runtime: publish HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z

runtime/history/HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z",
+  "status": "FAIL",
+  "rc": 2,
+  "host": "pve01",
+  "mode": "verify",
+  "component": "cluster-knowledge-base-error-system",
+  "started_at_utc": "2026-08-06T00:30:46Z",
+  "finished_at_utc": "2026-08-06T00:30:51Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
+  "error_register_checked": true,
+  "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83",
+  "command_sha256": "c3d56ffc46fea0569c3cbce438ff0757d334bd10e229fab9ec1b04dc01962f2d",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 2,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "6ff513773ec1ebd20a3901b2f78df6c1df819b171f6ef343794266db30cc24ce",
+  "sanitized_output_sha256": "6ff513773ec1ebd20a3901b2f78df6c1df819b171f6ef343794266db30cc24ce",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z\",\"command_rc\":2,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":2,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"ERROR\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z\",\"command_rc\":2,\"control_plane_error\":null,\"error_system_v2_future_record\":{\"classification\":\"GITEA_BRANCH_PROTECTION_REJECTS_DIRECT_PUSHER\",\"fingerprint\":\"40795f946c36fcaaf8413b2b46b1900a5df4771d93aeb24f2a596287df0a8023\",\"id\":\"GITEA_PROTECTED_MAIN_DIRECT_PUSH_DRY_RUN_FALSE_POSITIVE\",\"negative_control\":\"dry-run may return rc=0 without exercising the server-side protected-branch mutation decision\",\"normalized_signature\":\"gitea protected main rejects direct push while git push --dry-run succeeds; dry-run does not prove that the server-side protected-branch pre-receive path will accept a real update\",\"positive_control\":\"protected main has direct push disabled and the previous real push was rejected\",\"prevention_rule\":\"A successful git push --dry-run must never be treated as proof that a real update to a protected branch is allowed; the configured branch-protection write path must be proven separately by read-only evidence.\",\"regression_test_required\":true,\"space\":\"runtime\"},\"exact_error\":{\"code\":\"SUBPROCESS_FAILED\",\"evidence\":{\"program\":\"git\",\"rc\":128,\"stderr_sha256\":\"591344aa654102654e3f613438365c6071c792d6940b446f17161d298bacfd7a\"},\"message\":\"Read-only subprocess failed: git\"},\"identity_confirmed\":true,\"mode\":\"READ_ONLY\",\"mutation_outcome\":\"NO_MUTATION\",\"next_step\":\"Prepare no mutation command until this read-only proof failure is resolved by exact evidence.\",\"output_truncated_in_json\":false,\"previous_exact_result\":{\"capsule_sha256\":\"f5e77d9db0c525ab690b399a890da6c71897fb2334c478740f68fde805589478\",\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-PUSH-REJECTION-ROOT-CAUSE-READ-ONLY-20260805T155800Z\",\"identity_confirmed\":true,\"output_complete\":true,\"output_sha256\":\"0b90f060b557a2b73c9fca1232f2c60daa60a323537377fc0e851f823bf2abdf\",\"published_resources_checked\":3,\"runner_document_rc\":0,\"runner_json_sha256\":\"03556bd432819e9d9389f7ab7155249b727e692e561a4019534788ca6c3da1e3\",\"runner_rc\":0,\"runner_text_sha256\":\"028cd35cccc7673af18b85f2e732a4c07c629951b0c2ca0284546b3a0eafe14f\",\"runner_wrapper_matches_document\":true,\"semantic_fields_verified\":[\"changes_made\",\"command_id\",\"command_rc\",\"control_plane_error\",\"found\",\"mutation_outcome\",\"output_complete\",\"output_truncated_in_json\",\"output_truncated_in_runner_json\",\"private_addresses_included\",\"rc\",\"rollback_restored\",\"rollback_started\",\"runner_document_rc\",\"runner_rc\",\"runner_status\",\"runner_wrapper_matches_document\",\"sanitized\",\"secrets_included\",\"status\"],\"slot_directory_count\":12,\"slot_lane\":\"2\"},\"rc\":2,\"rollback_restored\":null,\"rollback_started\":false,\"schema\":\"homelab.read-only-diagnostic.v3\",\"status\":\"ERROR\"}\n"
