{
  "schema_version": 1,
  "channel": "homelab-runtime",
  "command_id": "GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z",
  "status": "OK",
  "rc": 0,
  "host": "pve01",
  "mode": "verify",
  "component": "gitea-machine-identity",
  "started_at_utc": "2026-07-30T19:44:36Z",
  "finished_at_utc": "2026-07-30T19:44:36Z",
  "reference_register_checked": true,
  "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
  "error_register_checked": true,
  "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83",
  "command_sha256": "a571191a9f200a5086dfa94a7a08706bc0babddd80e4220a0d7f85b936f88d7c",
  "duplicate_failed_command_blocked": false,
  "block_reason": null,
  "execution_started": true,
  "change_declared": false,
  "result_contract_valid": true,
  "result_contract_status": null,
  "result_contract_error": null,
  "command_rc": 0,
  "changes_made": false,
  "rollback_started": false,
  "rollback_restored": null,
  "mutation_outcome": "NO_MUTATION",
  "sanitized": true,
  "secrets_included": false,
  "private_addresses_included": false,
  "raw_evidence_retained_locally": true,
  "raw_evidence_sha256": "d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677",
  "sanitized_output_sha256": "d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677",
  "output_truncated_in_json": false,
  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
  "output": "{\"capability_branch\":[],\"changes_made\":false,\"command_id\":\"GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z\",\"dry_run\":{\"bytes\":2784,\"interesting_context\":[\"0004: on_err(){\",\"0005:   local rc=$?\",\"0006:   trap - ERR\",\"0007:   printf 'ROOT_CAUSE=UNEXPECTED_PHASE_ERROR\",\"0008: '\",\"0009:   printf 'ROOT_CAUSE_COUNT=1\",\"0010: '\",\"0011:   printf 'DETAIL=line:%s rc:%s\",\"0012: ' \\\"${1:-0}\\\" \\\"$rc\\\"\",\"0013:   exit \\\"$rc\\\"\",\"0014: }\",\"0015: trap 'on_err \\\"$LINENO\\\"' ERR\",\"0016: \",\"0017: TASK_ID=\\\"gitea-machine-identity-controlled-migration-v4\\\"\",\"0018: STAGING=\\\"/var/lib/homelab-admin/staging/$TASK_ID\\\"\",\"0019: PINNED=\\\"$STAGING/known_hosts.vm170\\\"\",\"0020: REMOTE=\\\"https://git.gram1.ru/homelab-admin/homelab-ops.git\\\"\",\"0021: CREDENTIAL_FILE=\\\"/etc/homelab-admin/credentials/gitea-homelab-ops\\\"\",\"0022: HELPER_FILE=\\\"/usr/local/libexec/homelab-git-credential\\\"\",\"0023: \",\"0024: OUT=\\\"$HOMELAB_RUN_DIR/vm170-capability.txt\\\"\",\"....\",\"0034: host=git.gram1.ru\",\"0035: path=unrelated/repo.git\",\"0036: \",\"0037: ' | \\\"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\\\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO\",\"0038: ROOT_CAUSE_COUNT=1\",\"0039: '; exit 1; } || true\",\"0040: \",\"0041: \",\"0042: set +e\",\"0043: timeout --signal=TERM --kill-after=2s 24s ssh \\\\\",\"0044:   -o BatchMode=yes \\\\\",\"0045:   -o ConnectTimeout=6 \\\\\",\"0046:   -o IdentitiesOnly=yes \\\\\",\"0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\\\\",\"0048:   -o StrictHostKeyChecking=yes \\\\\",\"0049:   -o UserKnownHostsFile=\\\"$PINNED\\\" \\\\\",\"0050:   root@[PRIVATE_IP] \\\\\",\"0051:   'bash -s --' capability \\\"$TASK_ID\\\" \\\"$plan_b64\\\" \\\\\",\"0052:   <\\\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\\\" \\\\\",\"0053:   >\\\"$OUT\\\" 2>&1\",\"0054: ssh_rc=$?