runtime: publish RUNTIME-RECEIVER-FULL-023

2026-07-21 09:40:02 +00:00
parent 8083f10fe9
commit 22ed36e72c
4 changed files with 662 additions and 76 deletions
@@ -1,88 +1,322 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=BOOTSTRAP-FILE-DIAG-002
+COMMAND_ID=RUNTIME-RECEIVER-FULL-023
 STATUS=OK
 RC=0
 HOST=pve01
 MODE=read-only
-COMPONENT=gitea-bootstrap
+COMPONENT=gitea-runtime
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=f6f7749fda946015116cdbbd754c7e7f20356b4a6cf4df330a1b0b8fdf59cbb2
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc
-COMMAND_SHA256=ff7fad42e98aa003067d7496afc43ad2c9ad5fe91eb84b8eb79aeb41674bb1be
+COMMAND_SHA256=d17752c0235202b5d9f1822d70680ea57dd4578bde6bbc906c7569c0d0463bb0
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGES_MADE=false
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=2c25590ae8d63b455ecfea329a8495fa57f04ba43113a348dace1265c58ce33e
-SANITIZED_OUTPUT_SHA256=2c25590ae8d63b455ecfea329a8495fa57f04ba43113a348dace1265c58ce33e
+RAW_EVIDENCE_SHA256=2c183b9ced4334e5ff12c1ba35dceb1f7f6ef113298d44bf3fb80ca07305b8b3
+SANITIZED_OUTPUT_SHA256=cd4ccc98c3b9dff7bd1f5557b41fb60d073f889a31f3fd7d86900eecbe15dff4
 OUTPUT_BEGIN
-{
-  "schema_version": 2,
-  "cluster_id": "homelab",
-  "status": "READY",
-  "generated_at_utc": "2026-07-21T07:02:17Z",
-  "context": {
-    "full_context_command_id": "CONTEXT-SOURCES-FULL-002",
-    "full_context_commit": "e23caf794cc68ce5fa6f8922efa7f2a35c8aa6e0",
-    "full_context_sha256": "621830f58b028a0116a42964d02bdca31c280d6ff358f518d0e8f24c2ba01366",
-    "full_context_url": "https://git.gram1.ru/homelab-admin/homelab-public-context/raw/commit/e23caf794cc68ce5fa6f8922efa7f2a35c8aa6e0/runtime/history/CONTEXT-SOURCES-FULL-002.txt",
-    "context_index_command_id": "CONTEXT-INDEX-001",
-    "context_index_commit": "055521f14fbb0780bdb501c7d7be755350d45091",
-    "context_index_url": "https://git.gram1.ru/homelab-admin/homelab-public-context/raw/commit/055521f14fbb0780bdb501c7d7be755350d45091/runtime/history/CONTEXT-INDEX-001.json",
-    "reference_sha256": "f6f7749fda946015116cdbbd754c7e7f20356b4a6cf4df330a1b0b8fdf59cbb2",
-    "error_register_sha256": "ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc",
-    "error_register_embedded_in_full_context": true
-  },
-  "runtime": {
-    "history_url": "https://git.gram1.ru/homelab-admin/homelab-public-context/src/branch/assistant-runtime/runtime/history",
-    "latest_branch_url": "https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/latest.json",
-    "result_confirmation": "immutable_history_by_command_id",
-    "latest_json_is_authoritative": false
-  },
-  "operating_contract": {
-    "load_bootstrap_before_commands": true,
-    "load_error_register_before_commands": true,
-    "check_previous_command_result": true,
-    "reject_known_failed_exact_repeats": true,
