runtime: publish HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z

runtime/history/HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z",
+  "status": "FAIL",
+  "rc": 2,
+  "host": "pve01",
+  "mode": "verify",
+  "component": "cluster-knowledge-base-error-system",
+  "started_at_utc": "2026-08-05T23:59:50Z",
+  "finished_at_utc": "2026-08-05T23:59:55Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
+  "error_register_checked": true,
+  "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83",
+  "command_sha256": "09b6606c2edf48917dc56d27d5e10e526f99f357ae27463d9459c5f3152472fd",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 2,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "53d38d4587051b38a7a63af7faf5baba2775e0db83bd8eac918f8cdd1f8398b6",
+  "sanitized_output_sha256": "53d38d4587051b38a7a63af7faf5baba2775e0db83bd8eac918f8cdd1f8398b6",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z\",\"command_rc\":2,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":2,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"ERROR\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z\",\"command_rc\":2,\"control_plane_error\":null,\"error_system_v2_future_record\":{\"classification\":\"GITEA_BRANCH_PROTECTION_REJECTS_DIRECT_PUSHER\",\"fingerprint\":\"40795f946c36fcaaf8413b2b46b1900a5df4771d93aeb24f2a596287df0a8023\",\"id\":\"GITEA_PROTECTED_MAIN_DIRECT_PUSH_DRY_RUN_FALSE_POSITIVE\",\"negative_control\":\"dry-run may return rc=0 without exercising the server-side protected-branch mutation decision\",\"normalized_signature\":\"gitea protected main rejects direct push while git push --dry-run succeeds; dry-run does not prove that the server-side protected-branch pre-receive path will accept a real update\",\"positive_control\":\"protected main has direct push disabled and the previous real push was rejected\",\"prevention_rule\":\"A successful git push --dry-run must never be treated as proof that a real update to a protected branch is allowed; the configured branch-protection write path must be proven separately by read-only evidence.\",\"regression_test_required\":true,\"space\":\"runtime\"},\"exact_error\":{\"code\":\"HTTP_READ_FAILED\",\"evidence\":{\"status\":404,\"url_sha256\":\"35cfa68b510e0f5b871072b99661ddf8f8726f808b5025114b925cd3b4c26cbe\"},\"message\":\"Read-only HTTP request failed\"},\"identity_confirmed\":false,\"mode\":\"READ_ONLY\",\"mutation_outcome\":\"NO_MUTATION\",\"next_step\":\"Prepare no mutation command until this read-only proof failure is resolved by exact evidence.\",\"output_truncated_in_json\":false,\"rc\":2,\"rollback_restored\":null,\"rollback_started\":false,\"schema\":\"homelab.read-only-diagnostic.v2\",\"status\":\"ERROR\"}\n"
+}

runtime/history/HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z.txt

@@ -0,0 +1,34 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z
+STATUS=FAIL
+RC=2
+HOST=pve01
+MODE=verify
+COMPONENT=cluster-knowledge-base-error-system
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
+COMMAND_SHA256=09b6606c2edf48917dc56d27d5e10e526f99f357ae27463d9459c5f3152472fd
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=2
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=53d38d4587051b38a7a63af7faf5baba2775e0db83bd8eac918f8cdd1f8398b6
+SANITIZED_OUTPUT_SHA256=53d38d4587051b38a7a63af7faf5baba2775e0db83bd8eac918f8cdd1f8398b6
+OUTPUT_BEGIN
+HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z","command_rc":2,"control_plane_error":null,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":2,"rollback_restored":null,"rollback_started":false,"status":"ERROR","version":1}
+{"changes_made":false,"command_id":"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z","command_rc":2,"control_plane_error":null,"error_system_v2_future_record":{"classification":"GITEA_BRANCH_PROTECTION_REJECTS_DIRECT_PUSHER","fingerprint":"40795f946c36fcaaf8413b2b46b1900a5df4771d93aeb24f2a596287df0a8023","id":"GITEA_PROTECTED_MAIN_DIRECT_PUSH_DRY_RUN_FALSE_POSITIVE","negative_control":"dry-run may return rc=0 without exercising the server-side protected-branch mutation decision","normalized_signature":"gitea protected main rejects direct push while git push --dry-run succeeds; dry-run does not prove that the server-side protected-branch pre-receive path will accept a real update","positive_control":"protected main has direct push disabled and the previous real push was rejected","prevention_rule":"A successful git push --dry-run must never be treated as proof that a real update to a protected branch is allowed; the configured branch-protection write path must be proven separately by read-only evidence.","regression_test_required":true,"space":"runtime"},"exact_error":{"code":"HTTP_READ_FAILED","evidence":{"status":404,"url_sha256":"35cfa68b510e0f5b871072b99661ddf8f8726f808b5025114b925cd3b4c26cbe"},"message":"Read-only HTTP request failed"},"identity_confirmed":false,"mode":"READ_ONLY","mutation_outcome":"NO_MUTATION","next_step":"Prepare no mutation command until this read-only proof failure is resolved by exact evidence.","output_truncated_in_json":false,"rc":2,"rollback_restored":null,"rollback_started":false,"schema":"homelab.read-only-diagnostic.v2","status":"ERROR"}
+
+OUTPUT_END
+CHAT_OUTPUT_END

