From 7e59a2bcf87b0006586ce8a124fcb3d778b33e2d Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Mon, 27 Jul 2026 08:15:28 +0000 Subject: [PATCH] runtime: publish RESULT-API-PLAN-FIX1-20260727T081254Z --- ...RESULT-API-PLAN-FIX1-20260727T081254Z.json | 38 +++++++++++++++++++ .../RESULT-API-PLAN-FIX1-20260727T081254Z.txt | 33 ++++++++++++++++ runtime/latest.json | 20 +++++----- runtime/latest.txt | 24 ++++-------- 4 files changed, 89 insertions(+), 26 deletions(-) create mode 100644 runtime/history/RESULT-API-PLAN-FIX1-20260727T081254Z.json create mode 100644 runtime/history/RESULT-API-PLAN-FIX1-20260727T081254Z.txt diff --git a/runtime/history/RESULT-API-PLAN-FIX1-20260727T081254Z.json b/runtime/history/RESULT-API-PLAN-FIX1-20260727T081254Z.json new file mode 100644 index 0000000..1bdada0 --- /dev/null +++ b/runtime/history/RESULT-API-PLAN-FIX1-20260727T081254Z.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "RESULT-API-PLAN-FIX1-20260727T081254Z", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "verify", + "component": "result-integration", + "started_at_utc": "2026-07-27T08:15:28Z", + "finished_at_utc": "2026-07-27T08:15:28Z", + "reference_register_checked": true, + "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", + "error_register_checked": true, + "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", + "command_sha256": "9644a497547baa62f28f72c9441e4b258bf9d39522c9194ae9f85f774933641d", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "a6c37d6a632ede775490bc690b6c72649a7b2598a93737d615cd7819bff01f92", + "sanitized_output_sha256": "a6c37d6a632ede775490bc690b6c72649a7b2598a93737d615cd7819bff01f92", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "{\"PLAN_SHA256\":\"356df52cee0e86ffc9aa8280c5c325a15a0c1c422700ab0c8034ae3cf65a1381\",\"changes_made\":false,\"checks\":{\"adapter_healthy\":true,\"adapter_source_lock\":true,\"current_running_once\":true,\"host_pve01\":true,\"no_invalid_states\":true,\"no_other_running\":true,\"portal_healthy\":true,\"portal_source_lock\":true,\"root\":true,\"runner_preserved_lock\":true,\"signing_dir_absent\":true},\"plan\":{\"anti_regression\":[\"key_directory_uid_root\",\"key_directory_gid_root\",\"key_directory_mode_0700\",\"private_key_uid_root\",\"private_key_gid_root\",\"private_key_mode_0600\",\"public_key_uid_root\",\"public_key_gid_root\",\"public_key_mode_0600\",\"adapter_compile\",\"portal_compile\",\"adapter_self_test\",\"portal_self_test\",\"key_pair_verification\",\"command_lookup\",\"terminal_status\",\"evidence_fields\",\"document_sha_valid\",\"signature_valid\",\"latest_result_matches\",\"public_key_matches\",\"health_version_2\",\"command_route_present\",\"key_route_present\",\"no_state_listing_route\",\"runner_unmodified\"],\"change_flags\":{\"backup\":false,\"cluster\":false,\"gitea\":false,\"production\":true},\"exact_change_scope\":{\"backup\":false,\"cluster\":false,\"create\":[\"/var/lib/homelab-command-adapter/result-signing\",\"/var/lib/homelab-command-adapter/result-signing/private.pem\",\"/var/lib/homelab-command-adapter/result-signing/public.pem\"],\"gitea\":false,\"modify\":[\"/usr/local/sbin/homelab-command-adapter\",\"/usr/local/sbin/homelab-command-portal\"],\"preserve\":[\"/usr/local/sbin/homelab-chat-run\",\"existing state files\",\"existing evidence objects\",\"Gitea runtime history\",\"backup\",\"cluster\"],\"production\":true},\"generated_secret_policy\":{\"algorithm\":\"Ed25519\",\"directory\":\"/var/lib/homelab-command-adapter/result-signing\",\"directory_mode\":\"0700\",\"generation\":\"openssl