From 2dacdad13dc45f69c19acc1b98cd17d63fbc3238 Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Wed, 5 Aug 2026 10:23:33 +0000 Subject: [PATCH] runtime: publish HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z --- ...INDING-FIX-READ-ONLY-20260805T101800Z.json | 38 +++++++++++++++++++ ...BINDING-FIX-READ-ONLY-20260805T101800Z.txt | 34 +++++++++++++++++ runtime/latest.json | 16 ++++---- runtime/latest.txt | 14 +++---- 4 files changed, 87 insertions(+), 15 deletions(-) create mode 100644 runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z.json create mode 100644 runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z.txt diff --git a/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z.json b/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z.json new file mode 100644 index 0000000..d896d63 --- /dev/null +++ b/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "verify", + "component": "cluster-knowledge-base-error-system", + "started_at_utc": "2026-08-05T10:23:32Z", + "finished_at_utc": "2026-08-05T10:23:32Z", + "reference_register_checked": true, + "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", + "error_register_checked": true, + "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", + "command_sha256": "3b7e894e96375cd9c2ca5acea57037c13b58ad5569671b2dc4d6b343cc338d1d", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "8da3c12ce5470a5e17ad5c50e548c57dc3f80d6483fadfe2fc0bd7d013d717e1", + "sanitized_output_sha256": "8da3c12ce5470a5e17ad5c50e548c57dc3f80d6483fadfe2fc0bd7d013d717e1", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z\",\"command_rc\":0,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z\",\"command_rc\":0,\"correction_of_previous_logic_gap\":{\"exact_fix\":\"extend only the AST assignment allowlist needed for safe module bindings: Path division and re.compile; bind MANIFEST, RESULTS and RESULT_RE to fake read-only objects, then test bounded manifest schemas without network or real filesystem access\",\"proven_gap\":\"the strict sandbox excluded module globals required by the real feed path; MANIFEST was undefined, so the Reader caught NameError and returned HTTP 500 before any file source was exercised\",\"regression_test\":\"a path-backed feed with ROOT, MANIFEST, RESULTS and RESULT_RE must materialize all bindings, execute at least two read-only fake file sources and return structured JSON; arbitrary calls remain excluded\"},\"error_fingerprint\":\"710c2ff6ffab246cdeee319e83f650f33579824a72451450821eec3e98894a98\",\"latest_exact_result_basis\":{\"capsule_sha256\":\"aafc3c311ebe6c17242be68b5c4d1a2efef03ee993f2cd2d01673ea6749044f2\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-EXECUTOR-ARGUMENT-ORIGIN-TRACE-READ-ONLY-20260805T100500Z\",\"command_rc\":0,\"control_plane_error\":null,\"error_fingerprint\":\"5df9f11405f92e576f437d2dc0523af74b62ac27efe7de6a4a8a4f5c1bd8ce05\",\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_SANDBOX_GLOBAL_BINDING_FIX\",\"output_complete\":true,\"output_sha256\":\"b457b303ad6344a464f5a9b843525f8abbeb40cb0ad7cf879be3e75e39efef69\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_FEED_CAUGHT_EXCEPTION_ORIGIN_PROVEN\",\"runner_document_rc\":0,\"runner_json_sha256\":\"fee9eec5d59e169a2e9c9f6f51ca3dfdfc08d0354e24383b773edabaf137f692\",\"runner_rc\":0,\"runner_text_sha256\":\"37a4214e3061489126a6ea5deec48c69788f95a9aefa19d3334514afba4decf3\",\"runner_wrapper_matches_document\":true,\"status\":\"OK\"},\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_UNRESOLVED_GLOBAL_BINDING_TRACE\",\"output_truncated_in_json\":false,\"owned_listeners\":[{\"address_class\":\"private\",\"address_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\",\"family\":\"ipv4\",\"inode\":\"24795\",\"port\":18788}],\"pre_command_known_error_gate\":{\"checked\":true,\"items\":[{\"id\":\"candidate-scan-limit-20260805\",\"prevention\":\"exact files only; bounded AST, simulation, response and output limits\"},{\"id\":\"runner-wrapper-mismatch-20260805\",\"prevention\":\"single compact JSON below 42000 bytes; no raw source, secret or response body\"},{\"id\":\"gitea-owner-hardcoded-20260805\",\"prevention\":\"no repository owner, guest ID or repository URL is assumed\"},{\"id\":\"gitea-git-auth-unavailable-20260805\",\"prevention\":\"no Git or Gitea authentication attempt\"},{\"id\":\"pvesh-adapter-context-unreadable-20260805\",\"prevention\":\"the payload does not call pvesh or any real executor\"},{\"id\":\"gitea-process-self-match-20260805\",\"prevention\":\"Reader identity is bound to exact systemd ControlGroup\"},{\"id\":\"sanitize-non-string-attributeerror-20260805\",\"prevention\":\"sanitize converts Any to str; embedded bool test\"},{\"id\":\"reader-path-env-misclassified-as-route-20260805\",\"prevention\":\"PATH and filesystem-like values are excluded from request candidates\"},{\"id\":\"reader-loopback-only-probe-20260805\",\"prevention\":\"owned listeners are inspected but no network connection is made\"},{\"id\":\"reader-capability-not-secret-20260805\",\"prevention\":\"capability values are redacted before every output projection\"},{\"id\":\"reader-systemd-unit-parsed-as-python-20260805\",\"prevention\":\"only the exact Python server source is parsed or compiled\"},{\"id\":\"reader-helper-contract-coverage-gap-20260805\",\"prevention\":\"all handler methods reachable from do_GET/do_HEAD are traced\"},{\"id\":\"reader-capability-root-empty-suffix-404-20260805\",\"prevention\":\"never infer inventory from capability-only paths; trace the exact post-prefix suffix and response branch with fake executors first\"},{\"id\":\"reader-generic-suffix-missed-exact-operation-20260805\",\"prevention\":\"derive route operations from exact compiled branch constants and intersect them with AST path literals before sandbox execution\"},{\"id\":\"reader-feed-500-without-origin-20260805\",\"prevention\":\"before any live feed request, trace global helper reachability, exact executor/file argument origins and caught sandbox exceptions; health alone never proves inventory safety\"},{\"id\":\"reader-sandbox-global-binding-undefined-20260805\",\"prevention\":\"materialize reachable module globals only through a strict AST allowlist; Path joins and re.compile are allowed, arbitrary calls are blocked, and MANIFEST/RESULTS/RESULT_RE are regression-tested before any live request\"}]},\"prevention_test\":{\"must_run_before_future_cluster_or_gitea_commands\":true,\"name\":\"reader_v3_sandbox_global_binding_preflight\",\"requirements\":[\"verify exact Reader source SHA and systemd identity\",\"materialize reachable module globals only through the strict AST allowlist\",\"require MANIFEST, RESULTS and RESULT_RE to be bound when referenced by the feed path\",\"exercise at least two fake read-only file sources and require structured JSON before any live request\",\"block arbitrary assignment calls and every real network, executor or filesystem mutation\",\"never output capability values, private addresses, raw source, regex text or response bodies\"]},\"process_environment\":{\"capability_name_present\":true,\"names\":[\"HOME\",\"HOMELAB_READER_CAPABILITY\",\"HOMELAB_READER_PORT\",\"INVOCATION_ID\",\"JOURNAL_STREAM\",\"LANG\",\"LOGNAME\",\"MEMORY_PRESSURE_WATCH\",\"MEMORY_PRESSURE_WRITE\",\"PATH\",\"SHELL\",\"SYSTEMD_EXEC_PID\",\"USER\"],\"secret_name_count\":1},\"rc\":0,\"read_only\":true,\"ready_for_live_inventory_probe\":false,\"real_executor_calls_made\":false,\"real_file_mutations_made\":false,\"real_network_requests_made\":false,\"result_projection\":{\"bytes_before_projection\":19965,\"compacted\":false,\"max_bytes\":36000},\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_FEED_CAUGHT_EXCEPTION_ORIGIN_PROVEN\",\"sandbox_global_binding_trace\":{\"caught_exception_types\":[\"AttributeError\",\"NameError\"],\"live_probe_contract_ready\":false,\"ready_variant_count\":0,\"variant_count\":4,\"variants\":[{\"all_effects_read_only\":false,\"body_bytes\":13,\"body_sha256\":\"326ce78e3deb6574ce072bbe8379c0e4deb1cb12c160a0f1a8161f8ddc6f4bd7\",\"caught_exception_count\":1,\"caught_exceptions\":[{\"line\":60,\"message\":\"name 'MANIFEST' is not