-    "one_command_per_step": true,
-    "manual_terminal_output_required": false,
-    "runner": "homelab-chat-run",
-    "confirmation_tokens": [
-      ".",
-      ",",
-      "\\"
-    ],
-    "immediate_next_command": true,
-    "command_display": "collapsible_details",
-    "double_pre_command_check": true
-  },
-  "privacy": {
-    "sanitized": true,
-    "secrets_included": false,
-    "private_addresses_included": false
-  },
-  "entrypoints": {
-    "full_context_url": "https://git.gram1.ru/homelab-admin/homelab-public-context/raw/commit/e23caf794cc68ce5fa6f8922efa7f2a35c8aa6e0/runtime/history/CONTEXT-SOURCES-FULL-002.txt",
-    "errors_index_url": "https://git.gram1.ru/homelab-admin/homelab-public-context/raw/commit/a615069de3d32564fc4de29baff949bdaf811caf/runtime/history/ERRORS-INDEX-004.json",
-    "workflow_contract_url": "https://git.gram1.ru/homelab-admin/homelab-public-context/raw/commit/2f37a4eb600528d03f5c570af8c5aa0e463b1798/runtime/history/WORKFLOW-CONTRACT-003.json",
-    "double_check_rule_url": "https://git.gram1.ru/homelab-admin/homelab-public-context/raw/commit/d1061e47e7955dba9c73a2841d4eacf02ccc1bf5/runtime/policy/double-check-rule.json"
-  },
-  "freshness": {
-    "max_age_seconds": 86400,
-    "stale_requires_refresh": true
-  },
-  "coverage": {
-    "status": "PARTIAL",
-    "missing": [
-      "automatic_refresh",
-      "per_node_freshness",
-      "structured_service_inventory"
-    ]
-  }
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 027
+
+HOST_DATA='/opt/stacks/gitea/data'
+BARE_CONTAINER='/data/git/repositories/homelab-admin/homelab-public-context.git'
+
+PUBLIC_DIR="${HOST_DATA}/gitea/public/.well-known/homelab-runtime"
+STAGE_DIR="${HOST_DATA}/gitea/runtime-stage"
+WORK_ROOT="${HOST_DATA}/gitea/runtime-work"
+
+LOCK='/run/lock/homelab-runtime-receive.lock'
+
+[ "$#" -eq 3 ] || {
+    echo 'RESULT=FAIL'
+    echo 'REASON=USAGE'
+    exit 64
 }

+COMMAND_ID="$1"
+JSON_FILE="$2"
+TXT_FILE="$3"
+
+case "$COMMAND_ID" in
+    ''|*[!A-Za-z0-9._-]*)
+        echo 'RESULT=FAIL'
+        echo 'REASON=INVALID_COMMAND_ID'
+        exit 65
+        ;;
+esac
+
+[ -f "$JSON_FILE" ] || {
+    echo 'RESULT=FAIL'
+    echo 'REASON=JSON_FILE_MISSING'
+    exit 66
+}
+
+[ -f "$TXT_FILE" ] || {
+    echo 'RESULT=FAIL'
+    echo 'REASON=TXT_FILE_MISSING'
+    exit 67
+}
+
+exec 9>"$LOCK"
+flock -w 60 9 || {
+    echo 'RESULT=FAIL'
+    echo 'REASON=RECEIVER_LOCK_TIMEOUT'
+    exit 68
+}
+
+python3 - "$JSON_FILE" "$TXT_FILE" "$COMMAND_ID" <<'PY'
+import json
+import re
+import sys
+from pathlib import Path
+
+json_path = Path(sys.argv[1])
+text_path = Path(sys.argv[2])
+expected_id = sys.argv[3]
+
+if json_path.stat().st_size > 524_288:
+    raise SystemExit("JSON_TOO_LARGE")
+
+if text_path.stat().st_size > 1_048_576:
+    raise SystemExit("TEXT_TOO_LARGE")
+
+json_text = json_path.read_text(encoding="utf-8")