genpkey during APPLY only\",\"owner\":\"root:root\",\"private_key\":\"/var/lib/homelab-command-adapter/result-signing/private.pem\",\"private_key_never_output\":true,\"private_mode\":\"0600\",\"public_key\":\"/var/lib/homelab-command-adapter/result-signing/public.pem\",\"public_key_id_recorded_after_generation\":true,\"public_mode\":\"0600\"},\"operation\":\"INSTALL_SIGNED_READONLY_RESULT_API\",\"postconditions\":[\"Adapter and Portal target SHA installed\",\"Runner SHA unchanged\",\"signing directory mode 0700 root:root\",\"private key mode 0600 root:root\",\"public key mode 0600 root:root\",\"public/private key pair verifies\",\"Adapter and Portal stable NRestarts=0\",\"healthz version 2 returns signed latest_result\",\"public key PEM is retrievable\",\"exact command result route works\",\"document_sha256 recomputes\",\"Ed25519 signature verifies\",\"no secret/private address/local path fields\",\"existing states and evidence unchanged\"],\"public_contract\":{\"discovery_url\":\"https://run.vpn.gram1.ru/healthz\",\"health_version\":2,\"latest_result_in_healthz\":true,\"no_listing\":true,\"public_key_url\":\"https://run.vpn.gram1.ru/.well-known/homelab-result-key.pem\",\"result_url_template\":\"https://run.vpn.gram1.ru/.well-known/homelab-result//.json\",\"signature_algorithm\":\"Ed25519\",\"terminal_only\":true},\"risk\":\"REVERSIBLE\",\"rollback\":{\"diagnostics_before_rollback\":[\"source and target SHA\",\"systemd state and exact RC\",\"journal since APPLY start\",\"healthz response\",\"process tree\",\"state summary\",\"key public ID only\"],\"fresh_directory\":\"/var/lib/homelab-change-rollback/RESULT-API-APPLY-20260727\",\"remove_created_only\":[\"/var/lib/homelab-command-adapter/result-signing\"],\"restore_only\":[\"/usr/local/sbin/homelab-command-adapter\",\"/usr/local/sbin/homelab-command-portal\"]},\"schema\":1,\"service_sequence\":[\"stop Portal and verify inactive\",\"stop Adapter and verify inactive\",\"create fresh rollback copies\",\"generate signing key in temporary directory under the actual service identity\",\"explicitly chown key directory and both keys to root:root\",\"enforce directory 0700 and both key files 0600\",\"verify generated key pair\",\"atomically install key directory\",\"atomically install Adapter and Portal\",\"start Adapter and require three stable healthy samples\",\"start Portal and require three stable healthz v2 samples\"],\"source_lock\":{\"/usr/local/sbin/homelab-chat-run\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"/usr/local/sbin/homelab-command-adapter\":\"8d0af84dcfcf6ddbfd1c4e6cbb059cef66b4cfc6c75bfd66da649acc229c7f5e\",\"/usr/local/sbin/homelab-command-portal\":\"8056faf4ef6348f0b06319ad3c49fbfeeadf25b6370f857ea19569bd27652ee2\",\"/var/lib/homelab-command-adapter/result-signing\":\"ABSENT\"},\"target\":\"pve01\",\"target_lock\":{\"/usr/local/sbin/homelab-chat-run\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"/usr/local/sbin/homelab-command-adapter\":\"2601d502303028717864c5e6fed5ba49ebca0e467cac529498cae32ddcc97900\",\"/usr/local/sbin/homelab-command-portal\":\"8a2996c0c15240d3ff31bf76032e1920f23473535bd789eff8f2b6f71976a350\"}},\"rollback_started\":false,\"runner_sha256\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"source_adapter_sha256\":\"8d0af84dcfcf6ddbfd1c4e6cbb059cef66b4cfc6c75bfd66da649acc229c7f5e\",\"source_portal_sha256\":\"8056faf4ef6348f0b06319ad3c49fbfeeadf25b6370f857ea19569bd27652ee2\",\"static_tests\":{\"adapter_compile\":true,\"adapter_self