defined\",\"message_sha256\":\"7ffaa9a9433abf55defe29684eca6160f703dc251b5b9ab47ccbd33b3dd3411c\",\"symbol\":\"handle_reader\",\"type\":\"NameError\"}],\"content_type\":\"text/plain; charset=utf-8\",\"data_source_call_count\":0,\"effect_call_count\":0,\"effects\":[],\"handler_error_count\":0,\"json\":null,\"live_probe_contract_ready\":false,\"module_projection\":{\"excluded_assignment_count\":6,\"excluded_assignment_names\":[\"CAPABILITY\",\"MANIFEST\",\"PORT\",\"RESULTS\",\"RESULT_RE\",\"ROOT\"],\"include_safe_assignments\":false,\"included_assignment_count\":0,\"included_assignment_names\":[]},\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"expires\",\"pragma\",\"surrogate-control\",\"x-robots-tag\"],\"route_template\":\"//feed\",\"source_call_count\":3,\"source_calls\":[{\"line\":42,\"symbol\":\"do_GET\"},{\"line\":45,\"symbol\":\"handle_reader\"},{\"line\":23,\"symbol\":\"reply\"}],\"status\":500,\"variant\":\"definitions-plus-resolved-scope-control\"},{\"all_effects_read_only\":true,\"body_bytes\":129,\"body_sha256\":\"85fe9cf154061b903ec7068c5f577d11b9d09e666a75d4f8dece450c8a17b18e\",\"caught_exception_count\":0,\"caught_exceptions\":[],\"content_type\":\"application/json; charset=utf-8\",\"data_source_call_count\":1,\"effect_call_count\":1,\"effects\":[{\"kind\":\"path.read_bytes\",\"mode\":\"r\",\"origin_type\":\"file\",\"path_class\":\"/var\",\"path_sha256\":\"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca\",\"read_only_basis\":\"file_read\",\"read_only_proven\":true}],\"handler_error_count\":0,\"json\":{\"top_key_count\":5,\"top_keys\":[\"entries\",\"files\",\"generation\",\"items\",\"results\"],\"type\":\"dict\"},\"live_probe_contract_ready\":false,\"module_projection\":{\"excluded_assignment_count\":0,\"excluded_assignment_names\":[],\"include_safe_assignments\":true,\"included_assignment_count\":6,\"included_assignment_names\":[\"CAPABILITY\",\"MANIFEST\",\"PORT\",\"RESULTS\",\"RESULT_RE\",\"ROOT\"]},\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"etag\",\"expires\",\"pragma\",\"surrogate-control\",\"x-homelab-generation\",\"x-robots-tag\"],\"route_template\":\"//feed\",\"source_call_count\":3,\"source_calls\":[{\"line\":42,\"symbol\":\"do_GET\"},{\"line\":45,\"symbol\":\"handle_reader\"},{\"line\":23,\"symbol\":\"reply\"}],\"status\":200,\"variant\":\"strict-global-bindings-filename-results\"},{\"all_effects_read_only\":true,\"body_bytes\":813,\"body_sha256\":\"2e75f532b93c25bd87988703fb5b3cc4611b2c8302f4059cd845a5a0d44b5cef\",\"caught_exception_count\":0,\"caught_exceptions\":[],\"content_type\":\"application/json; charset=utf-8\",\"data_source_call_count\":1,\"effect_call_count\":1,\"effects\":[{\"kind\":\"path.read_bytes\",\"mode\":\"r\",\"origin_type\":\"file\",\"path_class\":\"/var\",\"path_sha256\":\"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca\",\"read_only_basis\":\"file_read\",\"read_only_proven\":true}],\"handler_error_count\":0,\"json\":{\"top_key_count\":5,\"top_keys\":[\"entries\",\"files\",\"generation\",\"items\",\"results\"],\"type\":\"dict\"},\"live_probe_contract_ready\":false,\"module_projection\":{\"excluded_assignment_count\":0,\"excluded_assignment_names\":[],\"include_safe_assignments\":true,\"included_assignment_count\":6,\"included_assignment_names\":[\"CAPABILITY\",\"MANIFEST\",\"PORT\",\"RESULTS\",\"RESULT_RE\",\"ROOT\"]},\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"etag\",\"expires\",\"pragma\",\"surrogate-control\",\"x-homelab-generation\",\"x-robots-tag\"],\"route_template\":\"//feed\",\"source_call_count\":3,\"source_calls\":[{\"line\":42,\"symbol\":\"do_GET\"},{\"line\":45,\"symbol\":\"handle_reader\"},{\"line\":23,\"symbol\":\"reply\"}],\"status\":200,\"variant\":\"manifest-object-results\"},{\"all_effects_read_only\":true,\"body_bytes\":13,\"body_sha256\":\"326ce78e3deb6574ce072bbe8379c0e4deb1cb12c160a0f1a8161f8ddc6f4bd7\",\"caught_exception_count\":1,\"caught_exceptions\":[{\"line\":62,\"message\":\"'list' object has no attribute 'get'\",\"message_sha256\":\"73c2dbfd4deaed7a7fafa1d233c6631ae8d7650f0d5f3bce5a9da6386d739734\",\"symbol\":\"handle_reader\",\"type\":\"AttributeError\"}],\"content_type\":\"text/plain; charset=utf-8\",\"data_source_call_count\":1,\"effect_call_count\":1,\"effects\":[{\"kind\":\"path.read_bytes\",\"mode\":\"r\",\"origin_type\":\"file\",\"path_class\":\"/var\",\"path_sha256\":\"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca\",\"read_only_basis\":\"file_read\",\"read_only_proven\":true}],\"handler_error_count\":0,\"json\":null,\"live_probe_contract_ready\":false,\"module_projection\":{\"excluded_assignment_count\":0,\"excluded_assignment_names\":[],\"include_safe_assignments\":true,\"included_assignment_count\":6,\"included_assignment_names\":[\"CAPABILITY\",\"MANIFEST\",\"PORT\",\"RESULTS\",\"RESULT_RE\",\"ROOT\"]},\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"expires\",\"pragma\",\"surrogate-control\",\"x-robots-tag\"],\"route_template\":\"//feed\",\"source_call_count\":3,\"source_calls\":[{\"line\":42,\"symbol\":\"do_GET\"},{\"line\":45,\"symbol\":\"handle_reader\"},{\"line\":23,\"symbol\":\"reply\"}],\"status\":500,\"variant\":\"manifest-list\"}]},\"sanitized_bytecode_branch_trace\":{\"branch_instruction_count\":14,\"branch_literal_count\":7,\"branch_literal_templates\":[\"X-Homelab-Generation\",\"X-Robots-Tag\",\"feed\",\"health\",\"health-v3\",\"include_body\",\"results\"],\"bytecode_disassembly_emitted\":false,\"bytecode_literal_count\":28,\"call_instruction_count\":53,\"code_object_count\":8,\"compile_ok\":true,\"exact_branch_operation_count\":2,\"exact_compiled_operation_count\":2,\"operation_suffixes\":[\"feed\",\"health\"],\"operation_suffixes_sha256\":\"7b2583665af60a5f63c575c89ecaff1cd688710d29507b6d79238e5d9ca5e58b\",\"raw_source_emitted\":false,\"source_literal_count\":2},\"schema\":1,\"source_files\":[{\"actual_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"bytes\":580,\"expected_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"matches_expected\":true,\"path\":\"/etc/systemd/system/homelab-reader-v3.service\"},{\"actual_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"bytes\":3539,\"expected_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"matches_expected\":true,\"path\":\"/usr/local/sbin/homelab-reader-server-v3\"}],\"source_selection\":{\"raw_source_emitted\":false,\"selected_path\":\"/usr/local/sbin/homelab-reader-server-v3\",\"systemd_unit_excluded\":true},\"source_state\":\"MATCH\",\"static_executor_argument_origin_trace\":{\"all_resolved_origins_read_only\":true,\"call_edge_count\":3,\"call_edges\":[{\"from\":\"Handler.do_GET\",\"to\":\"Handler.handle_reader\"},{\"from\":\"Handler.do_HEAD\",\"to\":\"Handler.handle_reader\"},{\"from\":\"Handler.handle_reader\",\"to\":\"Handler.reply\"}],\"handler_roots\":[\"Handler.do_GET\",\"Handler.do_HEAD\"],\"raw_source_emitted\":false,\"reachable_data_origin_count\":2,\"reachable_data_origins\":[{\"argument_origin_names\":[],\"argument_resolved\":false,\"call\":\"MANIFEST.read_bytes\",\"evidence_sha256\":\"3b9f9140c901f027be26f124b8c983ccfddbb3a62b03a416b5e7bfbb19f9fe59\",\"kind\":\"file\",\"mode\":\"r\",\"origin_symbol\":\"Handler.handle_reader\",\"path_class\":null,\"path_sha256\":null,\"read_only_basis\":\"file_read\",\"read_only_proven\":true},{\"argument_origin_names\":[],\"argument_resolved\":false,\"call\":\"target.read_bytes\",\"evidence_sha256\":\"aa896c2be567c54cf2da0cf24792da33575188def3c5d95fda4745ed3de4fdaf\",\"kind\":\"file\",\"mode\":\"r\",\"origin_symbol\":\"Handler.handle_reader\",\"path_class\":null,\"path_sha256\":null,\"read_only_basis\":\"file_read\",\"read_only_proven\":true}],\"reachable_symbol_count\":4,\"reachable_symbols\":[\"Handler.do_GET\",\"Handler.do_HEAD\",\"Handler.handle_reader\",\"Handler.reply\"],\"unresolved_origin_count\":2},\"static_response_trace\":{\"ast_parse_ok\":true,\"capability_prefix_count\":1,\"capability_prefix_templates\":[\"//\"],\"handler_count\":1,\"reachable_methods\":[\"do_GET\",\"do_HEAD\",\"handle_reader\",\"reply\"],\"resolved_scope_names\":[\"CAPABILITY\",\"PORT\"],\"source_suffix_literal_count\":2,\"source_suffix_literal_templates\":[\"feed\",\"health\"]},\"status\":\"OK\",\"systemd_identity\":{\"identity_valid\":true,\"pid_count\":1,\"probe\":{\"duration_seconds\":0.006,\"rc\":0,\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_bytes\":375,\"stdout_sha256\":\"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9\",\"stdout_truncated\":false},\"properties\":{\"ActiveState\":\"active\",\"ControlGroup\":\"/system.slice/homelab-reader-v3.service\",\"ExecStart_present\":true,\"ExecStart_sha256\":\"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379\",\"FragmentPath\":\"/etc/systemd/system/homelab-reader-v3.service\",\"LoadState\":\"loaded\",\"MainPID\":\"1282\",\"SubState\":\"running\"}}}\n" +} diff --git a/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z.txt b/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z.txt new file mode 100644 index 0000000..201ef0c --- /dev/null +++ b/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z.txt @@ -0,0 +1,34 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z +STATUS=OK +RC=0 +HOST=pve01 +MODE=verify +COMPONENT=cluster-knowledge-base-error-system +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 +COMMAND_SHA256=3b7e894e96375cd9c2ca5acea57037c13b58ad5569671b2dc4d6b343cc338d1d +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=8da3c12ce5470a5e17ad5c50e548c57dc3f80d6483fadfe2fc0bd7d013d717e1 +SANITIZED_OUTPUT_SHA256=8da3c12ce5470a5e17ad5c50e548c57dc3f80d6483fadfe2fc0bd7d013d717e1 +OUTPUT_BEGIN +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1} +{"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z","command_rc":0,"correction_of_previous_logic_gap":{"exact_fix":"extend