{
  "schema_version": 1,
  "channel": "homelab-runtime",
  "command_id": "RUNTIME-RECEIVER-FULL-023",
  "status": "OK",
  "rc": 0,
  "host": "pve01",
  "mode": "read-only",
  "component": "gitea-runtime",
  "started_at_utc": "2026-07-21T09:40:01Z",
  "finished_at_utc": "2026-07-21T09:40:01Z",
  "reference_register_checked": true,
  "reference_sha256": "f6f7749fda946015116cdbbd754c7e7f20356b4a6cf4df330a1b0b8fdf59cbb2",
  "error_register_checked": true,
  "error_register_sha256": "ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc",
  "command_sha256": "d17752c0235202b5d9f1822d70680ea57dd4578bde6bbc906c7569c0d0463bb0",
  "duplicate_failed_command_blocked": false,
  "block_reason": null,
  "execution_started": true,
  "changes_made": false,
  "sanitized": true,
  "secrets_included": false,
  "private_addresses_included": false,
  "raw_evidence_retained_locally": true,
  "raw_evidence_sha256": "2c183b9ced4334e5ff12c1ba35dceb1f7f6ef113298d44bf3fb80ca07305b8b3",
  "sanitized_output_sha256": "cd4ccc98c3b9dff7bd1f5557b41fb60d073f889a31f3fd7d86900eecbe15dff4",
  "output_truncated_in_json": false,
  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
  "output": "#!/usr/bin/env bash\nset -Eeuo pipefail\numask 027\n\nHOST_DATA='/opt/stacks/gitea/data'\nBARE_CONTAINER='/data/git/repositories/homelab-admin/homelab-public-context.git'\n\nPUBLIC_DIR=\"${HOST_DATA}/gitea/public/.well-known/homelab-runtime\"\nSTAGE_DIR=\"${HOST_DATA}/gitea/runtime-stage\"\nWORK_ROOT=\"${HOST_DATA}/gitea/runtime-work\"\n\nLOCK='/run/lock/homelab-runtime-receive.lock'\n\n[ \"$#\" -eq 3 ] || {\n    echo 'RESULT=FAIL'\n    echo 'REASON=USAGE'\n    exit 64\n}\n\nCOMMAND_ID=\"$1\"\nJSON_FILE=\"$2\"\nTXT_FILE=\"$3\"\n\ncase \"$COMMAND_ID\" in\n    ''|*[!A-Za-z0-9._-]*)\n        echo 'RESULT=FAIL'\n        echo 'REASON=INVALID_COMMAND_ID'\n        exit 65\n        ;;\nesac\n\n[ -f \"$JSON_FILE\" ] || {\n    echo 'RESULT=FAIL'\n    echo 'REASON=JSON_FILE_MISSING'\n    exit 66\n}\n\n[ -f \"$TXT_FILE\" ] || {\n    echo 'RESULT=FAIL'\n    echo 'REASON=TXT_FILE_MISSING'\n    exit 67\n}\n\nexec 9>\"$LOCK\"\nflock -w 60 9 || {\n    echo 'RESULT=FAIL'\n    echo 'REASON=RECEIVER_LOCK_TIMEOUT'\n    exit 68\n}\n\npython3 - \"$JSON_FILE\" \"$TXT_FILE\" \"$COMMAND_ID\" <<'PY'\nimport json\nimport re\nimport sys\nfrom pathlib import Path\n\njson_path = Path(sys.argv[1])\ntext_path = Path(sys.argv[2])\nexpected_id = sys.argv[3]\n\nif json_path.stat().st_size > 524_288:\n    raise SystemExit(\"JSON_TOO_LARGE\")\n\nif text_path.stat().st_size > 1_048_576:\n    raise SystemExit(\"TEXT_TOO_LARGE\")\n\njson_text = json_path.read_text(encoding=\"utf-8\")\ntext = text_path.read_text(encoding=\"utf-8\")\n\ndata = json.loads(json_text)\n\nif data.get(\"command_id\") != expected_id:\n    raise SystemExit(\"COMMAND_ID_MISMATCH\")\n\nif data.get(\"sanitized\") is not True:\n    raise