_test\":true,\"command_lookup\":true,\"command_route_present\":true,\"document_sha_valid\":true,\"evidence_fields\":true,\"health_version_2\":true,\"key_directory_gid_root\":true,\"key_directory_mode_0700\":true,\"key_directory_uid_root\":true,\"key_pair_verification\":true,\"key_route_present\":true,\"latest_result_matches\":true,\"no_state_listing_route\":true,\"portal_compile\":true,\"portal_self_test\":true,\"private_key_gid_root\":true,\"private_key_mode_0600\":true,\"private_key_uid_root\":true,\"public_key_gid_root\":true,\"public_key_matches\":true,\"public_key_mode_0600\":true,\"public_key_uid_root\":true,\"runner_unmodified\":true,\"signature_valid\":true,\"terminal_status\":true},\"status\":\"PASS\",\"target_adapter_sha256\":\"2601d502303028717864c5e6fed5ba49ebca0e467cac529498cae32ddcc97900\",\"target_portal_sha256\":\"8a2996c0c15240d3ff31bf76032e1920f23473535bd789eff8f2b6f71976a350\"}\n" +} diff --git a/runtime/history/RESULT-API-PLAN-FIX1-20260727T081254Z.txt b/runtime/history/RESULT-API-PLAN-FIX1-20260727T081254Z.txt new file mode 100644 index 0000000..8887c1a --- /dev/null +++ b/runtime/history/RESULT-API-PLAN-FIX1-20260727T081254Z.txt @@ -0,0 +1,33 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=RESULT-API-PLAN-FIX1-20260727T081254Z +STATUS=OK +RC=0 +HOST=pve01 +MODE=verify +COMPONENT=result-integration +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 +COMMAND_SHA256=9644a497547baa62f28f72c9441e4b258bf9d39522c9194ae9f85f774933641d +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=a6c37d6a632ede775490bc690b6c72649a7b2598a93737d615cd7819bff01f92 +SANITIZED_OUTPUT_SHA256=a6c37d6a632ede775490bc690b6c72649a7b2598a93737d615cd7819bff01f92 +OUTPUT_BEGIN +{"PLAN_SHA256":"356df52cee0e86ffc9aa8280c5c325a15a0c1c422700ab0c8034ae3cf65a1381","changes_made":false,"checks":{"adapter_healthy":true,"adapter_source_lock":true,"current_running_once":true,"host_pve01":true,"no_invalid_states":true,"no_other_running":true,"portal_healthy":true,"portal_source_lock":true,"root":true,"runner_preserved_lock":true,"signing_dir_absent":true},"plan":{"anti_regression":["key_directory_uid_root","key_directory_gid_root","key_directory_mode_0700","private_key_uid_root","private_key_gid_root","private_key_mode_0600","public_key_uid_root","public_key_gid_root","public_key_mode_0600","adapter_compile","portal_compile","adapter_self_test","portal_self_test","key_pair_verification","command_lookup","terminal_status","evidence_fields","document_sha_valid","signature_valid","latest_result_matches","public_key_matches","health_version_2","command_route_present","key_route_present","no_state_listing_route","runner_unmodified"],"change_flags":{"backup":false,"cluster":false,"gitea":false,"production":true},"exact_change_scope":{"backup":false,"cluster":false,"create":["/var/lib/homelab-command-adapter/result-signing","/var/lib/homelab-command-adapter/result-signing/private.pem","/var/lib/homelab-command-adapter/result-signing/public.pem"],"gitea":false,"modify":["/usr/local/sbin/homelab-command-adapter","/usr/local/sbin/homelab-command-portal"],"preserve":["/usr/local/sbin/homelab-chat-run","existing state files","existing evidence objects","Gitea runtime history","backup","cluster"],"production":true},"generated_secret_policy":{"algorithm":"Ed25519","directory":"/var/lib/homelab-command-adapter/result-signing","directory_mode":"0700","generation":"openssl genpkey during APPLY