"Kuma match sample"},{"level":2,"line":76,"title":"Prometheus related files"},{"level":2,"line":80,"title":"Edge health-file sample"},{"level":2,"line":107,"title":"pve01 health-file sample"},{"level":2,"line":113,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25","total_score":83},{"bytes":4739,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["rollback"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"monitoring_and_logs":["log"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["repair","failure"]},"headings":[{"level":1,"line":1,"title":"NPMplus route-change safety runbook"},{"level":2,"line":3,"title":"Purpose"},{"level":2,"line":9,"title":"Scope"},{"level":2,"line":23,"title":"Forbidden actions unless explicitly approved"},{"level":2,"line":36,"title":"Required read-only preflight"},{"level":2,"line":57,"title":"Generated config discovery"},{"level":2,"line":65,"title":"Target and protocol decision tree"},{"level":2,"line":74,"title":"Required patch sequence"},{"level":2,"line":93,"title":"Rollback requirements"},{"level":2,"line":99,"title":"Redirect-loop checks"},{"level":2,"line":111,"title":"Adjacent component awareness"},{"level":2,"line":125,"title":"Adjacent smoke checks"},{"level":2,"line":135,"title":"Terminal command requirements"},{"level":2,"line":148,"title":"Closeout requirements"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"364e3146093a497342a308b35afcd38821564da0f72cfa3bc1b24e4b3b0d81a1","total_score":83},{"bytes":8415,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":74,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","prometheus"],"network_and_dns":["firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-05 CrowdSec LAPI monitoring coverage inventory"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Coverage summary"},{"level":2,"line":31,"title":"Runtime monitoring containers"},{"level":2,"line":41,"title":"Repo evidence sample"},{"level":2,"line":69,"title":"Kuma match sample"},{"level":2,"line":76,"title":"Prometheus related files"},{"level":2,"line":80,"title":"Edge health-file sample"},{"level":2,"line":107,"title":"pve01 health-file sample"},{"level":2,"line":113,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25","total_score":83},{"bytes":4739,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["rollback"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"monitoring_and_logs":["log"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["repair","failure"]},"headings":[{"level":1,"line":1,"title":"NPMplus route-change safety runbook"},{"level":2,"line":3,"title":"Purpose"},{"level":2,"line":9,"title":"Scope"},{"level":2,"line":23,"title":"Forbidden actions unless explicitly approved"},{"level":2,"line":36,"title":"Required read-only preflight"},{"level":2,"line":57,"title":"Generated config discovery"},{"level":2,"line":65,"title":"Target and protocol decision tree"},{"level":2,"line":74,"title":"Required patch sequence"},{"level":2,"line":93,"title":"Rollback requirements"},{"level":2,"line":99,"title":"Redirect-loop checks"},{"level":2,"line":111,"title":"Adjacent component awareness"},{"level":2,"line":125,"title":"Adjacent smoke checks"},{"level":2,"line":135,"title":"Terminal command requirements"},{"level":2,"line":148,"title":"Closeout requirements"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"364e3146093a497342a308b35afcd38821564da0f72cfa3bc1b24e4b3b0d81a1","total_score":83},{"bytes":8415,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":74,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","prometheus"],"network_and_dns":["firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-05 CrowdSec LAPI monitoring coverage inventory"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Coverage summary"},{"level":2,"line":31,"title":"Runtime monitoring containers"},{"level":2,"line":41,"title":"Repo evidence sample"},{"level":2,"line":69,"title":"Kuma match sample"},{"level":2,"line":76,"title":"Prometheus related files"},{"level":2,"line":80,"title":"Edge health-file sample"},{"level":2,"line":107,"title":"pve01 health-file sample"},{"level":2,"line":113,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25","total_score":83},{"bytes":2463,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","admin","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[{"level":1,"line":1,"title":"P2 Ideal Cluster program init"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Starting counters"},{"level":2,"line":15,"title":"Baseline"},{"level":2,"line":21,"title":"Safety model"},{"level":2,"line":30,"title":"Workstreams"},{"level":3,"line":32,"title":"P2-A DR and restore maturity"},{"level":3,"line":40,"title":"P2-B Network and ingress source of truth"},{"level":3,"line":47,"title":"P2-C Access control and service policy"},{"level":3,"line":54,"title":"P2-D Observability closure"},{"level":3,"line":62,"title":"P2-E Backup coverage for services"},{"level":3,"line":70,"title":"P2-F Security hardening"},{"level":3,"line":78,"title":"P2-G NetBox and documentation source of truth"},{"level":2,"line":86,"title":"First selected task"},{"level":2,"line":90,"title":"Safety boundary"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1","total_score":81},{"bytes":2463,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","admin","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[{"level":1,"line":1,"title":"P2 Ideal Cluster program init"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Starting counters"},{"level":2,"line":15,"title":"Baseline"},{"level":2,"line":21,"title":"Safety model"},{"level":2,"line":30,"title":"Workstreams"},{"level":3,"line":32,"title":"P2-A DR and restore maturity"},{"level":3,"line":40,"title":"P2-B Network and ingress source of truth"},{"level":3,"line":47,"title":"P2-C Access control and service policy"},{"level":3,"line":54,"title":"P2-D Observability closure"},{"level":3,"line":62,"title":"P2-E Backup coverage for services"},{"level":3,"line":70,"title":"P2-F Security hardening"},{"level":3,"line":78,"title":"P2-G NetBox and documentation source of truth"},{"level":2,"line":86,"title":"First selected task"},{"level":2,"line":90,"title":"Safety boundary"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1","total_score":81},{"bytes":2463,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","admin","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[{"level":1,"line":1,"title":"P2 Ideal Cluster program init"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Starting counters"},{"level":2,"line":15,"title":"Baseline"},{"level":2,"line":21,"title":"Safety model"},{"level":2,"line":30,"title":"Workstreams"},{"level":3,"line":32,"title":"P2-A DR and restore maturity"},{"level":3,"line":40,"title":"P2-B Network and ingress source of truth"},{"level":3,"line":47,"title":"P2-C Access control and service policy"},{"level":3,"line":54,"title":"P2-D Observability closure"},{"level":3,"line":62,"title":"P2-E Backup coverage for services"},{"level":3,"line":70,"title":"P2-F Security hardening"},{"level":3,"line":78,"title":"P2-G NetBox and documentation source of truth"},{"level":2,"line":86,"title":"First selected task"},{"level":2,"line":90,"title":"Safety boundary"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1","total_score":81},{"bytes":504281,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["access","login","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["sha256","atomic"],"external_services":["public","internet","nginx"],"guests_and_workloads":["container","lxc","workload"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","firewall","dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure","ошиб"],"storage":["storage","thin","disk","volume"]},"headings":[{"level":1,"line":1,"title":"MkDocs refresh discovery"},{"level":2,"line":7,"title":"Raw output"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md","path_score":0,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["sensitive-assignment"],"sha256":"1ac8fe15ebd06db8ef3a9c6127fe5efe7ecbb76d395abbe551c249b249492d21","total_score":80},{"bytes":3398,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore"],"change_safety":["sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","dns","domain","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"00. Restore from zero for beginners"},{"level":2,"line":7,"title":"0. What must be available before restore"},{"level":2,"line":17,"title":"1. Restore physical and network layer"},{"level":2,"line":25,"title":"2. Restore Proxmox nodes"},{"level":2,"line":35,"title":"3. Restore DNS first"},{"level":2,"line":48,"title":"4. Restore edge-vm"},{"level":2,"line":66,"title":"5. Restore Nextcloud VM"},{"level":2,"line":78,"title":"6. Validate router NAT"},{"level":2,"line":88,"title":"7. Validate main URLs"},{"level":2,"line":100,"title":"8. Validate backup health"},{"level":2,"line":110,"title":"9. Validate monitoring"},{"level":2,"line":125,"title":"10. After restore"},{"level":2,"line":134,"title":"11. Known mistakes to avoid"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"5e430e17e36b23faa90caa38b019485cf09640c94011828e18841b0e361e4470","total_score":78},{"bytes":3785,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["access","admin","url"],"backup_and_restore":["backup"],"change_safety":["rollback","sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"internal_services":["internal service","lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns","domain","tls","certificate"],"storage":["storage","thin"]},"headings":[{"level":1,"line":1,"title":"01. Add new service runbook"},{"level":2,"line":5,"title":"Rule zero"},{"level":2,"line":9,"title":"1. Precheck"},{"level":2,"line":22,"title":"2. DNS"},{"level":2,"line":32,"title":"3. Install container"},{"level":2,"line":46,"title":"4. Local validation"},{"level":2,"line":56,"title":"5. NPMplus"},{"level":2,"line":68,"title":"6. Certificate"},{"level":2,"line":88,"title":"7. Monitoring"},{"level":2,"line":103,"title":"8. Homepage"},{"level":2,"line":109,"title":"9. Service note"},{"level":2,"line":127,"title":"10. Backup"},{"level":2,"line":135,"title":"11. Baseline"},{"level":2,"line":141,"title":"12. MASTER_STATUS"},{"level":2,"line":147,"title":"13. Git documentation"},{"level":2,"line":155,"title":"Known mistakes to