only the AST assignment allowlist needed for safe module bindings: Path division and re.compile; bind MANIFEST, RESULTS and RESULT_RE to fake read-only objects, then test bounded manifest schemas without network or real filesystem access","proven_gap":"the strict sandbox excluded module globals required by the real feed path; MANIFEST was undefined, so the Reader caught NameError and returned HTTP 500 before any file source was exercised","regression_test":"a path-backed feed with ROOT, MANIFEST, RESULTS and RESULT_RE must materialize all bindings, execute at least two read-only fake file sources and return structured JSON; arbitrary calls remain excluded"},"error_fingerprint":"710c2ff6ffab246cdeee319e83f650f33579824a72451450821eec3e98894a98","latest_exact_result_basis":{"capsule_sha256":"aafc3c311ebe6c17242be68b5c4d1a2efef03ee993f2cd2d01673ea6749044f2","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-EXECUTOR-ARGUMENT-ORIGIN-TRACE-READ-ONLY-20260805T100500Z","command_rc":0,"control_plane_error":null,"error_fingerprint":"5df9f11405f92e576f437d2dc0523af74b62ac27efe7de6a4a8a4f5c1bd8ce05","mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_SANDBOX_GLOBAL_BINDING_FIX","output_complete":true,"output_sha256":"b457b303ad6344a464f5a9b843525f8abbeb40cb0ad7cf879be3e75e39efef69","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_FEED_CAUGHT_EXCEPTION_ORIGIN_PROVEN","runner_document_rc":0,"runner_json_sha256":"fee9eec5d59e169a2e9c9f6f51ca3dfdfc08d0354e24383b773edabaf137f692","runner_rc":0,"runner_text_sha256":"37a4214e3061489126a6ea5deec48c69788f95a9aefa19d3334514afba4decf3","runner_wrapper_matches_document":true,"status":"OK"},"mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_UNRESOLVED_GLOBAL_BINDING_TRACE","output_truncated_in_json":false,"owned_listeners":[{"address_class":"private","address_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9","family":"ipv4","inode":"24795","port":18788}],"pre_command_known_error_gate":{"checked":true,"items":[{"id":"candidate-scan-limit-20260805","prevention":"exact files only; bounded AST, simulation, response and output limits"},{"id":"runner-wrapper-mismatch-20260805","prevention":"single compact JSON below 42000 bytes; no raw source, secret or response body"},{"id":"gitea-owner-hardcoded-20260805","prevention":"no repository owner, guest ID or repository URL is assumed"},{"id":"gitea-git-auth-unavailable-20260805","prevention":"no Git or Gitea authentication attempt"},{"id":"pvesh-adapter-context-unreadable-20260805","prevention":"the payload does not call pvesh or any real executor"},{"id":"gitea-process-self-match-20260805","prevention":"Reader identity is bound to exact systemd ControlGroup"},{"id":"sanitize-non-string-attributeerror-20260805","prevention":"sanitize converts Any to str; embedded bool test"},{"id":"reader-path-env-misclassified-as-route-20260805","prevention":"PATH and filesystem-like values are excluded from request candidates"},{"id":"reader-loopback-only-probe-20260805","prevention":"owned listeners are inspected but no network connection is made"},{"id":"reader-capability-not-secret-20260805","prevention":"capability values are redacted before every output projection"},{"id":"reader-systemd-unit-parsed-as-python-20260805","prevention":"only the exact Python server source is parsed or compiled"},{"id":"reader-helper-contract-coverage-gap-20260805","prevention":"all handler methods reachable from do_GET/do_HEAD are traced"},{"id":"reader-capability-root-empty-suffix-404-20260805","prevention":"never infer inventory from capability-only paths; trace the exact post-prefix suffix and response branch with fake executors first"},{"id":"reader-generic-suffix-missed-exact-operation-20260805","prevention":"derive route operations from exact compiled branch constants and intersect them with AST path literals before sandbox execution"},{"id":"reader-feed-500-without-origin-20260805","prevention":"before any live feed request, trace global helper reachability, exact executor/file argument origins and caught sandbox exceptions; health alone never proves inventory safety"},{"id":"reader-sandbox-global-binding-undefined-20260805","prevention":"materialize reachable module globals only through a strict AST allowlist; Path joins and re.compile are allowed, arbitrary calls are blocked, and MANIFEST/RESULTS/RESULT_RE are regression-tested before any live request"}]},"prevention_test":{"must_run_before_future_cluster_or_gitea_commands":true,"name":"reader_v3_sandbox_global_binding_preflight","requirements":["verify exact Reader source SHA and systemd identity","materialize reachable module globals only through the strict AST allowlist","require MANIFEST, RESULTS and RESULT_RE to be bound when referenced by the feed path","exercise at least two fake read-only file sources and require structured JSON before any live request","block arbitrary assignment calls and every real network, executor or filesystem mutation","never output capability values, private addresses, raw source, regex text or response bodies"]},"process_environment":{"capability_name_present":true,"names":["HOME","HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT","INVOCATION_ID","JOURNAL_STREAM","LANG","LOGNAME","MEMORY_PRESSURE_WATCH","MEMORY_PRESSURE_WRITE","PATH","SHELL","SYSTEMD_EXEC_PID","USER"],"secret_name_count":1},"rc":0,"read_only":true,"ready_for_live_inventory_probe":false,"real_executor_calls_made":false,"real_file_mutations_made":false,"real_network_requests_made":false,"result_projection":{"bytes_before_projection":19965,"compacted":false,"max_bytes":36000},"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_FEED_CAUGHT_EXCEPTION_ORIGIN_PROVEN","sandbox_global_binding_trace":{"caught_exception_types":["AttributeError","NameError"],"live_probe_contract_ready":false,"ready_variant_count":0,"variant_count":4,"variants":[{"all_effects_read_only":false,"body_bytes":13,"body_sha256":"326ce78e3deb6574ce072bbe8379c0e4deb1cb12c160a0f1a8161f8ddc6f4bd7","caught_exception_count":1,"caught_exceptions":[{"line":60,"message":"name 'MANIFEST' is not defined","message_sha256":"7ffaa9a9433abf55defe29684eca6160f703dc251b5b9ab47ccbd33b3dd3411c","symbol":"handle_reader","type":"NameError"}],"content_type":"text/plain; charset=utf-8","data_source_call_count":0,"effect_call_count":0,"effects":[],"handler_error_count":0,"json":null,"live_probe_contract_ready":false,"module_projection":{"excluded_assignment_count":6,"excluded_assignment_names":["CAPABILITY","MANIFEST","PORT","RESULTS","RESULT_RE","ROOT"],"include_safe_assignments":false,"included_assignment_count":0,"included_assignment_names":[]},"response_header_names":["cache-control","content-length","content-type","expires","pragma","surrogate-control","x-robots-tag"],"route_template":"//feed","source_call_count":3,"source_calls":[{"line":42,"symbol":"do_GET"},{"line":45,"symbol":"handle_reader"},{"line":23,"symbol":"reply"}],"status":500,"variant":"definitions-plus-resolved-scope-control"},{"all_effects_read_only":true,"body_bytes":129,"body_sha256":"85fe9cf154061b903ec7068c5f577d11b9d09e666a75d4f8dece450c8a17b18e","caught_exception_count":0,"caught_exceptions":[],"content_type":"application/json; charset=utf-8","data_source_call_count":1,"effect_call_count":1,"effects":[{"kind":"path.read_bytes","mode":"r","origin_type":"file","path_class":"/var","path_sha256":"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca","read_only_basis":"file_read","read_only_proven":true}],"handler_error_count":0,"json":{"top_key_count":5,"top_keys":["entries","files","generation","items","results"],"type":"dict"},"live_probe_contract_ready":false,"module_projection":{"excluded_assignment_count":0,"excluded_assignment_names":[],"include_safe_assignments":true,"included_assignment_count":6,"included_assignment_names":["CAPABILITY","MANIFEST","PORT","RESULTS","RESULT_RE","ROOT"]},"response_header_names":["cache-control","content-length","content-type","etag","expires","pragma","surrogate-control","x-homelab-generation","x-robots-tag"],"route_template":"//feed","source_call_count":3,"source_calls":[{"line":42,"symbol":"do_GET"},{"line":45,"symbol":"handle_reader"},{"line":23,"symbol":"reply"}],"status":200,"variant":"strict-global-bindings-filename-results"},{"all_effects_read_only":true,"body_bytes":813,"body_sha256":"2e75f532b93c25bd87988703fb5b3cc4611b2c8302f4059cd845a5a0d44b5cef","caught_exception_count":0,"caught_exceptions":[],"content_type":"application/json; charset=utf-8","data_source_call_count":1,"effect_call_count":1,"effects":[{"kind":"path.read_bytes","mode":"r","origin_type":"file","path_class":"/var","path_sha256":"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca","read_only_basis":"file_read","read_only_proven":true}],"handler_error_count":0,"json":{"top_key_count":5,"top_keys":["entries","files","generation","items","results"],"type":"dict"},"live_probe_contract_ready":false,"module_projection":{"excluded_assignment_count":0,"excluded_assignment_names":[],"include_safe_assignments":true,"included_assignment_count":6,"included_assignment_names":["CAPABILITY","MANIFEST","PORT","RESULTS","RESULT_RE","ROOT"]},"response_header_names":["cache-control","content-length","content-type","etag","expires","pragma","surrogate-control","x-homelab-generation","x-robots-tag"],"route_template":"//feed","source_call_count":3,"source_calls":[{"line":42,"symbol":"do_GET"},{"line":45,"symbol":"handle_reader"},{"line":23,"symbol":"reply"}],"status":200,"variant":"manifest-object-results"},{"all_effects_read_only":true,"body_bytes":13,"body_sha256":"326ce78e3deb6574ce072bbe8379c0e4deb1cb12c160a0f1a8161f8ddc6f4bd7","caught_exception_count":1,"caught_exceptions":[{"line":62,"message":"'list' object