only","owner":"root:root","private_key":"/var/lib/homelab-command-adapter/result-signing/private.pem","private_key_never_output":true,"private_mode":"0600","public_key":"/var/lib/homelab-command-adapter/result-signing/public.pem","public_key_id_recorded_after_generation":true,"public_mode":"0600"},"operation":"INSTALL_SIGNED_READONLY_RESULT_API","postconditions":["Adapter and Portal target SHA installed","Runner SHA unchanged","signing directory mode 0700 root:root","private key mode 0600 root:root","public key mode 0600 root:root","public/private key pair verifies","Adapter and Portal stable NRestarts=0","healthz version 2 returns signed latest_result","public key PEM is retrievable","exact command result route works","document_sha256 recomputes","Ed25519 signature verifies","no secret/private address/local path fields","existing states and evidence unchanged"],"public_contract":{"discovery_url":"https://run.vpn.gram1.ru/healthz","health_version":2,"latest_result_in_healthz":true,"no_listing":true,"public_key_url":"https://run.vpn.gram1.ru/.well-known/homelab-result-key.pem","result_url_template":"https://run.vpn.gram1.ru/.well-known/homelab-result//.json","signature_algorithm":"Ed25519","terminal_only":true},"risk":"REVERSIBLE","rollback":{"diagnostics_before_rollback":["source and target SHA","systemd state and exact RC","journal since APPLY start","healthz response","process tree","state summary","key public ID only"],"fresh_directory":"/var/lib/homelab-change-rollback/RESULT-API-APPLY-20260727","remove_created_only":["/var/lib/homelab-command-adapter/result-signing"],"restore_only":["/usr/local/sbin/homelab-command-adapter","/usr/local/sbin/homelab-command-portal"]},"schema":1,"service_sequence":["stop Portal and verify inactive","stop Adapter and verify inactive","create fresh rollback copies","generate signing key in temporary directory under the actual service identity","explicitly chown key directory and both keys to root:root","enforce directory 0700 and both key files 0600","verify generated key pair","atomically install key directory","atomically install Adapter and Portal","start Adapter and require three stable healthy samples","start Portal and require three stable healthz v2 samples"],"source_lock":{"/usr/local/sbin/homelab-chat-run":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","/usr/local/sbin/homelab-command-adapter":"8d0af84dcfcf6ddbfd1c4e6cbb059cef66b4cfc6c75bfd66da649acc229c7f5e","/usr/local/sbin/homelab-command-portal":"8056faf4ef6348f0b06319ad3c49fbfeeadf25b6370f857ea19569bd27652ee2","/var/lib/homelab-command-adapter/result-signing":"ABSENT"},"target":"pve01","target_lock":{"/usr/local/sbin/homelab-chat-run":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","/usr/local/sbin/homelab-command-adapter":"2601d502303028717864c5e6fed5ba49ebca0e467cac529498cae32ddcc97900","/usr/local/sbin/homelab-command-portal":"8a2996c0c15240d3ff31bf76032e1920f23473535bd789eff8f2b6f71976a350"}},"rollback_started":false,"runner_sha256":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","source_adapter_sha256":"8d0af84dcfcf6ddbfd1c4e6cbb059cef66b4cfc6c75bfd66da649acc229c7f5e","source_portal_sha256":"8056faf4ef6348f0b06319ad3c49fbfeeadf25b6370f857ea19569bd27652ee2","static_tests":{"adapter_compile":true,"adapter_self_test":true,"command_lookup":true,"command_route_present":true,"document_sha_valid":true,"evidence_fields":true,"health_version_2":true,"key_directory_gid_root":true,"key_directory_mode_0700":true,"key_directory_uid_root":true,"key_pair_verification":true,"key_route_present":true,"latest_result_matches":true,"no_state_listing_