avoid"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c8634bd21ce16651970e1a6bdfba6fba9fd84fac030cd53a41798dc92b3ca81c","total_score":77},{"bytes":15818,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28","total_score":76},{"bytes":31410,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","journal","metric"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk","volume"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","path_score":12,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da","total_score":76},{"bytes":15818,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28","total_score":76},{"bytes":31410,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","journal","metric"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk","volume"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","path_score":12,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da","total_score":76},{"bytes":15818,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28","total_score":76},{"bytes":31410,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","journal","metric"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk","volume"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","path_score":12,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da","total_score":76},{"bytes":4960,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["container"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-12 final ideal cluster closeout"},{"level":2,"line":7,"title":"Plain explanation"},{"level":2,"line":17,"title":"Final state"},{"level":2,"line":32,"title":"P3 task summary"},{"level":2,"line":48,"title":"Residual gaps to true 100"},{"level":2,"line":60,"title":"Checks"},{"level":2,"line":73,"title":"Next task"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b","total_score":75},{"bytes":4960,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["container"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-12 final ideal cluster closeout"},{"level":2,"line":7,"title":"Plain explanation"},{"level":2,"line":17,"title":"Final state"},{"level":2,"line":32,"title":"P3 task summary"},{"level":2,"line":48,"title":"Residual gaps to true 100"},{"level":2,"line":60,"title":"Checks"},{"level":2,"line":73,"title":"Next task"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b","total_score":75},{"bytes":4960,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["container"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-12 final ideal cluster closeout"},{"level":2,"line":7,"title":"Plain explanation"},{"level":2,"line":17,"title":"Final state"},{"level":2,"line":32,"title":"P3 task summary"},{"level":2,"line":48,"title":"Residual gaps to true 100"},{"level":2,"line":60,"title":"Checks"},{"level":2,"line":73,"title":"Next task"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b","total_score":75},{"bytes":1585,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","recovery"],"error_learning":["incident"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["alert","grafana"],"storage":["thin"]},"headings":[{"level":1,"line":1,"title":"Homelab recovery runbooks"},{"level":2,"line":5,"title":"Global first command"},{"level":2,"line":12,"title":"Runbooks"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/04_homelab-desired-state/runbooks/INDEX.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"fbaa19446121d3bdb225c82e33e274a91bc414e3786e2f0df49145db1f95f851","total_score":75},{"bytes":56894,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":18,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92","total_score":74},{"bytes":20108,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-09 health surface WARN/OTHER status register"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":13,"title":"Counters"},{"level":2,"line":22,"title":"Summary"},{"level":2,"line":31,"title":"Proposed class counts"},{"level":2,"line":39,"title":"Service hint counts"},{"level":2,"line":47,"title":"Register rows"},{"level":2,"line":136,"title":"Category meanings"},{"level":2,"line":146,"title":"Rules"},{"level":2,"line":154,"title":"Operational conclusion"},{"level":2,"line":158,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2","total_score":74},{"bytes":56894,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":18,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92","total_score":74},{"bytes":20108,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-09 health surface WARN/OTHER status register"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":13,"title":"Counters"},{"level":2,"line":22,"title":"Summary"},{"level":2,"line":31,"title":"Proposed class counts"},{"level":2,"line":39,"title":"Service hint counts"},{"level":2,"line":47,"title":"Register rows"},{"level":2,"line":136,"title":"Category meanings"},{"level":2,"line":146,"title":"Rules"},{"level":2,"line":154,"title":"Operational conclusion"},{"level":2,"line":158,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2","total_score":74},{"bytes":56894,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":18,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92","total_score":74},{"bytes":20108,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-09 health surface WARN/OTHER status register"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":13,"title":"Counters"},{"level":2,"line":22,"title":"Summary"},{"level":2,"line":31,"title":"Proposed class counts"},{"level":2,"line":39,"title":"Service hint counts"},{"level":2,"line":47,"title":"Register rows"},{"level":2,"line":136,"title":"Category meanings"},{"level":2,"line":146,"title":"Rules"},{"level":2,"line":154,"title":"Operational conclusion"},{"level":2,"line":158,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2","total_score":74},{"bytes":171784,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f","total_score":73},{"bytes":1555,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":62,"coverage":{"access_and_admin":["ssh","url"],"backup_and_restore":["backup","restore"],"change_safety":["rollback"],"identity_and_topology":["proxmox","pve01","cluster","node"],"monitoring_and_logs":["prometheus"]},"headings":[{"level":1,"line":1,"title":"Proxmox exporter runbook"},{"level":2,"line":3,"title":"Location"},{"level":2,"line":11,"title":"Secret handling"},{"level":2,"line":19,"title":"Exporter health"},{"level":2,"line":31,"title":"Prometheus checks"},{"level":2,"line":50,"title":"PVE permissions"},{"level":2,"line":57,"title":"Rollback"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/proxmox-exporter.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"ebcd3f4d48f72038a99d5d8f795c224942723be4ab4db46803664895ff975bad","total_score":73},{"bytes":171784,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f","total_score":73},{"bytes":171784,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f","total_score":73},{"bytes":84145,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["access","login","admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"guests_and_workloads":["container","qemu","workload","guest"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","journal","grafana","prometheus"],"network_and_dns":["tls"],"storage":["lvm","thin","disk","volume"]},"headings":[{"level":1,"line":1,"title":"P0 edge cleanup preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-edge-cleanup-preflight-20260624T192250Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620","total_score":72},{"bytes":19149,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["url"],"backup_and_restore":["backup","recovery"],"change_safety":["sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","corosync"],"monitoring_and_logs":["log","journal"],"network_and_dns":["network","dns"],"storage":["storage","thin"]},"headings":[{"level":1,"line":1,"title":"P1 AdGuardHome sync image policy preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4","total_score":72},{"bytes":2268,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":58,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","recovery"],"change_safety":["rollback"],"external_services":["public","nginx"],"monitoring_and_logs":["log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"]},"headings":[{"level":1,"line":1,"title":"P1-23 Next safe backlog after NPMplus runbook close"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Next task"},{"level":2,"line":13,"title":"Reason"},{"level":2,"line":19,"title":"Input facts"},{"level":2,"line":29,"title":"P1-24 expected output"},{"level":2,"line":41,"title":"P1-24 safety boundary"},{"level":2,"line":58,"title":"Required carry-forward guardrails"},{"level":2,"line":75,"title":"Command protocol"},{"level":2,"line":82,"title":"DOCX policy"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf","total_score":72},{"bytes":84145,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["access","login","admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"guests_and_workloads":["container","qemu","workload","guest"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","journal","grafana","prometheus"],"network_and_dns":["tls"],"storage":["lvm","thin","disk","volume"]},"headings":[{"level":1,"line":1,"title":"P0 edge cleanup preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-edge-cleanup-preflight-20260624T192250Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620","total_score":72},{"bytes":19149,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["url"],"backup_and_restore":["backup","recovery"],"change_safety":["sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","corosync"],"monitoring_and_logs":["log","journal"],"network_and_dns":["network","dns"],"storage":["storage","thin"]},"headings":[{"level":1,"line":1,"title":"P1 AdGuardHome sync image policy preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4","total_score":72},{"bytes":2268,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":58,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","recovery"],"change_safety":["rollback"],"external_services":["public","nginx"],"monitoring_and_logs":["log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"]},"headings":[{"level":1,"line":1,"title":"P1-23 Next safe backlog after NPMplus runbook close"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Next task"},{"level":2,"line":13,"title":"Reason"},{"level":2,"line":19,"title":"Input facts"},{"level":2,"line":29,"title":"P1-24 expected output"},{"level":2,"line":41,"title":"P1-24 safety boundary"},{"level":2,"line":58,"title":"Required carry-forward guardrails"},{"level":2,"line":75,"title":"Command protocol"},{"level":2,"line":82,"title":"DOCX policy"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf","total_score":72},{"bytes":84145,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["access","login","admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"guests_and_workloads":["container","qemu","workload","guest"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","journal","grafana","prometheus"],"network_and_dns":["tls"],"storage":["lvm","thin","disk","volume"]},"headings":[{"level":1,"line":1,"title":"P0 edge cleanup preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-edge-cleanup-preflight-20260624T192250Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620","total_score":72},{"bytes":19149,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["url"],"backup_and_restore":["backup","recovery"],"change_safety":["sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","corosync"],"monitoring_and_logs":["log","journal"],"network_and_dns":["network","dns"],"storage":["storage","thin"]},"headings":[{"level":1,"line":1,"title":"P1 AdGuardHome sync image policy preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4","total_score":72},{"bytes":2268,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":58,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","recovery"],"change_safety":["rollback"],"external_services":["public","nginx"],"monitoring_and_logs":["log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"]},"headings":[{"level":1,"line":1,"title":"P1-23 Next safe backlog after NPMplus runbook close"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Next task"},{"level":2,"line":13,"title":"Reason"},{"level":2,"line":19,"title":"Input facts"},{"level":2,"line":29,"title":"P1-24 expected output"},{"level":2,"line":41,"title":"P1-24 safety boundary"},{"level":2,"line":58,"title":"Required carry-forward guardrails"},{"level":2,"line":75,"title":"Command protocol"},{"level":2,"line":82,"title":"DOCX policy"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf","total_score":72},{"bytes":43565,"commit":"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17","content_score":62,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup"],"change_safety":["sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","grafana","prometheus"],"network_and_dns":["dns"],"storage":["thin"]},"headings":[],"json_top_level_size":5,"json_top_level_type":"dict","path":"inventory/services.