+text = text_path.read_text(encoding="utf-8")
+
+data = json.loads(json_text)
+
+if data.get("command_id") != expected_id:
+    raise SystemExit("COMMAND_ID_MISMATCH")
+
+if data.get("sanitized") is not True:
+    raise SystemExit("SANITIZED_FLAG_REQUIRED")
+
+if data.get("secrets_included") is not False:
+    raise SystemExit("SECRETS_FLAG_INVALID")
+
+if data.get("private_addresses_included") is not False:
+    raise SystemExit("PRIVATE_ADDRESS_FLAG_INVALID")
+
+combined = json_text + "\n" + text
+
+patterns = [
+    r"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",
+    r"(?i)(password|passwd|passphrase|authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key)\s*[:=]\s*\S+",
+    r"(?i)/root/\.ssh",
+    r"(?i)[SENSITIVE_PATH]",
+    r"(?i)rclone\.conf",
+    r"\b10(?:\.\d{1,3}){3}\b",
+    r"\b192\.168(?:\.\d{1,3}){2}\b",
+    r"\b172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}\b",
+]
+
+for pattern in patterns:
+    if re.search(pattern, combined):
+        raise SystemExit("FORBIDDEN_PUBLIC_CONTENT")
+
+print("PAYLOAD_VALIDATION=OK")
+PY
+
+GIT_UID="$(docker exec gitea id -u git)"
+GIT_GID="$(docker exec gitea id -g git)"
+
+mkdir -p \
+    "$PUBLIC_DIR" \
+    "$STAGE_DIR" \
+    "$WORK_ROOT"
+
+chown "$GIT_UID:$GIT_GID" \
+    "$STAGE_DIR" \
+    "$WORK_ROOT"
+
+install \
+    -o "$GIT_UID" \
+    -g "$GIT_GID" \
+    -m 0644 \
+    "$JSON_FILE" \
+    "$STAGE_DIR/latest.json"
+
+install \
+    -o "$GIT_UID" \
+    -g "$GIT_GID" \
+    -m 0644 \
+    "$TXT_FILE" \
+    "$STAGE_DIR/latest.txt"
+
+cat > "$STAGE_DIR/README.md" <<'DOC'
+# Homelab assistant runtime
+
+Sanitized command results for read-only assistant inspection.
+
+Credentials, authentication data, private keys, private IP addresses and
+unfiltered configuration files are prohibited.
+DOC
+
+chown "$GIT_UID:$GIT_GID" "$STAGE_DIR/README.md"
+chmod 0644 "$STAGE_DIR/README.md"
+
+PUBLISHED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+WORK_CONTAINER="/data/gitea/runtime-work/${COMMAND_ID}.$$"
+
+COMMIT_SHA="$(
+    docker exec \
+        -u "${GIT_UID}:${GIT_GID}" \
+        -e COMMAND_ID="$COMMAND_ID" \
+        -e PUBLISHED_AT="$PUBLISHED_AT" \
+        -e WORK_CONTAINER="$WORK_CONTAINER" \
+        gitea sh -lc '
+set -eu
+
+BARE="/data/git/repositories/homelab-admin/homelab-public-context.git"
+STAGE="/data/gitea/runtime-stage"
+WORK="$WORK_CONTAINER"
+
+rm -rf "$WORK"
+
+git clone --quiet "$BARE" "$WORK"
+
+cd "$WORK"
+
+git config user.name "homelab-runtime-publisher"
+git config user.email "homelab-runtime@localhost"
+
+if git show-ref \
+    --verify \
+    --quiet \
+    refs/remotes/origin/assistant-runtime
+then
+    git checkout \
+        --quiet \
+        -B assistant-runtime \
+        origin/assistant-runtime
+else
+    git checkout \
+        --quiet \
+        --orphan assistant-runtime
+