+}

runtime/history/HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z.txt

@@ -0,0 +1,34 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z
+STATUS=FAIL
+RC=2
+HOST=pve01
+MODE=verify
+COMPONENT=cluster-knowledge-base-error-system
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
+COMMAND_SHA256=c3d56ffc46fea0569c3cbce438ff0757d334bd10e229fab9ec1b04dc01962f2d
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=2
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=6ff513773ec1ebd20a3901b2f78df6c1df819b171f6ef343794266db30cc24ce
+SANITIZED_OUTPUT_SHA256=6ff513773ec1ebd20a3901b2f78df6c1df819b171f6ef343794266db30cc24ce
+OUTPUT_BEGIN
+HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z","command_rc":2,"control_plane_error":null,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":2,"rollback_restored":null,"rollback_started":false,"status":"ERROR","version":1}
+{"changes_made":false,"command_id":"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z","command_rc":2,"control_plane_error":null,"error_system_v2_future_record":{"classification":"GITEA_BRANCH_PROTECTION_REJECTS_DIRECT_PUSHER","fingerprint":"40795f946c36fcaaf8413b2b46b1900a5df4771d93aeb24f2a596287df0a8023","id":"GITEA_PROTECTED_MAIN_DIRECT_PUSH_DRY_RUN_FALSE_POSITIVE","negative_control":"dry-run may return rc=0 without exercising the server-side protected-branch mutation decision","normalized_signature":"gitea protected main rejects direct push while git push --dry-run succeeds; dry-run does not prove that the server-side protected-branch pre-receive path will accept a real update","positive_control":"protected main has direct push disabled and the previous real push was rejected","prevention_rule":"A successful git push --dry-run must never be treated as proof that a real update to a protected branch is allowed; the configured branch-protection write path must be proven separately by read-only evidence.","regression_test_required":true,"space":"runtime"},"exact_error":{"code":"SUBPROCESS_FAILED","evidence":{"program":"git","rc":128,"stderr_sha256":"591344aa654102654e3f613438365c6071c792d6940b446f17161d298bacfd7a"},"message":"Read-only subprocess failed: git"},"identity_confirmed":true,"mode":"READ_ONLY","mutation_outcome":"NO_MUTATION","next_step":"Prepare no mutation command until this read-only proof failure is resolved by exact evidence.","output_truncated_in_json":false,"previous_exact_result":{"capsule_sha256":"f5e77d9db0c525ab690b399a890da6c71897fb2334c478740f68fde805589478","command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-PUSH-REJECTION-ROOT-CAUSE-READ-ONLY-20260805T155800Z","identity_confirmed":true,"output_complete":true,"output_sha256":"0b90f060b557a2b73c9fca1232f2c60daa60a323537377fc0e851f823bf2abdf","published_resources_checked":3,"runner_document_rc":0,"runner_json_sha256":"03556bd432819e9d9389f7ab7155249b727e692e561a4019534788ca6c3da1e3","runner_rc":0,"runner_text_sha256":"028cd35cccc7673af18b85f2e732a4c07c629951b0c2ca0284546b3a0eafe14f","runner_wrapper_matches_document":true,"semantic_fields_verified":["changes_made","command_id","command_rc","control_plane_error","found","mutation_outcome","output_complete","output_truncated_in_json","output_truncated_in_runner_json","private_addresses_included","rc","rollback_restored","rollback_started","runner_document_rc","runner_rc","runner_status","runner_wrapper_matches_document","sanitized","secrets_included","status"],"slot_directory_count":12,"slot_lane":"2"},"rc":2,"rollback_restored":null,"rollback_started":false,"schema":"homelab.read-only-diagnostic.v3","status":"ERROR"}