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/cr-2026-0017-inventory-foundation"],"sensitive_findings":[],"sha256":"189ab606f9de7b379b03510aef024def88ab91a1e2782d0c7d74fe93fa61509b","total_score":71},{"bytes":2281,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"access_and_admin":["ssh","url"],"backup_and_restore":["backup","restore"],"change_safety":["rollback"],"identity_and_topology":["pve01","node"],"monitoring_and_logs":["metric","prometheus"],"storage":["disk"]},"headings":[{"level":1,"line":1,"title":"smartmontools + node_exporter textfile runbook"},{"level":2,"line":3,"title":"Scope"},{"level":2,"line":18,"title":"Local checks on a PVE node"},{"level":2,"line":40,"title":"Prometheus checks from edge-vm"},{"level":2,"line":54,"title":"Expected metrics"},{"level":2,"line":63,"title":"Rollback"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/smartmontools-node-exporter.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"8bbdc976a24aadb0943ef386486d11f58f4e8b16b6589f519d2b5d99b2bdcaca","total_score":71},{"bytes":32948,"commit":"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17","content_score":70,"coverage":{"access_and_admin":["access","login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["cluster","node","quorum"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0017-inventory-foundation"],"sensitive_findings":[],"sha256":"3e79648b565bad680dbafbda376155ce48e74bd9deaeda58b3425906ac025ab0","total_score":70},{"bytes":26500,"commit":"f5b22d867ea467987008408e3fb1fb0e17fa7b2e","content_score":70,"coverage":{"access_and_admin":["login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["cluster","node","quorum"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook"],"sensitive_findings":[],"sha256":"5dab56a2e73e4a3582d4792b91a0c803d485e68b40791bc456315748b15490a0","total_score":70},{"bytes":29485,"commit":"fe1221b06643db3b00a621b0230f92a46a4edc2b","content_score":70,"coverage":{"access_and_admin":["login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["cluster","node","quorum"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition","refs/heads/main","refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"8051e3e761493a1b7088a0f3ed7e0aa9218673f453ca88171178364d26701f64","total_score":70},{"bytes":5868,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","metric"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["troubleshoot"]},"headings":[{"level":1,"line":1,"title":"P1-20 Exposure matrix repo preflight"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":12,"title":"Safety boundary"},{"level":2,"line":22,"title":"Matching file paths"},{"level":2,"line":105,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30","total_score":70},{"bytes":8774,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall"],"storage":["storage"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e","total_score":70},{"bytes":7063,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-02 privilege risk classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Classification summary"},{"level":2,"line":27,"title":"Review table"},{"level":2,"line":40,"title":"Detailed classification"},{"level":3,"line":42,"title":"authentik-worker-1"},{"level":3,"line":68,"title":"cadvisor"},{"level":3,"line":93,"title":"dockge"},{"level":3,"line":119,"title":"npmplus"},{"level":3,"line":146,"title":"homeassistant"},{"level":3,"line":173,"title":"homelab-registry-cache"},{"level":3,"line":199,"title":"kopia"},{"level":3,"line":225,"title":"socket-proxy"},{"level":2,"line":253,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2","total_score":70},{"bytes":16075,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access","login","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","metric","prometheus"],"network_and_dns":["network","firewall","dns","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a","total_score":70},{"bytes":61338,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":19,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0","total_score":70},{"bytes":15688,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface findings classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Overall classification"},{"level":2,"line":28,"title":"Source summary"},{"level":2,"line":40,"title":"Category counts"},{"level":2,"line":47,"title":"Classified findings"},{"level":2,"line":132,"title":"Interpretation"},{"level":2,"line":138,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b","total_score":70},{"bytes":18777,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":23,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca","total_score":70},{"bytes":9282,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface normalization plan"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Starting classification"},{"level":2,"line":33,"title":"Normalization tracks"},{"level":2,"line":42,"title":"Implementation sequence"},{"level":2,"line":51,"title":"Sample findings carried forward"},{"level":2,"line":98,"title":"Guardrails"},{"level":2,"line":107,"title":"Future close criteria"},{"level":2,"line":115,"title":"Operational conclusion"},{"level":2,"line":121,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507","total_score":70},{"bytes":5868,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","metric"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["troubleshoot"]},"headings":[{"level":1,"line":1,"title":"P1-20 Exposure matrix repo preflight"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":12,"title":"Safety boundary"},{"level":2,"line":22,"title":"Matching file paths"},{"level":2,"line":105,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30","total_score":70},{"bytes":8774,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall"],"storage":["storage"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e","total_score":70},{"bytes":7063,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-02 privilege risk classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Classification summary"},{"level":2,"line":27,"title":"Review table"},{"level":2,"line":40,"title":"Detailed classification"},{"level":3,"line":42,"title":"authentik-worker-1"},{"level":3,"line":68,"title":"cadvisor"},{"level":3,"line":93,"title":"dockge"},{"level":3,"line":119,"title":"npmplus"},{"level":3,"line":146,"title":"homeassistant"},{"level":3,"line":173,"title":"homelab-registry-cache"},{"level":3,"line":199,"title":"kopia"},{"level":3,"line":225,"title":"socket-proxy"},{"level":2,"line":253,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2","total_score":70},{"bytes":16075,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access","login","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","metric","prometheus"],"network_and_dns":["network","firewall","dns","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a","total_score":70},{"bytes":61338,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":19,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0","total_score":70},{"bytes":15688,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface findings classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Overall classification"},{"level":2,"line":28,"title":"Source summary"},{"level":2,"line":40,"title":"Category counts"},{"level":2,"line":47,"title":"Classified findings"},{"level":2,"line":132,"title":"Interpretation"},{"level":2,"line":138,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b","total_score":70},{"bytes":18777,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":23,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca","total_score":70},{"bytes":9282,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface normalization plan"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Starting classification"},{"level":2,"line":33,"title":"Normalization tracks"},{"level":2,"line":42,"title":"Implementation sequence"},{"level":2,"line":51,"title":"Sample findings carried forward"},{"level":2,"line":98,"title":"Guardrails"},{"level":2,"line":107,"title":"Future close criteria"},{"level":2,"line":115,"title":"Operational conclusion"},{"level":2,"line":121,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507","total_score":70},{"bytes":5868,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","metric"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["troubleshoot"]},"headings":[{"level":1,"line":1,"title":"P1-20 Exposure matrix repo preflight"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":12,"title":"Safety boundary"},{"level":2,"line":22,"title":"Matching file paths"},{"level":2,"line":105,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30","total_score":70},{"bytes":8774,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall"],"storage":["storage"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e","total_score":70},{"bytes":7063,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-02 privilege risk classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Classification summary"},{"level":2,"line":27,"title":"Review table"},{"level":2,"line":40,"title":"Detailed classification"},{"level":3,"line":42,"title":"authentik-worker-1"},{"level":3,"line":68,"title":"cadvisor"},{"level":3,"line":93,"title":"dockge"},{"level":3,"line":119,"title":"npmplus"},{"level":3,"line":146,"title":"homeassistant"},{"level":3,"line":173,"title":"homelab-registry-cache"},{"level":3,"line":199,"title":"kopia"},{"level":3,"line":225,"title":"socket-proxy"},{"level":2,"line":253,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2","total_score":70},{"bytes":16075,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access","login","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","metric","prometheus"],"network_and_dns":["network","firewall","dns","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a","total_score":70},{"bytes":61338,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":19,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0","total_score":70},{"bytes":15688,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface findings classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Overall classification"},{"level":2,"line":28,"title":"Source summary"},{"level":2,"line":40,"title":"Category counts"},{"level":2,"line":47,"title":"Classified findings"},{"level":2,"line":132,"title":"Interpretation"},{"level":2,"line":138,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b","total_score":70},{"bytes":18777,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":23,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca","total_score":70},{"bytes":9282,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface normalization plan"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Starting classification"},{"level":2,"line":33,"title":"Normalization tracks"},{"level":2,"line":42,"title":"Implementation sequence"},{"level":2,"line":51,"title":"Sample findings carried forward"},{"level":2,"line":98,"title":"Guardrails"},{"level":2,"line":107,"title":"Future close criteria"},{"level":2,"line":115,"title":"Operational conclusion"},{"level":2,"line":121,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507","total_score":70},{"bytes":946,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":56,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","recovery"],"error_learning":["incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"]},"headings":[{"level":1,"line":1,"title":"Runbook: cluster-admin-incident-engine"},{"level":2,"line":3,"title":"Current verified backup state"},{"level":2,"line":12,"title":"First checks"},{"level":2,"line":19,"title":"Safe recovery rule"},{"level":2,"line":22,"title":"Evidence commands"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/04_homelab-desired-state/runbooks/cluster-admin-incident-engine.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"304ca47a962dbc921b18f465bbc433580e71e2fdecf6b868ff4cfc30daebac34","total_score":70},{"bytes":26140,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["superseded"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-11-health-surface-p1-file-operator-decision-package-20260625T234808Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3d85ce8de8cc17b76fde6fa144b918000f052c847780529b9caa98ccc0f10c80","total_score":69},{"bytes":3023,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[],"json_top_level_size":9,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"4983daf23fd88331c0985a6a794cebfb06731768766e277f10ac847174eba312","total_score":69},{"bytes":2982,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"backup_and_restore":["backup","restore","retention"],"error_learning":["regression"],"external_services":["reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","domain","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-01 evidence-based cluster score model"},{"level":2,"line":5,"title":"Final score for this baseline"},{"level":2,"line":11,"title":"Key findings"},{"level":2,"line":21,"title":"Score domains"},{"level":2,"line":33,"title":"Actions required to reach 100/100"},{"level":2,"line":49,"title":"Safety state"},{"level":2,"line":56,"title":"Next task"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-01-cluster-ideal-state-evidence-based-score-model-20260626T040011Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"17ea887feea2f371871c0e3155bcc3f3dd979dca0627d32e4f01da6ba8241e42","total_score":69},{"bytes":2502,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":52,"coverage":{"backup_and_restore":["backup","restore"],"error_learning":["regression"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-11 final CI/no-regression/runbooks inventory"},{"level":2,"line":5,"title":"Plain explanation"},{"level":2,"line":11,"title":"Summary"},{"level":2,"line":25,"title":"Close artifacts"},{"level":2,"line":38,"title":"Redaction"},{"level":2,"line":42,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.md","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c610e8118037cdf7239ce61bac44dda4dfc8af4ca4c9d7166829e0ef56241bcb","total_score":69},{"bytes":1375,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":58,"coverage":{"access_and_admin":["access","ssh","url"],"backup_and_restore":["backup"],"change_safety":["rollback"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","node"],"monitoring_and_logs":["monitor","log","journal","metric","prometheus"],"repair_and_troubleshooting":["diagnostic"]},"headings":[{"level":1,"line":1,"title":"Scrutiny pve01 runbook"},{"level":2,"line":3,"title":"Location"},{"level":2,"line":10,"title":"Health check"},{"level":2,"line":26,"title":"Logs"},{"level":2,"line":32,"title":"Data"},{"level":2,"line":41,"title":"Access"},{"level":2,"line":51,"title":"Relationship with Prometheus SMART monitoring"},{"level":2,"line":59,"title":"Rollback"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/scrutiny-pve01.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"e8e03dc156536ae569e4f42bb7baf715495c91ad24d3e16924bd329ce74dc12c","total_score":69},{"bytes":26140,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["superseded"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-11-health-surface-p1-file-operator-decision-package-20260625T234808Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3d85ce8de8cc17b76fde6fa144b918000f052c847780529b9caa98ccc0f10c80","total_score":69},{"bytes":3023,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[],"json_top_level_size":9,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"4983daf23fd88331c0985a6a794cebfb06731768766e277f10ac847174eba312","total_score":69}],"error_artifacts_omitted":60,"handbook_candidates":[{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":1079183,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":102,"coverage":{"access_and_admin":["access","login","admin","ssh","console","url"],"backup_and_restore":["backup","бэкап","restore","восстанов","recovery","retention"],"change_safety":["rollback","sha256","atomic"],"error_learning":["regression","incident","superseded"],"external_services":["внешн","public","reverse proxy","nginx"],"guests_and_workloads":["vmid","container","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["внутренн","lan"],"monitoring_and_logs":["monitor","alert","log","journal","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","tls","certificate"],"repair_and_troubleshooting":["repair","troubleshoot","diagnostic","failure"],"storage":["storage","thin","disk"]},"excerpt":"<OMITTED_SENSITIVE_CONTENT><BOUNDED_PROJECTION><BOUNDED_PROJECTION><BOUNDED_PROJECTION>","headings":[],"json_top_level_size":1000,"json_top_level_type":"list","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["url-userinfo"],"sha256":"aeb92358514ec5cd67d557f15ea295b3ae4f25df5f17a14556dae750b8496d1b","total_score":102},{"bytes":9499,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":88,"coverage":{"access_and_admin":["access","login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","internet"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["internal service","lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","grafana","prometheus"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"excerpt":"# DR from zero runbook, 2026-06-22\n\nChecked at UTC: `2026-06-22T09:00:38Z`.\n\nMarker: **DR from zero runbook, 2026-06-22**\n\n## Purpose\n\nThis runbook describes how to rebuild a minimum viable homelab from zero after a serious failure.\n\nIt is not a restore execution log. It is a step-by-step operator procedure.\n\n## Scope\n\nThe goal is to recover enough infrastructure to regain access, documentation, identity, routing, secrets, Git, backup visibility, and then stateful applications.\n\nMinimum viable homelab means:\n\n- SSH access works;\n- VPN/Tailscale/NetBird access works or has a known temporary replacement;\n- Git repository is available;\n- SOPS/age secrets can be decrypted;\n- MkDocs documentation is published;\n- NPMplus routes can be restored;\n- Authentik, Gitea, Vaultwarden, NetBox, and Uptime Kuma can be restored;\n- backup/offhost locations are visible;\n- health checks prove the restored state.\n\n## Current known source-of-truth commits\n\n- Backup coverage closure: completed before this runbook.\n- MkDocs publish hardening: completed.\n- Backup tiering table: completed.\n- Current repo head when starting this runbook: `adb8c55`.\n\n## P0 restore order\n\n| Order | Component | Why first | Expec<BOUNDED_PROJECTION>","headings":[{"level":1,"line":1,"title":"DR from zero runbook, 2026-06-22"},{"level":2,"line":7,"title":"Purpose"},{"level":2,"line":13,"title":"Scope"},{"level":2,"line":29,"title":"Current known source-of-truth commits"},{"level":2,"line":36,"title":"P0 restore order"},{"level":2,"line":55,"title":"Critical backup sources"},{"level":2,"line":71,"title":"Phase 0 — stop and preserve evidence"},{"level":2,"line":86,"title":"Phase 1 — base host recovery"},{"level":2,"line":104,"title":"Phase 2 — network access"},{"level":2,"line":119,"title":"Phase 3 — clone repository"},{"level":2,"line":136,"title":"Phase 4 — restore secrets/SOPS"},{"level":2,"line":155,"title":"Phase 5 — restore documentation first"},{"level":2,"line":173,"title":"Phase 6 — recover NPMplus and Uptime Kuma"},{"level":2,"line":197,"title":"Phase 7 — recover Authentik"},{"level":2,"line":215,"title":"Phase 8 — recover Gitea"},{"level":2,"line":230,"title":"Phase 9 — recover Vaultwarden"},{"level":2,"line":244,"title":"Phase 10 — recover NetBox"},{"level":2,"line":270,"title":"Phase 11 — recover Edge VM"},{"level":2,"line":291,"title":"Phase 12 — recover user data services"},{"level":2,"line":306,"title":"Phase 13 — restore monitoring and alerting"},{"level":2,"line":325,"title":"Do not do"},{"level":2,"line":334,"title":"Final DR closure checklist"},{"level":2,"line":353,"title":"Next improvement after this runbook"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f8312cd7cd0a296c60950a60c7866a67b19a70016b93f68b3a76b78d5440cb63","total_score":102},{"bytes":9386,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["qemu"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns"],"repair_and_troubleshooting":["failure"],"storage":["thin","disk"]},"headings":[{"level":1,"line":1,"title":"Disaster Recovery Runbook"},{"level":2,"line":6,"title":"Current verified recovery anchors"},{"level":2,"line":25,"title":"Things that must exist outside the repo"},{"level":2,"line":39,"title":"Recovery priority"},{"level":2,"line":51,"title":"Phase 0: establish a control host"},{"level":2,"line":65,"title":"Phase 1: restore rclone access"},{"level":2,"line":90,"title":"Phase 2: restore the critical/small cloud bundle"},{"level":1,"line":107,"title":"Expected:"},{"level":1,"line":108,"title":"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c"},{"level":2,"line":130,"title":"Phase 3: recover small app/config backups"},{"level":2,"line":163,"title":"Phase 4: recover edge-vm large backup"},{"level":1,"line":194,"title":"Expected size:"},{"level":1,"line":195,"title":"16936767590"},{"level":1,"line":196,"title":"Expected SHA256:"},{"level":1,"line":197,"title":"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001"},{"level":2,"line":202,"title":"Phase 5: restore validation checklist"},{"level":2,"line":218,"title":"Phase 6: re-enable backup and offsite automation"},{"level":2,"line":231,"title":"Known failure lessons"},{"level":2,"line":243,"title":"Vaultwarden isolated restore drill result — 2026-06-18"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e","total_score":100},{"bytes":9386,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["qemu"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns"],"repair_and_troubleshooting":["failure"],"storage":["thin","disk"]},"headings":[{"level":1,"line":1,"title":"Disaster Recovery Runbook"},{"level":2,"line":6,"title":"Current verified recovery anchors"},{"level":2,"line":25,"title":"Things that must exist outside the repo"},{"level":2,"line":39,"title":"Recovery priority"},{"level":2,"line":51,"title":"Phase 0: establish a control host"},{"level":2,"line":65,"title":"Phase 1: restore rclone access"},{"level":2,"line":90,"title":"Phase 2: restore the critical/small cloud bundle"},{"level":1,"line":107,"title":"Expected:"},{"level":1,"line":108,"title":"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c"},{"level":2,"line":130,"title":"Phase 3: recover small app/config backups"},{"level":2,"line":163,"title":"Phase 4: recover edge-vm large backup"},{"level":1,"line":194,"title":"Expected size:"},{"level":1,"line":195,"title":"16936767590"},{"level":1,"line":196,"title":"Expected SHA256:"},{"level":1,"line":197,"title":"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001"},{"level":2,"line":202,"title":"Phase 5: restore validation checklist"},{"level":2,"line":218,"title":"Phase 6: re-enable backup and offsite automation"},{"level":2,"line":231,"title":"Known failure lessons"},{"level":2,"line":243,"title":"Vaultwarden isolated restore drill result — 2026-06-18"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e","total_score":100},{"bytes":16031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["internal service","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"05. Service Catalog"},{"level":2,"line":5,"title":"Edge VM"},{"level":2,"line":12,"title":"NPMplus"},{"level":2,"line":22,"title":"Uptime Kuma"},{"level":2,"line":30,"title":"Gotify"},{"level":2,"line":38,"title":"Vaultwarden"},{"level":2,"line":49,"title":"Dockge"},{"level":2,"line":61,"title":"Homepage"},{"level":2,"line":71,"title":"Gitea"},{"level":2,"line":84,"title":"Nextcloud AIO"},{"level":2,"line":95,"title":"DNS stack"},{"level":2,"line":102,"title":"Backup"},{"level":2,"line":109,"title":"Edge applications added 2026-06-15/16"},{"level":2,"line":132,"title":"Backup health proxy"},{"level":2,"line":155,"title":"Edge VM capacity note"},{"level":2,"line":366,"title":"Homepage grouped dashboard update, 2026-06-22"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a","total_score":95},{"bytes":106031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":92,"coverage":{"access_and_admin":["access","login","admin","web ui","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","lxc","qemu","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["локальн","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"99. Current state summary"},{"level":2,"line":5,"title":"Git repository"},{"level":2,"line":12,"title":"Operating rules"},{"level":2,"line":21,"title":"Current verified backup health"},{"level":2,"line":32,"title":"Backup scripts and services"},{"level":2,"line":41,"title":"Proxmox and network layout"},{"level":2,"line":58,"title":"NPMplus state"},{"level":2,"line":81,"title":"DNS rewrites"},{"level":2,"line":101,"title":"Edge applications"},{"level":2,"line":118,"title":"Uptime Kuma"},{"level":2,"line":131,"title":"Cloudflare token rotation"},{"level":2,"line":139,"title":"Known working URLs"},{"level":2,"line":166,"title":"Pending after this documentation update"},{"level":2,"line":181,"title":"Edge application setup checkpoint — 2026-06-16T10:26:57Z"},{"level":2,"line":194,"title":"Immich media storage checkpoint — 2026-06-16T11:01:32Z"},{"level":2,"line":204,"title":"Immich media backup checkpoint — 2026-06-16T11:24:22Z"},{"level":2,"line":219,"title":"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z"},{"level":2,"line":231,"title":"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z"},{"level":2,"line":245,"title":"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z"},{"level":2,"line":257,"title":"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z"},{"level":2,"line":266,"title":"Closed validation checkpoint — 2026-06-16T16:51:40Z"},{"level":2,"line":278,"title":"Disk Space Health checkpoint — 2026-06-16T17:06:06Z"},{"level":2,"line":298,"title":"Memos backup checkpoint — 2026-06-16T17:33:39Z"},{"level":2,"line":319,"title":"Paperless backup checkpoint — 2026-06-16T17:50:49Z"},{"level":2,"line":350,"title":"Application restore validation checkpoint — 2026-06-16T18:01:17Z"},{"level":2,"line":364,"title":"Final full baseline checkpoint — 2026-06-16T18:10:15Z"},{"level":2,"line":407,"title":"Daily cluster status report"},{"level":2,"line":420,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":447,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":482,"title":"Контейнерная волна обновлений, 2026-06-19"},{"level":2,"line":498,"title":"CVE root-cause analysis, 2026-06-19"},{"level":2,"line":514,"title":"Browser / Chromium risk analysis, 2026-06-19"},{"level":2,"line":527,"title":"Base OS package CVE analysis, 2026-06-19"},{"level":2,"line":541,"title":"Go runtime/dependency CVE analysis, 2026-06-19"},{"level":2,"line":555,"title":"Node/NPM dependency CVE analysis, 2026-06-19"},{"level":2,"line":569,"title":"Dockge / Karakeep candidate tag scan, 2026-06-19"},{"level":2,"line":583,"title":"Karakeep production update, 2026-06-19"},{"level":2,"line":605,"title":"Uptime Kuma candidate tag scan, 2026-06-19"},{"level":2,"line":622,"title":"Uptime Kuma production update, 2026-06-19"},{"level":2,"line":644,"title":"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19"},{"level":2,"line":663,"title":"Linkding candidate tag scan, 2026-06-19"},{"level":2,"line":678,"title":"Linkding production update, 2026-06-19"},{"level":2,"line":698,"title":"Current Trivy leaderboard after Linkding, 2026-06-19"},{"level":2,"line":717,"title":"Batch candidate scan, 2026-06-19"},{"level":2,"line":744,"title":"Disk cleanup and Git push recovery, 2026-06-19"},{"level":2,"line":758,"title":"Next update candidates from batch scan, 2026-06-19"},{"level":2,"line":770,"title":"IT-Tools production update, 2026-06-19"},{"level":2,"line":789,"title":"NPMplus production update, 2026-06-19"},{"level":2,"line":812,"title":"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19"},{"level":2,"line":827,"title":"Paperless stable candidate scan, 2026-06-19"},{"level":2,"line":852,"title":"Immich app stable pair candidate scan, 2026-06-19"},{"level":2,"line":878,"title":"Immich app pair candidate scan result, 2026-06-19"},{"level":2,"line":896,"title":"Home Assistant stable candidate scan, 2026-06-19"},{"level":2,"line":919,"title":"MinIO release candidate scan, 2026-06-19"},{"level":2,"line":942,"title":"Mealie stable candidate scan, 2026-06-19"},{"level":2,"line":965,"title":"Authentik server image candidate scan, 2026-06-19"},{"level":2,"line":988,"title":"Karakeep Meilisearch candidate scan, 2026-06-19"},{"level":2,"line":1011,"title":"Karakeep Chrome candidate scan, 2026-06-19"},{"level":2,"line":1034,"title":"Vaultwarden stable candidate scan, 2026-06-19"},{"level":2,"line":1057,"title":"Vaultwarden production update, 2026-06-20"},{"level":2,"line":1083,"title":"Current Trivy leaderboard after Vaultwarden, 2026-06-20"},{"level":2,"line":1098,"title":"n8n stable candidate scan, 2026-06-20"},{"level":2,"line":1121,"title":"n8n latest tag restore, 2026-06-20"},{"level":2,"line":1137,"title":"n8n 2.27.3 smoke-test, 2026-06-20"},{"level":2,"line":1163,"title":"n8n production update, 2026-06-20"},{"level":2,"line":1193,"title":"Gotify stable candidate scan, 2026-06-20"},{"level":2,"line":1213,"title":"Batch remaining open candidate scan, 2026-06-20"},{"level":2,"line":1234,"title":"CrowdSec production update, 2026-06-20"},{"level":2,"line":1262,"title":"Final CVE pass summary, 2026-06-20"},{"level":2,"line":1286,"title":"n8n encryption key rotation, 2026-06-20"},{"level":2,"line":1311,"title":"Audit and backup inventory, 2026-06-20"},{"level":2,"line":1326,"title":"Immich Postgres restore smoke-test, 2026-06-20"},{"level":2,"line":1342,"title":"Immich Postgres candidate scan, 2026-06-20"},{"level":2,"line":1352,"title":"Dockge candidate scan, 2026-06-20"},{"level":2,"line":1362,"title":"Paperless candidate scan, 2026-06-20"},{"level":2,"line":1372,"title":"Karakeep and Immich Server real-tag scan, 2026-06-20"},{"level":2,"line":1382,"title":"Closing high-CVE ledger, 2026-06-20"},{"level":2,"line":1392,"title":"Candidate test directories cleanup, 2026-06-20"},{"level":2,"line":1402,"title":"Old n8n key backup removal preflight, 2026-06-20"},{"level":2,"line":1412,"title":"NetBird peers health hardening, 2026-06-20"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md","path_score":3,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c","total_score":95},{"bytes":16031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["internal service","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"05. Service Catalog"},{"level":2,"line":5,"title":"Edge VM"},{"level":2,"line":12,"title":"NPMplus"},{"level":2,"line":22,"title":"Uptime Kuma"},{"level":2,"line":30,"title":"Gotify"},{"level":2,"line":38,"title":"Vaultwarden"},{"level":2,"line":49,"title":"Dockge"},{"level":2,"line":61,"title":"Homepage"},{"level":2,"line":71,"title":"Gitea"},{"level":2,"line":84,"title":"Nextcloud AIO"},{"level":2,"line":95,"title":"DNS stack"},{"level":2,"line":102,"title":"Backup"},{"level":2,"line":109,"title":"Edge applications added 2026-06-15/16"},{"level":2,"line":132,"title":"Backup health proxy"},{"level":2,"line":155,"title":"Edge VM capacity note"},{"level":2,"line":366,"title":"Homepage grouped dashboard update, 2026-06-22"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a","total_score":95},{"bytes":106031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":92,"coverage":{"access_and_admin":["access","login","admin","web ui","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","lxc","qemu","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["локальн","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"99. Current