has no attribute 'get'","message_sha256":"73c2dbfd4deaed7a7fafa1d233c6631ae8d7650f0d5f3bce5a9da6386d739734","symbol":"handle_reader","type":"AttributeError"}],"content_type":"text/plain; charset=utf-8","data_source_call_count":1,"effect_call_count":1,"effects":[{"kind":"path.read_bytes","mode":"r","origin_type":"file","path_class":"/var","path_sha256":"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca","read_only_basis":"file_read","read_only_proven":true}],"handler_error_count":0,"json":null,"live_probe_contract_ready":false,"module_projection":{"excluded_assignment_count":0,"excluded_assignment_names":[],"include_safe_assignments":true,"included_assignment_count":6,"included_assignment_names":["CAPABILITY","MANIFEST","PORT","RESULTS","RESULT_RE","ROOT"]},"response_header_names":["cache-control","content-length","content-type","expires","pragma","surrogate-control","x-robots-tag"],"route_template":"//feed","source_call_count":3,"source_calls":[{"line":42,"symbol":"do_GET"},{"line":45,"symbol":"handle_reader"},{"line":23,"symbol":"reply"}],"status":500,"variant":"manifest-list"}]},"sanitized_bytecode_branch_trace":{"branch_instruction_count":14,"branch_literal_count":7,"branch_literal_templates":["X-Homelab-Generation","X-Robots-Tag","feed","health","health-v3","include_body","results"],"bytecode_disassembly_emitted":false,"bytecode_literal_count":28,"call_instruction_count":53,"code_object_count":8,"compile_ok":true,"exact_branch_operation_count":2,"exact_compiled_operation_count":2,"operation_suffixes":["feed","health"],"operation_suffixes_sha256":"7b2583665af60a5f63c575c89ecaff1cd688710d29507b6d79238e5d9ca5e58b","raw_source_emitted":false,"source_literal_count":2},"schema":1,"source_files":[{"actual_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","bytes":580,"expected_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","matches_expected":true,"path":"/etc/systemd/system/homelab-reader-v3.service"},{"actual_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","bytes":3539,"expected_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","matches_expected":true,"path":"/usr/local/sbin/homelab-reader-server-v3"}],"source_selection":{"raw_source_emitted":false,"selected_path":"/usr/local/sbin/homelab-reader-server-v3","systemd_unit_excluded":true},"source_state":"MATCH","static_executor_argument_origin_trace":{"all_resolved_origins_read_only":true,"call_edge_count":3,"call_edges":[{"from":"Handler.do_GET","to":"Handler.handle_reader"},{"from":"Handler.do_HEAD","to":"Handler.handle_reader"},{"from":"Handler.handle_reader","to":"Handler.reply"}],"handler_roots":["Handler.do_GET","Handler.do_HEAD"],"raw_source_emitted":false,"reachable_data_origin_count":2,"reachable_data_origins":[{"argument_origin_names":[],"argument_resolved":false,"call":"MANIFEST.read_bytes","evidence_sha256":"3b9f9140c901f027be26f124b8c983ccfddbb3a62b03a416b5e7bfbb19f9fe59","kind":"file","mode":"r","origin_symbol":"Handler.handle_reader","path_class":null,"path_sha256":null,"read_only_basis":"file_read","read_only_proven":true},{"argument_origin_names":[],"argument_resolved":false,"call":"target.read_bytes","evidence_sha256":"aa896c2be567c54cf2da0cf24792da33575188def3c5d95fda4745ed3de4fdaf","kind":"file","mode":"r","origin_symbol":"Handler.handle_reader","path_class":null,"path_sha256":null,"read_only_basis":"file_read","read_only_proven":true}],"reachable_symbol_count":4,"reachable_symbols":["Handler.do_GET","Handler.do_HEAD","Handler.handle_reader","Handler.reply"],"unresolved_origin_count":2},"static_response_trace":{"ast_parse_ok":true,"capability_prefix_count":1,"capability_prefix_templates":["//"],"handler_count":1,"reachable_methods":["do_GET","do_HEAD","handle_reader","reply"],"resolved_scope_names":["CAPABILITY","PORT"],"source_suffix_literal_count":2,"source_suffix_literal_templates":["feed","health"]},"status":"OK","systemd_identity":{"identity_valid":true,"pid_count":1,"probe":{"duration_seconds":0.006,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":375,"stdout_sha256":"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9","stdout_truncated":false},"properties":{"ActiveState":"active","ControlGroup":"/system.slice/homelab-reader-v3.service","ExecStart_present":true,"ExecStart_sha256":"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379","FragmentPath":"/etc/systemd/system/homelab-reader-v3.service","LoadState":"loaded","MainPID":"1282","SubState":"running"}}} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index fe31bad..d896d63 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "HOMELAB-CLUSTER-ADMIN-UPDATES-V4-V1-ERROR-READ-ONLY-20260805T102000Z", + "command_id": "HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z", "status": "OK", "rc": 0, "host": "pve01", "mode": "verify", - "component": "homelab-cluster-admin-update-visibility", - "started_at_utc": "2026-08-05T10:22:10Z", - "finished_at_utc": "2026-08-05T10:22:10Z", + "component": "cluster-knowledge-base-error-system", + "started_at_utc": "2026-08-05T10:23:32Z", + "finished_at_utc": "2026-08-05T10:23:32Z", "reference_register_checked": true, "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", "error_register_checked": true, "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", - "command_sha256": "2770186b855763857e28e90a11f1d5274eaf5eead326e4056c55da9e3b3574a0", + "command_sha256": "3b7e894e96375cd9c2ca5acea57037c13b58ad5569671b2dc4d6b343cc338d1d", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "b97b29eeaba8457c965324b3fa4b0d4f2c55eb9854900ac502f3421fd12c6990", - "sanitized_output_sha256": "b97b29eeaba8457c965324b3fa4b0d4f2c55eb9854900ac502f3421fd12c6990", + "raw_evidence_sha256": "8da3c12ce5470a5e17ad5c50e548c57dc3f80d6483fadfe2fc0bd7d013d717e1", + "sanitized_output_sha256": "8da3c12ce5470a5e17ad5c50e548c57dc3f80d6483fadfe2fc0bd7d013d717e1", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-V4-V1-ERROR-READ-ONLY-20260805T102000Z\",\"command_rc\":0,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"rc\":0,\"rollback_restored\":false,\"rollback_started\":false,\"status\":\"OK\",\"summary_bytes\":2767,\"summary_sha256\":\"7b2a9f6f52d91e54d68c293f0dca399ac21d4a3a277d19bb5064b6c33d4da733\",\"v1_capsule_sha256\":\"046ab0b658e0039c6a4fe886da08ebd9879331bafe35fed469d25397ad371696\",\"v1_command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z\",\"v1_exact_result_identity_confirmed\":true,\"v1_full_output_sha256\":\"1eb35f0774e26589f4ca703a49ca0b56a21e6cd3aad2e6f4cc351f117c506a5c\",\"v1_runner_json_sha256\":\"29884755d025c0e26b084dff1dec25738fa9eca5c2318481536aeaacc279fc0a\",\"v1_runner_text_sha256\":\"71e9e8c8552b73e8e1c88d294d79993116f30c5d50c8b52d4d459f845b961490\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-V4-V1-ERROR-READ-ONLY-20260805T102000Z\",\"mutation_outcome\":\"NO_MUTATION\",\"read_only\":true,\"rollback_restored\":false,\"rollback_started\":false,\"schema\":4,\"status\":\"OK\",\"v1_error\":{\"error\":\"pvesh /nodes did not return an array\",\"error_type\":\"RuntimeError\"},\"v1_exact_result_identity_confirmed\":true,\"v1_execution\":{\"changes_made\":false,\"command_rc\":1,\"control_plane_error\":null,\"full_output_read_and_parsed\":true,\"mutation_outcome\":\"NO_MUTATION\",\"output_source\":\"runner_json\",\"output_truncated_in_json\":false,\"rc\":1,\"rollback_restored\":null,\"rollback_started\":false,\"runner_document_rc\":1,\"runner_rc\":1,\"runner_wrapper_matches_document\":true,\"status\":\"FAIL\"},\"v1_full_output\":\"HOMELAB_RESULT_CONTRACT={\\\"changes_made\\\":false,\\\"command_id\\\":\\\"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z\\\",\\\"command_rc\\\":1,\\\"control_plane_error\\\":null,\\\"mutation_outcome\\\":\\\"NO_MUTATION\\\",\\\"rc\\\":1,\\\"rollback_restored\\\":false,\\\"rollback_started\\\":false,\\\"schema\\\":1,\\\"status\\\":\\\"FAIL\\\"}\\n{\\\"changes_made\\\":false,\\\"command_id\\\":\\\"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z\\\",\\\"error\\\":\\\"pvesh /nodes did not return an