+
+OUTPUT_END
+CHAT_OUTPUT_END

runtime/latest.json

@@ -1,38 +1,38 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "HOMELAB-CLUSTER-ADMIN-UPDATES-V42-INCIDENT-ENGINE-CARD-FIXED-PATCH-20260806T001400Z",
+  "command_id": "HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z",
   "status": "FAIL",
-  "rc": 76,
+  "rc": 2,
   "host": "pve01",
-  "mode": "change",
+  "mode": "verify",
-  "component": "homelab-cluster-admin-update-visibility",
+  "component": "cluster-knowledge-base-error-system",
-  "started_at_utc": "2026-08-06T00:19:48Z",
+  "started_at_utc": "2026-08-06T00:30:46Z",
-  "finished_at_utc": "2026-08-06T00:19:50Z",
+  "finished_at_utc": "2026-08-06T00:30:51Z",
   "reference_register_checked": true,
   "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
   "error_register_checked": true,
   "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83",
-  "command_sha256": "bac821dd585f64696d34fe7073c7fbb8df0518de3494c926d240b1b3d17ae117",
+  "command_sha256": "c3d56ffc46fea0569c3cbce438ff0757d334bd10e229fab9ec1b04dc01962f2d",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
-  "change_declared": true,
+  "change_declared": false,
-  "result_contract_valid": false,
+  "result_contract_valid": true,
   "result_contract_status": null,
-  "result_contract_error": "INVALID_CONTRACT:ValueError",
+  "result_contract_error": null,
-  "command_rc": 1,
+  "command_rc": 2,
-  "changes_made": null,
+  "changes_made": false,
-  "rollback_started": null,
+  "rollback_started": false,
   "rollback_restored": null,
-  "mutation_outcome": "UNKNOWN",
+  "mutation_outcome": "NO_MUTATION",
   "sanitized": true,
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "4e48bed08b9745291f28aa16054f3c5da12062ecd7e60175462ac5a26cae8292",
+  "raw_evidence_sha256": "6ff513773ec1ebd20a3901b2f78df6c1df819b171f6ef343794266db30cc24ce",
-  "sanitized_output_sha256": "7e118781aff9680d3f2fc54492ae4f820cc8002a8df56aac8dff1e4fad8d8ba8",
+  "sanitized_output_sha256": "6ff513773ec1ebd20a3901b2f78df6c1df819b171f6ef343794266db30cc24ce",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-V42-INCIDENT-ENGINE-CARD-FIXED-PATCH-20260806T001400Z\",\"command_rc\":1,\"control_plane_error\":null,\"mutation_outcome\":\"ROLLED_BACK\",\"rc\":1,\"report_bytes\":1958,\"report_sha256\":\"8a807a9aac198ab0d18f80ebe9f5e7684f1d5f908c198477340d9f2459e0b85f\",\"rollback_restored\":true,\"rollback_started\":true,\"status\":\"FAIL\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-V42-INCIDENT-ENGINE-CARD-FIXED-PATCH-20260806T001400Z\",\"error\":\"RuntimeError: new routes absent from OpenAPI\",\"error_type\":\"RuntimeError\",\"mutation_outcome\":\"ROLLED_BACK\",\"remote\":{\"backup\":\"/var/backups/homelab-cluster-admin/HOMELAB-CLUSTER-ADMIN-UPDATES-V42-INCIDENT-ENGINE-CARD-FIXED-PATCH-20260806T001400Z/incident-engine-app.py\",\"candidate_sha256\":\"26787f335382f6d6beff9a31a185e4998f50f91eed9b8b94831619c5a87a9647\",\"changed\":false,\"error\":\"RuntimeError: new routes absent from OpenAPI\",\"original_sha256\":\"17d95ebfc28cef34846a8999664019d5d032ee8176b7fedd9ceeebfc5c97e3b6\",\"rollback_errors\":[],\"service_after_rollback\":{\"ActiveState\":\"active\",\"ExecMainStatus\":\"0\",\"ExecStart\":\"{ path=/usr/bin/python3 ; argv[]=/usr/bin/python3 -m uvicorn app:app --host 0.0.0.0 --port 8081 --proxy-headers --forwarded-allow-ips=[PRIVATE_IP],127.0.0.1 ; ignore_errors=no ; start_time=[Thu 2026-08-06 