CHAT_OUTPUT_BEGIN
COMMAND_ID=HOMELAB-CLUSTER-KB-V1-READER-V3-HELPER-CONTRACT-READ-ONLY-20260805T085900Z
STATUS=OK
RC=0
HOST=pve01
MODE=verify
COMPONENT=cluster-knowledge-base-error-system
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
COMMAND_SHA256=916bb1e5adc8f7e0ceb715cf1c84697d9a99523f8f3dd737bf66317519191acd
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=b829e8f514d0be81fc40bbbeb82d9196862a423ddfe6985bc17e3792c49584e2
SANITIZED_OUTPUT_SHA256=b829e8f514d0be81fc40bbbeb82d9196862a423ddfe6985bc17e3792c49584e2
OUTPUT_BEGIN
HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-HELPER-CONTRACT-READ-ONLY-20260805T085900Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1}
{"ast_source_selection":{"selected_count":1,"selected_paths":["/usr/local/sbin/homelab-reader-server-v3"],"systemd_unit_excluded":true},"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-HELPER-CONTRACT-READ-ONLY-20260805T085900Z","command_rc":0,"correction_of_previous_logic_gaps":[{"exact_fix":"analyze every reachable or path-bearing method in the exact handler class, follow self-method edges, resolve path aliases and normalize lstrip/removeprefix before probing","proven_gap":"the previous analyzer parsed the exact Python source but restricted contract extraction to do_GET/do_HEAD and did not model path operands of compare_digest or leading-slash normalization in helper methods","regression_test":"a handler whose do_GET calls a helper using compare_digest(self.path.split(...).lstrip('/'), CAPABILITY) must produce one redacted source-derived route"}],"error_fingerprint":"27ca4a7a83a33494c7c40dd173cbca17a1885d66fbed4ce2272a6c61ebb58387","latest_exact_result_basis":{"capsule_sha256":"bd099f64b0fc0af2ec1b3da3ea49185b7fd81a716b33d7811e796c0374e6d094","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-HANDLER-CONTROL-FLOW-READ-ONLY-20260805T085100Z","command_rc":0,"control_plane_error":null,"error_fingerprint":"14c4867b57e7cadf602ed3e999632ca22c1347c101703fc01af7d49a4e3266e3","mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_HANDLER_CONTROL_FLOW_TRACE","output_complete":true,"output_sha256":"17cf9be1f2e911f7f5e392c00def5e5d77fe08c3425cce755acac1ce3a9e1d06","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_LISTENER_FOUND_BUT_AST_AUTH_ROUTE_CONTRACT_NOT_DERIVED","runner_document_rc":0,"runner_json_sha256":"ac1fa14875c76c86c2fd768d689fa06e73e4eff9ea84a89c7c954aedbc70c30f","runner_rc":0,"runner_text_sha256":"b360c8d360a3e1f57e6dc5ae5615ecd5571177f310ccdd03d2748c94c2c35e01","runner_wrapper_matches_document":true,"status":"OK"},"mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_RESPONSE_SCHEMA_TRACE","output_truncated_in_json":false,"owned_listeners":[{"address_class":"private","address_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9","family":"ipv4","inode":"24795","port":18788}],"pre_command_known_error_gate":{"checked":true,"items":[{"id":"candidate-scan-limit-20260805","prevention":"exact files only; hard source, response, route, probe and output limits"},{"id":"runner-wrapper-mismatch-20260805","prevention":"single compact JSON below 42000 bytes; no raw sources or response bodies"},{"id":"gitea-owner-hardcoded-20260805","prevention":"no repository owner or repository URL is assumed"},{"id":"gitea-git-auth-unavailable-20260805","prevention":"no Git or Gitea authentication retry in this command"},{"id":"pvesh-adapter-context-unreadable-20260805","prevention":"pvesh is not called"},{"id":"gitea-process-self-match-20260805","prevention":"Reader identity is bound to exact systemd ControlGroup"},{"id":"sanitize-non-string-attributeerror-20260805","prevention":"sanitize converts Any to str; embedded bool regression test"},{"id":"reader-v3-skipped-on-nonauthoritative-inventory-20260805","prevention":"this command directly probes Reader V3"},{"id":"reader-path-env-misclassified-as-route-20260805","prevention":"PATH/PYTHONPATH and colon-separated filesystem values are explicitly forbidden as HTTP routes"},{"id":"reader-loopback-only-probe-20260805","prevention":"connections use the exact address of the socket owned by the Reader ControlGroup; 127.0.0.1 is not assumed"},{"id":"reader-capability-not-secret-20260805","prevention":"all capability values are secret; values and concrete secret-bearing routes are never output"},{"id":"reader-v3-root-404-no-json-20260805","prevention":"derive auth and route only from exact AST comparisons, source literals and process environment before probing"},{"id":"reader-systemd-unit-parsed-as-python-20260805","prevention":"only the exact Python server source is passed to ast.parse; systemd units are verified by SHA but never parsed as Python"},{"id":"reader-helper-contract-coverage-gap-20260805","prevention":"analyze every method in the exact BaseHTTPRequestHandler class, follow self-method edges, model path operands of compare_digest, and normalize leading-slash removal before probing"}]},"prevention_test":{"must_run_before_future_cluster_or_gitea_commands":true,"name":"reader_v3_helper_contract_preflight","requirements":["verify exact Reader source SHA","bind process and socket to exact systemd ControlGroup","follow handler self-method call edges","model