route":true,"portal_compile":true,"portal_self_test":true,"private_key_gid_root":true,"private_key_mode_0600":true,"private_key_uid_root":true,"public_key_gid_root":true,"public_key_matches":true,"public_key_mode_0600":true,"public_key_uid_root":true,"runner_unmodified":true,"signature_valid":true,"terminal_status":true},"status":"PASS","target_adapter_sha256":"2601d502303028717864c5e6fed5ba49ebca0e467cac529498cae32ddcc97900","target_portal_sha256":"8a2996c0c15240d3ff31bf76032e1920f23473535bd789eff8f2b6f71976a350"} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index acd59d8..1bdada0 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "RESULT-API-PLAN-20260727T080229Z", - "status": "FAIL", - "rc": 1, + "command_id": "RESULT-API-PLAN-FIX1-20260727T081254Z", + "status": "OK", + "rc": 0, "host": "pve01", "mode": "verify", "component": "result-integration", - "started_at_utc": "2026-07-27T08:03:24Z", - "finished_at_utc": "2026-07-27T08:03:24Z", + "started_at_utc": "2026-07-27T08:15:28Z", + "finished_at_utc": "2026-07-27T08:15:28Z", "reference_register_checked": true, "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", "error_register_checked": true, "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", - "command_sha256": "ad2f0fca5a5de73567bdf0a575301a6d9e7417b2ee4359e7ba4677549fac49ac", + "command_sha256": "9644a497547baa62f28f72c9441e4b258bf9d39522c9194ae9f85f774933641d", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -21,7 +21,7 @@ "result_contract_valid": true, "result_contract_status": null, "result_contract_error": null, - "command_rc": 1, + "command_rc": 0, "changes_made": false, "rollback_started": false, "rollback_restored": null, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "68ad58daa2047e58029205572c05dce673c3091831bbe301b95a779fad124081", - "sanitized_output_sha256": "68ad58daa2047e58029205572c05dce673c3091831bbe301b95a779fad124081", + "raw_evidence_sha256": "a6c37d6a632ede775490bc690b6c72649a7b2598a93737d615cd7819bff01f92", + "sanitized_output_sha256": "a6c37d6a632ede775490bc690b6c72649a7b2598a93737d615cd7819bff01f92", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "Traceback (most recent call last):\n File \"/var/lib/homelab-command-adapter/capsules/97a6dc8d4353d4f414a2c6eab15ceb2f6f8344c1f15265673cbbc62fe735155b/payload/result_api_plan.py\", line 1298, in \n raise SystemExit(main())\n ~~~~^^\n File \"/var/lib/homelab-command-adapter/capsules/97a6dc8d4353d4f414a2c6eab15ceb2f6f8344c1f15265673cbbc62fe735155b/payload/result_api_plan.py\", line 999, in main\n module.verify_result_signing_material()\n ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^\n File \"/tmp/tmppaqxv0uy/adapter.py\", line 1343, in verify_result_signing_material\nresult_api_adapter_candidate.AdapterError: result signing material permissions invalid: /tmp/tmppaqxv0uy/keys/private.pem\n" + "output": "{\"PLAN_SHA256\":\"356df52cee0e86ffc9aa8280c5c325a15a0c1c422700ab0c8034ae3cf65a1381\",\"changes_made\":false,\"checks\":{\"adapter_healthy\":true,\"adapter_source_lock\":true,\"current_running_once\":true,\"host_pve01\":true,\"no_invalid_states\":true,\"no_other_running\":true,\"portal_healthy\":true,\"portal_source_lock\":true,\"root\":true,\"runner_preserved_lock\":true,\"signing_dir_absent\":true},\"plan\":{\"anti_regression\":[\"key_directory_uid_root\",\"key_directory_gid_root\",\"key_directory_mode_0700\",\"private_key_uid_root\",\"private_key_gid_root\",\"private_key_mode_0600\",\"public_key_uid_root\",\"public_key_gid_root\",\"public_key_mode_0600