00:19:50 UTC] ; stop_time=[n/a] ; pid=2125508 ; code=(null) ; status=0/0 }\",\"FragmentPath\":\"/etc/systemd/system/cluster-admin-incident-engine.service\",\"LoadState\":\"loaded\",\"MainPID\":\"2125508\",\"Result\":\"success\",\"SubState\":\"running\",\"UnitFileState\":\"enabled\",\"WorkingDirectory\":\"/opt/cluster-admin-incident-engine\"},\"service_before\":{\"ActiveState\":\"active\",\"ExecMainStatus\":\"0\",\"ExecStart\":\"{ path=/usr/bin/python3 ; argv[]=/usr/bin/python3 -m uvicorn app:app --host 0.0.0.0 --port 8081 --proxy-headers --forwarded-allow-ips=[PRIVATE_IP],127.0.0.1 ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }\",\"FragmentPath\":\"/etc/systemd/system/cluster-admin-incident-engine.service\",\"LoadState\":\"loaded\",\"MainPID\":\"487\",\"Result\":\"success\",\"SubState\":\"running\",\"UnitFileState\":\"enabled\",\"WorkingDirectory\":\"/opt/cluster-admin-incident-engine\"},\"status\":\"FAILED_ROLLED_BACK\"},\"rollback_errors\":[],\"rollback_restored\":true,\"rollback_started\":true,\"schema\":42,\"status\":\"FAIL\"}\n"
+  "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z\",\"command_rc\":2,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":2,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"ERROR\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z\",\"command_rc\":2,\"control_plane_error\":null,\"error_system_v2_future_record\":{\"classification\":\"GITEA_BRANCH_PROTECTION_REJECTS_DIRECT_PUSHER\",\"fingerprint\":\"40795f946c36fcaaf8413b2b46b1900a5df4771d93aeb24f2a596287df0a8023\",\"id\":\"GITEA_PROTECTED_MAIN_DIRECT_PUSH_DRY_RUN_FALSE_POSITIVE\",\"negative_control\":\"dry-run may return rc=0 without exercising the server-side protected-branch mutation decision\",\"normalized_signature\":\"gitea protected main rejects direct push while git push --dry-run succeeds; dry-run does not prove that the server-side protected-branch pre-receive path will accept a real update\",\"positive_control\":\"protected main has direct push disabled and the previous real push was rejected\",\"prevention_rule\":\"A successful git push --dry-run must never be treated as proof that a real update to a protected branch is allowed; the configured branch-protection write path must be proven separately by read-only evidence.\",\"regression_test_required\":true,\"space\":\"runtime\"},\"exact_error\":{\"code\":\"SUBPROCESS_FAILED\",\"evidence\":{\"program\":\"git\",\"rc\":128,\"stderr_sha256\":\"591344aa654102654e3f613438365c6071c792d6940b446f17161d298bacfd7a\"},\"message\":\"Read-only subprocess failed: git\"},\"identity_confirmed\":true,\"mode\":\"READ_ONLY\",\"mutation_outcome\":\"NO_MUTATION\",\"next_step\":\"Prepare no mutation command until this read-only proof failure is resolved by exact evidence.\",\"output_truncated_in_json\":false,\"previous_exact_result\":{\"capsule_sha256\":\"f5e77d9db0c525ab690b399a890da6c71897fb2334c478740f68fde805589478\",\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-PUSH-REJECTION-ROOT-CAUSE-READ-ONLY-20260805T155800Z\",\"identity_confirmed\":true,\"output_complete\":true,\"output_sha256\":\"0b90f060b557a2b73c9fca1232f2c60daa60a323537377fc0e851f823bf2abdf\",\"published_resources_checked\":3,\"runner_document_rc\":0,\"runner_json_sha256\":\"03556bd432819e9d9389f7ab7155249b727e692e561a4019534788ca6c3da1e3\",\"runner_rc\":0,\"runner_text_sha256\":\"028cd35cccc7673af18b85f2e732a4c07c629951b0c2ca0284546b3a0eafe14f\",\"runner_wrapper_matches_document\":true,\"semantic_fields_verified\":[\"changes_made\",\"command_id\",\"command_rc\",\"control_plane_error\",\"found\",\"mutation_outcome\",\"output_complete\",\"output_truncated_in_json\",\"output_truncated_in_runner_json\",\"private_addresses_included\",\"rc\",\"rollback_restored\",\"rollback_started\",\"runner_document_rc\",\"runner_rc\",\"runner_status\",\"runner_wrapper_matches_document\",\"sanitized\",\"secrets_included\",\"status\"],\"slot_directory_count\":12,\"slot_lane\":\"2\"},\"rc\":2,\"rollback_restored\":null,\"rollback_started\":false,\"schema\":\"homelab.read-only-diagnostic.v3\",\"status\":\"ERROR\"}\n"