state summary"},{"level":2,"line":5,"title":"Git repository"},{"level":2,"line":12,"title":"Operating rules"},{"level":2,"line":21,"title":"Current verified backup health"},{"level":2,"line":32,"title":"Backup scripts and services"},{"level":2,"line":41,"title":"Proxmox and network layout"},{"level":2,"line":58,"title":"NPMplus state"},{"level":2,"line":81,"title":"DNS rewrites"},{"level":2,"line":101,"title":"Edge applications"},{"level":2,"line":118,"title":"Uptime Kuma"},{"level":2,"line":131,"title":"Cloudflare token rotation"},{"level":2,"line":139,"title":"Known working URLs"},{"level":2,"line":166,"title":"Pending after this documentation update"},{"level":2,"line":181,"title":"Edge application setup checkpoint — 2026-06-16T10:26:57Z"},{"level":2,"line":194,"title":"Immich media storage checkpoint — 2026-06-16T11:01:32Z"},{"level":2,"line":204,"title":"Immich media backup checkpoint — 2026-06-16T11:24:22Z"},{"level":2,"line":219,"title":"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z"},{"level":2,"line":231,"title":"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z"},{"level":2,"line":245,"title":"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z"},{"level":2,"line":257,"title":"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z"},{"level":2,"line":266,"title":"Closed validation checkpoint — 2026-06-16T16:51:40Z"},{"level":2,"line":278,"title":"Disk Space Health checkpoint — 2026-06-16T17:06:06Z"},{"level":2,"line":298,"title":"Memos backup checkpoint — 2026-06-16T17:33:39Z"},{"level":2,"line":319,"title":"Paperless backup checkpoint — 2026-06-16T17:50:49Z"},{"level":2,"line":350,"title":"Application restore validation checkpoint — 2026-06-16T18:01:17Z"},{"level":2,"line":364,"title":"Final full baseline checkpoint — 2026-06-16T18:10:15Z"},{"level":2,"line":407,"title":"Daily cluster status report"},{"level":2,"line":420,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":447,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":482,"title":"Контейнерная волна обновлений, 2026-06-19"},{"level":2,"line":498,"title":"CVE root-cause analysis, 2026-06-19"},{"level":2,"line":514,"title":"Browser / Chromium risk analysis, 2026-06-19"},{"level":2,"line":527,"title":"Base OS package CVE analysis, 2026-06-19"},{"level":2,"line":541,"title":"Go runtime/dependency CVE analysis, 2026-06-19"},{"level":2,"line":555,"title":"Node/NPM dependency CVE analysis, 2026-06-19"},{"level":2,"line":569,"title":"Dockge / Karakeep candidate tag scan, 2026-06-19"},{"level":2,"line":583,"title":"Karakeep production update, 2026-06-19"},{"level":2,"line":605,"title":"Uptime Kuma candidate tag scan, 2026-06-19"},{"level":2,"line":622,"title":"Uptime Kuma production update, 2026-06-19"},{"level":2,"line":644,"title":"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19"},{"level":2,"line":663,"title":"Linkding candidate tag scan, 2026-06-19"},{"level":2,"line":678,"title":"Linkding production update, 2026-06-19"},{"level":2,"line":698,"title":"Current Trivy leaderboard after Linkding, 2026-06-19"},{"level":2,"line":717,"title":"Batch candidate scan, 2026-06-19"},{"level":2,"line":744,"title":"Disk cleanup and Git push recovery, 2026-06-19"},{"level":2,"line":758,"title":"Next update candidates from batch scan, 2026-06-19"},{"level":2,"line":770,"title":"IT-Tools production update, 2026-06-19"},{"level":2,"line":789,"title":"NPMplus production update, 2026-06-19"},{"level":2,"line":812,"title":"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19"},{"level":2,"line":827,"title":"Paperless stable candidate scan, 2026-06-19"},{"level":2,"line":852,"title":"Immich app stable pair candidate scan, 2026-06-19"},{"level":2,"line":878,"title":"Immich app pair candidate scan result, 2026-06-19"},{"level":2,"line":896,"title":"Home Assistant stable candidate scan, 2026-06-19"},{"level":2,"line":919,"title":"MinIO release candidate scan, 2026-06-19"},{"level":2,"line":942,"title":"Mealie stable candidate scan, 2026-06-19"},{"level":2,"line":965,"title":"Authentik server image candidate scan, 2026-06-19"},{"level":2,"line":988,"title":"Karakeep Meilisearch candidate scan, 2026-06-19"},{"level":2,"line":1011,"title":"Karakeep Chrome candidate scan, 2026-06-19"},{"level":2,"line":1034,"title":"Vaultwarden stable candidate scan, 2026-06-19"},{"level":2,"line":1057,"title":"Vaultwarden production update, 2026-06-20"},{"level":2,"line":1083,"title":"Current Trivy leaderboard after Vaultwarden, 2026-06-20"},{"level":2,"line":1098,"title":"n8n stable candidate scan, 2026-06-20"},{"level":2,"line":1121,"title":"n8n latest tag restore, 2026-06-20"},{"level":2,"line":1137,"title":"n8n 2.27.3 smoke-test, 2026-06-20"},{"level":2,"line":1163,"title":"n8n production update, 2026-06-20"},{"level":2,"line":1193,"title":"Gotify stable candidate scan, 2026-06-20"},{"level":2,"line":1213,"title":"Batch remaining open candidate scan, 2026-06-20"},{"level":2,"line":1234,"title":"CrowdSec production update, 2026-06-20"},{"level":2,"line":1262,"title":"Final CVE pass summary, 2026-06-20"},{"level":2,"line":1286,"title":"n8n encryption key rotation, 2026-06-20"},{"level":2,"line":1311,"title":"Audit and backup inventory, 2026-06-20"},{"level":2,"line":1326,"title":"Immich Postgres restore smoke-test, 2026-06-20"},{"level":2,"line":1342,"title":"Immich Postgres candidate scan, 2026-06-20"},{"level":2,"line":1352,"title":"Dockge candidate scan, 2026-06-20"},{"level":2,"line":1362,"title":"Paperless candidate scan, 2026-06-20"},{"level":2,"line":1372,"title":"Karakeep and Immich Server real-tag scan, 2026-06-20"},{"level":2,"line":1382,"title":"Closing high-CVE ledger, 2026-06-20"},{"level":2,"line":1392,"title":"Candidate test directories cleanup, 2026-06-20"},{"level":2,"line":1402,"title":"Old n8n key backup removal preflight, 2026-06-20"},{"level":2,"line":1412,"title":"NetBird peers health hardening, 2026-06-20"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md","path_score":3,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c","total_score":95},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":38408,"commit":"60f53ea6fe6724196802a46de3de19c7889a51cc","content_score":86,"coverage":{"access_and_admin":["login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256","atomic"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["pve01","cluster","node","quorum","corosync"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["network","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary"],"sensitive_findings":[],"sha256":"07c9854ab0232d1f2766cdab114d0d398a4dcc1a5b41ea7fde77646e5f42804e","total_score":86},{"bytes":61327,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["access","login","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","qemu"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","grafana","prometheus"],"network_and_dns":["network","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"Services bootstrap snapshot — 2026-06-17"},{"level":2,"line":3,"title":"Scope"},{"level":2,"line":9,"title":"Edge VM"},{"level":2,"line":19,"title":"NetBird VPS"},{"level":2,"line":34,"title":"NetBird backup status"},{"level":3,"line":37,"title":"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb<BOUNDED_PROJECTION>"},{"level":2,"line":40,"title":"NetBird backup timers"},{"level":2,"line":46,"title":"Important follow-ups"},{"level":2,"line":54,"title":"NetBird Uptime Kuma monitors"},{"level":2,"line":64,"title":"NetBird homelab peers"},{"level":3,"line":69,"title":"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0              UNKNOWN        100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 <BOUNDED_PROJECTION>"},{"level":2,"line":72,"title":"NetBird peers health monitor"},{"level":2,"line":88,"title":"File Browser credential remediation"},{"level":2,"line":98,"title":"Proxmox private SSL via NetBird FQDN"},{"level":2,"line":116,"title":"File Browser backup, offhost sync, and restore validation"},{"level":2,"line":150,"title":"App stacks batch backup chain"},{"level":2,"line":194,"title":"Final backup and health baseline"},{"level":2,"line":202,"title":"Private NPMplus hosts via NetBird"},{"level":2,"line":231,"title":"Homepage VPN Authentik forward-auth"},{"level":2,"line":244,"title":"Homepage Authentik forward-auth rollback"},{"level":2,"line":257,"title":"Private VPN hosts safe baseline after Authentik rollback"},{"level":2,"line":271,"title":"Private VPN Hosts Kuma monitor"},{"level":2,"line":289,"title":"Private VPN Hosts health timer"},{"level":2,"line":304,"title":"Private VPN Hosts timer auto-cycle verified"},{"level":2,"line":314,"title":"Final ops snapshot — private VPN hosts"},{"level":2,"line":326,"title":"NPMplus + Kuma config backup chain"},{"level":2,"line":348,"title":"Corrected NPMplus + Kuma config backup chain"},{"level":2,"line":367,"title":"NPMplus + Kuma backup chain Kuma monitors"},{"level":2,"line":382,"title":"NPMplus + Kuma config backup timer"},{"level":2,"line":398,"title":"Authentik backup chain"},{"level":2,"line":408,"title":"Authentik backup chain Kuma monitors"},{"level":2,"line":417,"title":"Authentik backup timer"},{"level":2,"line":431,"title":"Gitea backup chain"},{"level":2,"line":441,"title":"Gitea backup chain"},{"level":2,"line":445,"title":"Gitea backup chain Kuma monitors"},{"level":2,"line":454,"title":"Gitea backup timer"},{"level":2,"line":465,"title":"Vaultwarden backup chain"},{"level":2,"line":475,"title":"Vaultwarden backup chain Kuma monitors"},{"level":2,"line":484,"title":"Vaultwarden backup timer"},{"level":2,"line":495,"title":"Edge VM manual vzdump backup"},{"level":2,"line":502,"title":"Edge VM vzdump offhost copy"},{"level":2,"line":508,"title":"Edge VM vzdump restore verification"},{"level":2,"line":515,"title":"Edge VM vzdump Kuma monitors"},{"level":2,"line":528,"title":"Edge VM vzdump weekly timer"},{"level":2,"line":543,"title":"Immich media backup existing automation inventory"},{"level":2,"line":553,"title":"Immich media restore verification"},{"level":2,"line":560,"title":"Immich media restore Kuma monitor"},{"level":2,"line":570,"title":"Immich media restore Kuma monitor correction"},{"level":2,"line":577,"title":"P0 backup baseline closure"},{"level":2,"line":589,"title":"P1 Mail.ru Cloud offsite inventory"},{"level":2,"line":651,"title":"P1 Mail.ru Cloud rclone config drift resolved"},{"level":2,"line":667,"title":"P1 Mail.ru Cloud canary"},{"level":2,"line":675,"title":"P1 Mail.ru Cloud production payload inventory"},{"level":2,"line":710,"title":"P1 Mail.ru Cloud critical baseline upload"},{"level":2,"line":720,"title":"P1 Mail.ru Cloud Kuma monitors"},{"level":2,"line":732,"title":"P1 Mail.ru Cloud edge-vm chunked large upload"},{"level":2,"line":742,"title":"P1 Mail.ru Cloud Edge VM Kuma monitor"},{"level":2,"line":753,"title":"P1 Mail.ru Cloud offsite seed closure"},{"level":2,"line":776,"title":"P1 Mail.ru Cloud critical upload