path comparisons and compare_digest in helper methods","normalize only source-proven leading-slash removal","never output capability values or private addresses","probe only source-supported request contracts","accept inventory only from successful JSON with normalized guest rows"]},"process_environment":{"capability_name_present":true,"names":["HOME","HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT","INVOCATION_ID","JOURNAL_STREAM","LANG","LOGNAME","MEMORY_PRESSURE_WATCH","MEMORY_PRESSURE_WRITE","PATH","SHELL","SYSTEMD_EXEC_PID","USER"],"secret_name_count":1},"protocol_probe":{"auth_candidate_count":0,"gitea_candidates":[],"guest_count":0,"probes":[{"auth":"none","auth_basis":"control","auth_header_names":[],"body_bytes":10,"body_sha256":"709009e02c8e364113b28205aadde30cce270d709073f28153c85fdc5036c96d","body_truncated":false,"content_type":"text/plain; charset=utf-8","duration_seconds":0.001,"endpoint_index":0,"json":null,"method":"GET","response_header_names":["cache-control","content-length","content-type","date","expires","pragma","server","surrogate-control","x-robots-tag"],"route_source":"ast_path_startswith_any_method","route_template":"/<capability>/","status":404},{"auth":"none","auth_basis":"control","auth_header_names":[],"body_bytes":10,"body_sha256":"709009e02c8e364113b28205aadde30cce270d709073f28153c85fdc5036c96d","body_truncated":false,"content_type":"text/plain; charset=utf-8","duration_seconds":0.001,"endpoint_index":0,"json":null,"method":"GET","response_header_names":["cache-control","content-length","content-type","date","expires","pragma","server","surrogate-control","x-robots-tag"],"route_source":"ast_reachable_method_literal","route_template":"/<capability>","status":404},{"auth":"none","auth_basis":"control","auth_header_names":[],"body_bytes":10,"body_sha256":"709009e02c8e364113b28205aadde30cce270d709073f28153c85fdc5036c96d","body_truncated":false,"content_type":"text/plain; charset=utf-8","duration_seconds":0.001,"endpoint_index":0,"json":null,"method":"GET","response_header_names":["cache-control","content-length","content-type","date","expires","pragma","server","surrogate-control","x-robots-tag"],"route_source":"ast_reachable_method_literal","route_template":"/","status":404}],"request_contract_count":3,"successful_inventory_routes":[]},"rc":0,"read_only":true,"ready_for_guest_probe":false,"result_projection":{"bytes_before_projection":9916,"compacted":false,"max_bytes":36000},"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_EXACT_AUTH_AND_ROUTE_CONTRACT_PROBED_BUT_NO_AUTHORITATIVE_JSON_RESPONSE","schema":1,"source_files":[{"actual_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","bytes":580,"expected_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","matches_expected":true,"path":"/etc/systemd/system/homelab-reader-v3.service"},{"actual_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","bytes":3539,"expected_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","matches_expected":true,"path":"/usr/local/sbin/homelab-reader-server-v3"}],"source_semantics":{"analyzed_method_count":4,"analyzed_methods":["do_GET","do_HEAD","handle_reader","reply"],"ast_parse_ok":true,"auth_variants":[{"basis":"control","header_names":[],"label":"none"}],"handler_count":2,"header_contract_count":0,"header_names":[],"parse_errors":[],"path_alias_count":4,"path_compare_digest_count":0,"path_predicate_count":5,"protocol_markers":["basehttprequesthandler","content-type","do_get","do_head","http.server","send_response"],"query_contract_count":0,"query_keys":[],"resolved_scope_names":["CAPABILITY","PORT","allow_reuse_address","server_version"],"route_template_count":3,"route_templates":[{"evidence_sha256":"3e022402ebaac8e3f28c9bd23f581a0d3b497ee6f746ddae9504aafa00503ad0","match_kind":"prefix","method":"GET","secret_bearing":true,"source":"ast_path_startswith_any_method","template":"/<capability>/"},{"evidence_sha256":"503a079ea70636de095387956b4dff774121ca61b676f2e02197822c2abd4bed","match_kind":"exact","method":"GET","secret_bearing":true,"source":"ast_reachable_method_literal","template":"/<capability>"},{"evidence_sha256":"2aa6b2ef6e5dfe39f88e5bf3558f3778c1b61b59eae77c349b98c1afe6589ec6","match_kind":"exact","method":"GET","secret_bearing":false,"source":"ast_reachable_method_literal","template":"/"}],"self_call_edges":[{"from":"do_GET","to":"handle_reader"},{"from":"do_HEAD","to":"handle_reader"},{"from":"handle_reader","to":"reply"}],"source_environment_references":["HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT"]},"source_state":"MATCH","status":"OK","systemd_identity":{"identity_valid":true,"pid_count":1,"probe":{"duration_seconds":0.005,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":375,"stdout_sha256":"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9","stdout_truncated":false},"properties":{"ActiveState":"active","ControlGroup":"/system.slice/homelab-reader-v3.service","ExecStart_present":true,"ExecStart_sha256":"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379","FragmentPath":"/etc/systemd/system/homelab-reader-v3.service","LoadState":"loaded","MainPID":"1282","SubState":"running"}}}

OUTPUT_END
CHAT_OUTPUT_END