\",\"0055: set -e\",\"0056: case \\\"$ssh_rc\\\" in\",\"0057:   0) ;;\",\"0058:   124|137|143)\",\"0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT\",\"0060: ROOT_CAUSE_COUNT=1\",\"0061: DETAIL=24s\",\"0062: '\",\"0063:     exit 1\",\"0064:     ;;\",\"0065:   *)\",\"0066:     sed -n '/^[A-Z][A-Z0-9_]*=/p' \\\"$OUT\\\"\",\"0067:     printf 'ROOT_CAUSE=VM170_CAPABILITY_FAILED\",\"0068: ROOT_CAUSE_COUNT=1\",\"0069: DETAIL=rc:%s\",\"0070: ' \\\"$ssh_rc\\\"\",\"0071:     exit \\\"$ssh_rc\\\"\",\"0072:     ;;\",\"0073: esac\",\"0074: \",\"....\",\"0076: grep -Fq 'GITEA_CLI_CALLS=1' \\\"$OUT\\\"\",\"0077: grep -Fq 'PASSWORD_FLAGS_FOR_BOT=ABSENT_BY_PLAN' \\\"$OUT\\\"\",\"0078: \",\"0079: jq -n --arg task_id \\\"$TASK_ID\\\" '{status:\\\"OK\\\",root_cause_count:0,task_id:$task_id,production_changed:false,bot_capability:true,single_call_material_capability:true,password_flags_for_bot:false,helper_scope_contract:true,gitea_cli_calls:1,package_tests:true}' >\\\"$HOMELAB_RUN_DIR/dry-run.json\\\"\",\"0080: printf 'DRY_RUN_STATUS=OK\",\"0081: '\",\"0082: printf 'ROOT_CAUSE_COUNT=0\",\"0083: '\",\"0084: printf 'GITEA_BOT_USER_CAPABILITY=YES\",\"0085: '\"],\"lines\":97,\"path\":\"/root/gitea-machine-identity-controlled-migration-v4/phases/dry-run.sh\",\"sha256\":\"c5edfe7553ffb7f44a80dd530b805fb732ee0e09097f5b3a6ca77d1f9bc27329\",\"timeout_records\":[{\"durations\":[\"2s\",\"24s\"],\"line\":43,\"text\":\"timeout --signal=TERM --kill-after=2s 24s ssh \\\\\"},{\"durations\":[],\"line\":45,\"text\":\"  -o ConnectTimeout=6 \\\\\"}]},\"dry_run_lines_34_65\":[\"0034: host=git.gram1.ru\",\"0035: path=unrelated/repo.git\",\"0036: \",\"0037: ' | \\\"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\\\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO\",\"0038: ROOT_CAUSE_COUNT=1\",\"0039: '; exit 1; } || true\",\"0040: \",\"0041: \",\"0042: set +e\",\"0043: timeout --signal=TERM --kill-after=2s 24s ssh \\\\\",\"0044:   -o BatchMode=yes \\\\\",\"0045:   -o ConnectTimeout=6 \\\\\",\"0046:   -o IdentitiesOnly=yes \\\\\",\"0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\\\\",\"0048:   -o StrictHostKeyChecking=yes \\\\\",\"0049:   -o UserKnownHostsFile=\\\"$PINNED\\\" \\\\\",\"0050:   root@[PRIVATE_IP] \\\\\",\"0051:   'bash -s --' capability \\\"$TASK_ID\\\" \\\"$plan_b64\\\" \\\\\",\"0052:   <\\\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\\\" \\\\\",\"0053:   >\\\"$OUT\\\" 2>&1\",\"0054: ssh_rc=$?\",\"0055: set -e\",\"0056: case \\\"$ssh_rc\\\" in\",\"0057:   0) ;;\",\"0058:   124|137|143)\",\"0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT\",\"0060: ROOT_CAUSE_COUNT=1\",\"0061: DETAIL=24s\",\"0062: '\",\"0063:     exit 1\",\"0064:     ;;\",\"0065:   *)\"],\"mutation_outcome\":\"NO_MUTATION\",\"next_stage\":\"PATCH_EXACT_INTERNAL_TIMEOUT_AND_RUN_MIGRATION\",\"output_truncated_in_json\":false,\"private_addresses_included\":false,\"rc\":0,\"remote_asset\":{\"bytes\":7616,\"interesting_context\":[\"0002: set -Eeuo pipefail\",\"0003: \",\"0004: fail(){\",\"0005:   printf 'ROOT_CAUSE=%s\",\"0006: ROOT_CAUSE_COUNT=1\",\"0007: DETAIL=%s\",\"0008: ' \\\"$1\\\" \\\"$2\\\"\",\"0009:   exit 1\",\"0010: }\",\"....\",\"0014: task_id=\\\"$2\\\"\",\"0015: plan_b64=\\\"${3:-}\\\"\",\"0016: \",\"0017: [[ \\\"$task_id\\\" == \\\"gitea-machine-identity-controlled-migration-v4\\\" ]] || fail TASK_ID_MISMATCH \\\"$task_id\\\"\",\"0018: case \\\"$mode\\\" in\",\"0019:   capability|apply|verify-state|rollback|cleanup-owned|seal) ;;\",\"0020:   *) fail INVALID_MODE \\\"$mode\\\" ;;\",\"....