 }

runtime/latest.txt

@@ -1,34 +1,34 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=HOMELAB-CLUSTER-ADMIN-UPDATES-V42-INCIDENT-ENGINE-CARD-FIXED-PATCH-20260806T001400Z
+COMMAND_ID=HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z
 STATUS=FAIL
-RC=76
+RC=2
 HOST=pve01
-MODE=change
+MODE=verify
-COMPONENT=homelab-cluster-admin-update-visibility
+COMPONENT=cluster-knowledge-base-error-system
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
-COMMAND_SHA256=bac821dd585f64696d34fe7073c7fbb8df0518de3494c926d240b1b3d17ae117
+COMMAND_SHA256=c3d56ffc46fea0569c3cbce438ff0757d334bd10e229fab9ec1b04dc01962f2d
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
-CHANGE_DECLARED=true
+CHANGE_DECLARED=false
-RESULT_CONTRACT_VALID=false
+RESULT_CONTRACT_VALID=true
-RESULT_CONTRACT_STATUS=UNKNOWN
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
-RESULT_CONTRACT_ERROR=INVALID_CONTRACT:ValueError
+RESULT_CONTRACT_ERROR=NONE
-COMMAND_RC=1
+COMMAND_RC=2
-CHANGES_MADE=unknown
+CHANGES_MADE=false
-ROLLBACK_STARTED=unknown
+ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
-MUTATION_OUTCOME=UNKNOWN
+MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=4e48bed08b9745291f28aa16054f3c5da12062ecd7e60175462ac5a26cae8292
+RAW_EVIDENCE_SHA256=6ff513773ec1ebd20a3901b2f78df6c1df819b171f6ef343794266db30cc24ce
-SANITIZED_OUTPUT_SHA256=7e118781aff9680d3f2fc54492ae4f820cc8002a8df56aac8dff1e4fad8d8ba8
+SANITIZED_OUTPUT_SHA256=6ff513773ec1ebd20a3901b2f78df6c1df819b171f6ef343794266db30cc24ce
 OUTPUT_BEGIN
-HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-V42-INCIDENT-ENGINE-CARD-FIXED-PATCH-20260806T001400Z","command_rc":1,"control_plane_error":null,"mutation_outcome":"ROLLED_BACK","rc":1,"report_bytes":1958,"report_sha256":"8a807a9aac198ab0d18f80ebe9f5e7684f1d5f908c198477340d9f2459e0b85f","rollback_restored":true,"rollback_started":true,"status":"FAIL","version":1}
+HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z","command_rc":2,"control_plane_error":null,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":2,"rollback_restored":null,"rollback_started":false,"status":"ERROR","version":1}
-{"changes_made":false,"command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-V42-INCIDENT-ENGINE-CARD-FIXED-PATCH-20260806T001400Z","error":"RuntimeError: new routes absent from OpenAPI","error_type":"RuntimeError","mutation_outcome":"ROLLED_BACK","remote":{"backup":"/var/backups/homelab-cluster-admin/HOMELAB-CLUSTER-ADMIN-UPDATES-V42-INCIDENT-ENGINE-CARD-FIXED-PATCH-20260806T001400Z/incident-engine-app.py","candidate_sha256":"26787f335382f6d6beff9a31a185e4998f50f91eed9b8b94831619c5a87a9647","changed":false,"error":"RuntimeError: new routes absent from OpenAPI","original_sha256":"17d95ebfc28cef34846a8999664019d5d032ee8176b7fedd9ceeebfc5c97e3b6","rollback_errors":[],"service_after_rollback":{"ActiveState":"active","ExecMainStatus":"0","ExecStart":"{ path=/usr/bin/python3 ; argv[]=/usr/bin/python3 -m uvicorn app:app --host 0.0.0.0 --port 8081 --proxy-headers --forwarded-allow-ips=[PRIVATE_IP],127.0.0.1 ; ignore_errors=no ; start_time=[Thu 2026-08-06 00:19:50 UTC] ; stop_time=[n/a] ; pid=2125508 ; code=(null) ; status=0/0 }","FragmentPath":"/etc/systemd/system/cluster-admin-incident-engine.service","LoadState":"loaded","MainPID":"2125508","Result":"success","SubState":"running","UnitFileState":"enabled","WorkingDirectory":"/opt/cluster-admin-incident-engine"},"service_before":{"ActiveState":"active","ExecMainStatus":"0","ExecStart":"{ path=/usr/bin/python3 ; argv[]=/usr/bin/python3 -m uvicorn app:app --host 0.0.0.0 --port 8081 --proxy-headers --forwarded-allow-ips=[PRIVATE_IP],127.0.0.1 ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }","FragmentPath":"/etc/systemd/system/cluster-admin-incident-engine.service","LoadState":"loaded","MainPID":"487","Result":"success","SubState":"running","UnitFileState":"enabled","WorkingDirectory":"/opt/cluster-admin-incident-engine"},"status":"FAILED_ROLLED_BACK"},"rollback_errors":[],"rollback_restored":true,"rollback_started":true,"schema":42,"status":"FAIL"}
+{"changes_made":false,"command_id":"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-R6-20260806T001200Z","command_rc":2,"control_plane_error":null,"error_system_v2_future_record":{"classification":"GITEA_BRANCH_PROTECTION_REJECTS_DIRECT_PUSHER","fingerprint":"40795f946c36fcaaf8413b2b46b1900a5df4771d93aeb24f2a596287df0a8023","id":"GITEA_PROTECTED_MAIN_DIRECT_PUSH_DRY_RUN_FALSE_POSITIVE","negative_control":"dry-run may return rc=0 without exercising the server-side protected-branch mutation decision","normalized_signature":"gitea protected main rejects direct push while git push --dry-run succeeds; dry-run does not prove that the server-side protected-branch pre-receive path will accept a real update","positive_control":"protected main has direct push disabled and the previous real push was rejected","prevention_rule":"A successful git push --dry-run must never be treated as proof that a real update to a protected branch is allowed; the configured branch-protection write path must be proven separately by read-only evidence.","regression_test_required":true,"space":"runtime"},"exact_error":{"code":"SUBPROCESS_FAILED","evidence":{"program":"git","rc":128,"stderr_sha256":"591344aa654102654e3f613438365c6071c792d6940b446f17161d298bacfd7a"},"message":"Read-only subprocess failed: git"},"identity_confirmed":true,"mode":"READ_ONLY","mutation_outcome":"NO_MUTATION","next_step":"Prepare no mutation command until this read-only proof failure is resolved by exact evidence.","output_truncated_in_json":false,"previous_exact_result":{"capsule_sha256":"f5e77d9db0c525ab690b399a890da6c71897fb2334c478740f68fde805589478","command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-PUSH-REJECTION-ROOT-CAUSE-READ-ONLY-20260805T155800Z","identity_confirmed":true,"output_complete":true,"output_sha256":"0b90f060b557a2b73c9fca1232f2c60daa60a323537377fc0e851f823bf2abdf","published_resources_checked":3,"runner_document_rc":0,"runner_json_sha256":"03556bd432819e9d9389f7ab7155249b727e692e561a4019534788ca6c3da1e3","runner_rc":0,"runner_text_sha256":"028cd35cccc7673af18b85f2e732a4c07c629951b0c2ca0284546b3a0eafe14f","runner_wrapper_matches_document":true,"semantic_fields_verified":["changes_made","command_id","command_rc","control_plane_error","found","mutation_outcome","output_complete","output_truncated_in_json","output_truncated_in_runner_json","private_addresses_included","rc","rollback_restored","rollback_started","runner_document_rc","runner_rc","runner_status","runner_wrapper_matches_document","sanitized","secrets_included","status"],"slot_directory_count":12,"slot_lane":"2"},"rc":2,"rollback_restored":null,"rollback_started":false,"schema":"homelab.read-only-diagnostic.v3","status":"ERROR"}
 
 OUTPUT_END
 CHAT_OUTPUT_END