SystemExit(\"SANITIZED_FLAG_REQUIRED\")\n\nif data.get(\"secrets_included\") is not False:\n    raise SystemExit(\"SECRETS_FLAG_INVALID\")\n\nif data.get(\"private_addresses_included\") is not False:\n    raise SystemExit(\"PRIVATE_ADDRESS_FLAG_INVALID\")\n\ncombined = json_text + \"\\n\" + text\n\npatterns = [\n    r\"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----\",\n    r\"(?i)(password|passwd|passphrase|authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key)\\s*[:=]\\s*\\S+\",\n    r\"(?i)/root/\\.ssh\",\n    r\"(?i)[SENSITIVE_PATH]\",\n    r\"(?i)rclone\\.conf\",\n    r\"\\b10(?:\\.\\d{1,3}){3}\\b\",\n    r\"\\b192\\.168(?:\\.\\d{1,3}){2}\\b\",\n    r\"\\b172\\.(?:1[6-9]|2\\d|3[01])(?:\\.\\d{1,3}){2}\\b\",\n]\n\nfor pattern in patterns:\n    if re.search(pattern, combined):\n        raise SystemExit(\"FORBIDDEN_PUBLIC_CONTENT\")\n\nprint(\"PAYLOAD_VALIDATION=OK\")\nPY\n\nGIT_UID=\"$(docker exec gitea id -u git)\"\nGIT_GID=\"$(docker exec gitea id -g git)\"\n\nmkdir -p \\\n    \"$PUBLIC_DIR\" \\\n    \"$STAGE_DIR\" \\\n    \"$WORK_ROOT\"\n\nchown \"$GIT_UID:$GIT_GID\" \\\n    \"$STAGE_DIR\" \\\n    \"$WORK_ROOT\"\n\ninstall \\\n    -o \"$GIT_UID\" \\\n    -g \"$GIT_GID\" \\\n    -m 0644 \\\n    \"$JSON_FILE\" \\\n    \"$STAGE_DIR/latest.json\"\n\ninstall \\\n    -o \"$GIT_UID\" \\\n    -g \"$GIT_GID\" \\\n    -m 0644 \\\n    \"$TXT_FILE\" \\\n    \"$STAGE_DIR/latest.txt\"\n\ncat > \"$STAGE_DIR/README.md\" <<'DOC'\n# Homelab assistant runtime\n\nSanitized command results for read-only assistant inspection.\n\nCredentials, authentication data, private keys, private IP addresses and\nunfiltered configuration files are prohibited.\nDOC\n\nchown \"$GIT_UID:$GIT_GID\" \"$STAGE_DIR/README.md\"\nchmod 0644 \"$STAGE_DIR/README.md\"\n\nPUBLISHED_AT=\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"\nWORK_CONTAINER=\"/data/gitea/runtime-work/${COMMAND_ID}.$$\"\n\nCOMMIT_SHA=\"$(\n    docker exec \\\n        -u \"${GIT_UID}:${GIT_GID}\" \\\n        -e COMMAND_ID=\"$COMMAND_ID\" \\\n        -e PUBLISHED_AT=\"$PUBLISHED_AT\" \\\n        -e WORK_CONTAINER=\"$WORK_CONTAINER\" \\\n        gitea sh -lc '\nset -eu\n\nBARE=\"/data/git/repositories/homelab-admin/homelab-public-context.git\"\nSTAGE=\"/data/gitea/runtime-stage\"\nWORK=\"$WORK_CONTAINER\"\n\nrm -rf \"$WORK\"\n\ngit clone --quiet \"$BARE\" \"$WORK\"\n\ncd \"$WORK\"\n\ngit config user.name \"homelab-runtime-publisher\"\ngit config user.email \"homelab-runtime@localhost\"\n\nif git show-ref \\\n    --verify \\\n    --quiet \\\n    refs/remotes/origin/assistant-runtime\nthen\n    git checkout \\\n        --quiet \\\n        -B assistant-runtime \\\n        origin/assistant-runtime\nelse\n    git checkout \\\n        --quiet \\\n        --orphan assistant-runtime\n\n    git rm -rf . >/dev/null 2>&1 || true\nfi\n\nmkdir -p runtime/history\n\ncp \"$STAGE/latest.json\" runtime/latest.json\ncp \"$STAGE/latest.txt\" runtime/latest.txt\ncp \"$STAGE/latest.json\" \"runtime/history/${COMMAND_ID}.json\"\ncp \"$STAGE/latest.txt\" \"runtime/history/${COMMAND_ID}.txt\"\ncp \"$STAGE/README.md\" README.md\n\ngit add \\\n    README.md \\\n    runtime/latest.json \\\n    runtime/latest.txt \\\n    \"runtime/history/${COMMAND_ID}.json\"\n\ngit add \"runtime/history/${COMMAND_ID}.txt\"\n\nif ! git diff --cached --quiet\nthen\n    GIT_AUTHOR_DATE=\"$PUBLISHED_AT\" \\\n    GIT_COMMITTER_DATE=\"$PUBLISHED_AT\" \\\n        git commit \\\n            --quiet \\\n            -m \"runtime: publish ${COMMAND_ID}\"\nfi\n\nCOMMIT=\"$(git rev-parse HEAD)\"\n\ngit --git-dir=\"$BARE\" \\\n    fetch \\\n    --quiet \\\n    \"$WORK\" \\\n    refs/heads/assistant-runtime\n\nOLD=\"$(\n    git --git-dir=\"$BARE\" \\\n        rev-parse refs/heads/assistant-runtime \\\n        2>/dev/null ||\n    true\n)\"\n\nif [ -n \"$OLD\" ]\nthen\n    git --git-dir=\"$BARE\" \\\n        update-ref \\\n        refs/heads/assistant-runtime \\\n        \"$COMMIT\" \\\n        \"$OLD\"\nelse\n    git --git-dir=\"$BARE\" \\\n        update-ref \\\n        refs/heads/assistant-runtime \\\n        \"$COMMIT\"\nfi\n\nrm -rf \"$WORK\"\n\nprintf \"%s\\n\" \"$COMMIT\"\n'\n)\"\n\nJSON_TMP=\"$(mktemp \"${PUBLIC_DIR}/.latest.json.XXXXXX\")\"\nTXT_TMP=\"$(mktemp \"${PUBLIC_DIR}/.latest.txt.XXXXXX\")\"\nINDEX_TMP=\"$(mktemp \"${PUBLIC_DIR}/.index.json.XXXXXX\")\"\n\ninstall -m 0644 \"$JSON_FILE\" \"$JSON_TMP\"\ninstall -m 0644 \"$TXT_FILE\" \"$TXT_TMP\"\n\npython3 - \\\n    \"$COMMAND_ID\" \\\n    \"$PUBLISHED_AT\" \\\n    \"$COMMIT_SHA\" >\"$INDEX_TMP\" <<'PY'\nimport json\nimport sys\n\ncommand_id, published_at, commit_sha = sys.argv[1:4]\n\nprint(json.dumps({\n    \"schema_version\": 1,\n    \"channel\": \"homelab-runtime\",\n    \"branch\": \"assistant-runtime\",\n    \"latest_command_id\": command_id,\n    \"published_at_utc\": published_at,\n    \"commit_sha\": commit_sha,\n    \"latest_json_url\": (\n        \"https://git.gram1.ru/.well-known/\"\n        \"homelab-runtime/latest.json\"\n    ),\n    \"latest_text_url\": (\n        \"https://git.gram1.ru/.well-known/\"\n        \"homelab-runtime/latest.txt\"\n    )\n}, ensure_ascii=False, indent=2))\nPY\n\nchmod 0644 \"$INDEX_TMP\"\n\nmv -f \"$JSON_TMP\" \"$PUBLIC_DIR/latest.json\"\nmv -f \"$TXT_TMP\" \"$PUBLIC_DIR/latest.txt\"\nmv -f \"$INDEX_TMP\" \"$PUBLIC_DIR/index.json\"\n\ncurl -fsS \\\n    --max-time 10 \\\n    http://127.0.0.1:3002/.well-known/homelab-runtime/latest.json |\ngrep -F \"$COMMAND_ID\" >/dev/null\n\ncurl -fsS \\\n    --max-time 10 \\\n    \"http://127.0.0.1:3002/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/latest.json\" |\ngrep -F \"$COMMAND_ID\" >/dev/null\n\necho 'RESULT=OK'\necho \"COMMAND_ID=$COMMAND_ID\"\necho \"COMMIT_SHA=$COMMIT_SHA\"\necho 'STATIC_PUBLICATION=OK'\necho 'RAW_BRANCH_PUBLICATION=OK'\n"
}