+    git rm -rf . >/dev/null 2>&1 || true
+fi
+
+mkdir -p runtime/history
+
+cp "$STAGE/latest.json" runtime/latest.json
+cp "$STAGE/latest.txt" runtime/latest.txt
+cp "$STAGE/latest.json" "runtime/history/${COMMAND_ID}.json"
+cp "$STAGE/latest.txt" "runtime/history/${COMMAND_ID}.txt"
+cp "$STAGE/README.md" README.md
+
+git add \
+    README.md \
+    runtime/latest.json \
+    runtime/latest.txt \
+    "runtime/history/${COMMAND_ID}.json"
+
+git add "runtime/history/${COMMAND_ID}.txt"
+
+if ! git diff --cached --quiet
+then
+    GIT_AUTHOR_DATE="$PUBLISHED_AT" \
+    GIT_COMMITTER_DATE="$PUBLISHED_AT" \
+        git commit \
+            --quiet \
+            -m "runtime: publish ${COMMAND_ID}"
+fi
+
+COMMIT="$(git rev-parse HEAD)"
+
+git --git-dir="$BARE" \
+    fetch \
+    --quiet \
+    "$WORK" \
+    refs/heads/assistant-runtime
+
+OLD="$(
+    git --git-dir="$BARE" \
+        rev-parse refs/heads/assistant-runtime \
+        2>/dev/null ||
+    true
+)"
+
+if [ -n "$OLD" ]
+then
+    git --git-dir="$BARE" \
+        update-ref \
+        refs/heads/assistant-runtime \
+        "$COMMIT" \
+        "$OLD"
+else
+    git --git-dir="$BARE" \
+        update-ref \
+        refs/heads/assistant-runtime \
+        "$COMMIT"
+fi
+
+rm -rf "$WORK"
+
+printf "%s\n" "$COMMIT"
+'
+)"
+
+JSON_TMP="$(mktemp "${PUBLIC_DIR}/.latest.json.XXXXXX")"
+TXT_TMP="$(mktemp "${PUBLIC_DIR}/.latest.txt.XXXXXX")"
+INDEX_TMP="$(mktemp "${PUBLIC_DIR}/.index.json.XXXXXX")"
+
+install -m 0644 "$JSON_FILE" "$JSON_TMP"
+install -m 0644 "$TXT_FILE" "$TXT_TMP"
+
+python3 - \
+    "$COMMAND_ID" \
+    "$PUBLISHED_AT" \
+    "$COMMIT_SHA" >"$INDEX_TMP" <<'PY'
+import json
+import sys
+
+command_id, published_at, commit_sha = sys.argv[1:4]
+
+print(json.dumps({
+    "schema_version": 1,
+    "channel": "homelab-runtime",
+    "branch": "assistant-runtime",
+    "latest_command_id": command_id,
+    "published_at_utc": published_at,
+    "commit_sha": commit_sha,
+    "latest_json_url": (
+        "https://git.gram1.ru/.well-known/"
+        "homelab-runtime/latest.json"
+    ),
+    "latest_text_url": (
+        "https://git.gram1.ru/.well-known/"
+        "homelab-runtime/latest.txt"
+    )
+}, ensure_ascii=False, indent=2))
+PY
+
+chmod 0644 "$INDEX_TMP"
+
+mv -f "$JSON_TMP" "$PUBLIC_DIR/latest.json"
+mv -f "$TXT_TMP" "$PUBLIC_DIR/latest.txt"
+mv -f "$INDEX_TMP" "$PUBLIC_DIR/index.json"
+
+curl -fsS \
+    --max-time 10 \
+    http://127.0.0.1:3002/.well-known/homelab-runtime/latest.json |
+grep -F "$COMMAND_ID" >/dev/null
+
+curl -fsS \
+    --max-time 10 \
+    "http://127.0.0.1:3002/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/latest.json" |
+grep -F "$COMMAND_ID" >/dev/null
+
+echo 'RESULT=OK'
+echo "COMMAND_ID=$COMMAND_ID"
+echo "COMMIT_SHA=$COMMIT_SHA"
+echo 'STATIC_PUBLICATION=OK'
+echo 'RAW_BRANCH_PUBLICATION=OK'
+
 OUTPUT_END
 CHAT_OUTPUT_END