automation"},{"level":2,"line":791,"title":"P1 Mail.ru Cloud edge-vm upload automation"},{"level":2,"line":807,"title":"P1 Mail.ru Cloud automation and retention closure"},{"level":2,"line":829,"title":"P1 Mail.ru Cloud restore drill automation"},{"level":2,"line":843,"title":"P2 Disaster Recovery runbook"},{"level":2,"line":853,"title":"P2 Critical bundle bootstrap drill"},{"level":2,"line":870,"title":"P2 Disaster Recovery bootstrap closure"},{"level":2,"line":892,"title":"Vaultwarden isolated restore drill — 2026-06-18"},{"level":2,"line":929,"title":"Daily cluster status report — 2026-06-18"},{"level":2,"line":985,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":1012,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":1047,"title":"Trivy scan mode after 2026-06-19 update wave"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["sensitive-assignment"],"sha256":"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6","total_score":86},{"bytes":89904,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["admin","console","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","grafana","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["troubleshoot"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"P0 alert routing preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab","total_score":86}],"handbook_candidates_omitted":20,"history":{"log":"COMMIT\tf9d3ba8caf65005605aa8aee2ede7e4e7e94ee49\t2026-07-31T10:37:56+03:00\thomelab-site-baseline\tGRAM1: capture initial site baseline 20260731T071400Z\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\n\nCOMMIT\tf12d914540d40b3c221786c81be0ec17f42c91a5\t2026-07-20T00:16:16+03:00\tHOMELAB Ops Reviewer\tCR-2026-0017: record one-pass live inventory verification\nM\terrors/regression-cases.json\n\nCOMMIT\td831f34685a9305412f949c1e845842af78661a1\t2026-07-20T00:05:34+03:00\tHOMELAB Ops Reviewer\tCR-2026-0017: add unified homelab inventory foundation\nM\terrors/regression-cases.json\n\nCOMMIT\t60f53ea6fe6724196802a46de3de19c7889a51cc\t2026-07-19T13:49:08+03:00\tHOMELAB Bootstrap Reviewer\tCR-2026-0015: add pve03 r8152 RX ring canary\nM\terrors/regression-cases.json\n\nCOMMIT\t25b275f96b54551e26f07516c72651d85f235ad0\t2026-07-18T16:27:33+03:00\thomelab-ops-bootstrap\tCR-2026-0013: allow VM160 worker bootstrap transition\nM\terrors/regression-cases.json\n\nCOMMIT\tf5b22d867ea467987008408e3fb1fb0e17fa7b2e\t2026-07-18T14:17:33+03:00\thomelab-ops-bootstrap\tCR-2026-0012: add one-command Skladchik Cookie refresh runbook\nM\terrors/regression-cases.json\n\nCOMMIT\tbb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9\t2026-07-18T13:11:46+03:00\thomelab-ops-bootstrap\tCR-2026-0011: force fresh Skladchik Cookie before jar persistence\nM\terrors/regression-cases.json\n\nCOMMIT\t7bd1b050f8d64c7b55dfd51ead63f0adda87f2df\t2026-07-18T10:34:25+03:00\thomelab-ops-bootstrap\tCR-2026-0010: separate current and target Skladchik edge SHAs\nM\terrors/regression-cases.json\n\nCOMMIT\t10a747b86ef498aabd3a71b1e32dfb6c80547ddb\t2026-07-18T09:59:55+03:00\thomelab-ops-bootstrap\tCR-2026-0009: guard Skladchik monitor concurrency\nM\terrors/regression-cases.json\n\nCOMMIT\t1f7abe5acf856ad2a2abe10ef2a9452485edb073\t2026-07-18T09:26:07+03:00\thomelab-ops-bootstrap\tCR-2026-0008: repair Skladchik rollback snapshot integrity\nM\terrors/regression-cases.json\n\nCOMMIT\td399d24440f948b518761ecfd516521993861b43\t2026-07-18T08:10:58+03:00\thomelab-ops-bootstrap\tCR-2026-0007: add controlled Skladchik reauthentication task\nM\terrors/regression-cases.json\n\nCOMMIT\t65855c4108dd0dd961803ad8233e5a805c00993b\t2026-07-18T06:15:45+03:00\thomelab-ops-bootstrap\tCR-2026-0006: lock cluster cloud quorum failures\nM\terrors/regression-cases.json\n\nCOMMIT\tb8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\t2026-07-18T03:57:33+03:00\tHOMELAB Bootstrap Reviewer\tCR-2026-0005 prepare reviewed logrotate bootstrap clearance\nM\terrors/regression-cases.json\n\nCOMMIT\t14d8bb0467e5890a7166444afda90a0185552eba\t2026-07-16T01:29:16+03:00\thomelab-ops-bootstrap\tbootstrap homelab-ops v2\nA\terrors/regression-cases.json\n<BOUNDED_PROJECTION><BOUNDED_PROJECTION>","log_bytes":7893,"log_sha256":"6952e258f02107d8b918fe6d37d51146ba54c5a3fa27110434001f2046127c7e","log_truncated":false,"paths":["sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","errors/regression-cases.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json"]},"mandatory_error_artifacts":{"linter":{"paths":[],"present":false},"regression_registry":{"paths":["errors/regression-cases.json"],"present":true},"repository_validator":{"paths":["tools/validate_repo.py"],"present":true},"superseded_policy":{"paths":[],"present":false},"tests":{"paths":["tests/fixtures/gitea-legacy-auth-permission.json","tests/test_access_contexts.py","tests/test_cr_2026_0005.py","tests/test_cr_2026_0006.py","tests/test_cr_2026_0006_vm160_task.py","tests/test_cr_2026_0007_skladchik_reauth.py","tests/test_cr_2026_0007_skladchik_semantic_repair.py","tests/test_cr_2026_0008_skladchik_snapshot_integrity.py","tests/test_cr_2026_0009_skladchik_concurrency_guard.py","tests/test_cr_2026_0011_skladchik_cookie_jar_reset.py","tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py","tests/test_cr_2026_0013_vm160_worker_bootstrap_transition.py","tests/test_cr_2026_0015_pve03_r8152_rx_ring_canary.py","tests/test_cr_2026_0018_execution_boundary_preparation.py","tests/test_inventory_foundation.py","tests/test_live_verification.py","tests/test_no_repeat_policy.py","tests/test_reg_014_015.py","tests/test_repository.py"],"present":true}},"scanned_commits":[{"candidate_files":19,"commit":"fe1221b06643db3b00a621b0230f92a46a4edc2b","read_files":19,"refs":["refs/heads/main"],"tree_files":125},{"candidate_files":10,"commit":"16e84298035f5e4ec7e2b7d39967ad5e40ea3d4b","read_files":10,"refs":["refs/heads/cr-2026-0006-cluster-cloud-quorum"],"tree_files":66},{"candidate_files":32,"commit":"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17","read_files":32,"refs":["refs/heads/cr-2026-0017-inventory-foundation"],"tree_files":160},{"candidate_files":13,"commit":"1f7abe5acf856ad2a2abe10ef2a9452485edb073","read_files":13,"refs":["refs/heads/cr-2026-0008-skladchik-snapshot-integrity"],"tree_files":94},{"candidate_files":17,"commit":"25b275f96b54551e26f07516c72651d85f235ad0","read_files":17,"refs":["refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition"],"tree_files":110},{"candidate_files":18,"commit":"60f53ea6fe6724196802a46de3de19c7889a51cc","read_files":18,"refs":["refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary"],"tree_files":127},{"candidate_files":2270,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","read_files":2267,"refs":["refs/heads/site-gram1-ru-baseline-canonical-20260731"],"tree_files":4438},{"candidate_files":14,"commit":"7bd1b050f8d64c7b55dfd51ead63f0adda87f2df","read_files":14,"refs":["refs/heads/cr-2026-0009-skladchik-concurrency-guard"],"tree_files":99},{"candidate_files":7,"commit":"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc","read_files":7,"refs":["refs/heads/cr-2026-0005-codex-bootstrap-activation"],"tree_files":47},{"candidate_files":15,"commit":"bb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9","read_files":15,"refs":["refs/heads/cr-2026-0011-skladchik-cookie-jar-reset"],"tree_files":102},{"candidate_files":12,"commit":"d399d24440f948b518761ecfd516521993861b43","read_files":12,"refs":["refs/heads/cr-2026-0007-skladchik-controlled-reauth"],"tree_files":91},{"candidate_files":16,"commit":"f5b22d867ea467987008408e3fb1fb0e17fa7b2e","read_files":16,"refs":["refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook"],"tree_files":107},{"candidate_files":2270,"commit":"f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49","read_files":2267,"refs":["refs/heads/site-gram1-ru-baseline-20260731"],"tree_files":4434}],"scanned_unique_heads":13},"validation":{"unittest":{"duration_seconds":0.121,"rc":1,"stderr":"test_apply_exact_scope (test_cr_2026_0005.CR20260005Tests.test_apply_exact_scope) ... ok\ntest_declared_phase_outputs (test_cr_2026_0005.CR20260005Tests.test_declared_phase_outputs) ... ok\ntest_journal_pipeline_safety (test_cr_2026_0005.CR20260005Tests.test_journal_pipeline_safety) ... ok\ntest_no_pmxcfs_or_remote_mutation (test_cr_2026_0005.CR20260005Tests.test_no_pmxcfs_or_remote_mutation) ... ok\ntest_phase_guardrails (test_cr_2026_0005.CR20260005Tests.test_phase_guardrails) ... ok\ntest_policy_markers (test_cr_2026_0005.CR20260005Tests.test_policy_markers) ... ok\ntest_regression_cases (test_cr_2026_0005.CR20260005Tests.test_regression_cases) ... ok\ntest_standard_seal (test_cr_2026_0005.CR20260005Tests.test_standard_seal) ... ok\ntest_systemctl_failed_first_field (test_cr_2026_0005.CR20260005Tests.test_systemctl_failed_first_field) ... ok\ntest_task_semantic_coherence (test_cr_2026_0005.CR20260005Tests.test_task_semantic_coherence) ... ok\ntest_change_is_local_only (test_cr_2026_0006.CR20260006Tests.test_change_is_local_only) ... ok\ntest_command_delivery_locks (test_cr_2026_0006.CR20260006Tests.test_command_delivery_locks) ... ok\ntest_distinct_accounts (test_cr_2026_0006.CR20260006Tests.test_distinct_accounts) ... ok\ntest_local_delete_fail_closed (test_cr_2026_0006.CR20260006Tests.test_local_delete_fail_closed) ... ok\ntest_policy_contract (test_cr_2026_0006.CR20260006Tests.test_policy_contract) ... ok\ntest_regression_cases (test_cr_2026_0006.CR20260006Tests.test_regression_cases) ... ok\ntest_restore_contract (test_cr_2026_0006.CR20260006Tests.test_restore_contract) ... ok\ntest_contract (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_contract) ... ok\ntest_distinct_accounts_and_exact_mapping (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_distinct_accounts_and_exact_mapping) ... ok\ntest_exact_path_and_symlink_guards (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_exact_path_and_symlink_guards) ... ok\ntest_health_root_cause_evidence (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_health_root_cause_evidence) ... ok\ntest_no_forbidden_delivery_or_hostkey_patterns (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_no_forbidden_delivery_or_hostkey_patterns) ... ok\ntest_no_inline_remote_shell_program (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_no_inline_remote_shell_program) ... ok\ntest_per_part_and_full_roundtrip_single_remote_pass (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_per_part_and_full_roundtrip_single_remote_pass) ... ok\ntest_preflight_checks_all_execution_nodes_with_versioned_scripts (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_preflight_checks_all_execution_nodes_with_versioned_scripts) ... ok\ntest_prepare_verifies_prepared_not_sealed (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_prepare_verifies_prepared_not_sealed) ... ok\ntest_rollback_restores_remote_generation_health_and_symlink (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_rollback_restores_remote_generation_health_and_symlink) ... ok\ntest_shell_syntax (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_shell_syntax) ... ok\ntest_two_stage_seal_has_truthful_delete_order (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_two_stage_seal_has_truthful_delete_order) ... ok\ntest_verify_queries_pve03_not_pve01_staging (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_verify_queries_pve03_not_pve01_staging) ... ok\ntest_contract (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_contract) ... ok\ntest_edge_script_sha_is_exact_sha256 (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_edge_script_sha_is_exact_sha256) ... ok\ntest_inline_python_policy_matches_linter_scope (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_inline_python_policy_matches_linter_scope) ... ok\ntest_no_inline_remote_shell (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_no_inline_remote_shell) ... ok\ntest_regression_lock (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_regression_lock) ... ok\ntest_rollback_before_apply (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_rollback_before_apply) ... ok\ntest_shell_syntax (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_shell_syntax) ... ok\ntest_strict_hostkey_and_no_secret_material (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_strict_hostkey_and_no_secret_material) ... ok\ntest_verify_requires_real_counts (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_verify_requires_real_counts) ... ok\ntest_all_active_callers_are_versioned_and_strict (test_cr_2026_0007_skladchik_semantic_repair.SkladchikSemanticRepairTests.test_all_active_callers_are_versioned_and_strict) ... ok\ntest_apply_installs_live_and_desired_assets (test_cr_2026_0007_skladchik_semantic_repair.SkladchikSemanticRepairTests.test_apply_installs_live_and_desired_assets) ... ok\nte","stderr_sha256":"301889d5996ed9723faa0f3f808c32efd9bb4247ffc81d261743a16876e5ea73","stderr_truncated":false,"stdout":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"validate_repo":{"duration_seconds":0.031,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"8d9b6d16bd0883193db77e5e0d348f4f97fa99cfc3e1107e09f47a0af945d7ec","stdout_truncated":false}}},"gitea_changed":false,"handbook_assessment":{"canonical_ambiguous":true,"canonical_commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","canonical_found":true,"canonical_path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","canonical_score":105,"canonical_sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","coverage_missing":[],"coverage_present":["access_and_admin","backup_and_restore","change_safety","error_learning","external_services","guests_and_workloads","identity_and_topology","internal_services","monitoring_and_logs","network_and_dns","repair_and_troubleshooting","storage"],"live_inventory_evidence":{"backup_job_count":0,"guest_count":0,"node_count":0,"running_service_units_total":47,"storage_rows":0},"requires_update":true},"live_cluster":{"backup_jobs":[],"cluster_status":null,"commands":{"hostname":{"rc":0,"value":"pve01.gram1.ru"},"pvecm_status":{"excerpt":"","rc":255,"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n"},"pveversion":{"excerpt":"proxmox-ve: 9.2.0 (running kernel: 7.0.12-1-pve)\npve-manager: 9.2.3 (running version: 9.2.3/d0fde103346cf89a)\nproxmox-kernel-helper: 9.2.0\nproxmox-kernel-7.0: 7.0.12-1\nproxmox-kernel-7.0.12-1-pve-signed: 7.0.12-1\nproxmox-kernel-7.0.6-2-pve-signed: 7.0.6-2\nproxmox-kernel-7.0.2-6-pve-signed: 7.0.2-6\nceph-fuse: 19.2.3-pve4\ncorosync: 3.1.10-pve2\ncriu: 4.1.1-1\nfrr-pythontools: 10.6.1-1+pve2\nifupdown2: 3.3.0-1+pmx12\nintel-microcode: 3.20251111.1~deb13u1\nksm-control-daemon: 1.5-1\nlibjs-extjs: 7.0.0-5\nlibproxmox-acme-perl: 1.7.1\nlibproxmox-backup-qemu0: 2.0.2\nlibproxmox-rs-perl: 0.4.1\nlibpve-access-control: 9.1.1\nlibpve-apiclient-perl: 3.4.2\nlibpve-cluster-api-perl: 9.1.6\nlibpve-cluster-perl: 9.1.6\nlibpve-common-perl: 9.1.16\nlibpve-guest-common-perl: 6.0.4\nlibpve-http-server-perl: 6.0.5\nlibpve-network-perl: 1.6.6\nlibpve-notify-perl: 9.1.6\nlibpve-rs-perl: 0.15.3\nlibpve-storage-perl: 9.1.6\nlibspice-server1: 0.15.2-1+b1\nlvm2: 2.03.31-2+pmx1\nlxc-pve: 7.0.0-2\nlxcfs: 7.0.0-pve1\nnovnc-pve: 1.7.0-1\nproxmox-backup-client: 4.2.2-1\nproxmox-backup-file-restore: 4.2.2-1\nproxmox-backup-restore-image: 1.0.0\nproxmox-firewall: 1.2.3\nproxmox-kernel-helper: 9.2.0\nproxmox-mail-forward: 1.0.3\nproxmox-mini-journalreader: 1.6\nproxmox-offline-mirror-helper: 0.7.4\nproxmox-widget-toolkit: 5.2.5\npve-cluster: 9.1.6\npve-container: 6.1.10\npve-docs: 9.2.2\npve-edk2-firmware: 4.2025.05-2\npve-esxi-import-tools: 1.0.1\npve-firewall: 6.0.4\npve-firmware: 3.18-4\npve-ha-manager: 5.2.4\npve-i18n: 3.8.0\npve-qemu-kvm: 11.0.0-4\npve-xtermjs: 6.0.0-1\nqemu-server: 9.1.17\nsmartmontools: 7.5-pve2\nspiceterm: 3.4.2\nswtpm: 0.8.0+pve3\nvncterm: 1.9.2\nzfsutils-linux: 2.4.2-pve1\n","rc":0,"sha256":"19ba1ac5d9e5ee6299326b5ad7d5b334a03b23b84a97f3cbdf0f1cf7748d1c0a"}},"endpoint_meta":{"backup_jobs":{"duration_seconds":0.46,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"cluster_status":{"duration_seconds":0.462,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"ha_current":{"duration_seconds":0.471,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"ha_groups":{"duration_seconds":0.466,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"ha_resources":{"duration_seconds":0.461,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"nodes":{"duration_seconds":0.459,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"replication":{"duration_seconds":0.467,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"resources_storage":{"duration_seconds":0.461,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"resources_vm":{"duration_seconds":0.478,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"storage_config":{"duration_seconds":0.46,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false}},"guests":[],"ha_current":null,"ha_groups":null,"ha_resources":null,"nodes":[],"replication":null,"running_service_units":[{"description":"chrony, an NTP client/server","unit":"chrony.service"},{"description":"Corosync Cluster Engine","unit":"corosync.service"},{"description":"Regular background program processing daemon","unit":"cron.service"},{"description":"D-Bus System Message Bus","unit":"dbus.service"},{"description":"Device-mapper event daemon","unit":"dm-event.service"},{"description":"Getty on tty1","unit":"getty@tty1.service"},{"description":"Homelab command adapter","unit":"homelab-command-adapter.service"},{"description":"Homelab command portal","unit":"homelab-command-portal.service"},{"description":"Homelab health HTTP endpoint 9101","unit":"homelab-health-http-9101.service"},{"description":"Homelab health HTTP endpoint","unit":"homelab-health-http.service"},{"description":"Homelab immutable capability reader v3","unit":"homelab-reader-v3.service"},{"description":"Homelab automatic fixed result anchor","unit":"homelab-result-lookup.service"},{"description":"Homelab Scrutiny SMART dashboard","unit":"homelab-scrutiny.service"},{"description":"Kernel Samepage Merging (KSM) Tuning Daemon","unit":"ksmtuned.service"},{"description":"LXC Container Monitoring Daemon","unit":"lxc-monitord.service"},{"description":"FUSE filesystem for LXC","unit":"lxcfs.service"},{"description":"NetBird mesh network client","unit":"netbird.service"},{"description":"pNFS block layout mapping daemon","unit":"nfs-blkmap.service"},{"description":"Network UPS Tools - device driver for NUT device 'cyberpower'","unit":"nut-driver@cyberpower.service"},{"description":"Network UPS Tools - power device monitor and shutdown controller","unit":"nut-monitor.service"},{"description":"Network UPS Tools - power devices information server","unit":"nut-server.service"},{"description":"Postfix Mail Transport Agent (main/default instance)","unit":"postfix.service"},{"description":"Prometheus exporter for machine metrics","unit":"prometheus-node-exporter.service"},{"description":"Proxmox nftables firewall","unit":"proxmox-firewall.service"},{"description":"The Proxmox VE cluster filesystem","unit":"pve-cluster.service"},{"description":"PVE LXC Container: 110","unit":"pve-container@110.service"},{"description":"PVE LXC Container: 112","unit":"pve-container@112.service"},{"description":"Proxmox VE firewall","unit":"pve-firewall.service"},{"description":"PVE Cluster HA Resource Manager Daemon","unit":"pve-ha-crm.service"},{"description":"PVE Local HA Resource Manager Daemon","unit":"pve-ha-lrm.service"},{"description":"Proxmox VE LXC Syscall Daemon","unit":"pve-lxc-syscalld.service"},{"description":"PVE API Daemon","unit":"pvedaemon.service"},{"description":"Proxmox VE firewall logger","unit":"pvefw-logger.service"},{"description":"PVE API Proxy Server","unit":"pveproxy.service"},{"description":"Proxmox VE scheduler","unit":"pvescheduler.service"},{"description":"PVE Status Daemon","unit":"pvestatd.service"},{"description":"PVE Qemu Event Daemon","unit":"qmeventd.service"},{"description":"RPC bind portmap service","unit":"rpcbind.service"},{"description":"Data caching daemon for rrdtool","unit":"rrdcached.service"},{"description":"Self Monitoring and Reporting Technology (SMART) Daemon","unit":"smartmontools.service"},{"description":"PVE SPICE Proxy Server","unit":"spiceproxy.service"},{"description":"OpenBSD Secure Shell server","unit":"ssh.service"},{"description":"Journal Service","unit":"systemd-journald.service"},{"description":"User Login Management","unit":"systemd-logind.service"},{"description":"Rule-based Manager for Device Events and Files","unit":"systemd-udevd.service"},{"description":"Proxmox VE watchdog multiplexer","unit":"watchdog-mux.service"},{"description":"ZFS Event Daemon (zed)","unit":"zfs-zed.service"}],"running_service_units_total":47,"storage_config":[],"storages":[]},"mutation_outcome":"NO_MUTATION","next_action":"RESOLVE_ONLY_PROVEN_BLOCKING_FINDINGS_BEFORE_MUTATION","output_truncated_in_json":false,"prior_exact_failure":{"capsule_sha256":"e1b501473c532362e379e21e3ffb86a8c86c0c5b993c51ed32ed98ddc1eda157","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-20260805T062500Z","correction":"candidate scan now uses the already-enforced complete tree limit instead of the disproven 600-file sublimit","error":"repository complete scan limits were hit: candidate_file_limit:76da439c1f69f405b434e20b2a3da1c11dc92e38:2270; candidate_file_limit:f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49:2270","error_type":"RuntimeError","rc":1,"rollback_restored":null,"rollback_started":false,"runner_json_sha256":"0ec0065f247a5731fb21cf43eb73e871779f40941e235a3108513b4cb5d860fe","status":"FAIL"},"production_changed":false,"rc":0,"read_only":true,"result_json_sha256_before_hash_field":"bd5de9eb6188e90f9ac67327bf77ef5b78699292a46c3308333ed7c6fdf730ae","result_projection":{"bounded":true,"bytes_before_hash":294474,"compaction_applied":true},"rollback_restored":null,"rollback_started":false,"schema":1,"status":"OK"}

OUTPUT_END
CHAT_OUTPUT_END