array\\\",\\\"error_type\\\":\\\"RuntimeError\\\",\\\"mutation_outcome\\\":\\\"NO_MUTATION\\\",\\\"read_only\\\":true,\\\"rollback_restored\\\":false,\\\"rollback_started\\\":false,\\\"schema\\\":1,\\\"status\\\":\\\"FAIL\\\"}\\n\",\"v1_identity\":{\"capsule_sha256\":\"046ab0b658e0039c6a4fe886da08ebd9879331bafe35fed469d25397ad371696\",\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z\",\"full_output_bytes\":603,\"full_output_sha256\":\"1eb35f0774e26589f4ca703a49ca0b56a21e6cd3aad2e6f4cc351f117c506a5c\",\"runner_json_sha256\":\"29884755d025c0e26b084dff1dec25738fa9eca5c2318481536aeaacc279fc0a\",\"runner_text_sha256\":\"71e9e8c8552b73e8e1c88d294d79993116f30c5d50c8b52d4d459f845b961490\",\"state_document_sha256\":\"73f2fd58388b13057a86833f107947911bdf39343661d78addf9bee58a9e4d0f\",\"state_documents_matching\":1,\"state_files_scanned\":323,\"state_path_sha256\":\"0410ec80c8641912fd7fd1074e50f37ff4e7713b708d2f90c56cd9bd49bee84e\",\"state_status\":\"FAIL\",\"unique_runner_paths\":1},\"v1_report\":{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z\",\"error\":\"pvesh /nodes did not return an array\",\"error_type\":\"RuntimeError\",\"mutation_outcome\":\"NO_MUTATION\",\"read_only\":true,\"rollback_restored\":false,\"rollback_started\":false,\"schema\":1,\"status\":\"FAIL\"},\"v1_result_contract\":{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z\",\"command_rc\":1,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"rc\":1,\"rollback_restored\":false,\"rollback_started\":false,\"schema\":1,\"status\":\"FAIL\"}}\n" + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z\",\"command_rc\":0,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z\",\"command_rc\":0,\"correction_of_previous_logic_gap\":{\"exact_fix\":\"extend only the AST assignment allowlist needed for safe module bindings: Path division and re.compile; bind MANIFEST, RESULTS and RESULT_RE to fake read-only objects, then test bounded manifest schemas without network or real filesystem access\",\"proven_gap\":\"the strict sandbox excluded module globals required by the real feed path; MANIFEST was undefined, so the Reader caught NameError and returned HTTP 500 before any file source was exercised\",\"regression_test\":\"a path-backed feed with ROOT, MANIFEST, RESULTS and RESULT_RE must materialize all bindings, execute at least two read-only fake file sources and return structured JSON; arbitrary calls remain excluded\"},\"error_fingerprint\":\"710c2ff6ffab246cdeee319e83f650f33579824a72451450821eec3e98894a98\",\"latest_exact_result_basis\":{\"capsule_sha256\":\"aafc3c311ebe6c17242be68b5c4d1a2efef03ee993f2cd2d01673ea6749044f2\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-EXECUTOR-ARGUMENT-ORIGIN-TRACE-READ-ONLY-20260805T100500Z\",\"command_rc\":0,\"control_plane_error\":null,\"error_fingerprint\":\"5df9f11405f92e576f437d2dc0523af74b62ac27efe7de6a4a8a4f5c1bd8ce05\",\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_SANDBOX_GLOBAL_BINDING_FIX\",\"output_complete\":true,\"output_sha256\":\"b457b303ad6344a464f5a9b843525f8abbeb40cb0ad7cf879be3e75e39efef69\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_FEED_CAUGHT_EXCEPTION_ORIGIN_PROVEN\",\"runner_document_rc\":0,\"runner_json_sha256\":\"fee9eec5d59e169a2e9c9f6f51ca3dfdfc08d0354e24383b773edabaf137f692\",\"runner_rc\":0,\"runner_text_sha256\":\"37a4214e3061489126a6ea5deec48c69788f95a9aefa19d3334514afba4decf3\",\"runner_wrapper_matches_document\":true,\"status\":\"OK\"},\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_UNRESOLVED_GLOBAL_BINDING_TRACE\",\"output_truncated_in_json\":false,\"owned_listeners\":[{\"address_class\":\"private\",\"address_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\",\"family\":\"ipv4\",\"inode\":\"24795\",\"port\":18788}],\"pre_command_known_error_gate\":{\"checked\":true,\"items\":[{\"id\":\"candidate-scan-limit-20260805\",\"prevention\":\"exact files only; bounded AST, simulation, response and output limits\"},{\"id\":\"runner-wrapper-mismatch-20260805\",\"prevention\":\"single compact JSON below 42000 bytes; no raw source, secret or response body\"},{\"id\":\"gitea-owner-hardcoded-20260805\",\"prevention\":\"no repository owner, guest ID or repository URL is assumed\"},{\"id\":\"gitea-git-auth-unavailable-20260805\",\"prevention\":\"no Git or Gitea authentication attempt\"},{\"id\":\"pvesh-adapter-context-unreadable-20260805\",\"prevention\":\"the payload does not call pvesh or any real executor\"},{\"id\":\"gitea-process-self-match-20260805\",\"prevention\":\"Reader identity is bound to exact systemd ControlGroup\"},{\"id\":\"sanitize-non-string-attributeerror-20260805\",\"prevention\":\"sanitize converts Any to str; embedded bool test\"},{\"id\":\"reader-path-env-misclassified-as-route-20260805\",\"prevention\":\"PATH and filesystem-like values are excluded from request candidates\"},{\"id\":\"reader-loopback-only-probe-20260805\",\"prevention\":\"owned listeners are inspected but no network connection is made\"},{\"id\":\"reader-capability-not-secret-20260805\",\"prevention\":\"capability values are redacted before every output projection\"},{\"id\":\"reader-systemd-unit-parsed-as-python-20260805\",\"prevention\":\"only the exact Python server source is parsed or compiled\"},{\"id\":\"reader-helper-contract-coverage-gap-20260805\",\"prevention\":\"all handler methods reachable from do_GET/do_HEAD are traced\"},{\"id\":\"reader-capability-root-empty-suffix-404-20260805\",\"prevention\":\"never infer inventory from capability-only paths; trace the exact post-prefix suffix and response branch with fake executors first\"},{\"id\":\"reader-generic-suffix-missed-exact-operation-20260805\",\"prevention\":\"derive route operations from exact compiled branch constants and intersect them with AST path literals before sandbox execution\"},{\"id\":\"reader-feed-500-without-origin-20260805\",\"prevention\":\"before any live feed request, trace global helper reachability, exact executor/file argument origins and caught sandbox exceptions; health alone never proves inventory safety\"},{\"id\":\"reader-sandbox-global-binding-undefined-20260805\",\"prevention\":\"materialize reachable module globals only through a strict AST allowlist; Path joins and re.compile are allowed, arbitrary calls are blocked, and MANIFEST/RESULTS/RESULT_RE are regression-tested before any live request\"}]},\"prevention_test\":{\"must_run_before_future_cluster_or_gitea_commands\":true,\"name\":\"reader_v3_sandbox_global_binding_preflight\",\"requirements\":[\"verify exact Reader source SHA and systemd identity\",\"materialize reachable module globals only through the strict AST allowlist\",\"require MANIFEST, RESULTS and RESULT_RE to be bound when referenced by the feed path\",\"exercise at least two fake read-only file sources and require structured JSON before any live request\",\"block arbitrary assignment calls and every real network, executor or filesystem mutation\",\"never output capability values, private addresses, raw source, regex text or response bodies\"]},\"process_environment\":{\"capability_name_present\":true,\"names\":[\"HOME\",\"HOMELAB_READER_CAPABILITY\",\"HOMELAB_READER_PORT\",\"INVOCATION_ID\",\"JOURNAL_STREAM\",\"LANG\",\"LOGNAME\",\"MEMORY_PRESSURE_WATCH\",\"MEMORY_PRESSURE_WRITE\",\"PATH\",\"SHELL\",\"SYSTEMD_EXEC_PID\",\"USER\"],\"secret_name_count\":1},\"rc\":0,\"read_only\":true,\"ready_for_live_inventory_probe\":false,\"real_executor_calls_made\":false,\"real_file_mutations_made\":false,\"real_network_requests_made\":false,\"result_projection\":{\"bytes_before_projection\":19965,\"compacted\":false,\"max_bytes\":36000},\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_FEED_CAUGHT_EXCEPTION_ORIGIN_PROVEN\",\"sandbox_global_binding_trace\":{\"caught_exception_types\":[\"AttributeError\",\"NameError\"],\"live_probe_contract_ready\":false,\"ready_variant_count\":0,\"variant_count\":4,\"variants\":[{\"all_effects_read_only\":false,\"body_bytes\":13,\"body_sha256\":\"326ce78e3deb6574ce072bbe8379c0e4deb1cb12c160a0f1a8161f8ddc6f4bd7\",\"caught_exception_count\":1,\"caught_exceptions\":[{\"line\":60,\"message\":\"name 'MANIFEST' is not