runtime/latest.json

@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "HOMELAB-CLUSTER-ADMIN-UPDATES-V39-INCIDENT-ENGINE-PATCH-TARGET-READ-ONLY-20260805T170500Z",
+  "command_id": "HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z",
   "status": "FAIL",
-  "rc": 1,
+  "rc": 2,
   "host": "pve01",
   "mode": "verify",
-  "component": "homelab-cluster-admin-update-visibility",
+  "component": "cluster-knowledge-base-error-system",
-  "started_at_utc": "2026-08-05T23:58:50Z",
+  "started_at_utc": "2026-08-05T23:59:50Z",
-  "finished_at_utc": "2026-08-05T23:58:51Z",
+  "finished_at_utc": "2026-08-05T23:59:55Z",
   "reference_register_checked": true,
   "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
   "error_register_checked": true,
   "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83",
-  "command_sha256": "8db5bea360afecb3dc91e7f4483af8eb5a71cdd276a32a2bdc47366363358575",
+  "command_sha256": "09b6606c2edf48917dc56d27d5e10e526f99f357ae27463d9459c5f3152472fd",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -21,7 +21,7 @@
   "result_contract_valid": true,
   "result_contract_status": null,
   "result_contract_error": null,
-  "command_rc": 1,
+  "command_rc": 2,
   "changes_made": false,
   "rollback_started": false,
   "rollback_restored": null,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "e3f31190c59af9293cee34aac7836c9a16164c176d8168b343f0bd120deaf2c3",
+  "raw_evidence_sha256": "53d38d4587051b38a7a63af7faf5baba2775e0db83bd8eac918f8cdd1f8398b6",
-  "sanitized_output_sha256": "e3f31190c59af9293cee34aac7836c9a16164c176d8168b343f0bd120deaf2c3",
+  "sanitized_output_sha256": "53d38d4587051b38a7a63af7faf5baba2775e0db83bd8eac918f8cdd1f8398b6",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-V39-INCIDENT-ENGINE-PATCH-TARGET-READ-ONLY-20260805T170500Z\",\"command_rc\":1,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"rc\":1,\"rollback_restored\":false,\"rollback_started\":false,\"status\":\"FAIL\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-V39-INCIDENT-ENGINE-PATCH-TARGET-READ-ONLY-20260805T170500Z\",\"error\":\"V38 report identity\",\"error_type\":\"RuntimeError\",\"mutation_outcome\":\"NO_MUTATION\",\"read_only\":true,\"rollback_restored\":false,\"rollback_started\":false,\"schema\":39,\"status\":\"FAIL\"}\n"
+  "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z\",\"command_rc\":2,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":2,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"ERROR\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z\",\"command_rc\":2,\"control_plane_error\":null,\"error_system_v2_future_record\":{\"classification\":\"GITEA_BRANCH_PROTECTION_REJECTS_DIRECT_PUSHER\",\"fingerprint\":\"40795f946c36fcaaf8413b2b46b1900a5df4771d93aeb24f2a596287df0a8023\",\"id\":\"GITEA_PROTECTED_MAIN_DIRECT_PUSH_DRY_RUN_FALSE_POSITIVE\",\"negative_control\":\"dry-run may return rc=0 without exercising the server-side protected-branch mutation decision\",\"normalized_signature\":\"gitea protected main rejects direct push while git push --dry-run succeeds; dry-run does not prove that the server-side protected-branch pre-receive path will accept a real update\",\"positive_control\":\"protected main has direct push disabled and the previous real push was rejected\",\"prevention_rule\":\"A successful git push --dry-run must never be treated as proof that a real update to a protected branch is allowed; the configured branch-protection write path must be proven separately by read-only evidence.\",\"regression_test_required\":true,\"space\":\"runtime\"},\"exact_error\":{\"code\":\"HTTP_READ_FAILED\",\"evidence\":{\"status\":404,\"url_sha256\":\"35cfa68b510e0f5b871072b99661ddf8f8726f808b5025114b925cd3b4c26cbe\"},\"message\":\"Read-only HTTP request failed\"},\"identity_confirmed\":false,\"mode\":\"READ_ONLY\",\"mutation_outcome\":\"NO_MUTATION\",\"next_step\":\"Prepare no mutation command until this read-only proof failure is resolved by exact evidence.\",\"output_truncated_in_json\":false,\"rc\":2,\"rollback_restored\":null,\"rollback_started\":false,\"schema\":\"homelab.read-only-diagnostic.v2\",\"status\":\"ERROR\"}\n"
 }