\",\"0036:   shift\",\"0037:   local captured rc\",\"0038:   set +e\",\"0039:   captured=\\\"$(timeout --signal=TERM --kill-after=1s 3s docker \\\"$@\\\" 2>&1)\\\"\",\"0040:   rc=$?\",\"0041:   set -e\",\"0042:   case \\\"$rc\\\" in\",\"....\",\"0048: }\",\"0049: \",\"0050: find_container(){\",\"0051:   container_id=\\\"$(docker_capture container-discovery ps --filter 'ancestor=docker.gitea.com/gitea:1.26.2' --format '{{.ID}}')\\\"\",\"0052:   [[ \\\"$(printf '%s\",\"0053: ' \\\"$container_id\\\" | awk 'NF{n++} END{print n+0}')\\\" -eq 1 ]] ||\",\"0054:     fail GITEA_CONTAINER_CARDINALITY vm170\",\"0055:   image_value=\\\"$(docker_capture container-inspect inspect \\\"$container_id\\\" --format '{{.Config.Image}}')\\\"\",\"0056:   [[ \\\"$image_value\\\" == 'docker.gitea.com/gitea:1.26.2' ]] ||\",\"0057:     fail GITEA_IMAGE_MISMATCH \\\"$image_value\\\"\",\"0058: }\",\"0059: \",\"....\",\"0063:   shift 2\",\"0064:   local captured rc\",\"0065:   set +e\",\"0066:   captured=\\\"$(timeout --signal=TERM --kill-after=2s \\\"$seconds_value\\\" docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" 2>&1)\\\"\",\"0067:   rc=$?\",\"0068:   set -e\",\"0069:   case \\\"$rc\\\" in\",\"....\",\"0076: \",\"0077: gitea_quiet_best_effort(){\",\"0078:   set +e\",\"0079:   timeout --signal=TERM --kill-after=2s 18s docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" >/dev/null 2>&1\",\"0080:   local rc=$?\",\"0081:   set -e\",\"0082:   return \\\"$rc\\\"\",\"....\",\"0101: if [[ \\\"$mode\\\" == 'seal' ]]; then\",\"0102:   [[ -n \\\"$plan_b64\\\" ]] || fail PLAN_MISSING seal\",\"0103:   plan_json=\\\"$(printf '%s' \\\"$plan_b64\\\" | base64 -d)\\\"\",\"0104:   jq -e '.task_id==\\\"gitea-machine-identity-controlled-migration-v4\\\" and .machine_user==\\\"homelab-ops-bot\\\"' <<<\\\"$plan_json\\\" >/dev/null\",\"0105:   [[ -f \\\"$state_dir/verified\\\" ]] || fail VERIFY_MARKER_MISSING vm170\",\"0106:   [[ -f \\\"$state_dir/user-type-bot\\\" ]] || fail BOT_TYPE_MARKER_MISSING vm170\",\"0107:   [[ -f \\\"$state_dir/admin-flag-absent\\\" ]] || fail ADMIN_FLAG_MARKER_MISSING vm170\",\"....\",\"0120: [[ -n \\\"$plan_b64\\\" ]] || fail PLAN_MISSING \\\"$mode\\\"\",\"0121: plan_json=\\\"$(printf '%s' \\\"$plan_b64\\\" | base64 -d)\\\"\",\"0122: jq -e '\",\"0123:   .task_id==\\\"gitea-machine-identity-controlled-migration-v4\\\" and\",\"0124:   .machine_user==\\\"homelab-ops-bot\\\" and\",\"0125:   .repository==\\\"homelab-admin/homelab-ops\\\" and\",\"0126:   .permission==\\\"write\\\" and\"],\"lines\":248,\"path\":\"/root/gitea-machine-identity-controlled-migration-v4/assets/vm170-machine-identity.sh\",\"sha256\":\"6281daf0cb4cd27345b4c63f90d0c4908387d86e09f3acee371d23fc63ab3aa4\",\"timeout_records\":[{\"durations\":[\"1s\",\"3s\"],\"line\":39,\"text\":\"  captured=\\\"$(timeout --signal=TERM --kill-after=1s 3s docker \\\"$@\\\" 2>&1)\\\"\"},{\"durations\":[\"2s\"],\"line\":66,\"text\":\"  captured=\\\"$(timeout --signal=TERM --kill-after=2s \\\"$seconds_value\\\" docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" 2>&1)\\\"\"},{\"durations\":[\"2s\",\"18s\"],\"line\":79,\"text\":\"  timeout --signal=TERM --kill-after=2s 18s docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" >/dev/null 2>&1\"}]},\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"secrets_included\":false,\"stage\":\"DRY_RUN_TIMEOUT_SOURCE_CAPTURED\",\"status\":\"OK\"}\n"
}