defined\",\"message_sha256\":\"7ffaa9a9433abf55defe29684eca6160f703dc251b5b9ab47ccbd33b3dd3411c\",\"symbol\":\"handle_reader\",\"type\":\"NameError\"}],\"content_type\":\"text/plain; charset=utf-8\",\"data_source_call_count\":0,\"effect_call_count\":0,\"effects\":[],\"handler_error_count\":0,\"json\":null,\"live_probe_contract_ready\":false,\"module_projection\":{\"excluded_assignment_count\":6,\"excluded_assignment_names\":[\"CAPABILITY\",\"MANIFEST\",\"PORT\",\"RESULTS\",\"RESULT_RE\",\"ROOT\"],\"include_safe_assignments\":false,\"included_assignment_count\":0,\"included_assignment_names\":[]},\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"expires\",\"pragma\",\"surrogate-control\",\"x-robots-tag\"],\"route_template\":\"//feed\",\"source_call_count\":3,\"source_calls\":[{\"line\":42,\"symbol\":\"do_GET\"},{\"line\":45,\"symbol\":\"handle_reader\"},{\"line\":23,\"symbol\":\"reply\"}],\"status\":500,\"variant\":\"definitions-plus-resolved-scope-control\"},{\"all_effects_read_only\":true,\"body_bytes\":129,\"body_sha256\":\"85fe9cf154061b903ec7068c5f577d11b9d09e666a75d4f8dece450c8a17b18e\",\"caught_exception_count\":0,\"caught_exceptions\":[],\"content_type\":\"application/json; charset=utf-8\",\"data_source_call_count\":1,\"effect_call_count\":1,\"effects\":[{\"kind\":\"path.read_bytes\",\"mode\":\"r\",\"origin_type\":\"file\",\"path_class\":\"/var\",\"path_sha256\":\"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca\",\"read_only_basis\":\"file_read\",\"read_only_proven\":true}],\"handler_error_count\":0,\"json\":{\"top_key_count\":5,\"top_keys\":[\"entries\",\"files\",\"generation\",\"items\",\"results\"],\"type\":\"dict\"},\"live_probe_contract_ready\":false,\"module_projection\":{\"excluded_assignment_count\":0,\"excluded_assignment_names\":[],\"include_safe_assignments\":true,\"included_assignment_count\":6,\"included_assignment_names\":[\"CAPABILITY\",\"MANIFEST\",\"PORT\",\"RESULTS\",\"RESULT_RE\",\"ROOT\"]},\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"etag\",\"expires\",\"pragma\",\"surrogate-control\",\"x-homelab-generation\",\"x-robots-tag\"],\"route_template\":\"//feed\",\"source_call_count\":3,\"source_calls\":[{\"line\":42,\"symbol\":\"do_GET\"},{\"line\":45,\"symbol\":\"handle_reader\"},{\"line\":23,\"symbol\":\"reply\"}],\"status\":200,\"variant\":\"strict-global-bindings-filename-results\"},{\"all_effects_read_only\":true,\"body_bytes\":813,\"body_sha256\":\"2e75f532b93c25bd87988703fb5b3cc4611b2c8302f4059cd845a5a0d44b5cef\",\"caught_exception_count\":0,\"caught_exceptions\":[],\"content_type\":\"application/json; charset=utf-8\",\"data_source_call_count\":1,\"effect_call_count\":1,\"effects\":[{\"kind\":\"path.read_bytes\",\"mode\":\"r\",\"origin_type\":\"file\",\"path_class\":\"/var\",\"path_sha256\":\"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca\",\"read_only_basis\":\"file_read\",\"read_only_proven\":true}],\"handler_error_count\":0,\"json\":{\"top_key_count\":5,\"top_keys\":[\"entries\",\"files\",\"generation\",\"items\",\"results\"],\"type\":\"dict\"},\"live_probe_contract_ready\":false,\"module_projection\":{\"excluded_assignment_count\":0,\"excluded_assignment_names\":[],\"include_safe_assignments\":true,\"included_assignment_count\":6,\"included_assignment_names\":[\"CAPABILITY\",\"MANIFEST\",\"PORT\",\"RESULTS\",\"RESULT_RE\",\"ROOT\"]},\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"etag\",\"expires\",\"pragma\",\"surrogate-control\",\"x-homelab-generation\",\"x-robots-tag\"],\"route_template\":\"//feed\",\"source_call_count\":3,\"source_calls\":[{\"line\":42,\"symbol\":\"do_GET\"},{\"line\":45,\"symbol\":\"handle_reader\"},{\"line\":23,\"symbol\":\"reply\"}],\"status\":200,\"variant\":\"manifest-object-results\"},{\"all_effects_read_only\":true,\"body_bytes\":13,\"body_sha256\":\"326ce78e3deb6574ce072bbe8379c0e4deb1cb12c160a0f1a8161f8ddc6f4bd7\",\"caught_exception_count\":1,\"caught_exceptions\":[{\"line\":62,\"message\":\"'list' object has no attribute 'get'\",\"message_sha256\":\"73c2dbfd4deaed7a7fafa1d233c6631ae8d7650f0d5f3bce5a9da6386d739734\",\"symbol\":\"handle_reader\",\"type\":\"AttributeError\"}],\"content_type\":\"text/plain; charset=utf-8\",\"data_source_call_count\":1,\"effect_call_count\":1,\"effects\":[{\"kind\":\"path.read_bytes\",\"mode\":\"r\",\"origin_type\":\"file\",\"path_class\":\"/var\",\"path_sha256\":\"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca\",\"read_only_basis\":\"file_read\",\"read_only_proven\":true}],\"handler_error_count\":0,\"json\":null,\"live_probe_contract_ready\":false,\"module_projection\":{\"excluded_assignment_count\":0,\"excluded_assignment_names\":[],\"include_safe_assignments\":true,\"included_assignment_count\":6,\"included_assignment_names\":[\"CAPABILITY\",\"MANIFEST\",\"PORT\",\"RESULTS\",\"RESULT_RE\",\"ROOT\"]},\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"expires\",\"pragma\",\"surrogate-control\",\"x-robots-tag\"],\"route_template\":\"//feed\",\"source_call_count\":3,\"source_calls\":[{\"line\":42,\"symbol\":\"do_GET\"},{\"line\":45,\"symbol\":\"handle_reader\"},{\"line\":23,\"symbol\":\"reply\"}],\"status\":500,\"variant\":\"manifest-list\"}]},\"sanitized_bytecode_branch_trace\":{\"branch_instruction_count\":14,\"branch_literal_count\":7,\"branch_literal_templates\":[\"X-Homelab-Generation\",\"X-Robots-Tag\",\"feed\",\"health\",\"health-v3\",\"include_body\",\"results\"],\"bytecode_disassembly_emitted\":false,\"bytecode_literal_count\":28,\"call_instruction_count\":53,\"code_object_count\":8,\"compile_ok\":true,\"exact_branch_operation_count\":2,\"exact_compiled_operation_count\":2,\"operation_suffixes\":[\"feed\",\"health\"],\"operation_suffixes_sha256\":\"7b2583665af60a5f63c575c89ecaff1cd688710d29507b6d79238e5d9ca5e58b\",\"raw_source_emitted\":false,\"source_literal_count\":2},\"schema\":1,\"source_files\":[{\"actual_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"bytes\":580,\"expected_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"matches_expected\":true,\"path\":\"/etc/systemd/system/homelab-reader-v3.service\"},{\"actual_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"bytes\":3539,\"expected_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"matches_expected\":true,\"path\":\"/usr/local/sbin/homelab-reader-server-v3\"}],\"source_selection\":{\"raw_source_emitted\":false,\"selected_path\":\"/usr/local/sbin/homelab-reader-server-v3\",\"systemd_unit_excluded\":true},\"source_state\":\"MATCH\",\"static_executor_argument_origin_trace\":{\"all_resolved_origins_read_only\":true,\"call_edge_count\":3,\"call_edges\":[{\"from\":\"Handler.do_GET\",\"to\":\"Handler.handle_reader\"},{\"from\":\"Handler.do_HEAD\",\"to\":\"Handler.handle_reader\"},{\"from\":\"Handler.handle_reader\",\"to\":\"Handler.reply\"}],\"handler_roots\":[\"Handler.do_GET\",\"Handler.do_HEAD\"],\"raw_source_emitted\":false,\"reachable_data_origin_count\":2,\"reachable_data_origins\":[{\"argument_origin_names\":[],\"argument_resolved\":false,\"call\":\"MANIFEST.read_bytes\",\"evidence_sha256\":\"3b9f9140c901f027be26f124b8c983ccfddbb3a62b03a416b5e7bfbb19f9fe59\",\"kind\":\"file\",\"mode\":\"r\",\"origin_symbol\":\"Handler.handle_reader\",\"path_class\":null,\"path_sha256\":null,\"read_only_basis\":\"file_read\",\"read_only_proven\":true},{\"argument_origin_names\":[],\"argument_resolved\":false,\"call\":\"target.read_bytes\",\"evidence_sha256\":\"aa896c2be567c54cf2da0cf24792da33575188def3c5d95fda4745ed3de4fdaf\",\"kind\":\"file\",\"mode\":\"r\",\"origin_symbol\":\"Handler.handle_reader\",\"path_class\":null,\"path_sha256\":null,\"read_only_basis\":\"file_read\",\"read_only_proven\":true}],\"reachable_symbol_count\":4,\"reachable_symbols\":[\"Handler.do_GET\",\"Handler.do_HEAD\",\"Handler.handle_reader\",\"Handler.reply\"],\"unresolved_origin_count\":2},\"static_response_trace\":{\"ast_parse_ok\":true,\"capability_prefix_count\":1,\"capability_prefix_templates\":[\"//\"],\"handler_count\":1,\"reachable_methods\":[\"do_GET\",\"do_HEAD\",\"handle_reader\",\"reply\"],\"resolved_scope_names\":[\"CAPABILITY\",\"PORT\"],\"source_suffix_literal_count\":2,\"source_suffix_literal_templates\":[\"feed\",\"health\"]},\"status\":\"OK\",\"systemd_identity\":{\"identity_valid\":true,\"pid_count\":1,\"probe\":{\"duration_seconds\":0.006,\"rc\":0,\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_bytes\":375,\"stdout_sha256\":\"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9\",\"stdout_truncated\":false},\"properties\":{\"ActiveState\":\"active\",\"ControlGroup\":\"/system.slice/homelab-reader-v3.service\",\"ExecStart_present\":true,\"ExecStart_sha256\":\"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379\",\"FragmentPath\":\"/etc/systemd/system/homelab-reader-v3.service\",\"LoadState\":\"loaded\",\"MainPID\":\"1282\",\"SubState\":\"running\"}}}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 2c99de8..201ef0c 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,15 +1,15 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=HOMELAB-CLUSTER-ADMIN-UPDATES-V4-V1-ERROR-READ-ONLY-20260805T102000Z +COMMAND_ID=HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z STATUS=OK RC=0 HOST=pve01 MODE=verify -COMPONENT=homelab-cluster-admin-update-visibility +COMPONENT=cluster-knowledge-base-error-system REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 -COMMAND_SHA256=2770186b855763857e28e90a11f1d5274eaf5eead326e4056c55da9e3b3574a0 +COMMAND_SHA256=3b7e894e96375cd9c2ca5acea57037c13b58ad5569671b2dc4d6b343cc338d1d DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false @@ -24,11 +24,11 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=b97b29eeaba8457c965324b3fa4b0d4f2c55eb9854900ac502f3421fd12c6990 -SANITIZED_OUTPUT_SHA256=b97b29eeaba8457c965324b3fa4b0d4f2c55eb9854900ac502f3421fd12c6990 +RAW_EVIDENCE_SHA256=8da3c12ce5470a5e17ad5c50e548c57dc3f80d6483fadfe2fc0bd7d013d717e1 +SANITIZED_OUTPUT_SHA256=8da3c12ce5470a5e17ad5c50e548c57dc3f80d6483fadfe2fc0bd7d013d717e1 