runtime/latest.txt

@@ -1,22 +1,22 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=HOMELAB-CLUSTER-ADMIN-UPDATES-V39-INCIDENT-ENGINE-PATCH-TARGET-READ-ONLY-20260805T170500Z
+COMMAND_ID=HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z
 STATUS=FAIL
-RC=1
+RC=2
 HOST=pve01
 MODE=verify
-COMPONENT=homelab-cluster-admin-update-visibility
+COMPONENT=cluster-knowledge-base-error-system
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
-COMMAND_SHA256=8db5bea360afecb3dc91e7f4483af8eb5a71cdd276a32a2bdc47366363358575
+COMMAND_SHA256=09b6606c2edf48917dc56d27d5e10e526f99f357ae27463d9459c5f3152472fd
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
 RESULT_CONTRACT_VALID=true
 RESULT_CONTRACT_STATUS=NOT_APPLICABLE
 RESULT_CONTRACT_ERROR=NONE
-COMMAND_RC=1
+COMMAND_RC=2
 CHANGES_MADE=false
 ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
@@ -24,11 +24,11 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=e3f31190c59af9293cee34aac7836c9a16164c176d8168b343f0bd120deaf2c3
+RAW_EVIDENCE_SHA256=53d38d4587051b38a7a63af7faf5baba2775e0db83bd8eac918f8cdd1f8398b6
-SANITIZED_OUTPUT_SHA256=e3f31190c59af9293cee34aac7836c9a16164c176d8168b343f0bd120deaf2c3
+SANITIZED_OUTPUT_SHA256=53d38d4587051b38a7a63af7faf5baba2775e0db83bd8eac918f8cdd1f8398b6
 OUTPUT_BEGIN
-HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-V39-INCIDENT-ENGINE-PATCH-TARGET-READ-ONLY-20260805T170500Z","command_rc":1,"control_plane_error":null,"mutation_outcome":"NO_MUTATION","rc":1,"rollback_restored":false,"rollback_started":false,"status":"FAIL","version":1}
+HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z","command_rc":2,"control_plane_error":null,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":2,"rollback_restored":null,"rollback_started":false,"status":"ERROR","version":1}
-{"changes_made":false,"command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-V39-INCIDENT-ENGINE-PATCH-TARGET-READ-ONLY-20260805T170500Z","error":"V38 report identity","error_type":"RuntimeError","mutation_outcome":"NO_MUTATION","read_only":true,"rollback_restored":false,"rollback_started":false,"schema":39,"status":"FAIL"}
+{"changes_made":false,"command_id":"HOMELAB-GITEA-ALLOWED-PUSH-PATH-DIAGNOSTIC-READ-ONLY-20260805T165900Z","command_rc":2,"control_plane_error":null,"error_system_v2_future_record":{"classification":"GITEA_BRANCH_PROTECTION_REJECTS_DIRECT_PUSHER","fingerprint":"40795f946c36fcaaf8413b2b46b1900a5df4771d93aeb24f2a596287df0a8023","id":"GITEA_PROTECTED_MAIN_DIRECT_PUSH_DRY_RUN_FALSE_POSITIVE","negative_control":"dry-run may return rc=0 without exercising the server-side protected-branch mutation decision","normalized_signature":"gitea protected main rejects direct push while git push --dry-run succeeds; dry-run does not prove that the server-side protected-branch pre-receive path will accept a real update","positive_control":"protected main has direct push disabled and the previous real push was rejected","prevention_rule":"A successful git push --dry-run must never be treated as proof that a real update to a protected branch is allowed; the configured branch-protection write path must be proven separately by read-only evidence.","regression_test_required":true,"space":"runtime"},"exact_error":{"code":"HTTP_READ_FAILED","evidence":{"status":404,"url_sha256":"35cfa68b510e0f5b871072b99661ddf8f8726f808b5025114b925cd3b4c26cbe"},"message":"Read-only HTTP request failed"},"identity_confirmed":false,"mode":"READ_ONLY","mutation_outcome":"NO_MUTATION","next_step":"Prepare no mutation command until this read-only proof failure is resolved by exact evidence.","output_truncated_in_json":false,"rc":2,"rollback_restored":null,"rollback_started":false,"schema":"homelab.read-only-diagnostic.v2","status":"ERROR"}
 
 OUTPUT_END
 CHAT_OUTPUT_END