OUTPUT_BEGIN -HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-V4-V1-ERROR-READ-ONLY-20260805T102000Z","command_rc":0,"control_plane_error":null,"mutation_outcome":"NO_MUTATION","rc":0,"rollback_restored":false,"rollback_started":false,"status":"OK","summary_bytes":2767,"summary_sha256":"7b2a9f6f52d91e54d68c293f0dca399ac21d4a3a277d19bb5064b6c33d4da733","v1_capsule_sha256":"046ab0b658e0039c6a4fe886da08ebd9879331bafe35fed469d25397ad371696","v1_command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z","v1_exact_result_identity_confirmed":true,"v1_full_output_sha256":"1eb35f0774e26589f4ca703a49ca0b56a21e6cd3aad2e6f4cc351f117c506a5c","v1_runner_json_sha256":"29884755d025c0e26b084dff1dec25738fa9eca5c2318481536aeaacc279fc0a","v1_runner_text_sha256":"71e9e8c8552b73e8e1c88d294d79993116f30c5d50c8b52d4d459f845b961490","version":1} -{"changes_made":false,"command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-V4-V1-ERROR-READ-ONLY-20260805T102000Z","mutation_outcome":"NO_MUTATION","read_only":true,"rollback_restored":false,"rollback_started":false,"schema":4,"status":"OK","v1_error":{"error":"pvesh /nodes did not return an array","error_type":"RuntimeError"},"v1_exact_result_identity_confirmed":true,"v1_execution":{"changes_made":false,"command_rc":1,"control_plane_error":null,"full_output_read_and_parsed":true,"mutation_outcome":"NO_MUTATION","output_source":"runner_json","output_truncated_in_json":false,"rc":1,"rollback_restored":null,"rollback_started":false,"runner_document_rc":1,"runner_rc":1,"runner_wrapper_matches_document":true,"status":"FAIL"},"v1_full_output":"HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z\",\"command_rc\":1,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"rc\":1,\"rollback_restored\":false,\"rollback_started\":false,\"schema\":1,\"status\":\"FAIL\"}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z\",\"error\":\"pvesh /nodes did not return an array\",\"error_type\":\"RuntimeError\",\"mutation_outcome\":\"NO_MUTATION\",\"read_only\":true,\"rollback_restored\":false,\"rollback_started\":false,\"schema\":1,\"status\":\"FAIL\"}\n","v1_identity":{"capsule_sha256":"046ab0b658e0039c6a4fe886da08ebd9879331bafe35fed469d25397ad371696","command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z","full_output_bytes":603,"full_output_sha256":"1eb35f0774e26589f4ca703a49ca0b56a21e6cd3aad2e6f4cc351f117c506a5c","runner_json_sha256":"29884755d025c0e26b084dff1dec25738fa9eca5c2318481536aeaacc279fc0a","runner_text_sha256":"71e9e8c8552b73e8e1c88d294d79993116f30c5d50c8b52d4d459f845b961490","state_document_sha256":"73f2fd58388b13057a86833f107947911bdf39343661d78addf9bee58a9e4d0f","state_documents_matching":1,"state_files_scanned":323,"state_path_sha256":"0410ec80c8641912fd7fd1074e50f37ff4e7713b708d2f90c56cd9bd49bee84e","state_status":"FAIL","unique_runner_paths":1},"v1_report":{"changes_made":false,"command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z","error":"pvesh /nodes did not return an array","error_type":"RuntimeError","mutation_outcome":"NO_MUTATION","read_only":true,"rollback_restored":false,"rollback_started":false,"schema":1,"status":"FAIL"},"v1_result_contract":{"changes_made":false,"command_id":"HOMELAB-CLUSTER-ADMIN-UPDATES-DISCOVERY-V1-READ-ONLY-20260805T094500Z","command_rc":1,"control_plane_error":null,"mutation_outcome":"NO_MUTATION","rc":1,"rollback_restored":false,"rollback_started":false,"schema":1,"status":"FAIL"}} +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1} +{"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-SANDBOX-GLOBAL-BINDING-FIX-READ-ONLY-20260805T101800Z","command_rc":0,"correction_of_previous_logic_gap":{"exact_fix":"extend only the AST assignment allowlist needed for safe module bindings: Path division and re.compile; bind MANIFEST, RESULTS and RESULT_RE to fake read-only objects, then test bounded manifest schemas without network or real filesystem access","proven_gap":"the strict sandbox excluded module globals required by the real feed path; MANIFEST was undefined, so the Reader caught NameError and returned HTTP 500 before any file source was exercised","regression_test":"a path-backed feed with ROOT, MANIFEST, RESULTS and RESULT_RE must materialize all bindings, execute at least two read-only fake file sources and return structured JSON; arbitrary calls remain excluded"},"error_fingerprint":"710c2ff6ffab246cdeee319e83f650f33579824a72451450821eec3e98894a98","latest_exact_result_basis":{"capsule_sha256":"aafc3c311ebe6c17242be68b5c4d1a2efef03ee993f2cd2d01673ea6749044f2","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-EXECUTOR-ARGUMENT-ORIGIN-TRACE-READ-ONLY-20260805T100500Z","command_rc":0,"control_plane_error":null,"error_fingerprint":"5df9f11405f92e576f437d2dc0523af74b62ac27efe7de6a4a8a4f5c1bd8ce05","mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_SANDBOX_GLOBAL_BINDING_FIX","output_complete":true,"output_sha256":"b457b303ad6344a464f5a9b843525f8abbeb40cb0ad7cf879be3e75e39efef69","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_FEED_CAUGHT_EXCEPTION_ORIGIN_PROVEN","runner_document_rc":0,"runner_json_sha256":"fee9eec5d59e169a2e9c9f6f51ca3dfdfc08d0354e24383b773edabaf137f692","runner_rc":0,"runner_text_sha256":"37a4214e3061489126a6ea5deec48c69788f95a9aefa19d3334514afba4decf3","runner_wrapper_matches_document":true,"status":"OK"},"mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_UNRESOLVED_GLOBAL_BINDING_TRACE","output_truncated_in_json":false,"owned_listeners":[{"address_class":"private","address_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9","family":"ipv4","inode":"24795","port":18788}],"pre_command_known_error_gate":{"checked":true,"items":[{"id":"candidate-scan-limit-20260805","prevention":"exact files only; bounded AST, simulation, response and output limits"},{"id":"runner-wrapper-mismatch-20260805","prevention":"single compact JSON below 42000 bytes; no raw source, secret or response body"},{"id":"gitea-owner-hardcoded-20260805","prevention":"no repository owner, guest ID or repository URL is assumed"},{"id":"gitea-git-auth-unavailable-20260805","prevention":"no Git or Gitea authentication attempt"},{"id":"pvesh-adapter-context-unreadable-20260805","prevention":"the payload does not call pvesh or any real executor"},{"id":"gitea-process-self-match-20260805","prevention":"Reader identity is bound to exact systemd ControlGroup"},{"id":"sanitize-non-string-attributeerror-20260805","prevention":"sanitize converts Any to str; embedded bool test"},{"id":"reader-path-env-misclassified-as-route-20260805","prevention":"PATH and filesystem-like values are excluded from request candidates"},{"id":"reader-loopback-only-probe-20260805","prevention":"owned listeners are inspected but no network connection is made"},{"id":"reader-capability-not-secret-20260805","prevention":"capability values are redacted before every output projection"},{"id":"reader-systemd-unit-parsed-as-python-20260805","prevention":"only the exact Python server source is parsed or compiled"},{"id":"reader-helper-contract-coverage-gap-20260805","prevention":"all handler methods reachable from do_GET/do_HEAD are traced"},{"id":"reader-capability-root-empty-suffix-404-20260805","prevention":"never infer inventory from capability-only paths; trace the exact post-prefix suffix and response branch with fake executors first"},{"id":"reader-generic-suffix-missed-exact-operation-20260805","prevention":"derive route operations from exact compiled branch constants and intersect them with AST path literals before sandbox execution"},{"id":"reader-feed-500-without-origin-20260805","prevention":"before any live feed request, trace global helper reachability, exact executor/file argument origins and caught sandbox exceptions; health alone never proves inventory safety"},{"id":"reader-sandbox-global-binding-undefined-20260805","prevention":"materialize reachable module globals only through a strict AST allowlist; Path joins and re.compile are allowed, arbitrary calls are blocked, and MANIFEST/RESULTS/RESULT_RE are regression-tested before any live request"}]},"prevention_test":{"must_run_before_future_cluster_or_gitea_commands":true,"name":"reader_v3_sandbox_global_binding_preflight","requirements":["verify exact Reader source SHA and systemd identity","materialize reachable module globals only through the strict AST allowlist","require MANIFEST, RESULTS and RESULT_RE to be bound when referenced by the feed path","exercise at least two fake read-only file sources and require structured JSON before any live request","block arbitrary assignment calls and every real network, executor or filesystem mutation","never output capability values, private addresses, raw source, regex text or response bodies"]},"process_environment":{"capability_name_present":true,"names":["HOME","HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT","INVOCATION_ID","JOURNAL_STREAM","LANG","LOGNAME","MEMORY_PRESSURE_WATCH","MEMORY_PRESSURE_WRITE","PATH","SHELL","SYSTEMD_EXEC_PID","USER"],"secret_name_count":1},"rc":0,"read_only":true,"ready_for_live_inventory_probe":false,"real_executor_calls_made":false,"real_file_mutations_made":false,"real_network_requests_made":false,"result_projection":{"bytes_before_projection":19965,"compacted":false,"max_bytes":36000},"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_FEED_CAUGHT_EXCEPTION_ORIGIN_PROVEN","sandbox_global_binding_trace":{"caught_exception_types":["AttributeError","NameError"],"live_probe_contract_ready":false,"ready_variant_count":0,"variant_count":4,"variants":[{"all_effects_read_only":false,"body_bytes":13,"body_sha256":"326ce78e3deb6574ce072bbe8379c0e4deb1cb12c160a0f1a8161f8ddc6f4bd7","caught_exception_count":1,"caught_exceptions":[{"line":60,"message":"name 'MANIFEST' is not defined","message_sha256":"7ffaa9a9433abf55defe29684eca6160f703dc251b5b9ab47ccbd33b3dd3411c","symbol":"handle_reader","type":"NameError"}],"content_type":"text/plain; charset=utf-8","data_source_call_count":0,"effect_call_count":0,"effects":[],"handler_error_count":0,"json":null,"live_probe_contract_ready":false,"module_projection":{"excluded_assignment_count":6,"excluded_assignment_names":["CAPABILITY","MANIFEST","PORT","RESULTS","RESULT_RE","ROOT"],"include_safe_assignments":false,"included_assignment_count":0,"included_assignment_names":[]},"response_header_names":["cache-control","content-length","content-type","expires","pragma","surrogate-control","x-robots-tag"],"route_template":"//feed","source_call_count":3,"source_calls":[{"line":42,"symbol":"do_GET"},{"line":45,"symbol":"handle_reader"},{"line":23,"symbol":"reply"}],"status":500,"variant":"definitions-plus-resolved-scope-control"},{"all_effects_read_only":true,"body_bytes":129,"body_sha256":"85fe9cf154061b903ec7068c5f577d11b9d09e666a75d4f8dece450c8a17b18e","caught_exception_count":0,"caught_exceptions":[],"content_type":"application/json; charset=utf-8","data_source_call_count":1,"effect_call_count":1,"effects":[{"kind":"path.read_bytes","mode":"r","origin_type":"file","path_class":"/var","path_sha256":"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca","read_only_basis":"file_read","read_only_proven":true}],"handler_error_count":0,"json":{"top_key_count":5,"top_keys":["entries","files","generation","items","results"],"type":"dict"},"live_probe_contract_ready":false,"module_projection":{"excluded_assignment_count":0,"excluded_assignment_names":[],"include_safe_assignments":true,"included_assignment_count":6,"included_assignment_names":["CAPABILITY","MANIFEST","PORT","RESULTS","RESULT_RE","ROOT"]},"response_header_names":["cache-control","content-length","content-type","etag","expires","pragma","surrogate-control","x-homelab-generation","x-robots-tag"],"route_template":"//feed","source_call_count":3,"source_calls":[{"line":42,"symbol":"do_GET"},{"line":45,"symbol":"handle_reader"},{"line":23,"symbol":"reply"}],"status":200,"variant":"strict-global-bindings-filename-results"},{"all_effects_read_only":true,"body_bytes":813,"body_sha256":"2e75f532b93c25bd87988703fb5b3cc4611b2c8302f4059cd845a5a0d44b5cef","caught_exception_count":0,"caught_exceptions":[],"content_type":"application/json; charset=utf-8","data_source_call_count":1,"effect_call_count":1,"effects":[{"kind":"path.read_bytes","mode":"r","origin_type":"file","path_class":"/var","path_sha256":"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca","read_only_basis":"file_read","read_only_proven":true}],"handler_error_count":0,"json":{"top_key_count":5,"top_keys":["entries","files","generation","items","results"],"type":"dict"},"live_probe_contract_ready":false,"module_projection":{"excluded_assignment_count":0,"excluded_assignment_names":[],"include_safe_assignments":true,"included_assignment_count":6,"included_assignment_names":["CAPABILITY","MANIFEST","PORT","RESULTS","RESULT_RE","ROOT"]},"response_header_names":["cache-control","content-length","content-type","etag","expires","pragma","surrogate-control","x-homelab-generation","x-robots-tag"],"route_template":"//feed","source_call_count":3,"source_calls":[{"line":42,"symbol":"do_GET"},{"line":45,"symbol":"handle_reader"},{"line":23,"symbol":"reply"}],"status":200,"variant":"manifest-object-results"},{"all_effects_read_only":true,"body_bytes":13,"body_sha256":"326ce78e3deb6574ce072bbe8379c0e4deb1cb12c160a0f1a8161f8ddc6f4bd7","caught_exception_count":1,"caught_exceptions":[{"line":62,"message":"'list' object has no attribute 'get'","message_sha256":"73c2dbfd4deaed7a7fafa1d233c6631ae8d7650f0d5f3bce5a9da6386d739734","symbol":"handle_reader","type":"AttributeError"}],"content_type":"text/plain; charset=utf-8","data_source_call_count":1,"effect_call_count":1,"effects":[{"kind":"path.read_bytes","mode":"r","origin_type":"file","path_class":"/var","path_sha256":"e3e86f7cca26be90bb29b569ebbc865b3b544ad6f47fb1e976afae301aa02aca","read_only_basis":"file_read","read_only_proven":true}],"handler_error_count":0,"json":null,"live_probe_contract_ready":false,"module_projection":{"excluded_assignment_count":0,"excluded_assignment_names":[],"include_safe_assignments":true,"included_assignment_count":6,"included_assignment_names":["CAPABILITY","MANIFEST","PORT","RESULTS","RESULT_RE","ROOT"]},"response_header_names":["cache-control","content-length","content-type","expires","pragma","surrogate-control","x-robots-tag"],"route_template":"//feed","source_call_count":3,"source_calls":[{"line":42,"symbol":"do_GET"},{"line":45,"symbol":"handle_reader"},{"line":23,"symbol":"reply"}],"status":500,"variant":"manifest-list"}]},"sanitized_bytecode_branch_trace":{"branch_instruction_count":14,"branch_literal_count":7,"branch_literal_templates":["X-Homelab-Generation","X-Robots-Tag","feed","health","health-v3","include_body","results"],"bytecode_disassembly_emitted":false,"bytecode_literal_count":28,"call_instruction_count":53,"code_object_count":8,"compile_ok":true,"exact_branch_operation_count":2,"exact_compiled_operation_count":2,"operation_suffixes":["feed","health"],"operation_suffixes_sha256":"7b2583665af60a5f63c575c89ecaff1cd688710d29507b6d79238e5d9ca5e58b","raw_source_emitted":false,"source_literal_count":2},"schema":1,"source_files":[{"actual_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","bytes":580,"expected_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","matches_expected":true,"path":"/etc/systemd/system/homelab-reader-v3.service"},{"actual_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","bytes":3539,"expected_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","matches_expected":true,"path":"/usr/local/sbin/homelab-reader-server-v3"}],"source_selection":{"raw_source_emitted":false,"selected_path":"/usr/local/sbin/homelab-reader-server-v3","systemd_unit_excluded":true},"source_state":"MATCH","static_executor_argument_origin_trace":{"all_resolved_origins_read_only":true,"call_edge_count":3,"call_edges":[{"from":"Handler.do_GET","to":"Handler.handle_reader"},{"from":"Handler.do_HEAD","to":"Handler.handle_reader"},{"from":"Handler.handle_reader","to":"Handler.reply"}],"handler_roots":["Handler.do_GET","Handler.do_HEAD"],"raw_source_emitted":false,"reachable_data_origin_count":2,"reachable_data_origins":[{"argument_origin_names":[],"argument_resolved":false,"call":"MANIFEST.read_bytes","evidence_sha256":"3b9f9140c901f027be26f124b8c983ccfddbb3a62b03a416b5e7bfbb19f9fe59","kind":"file","mode":"r","origin_symbol":"Handler.handle_reader","path_class":null,"path_sha256":null,"read_only_basis":"file_read","read_only_proven":true},{"argument_origin_names":[],"argument_resolved":false,"call":"target.read_bytes","evidence_sha256":"aa896c2be567c54cf2da0cf24792da33575188def3c5d95fda4745ed3de4fdaf","kind":"file","mode":"r","origin_symbol":"Handler.handle_reader","path_class":null,"path_sha256":null,"read_only_basis":"file_read","read_only_proven":true}],"reachable_symbol_count":4,"reachable_symbols":["Handler.do_GET","Handler.do_HEAD","Handler.handle_reader","Handler.reply"],"unresolved_origin_count":2},"static_response_trace":{"ast_parse_ok":true,"capability_prefix_count":1,"capability_prefix_templates":["//"],"handler_count":1,"reachable_methods":["do_GET","do_HEAD","handle_reader","reply"],"resolved_scope_names":["CAPABILITY","PORT"],"source_suffix_literal_count":2,"source_suffix_literal_templates":["feed","health"]},"status":"OK","systemd_identity":{"identity_valid":true,"pid_count":1,"probe":{"duration_seconds":0.006,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":375,"stdout_sha256":"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9","stdout_truncated":false},"properties":{"ActiveState":"active","ControlGroup":"/system.slice/homelab-reader-v3.service","ExecStart_present":true,"ExecStart_sha256":"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379","FragmentPath":"/etc/systemd/system/homelab-reader-v3.service","LoadState":"loaded","MainPID":"1282","SubState":"running"}}} OUTPUT_END CHAT_OUTPUT_END