\",\"adapter_compile\",\"portal_compile\",\"adapter_self_test\",\"portal_self_test\",\"key_pair_verification\",\"command_lookup\",\"terminal_status\",\"evidence_fields\",\"document_sha_valid\",\"signature_valid\",\"latest_result_matches\",\"public_key_matches\",\"health_version_2\",\"command_route_present\",\"key_route_present\",\"no_state_listing_route\",\"runner_unmodified\"],\"change_flags\":{\"backup\":false,\"cluster\":false,\"gitea\":false,\"production\":true},\"exact_change_scope\":{\"backup\":false,\"cluster\":false,\"create\":[\"/var/lib/homelab-command-adapter/result-signing\",\"/var/lib/homelab-command-adapter/result-signing/private.pem\",\"/var/lib/homelab-command-adapter/result-signing/public.pem\"],\"gitea\":false,\"modify\":[\"/usr/local/sbin/homelab-command-adapter\",\"/usr/local/sbin/homelab-command-portal\"],\"preserve\":[\"/usr/local/sbin/homelab-chat-run\",\"existing state files\",\"existing evidence objects\",\"Gitea runtime history\",\"backup\",\"cluster\"],\"production\":true},\"generated_secret_policy\":{\"algorithm\":\"Ed25519\",\"directory\":\"/var/lib/homelab-command-adapter/result-signing\",\"directory_mode\":\"0700\",\"generation\":\"openssl genpkey during APPLY only\",\"owner\":\"root:root\",\"private_key\":\"/var/lib/homelab-command-adapter/result-signing/private.pem\",\"private_key_never_output\":true,\"private_mode\":\"0600\",\"public_key\":\"/var/lib/homelab-command-adapter/result-signing/public.pem\",\"public_key_id_recorded_after_generation\":true,\"public_mode\":\"0600\"},\"operation\":\"INSTALL_SIGNED_READONLY_RESULT_API\",\"postconditions\":[\"Adapter and Portal target SHA installed\",\"Runner SHA unchanged\",\"signing directory mode 0700 root:root\",\"private key mode 0600 root:root\",\"public key mode 0600 root:root\",\"public/private key pair verifies\",\"Adapter and Portal stable NRestarts=0\",\"healthz version 2 returns signed latest_result\",\"public key PEM is retrievable\",\"exact command result route works\",\"document_sha256 recomputes\",\"Ed25519 signature verifies\",\"no secret/private address/local path fields\",\"existing states and evidence unchanged\"],\"public_contract\":{\"discovery_url\":\"https://run.vpn.gram1.ru/healthz\",\"health_version\":2,\"latest_result_in_healthz\":true,\"no_listing\":true,\"public_key_url\":\"https://run.vpn.gram1.ru/.well-known/homelab-result-key.pem\",\"result_url_template\":\"https://run.vpn.gram1.ru/.well-known/homelab-result//.json\",\"signature_algorithm\":\"Ed25519\",\"terminal_only\":true},\"risk\":\"REVERSIBLE\",\"rollback\":{\"diagnostics_before_rollback\":[\"source and target SHA\",\"systemd state and exact RC\",\"journal since APPLY start\",\"healthz response\",\"process tree\",\"state summary\",\"key public ID only\"],\"fresh_directory\":\"/var/lib/homelab-change-rollback/RESULT-API-APPLY-20260727\",\"remove_created_only\":[\"/var/lib/homelab-command-adapter/result-signing\"],\"restore_only\":[\"/usr/local/sbin/homelab-command-adapter\",\"/usr/local/sbin/homelab-command-portal\"]},\"schema\":1,\"service_sequence\":[\"stop Portal and verify inactive\",\"stop Adapter and verify inactive\",\"create fresh rollback copies\",\"generate signing key in temporary directory under the actual service identity\",\"explicitly chown key directory and both keys to root:root\",\"enforce directory 0700 and both key files 0600\",\"verify generated key pair\",\"atomically install key directory\",\"atomically install Adapter and Portal\",\"start Adapter and require three stable healthy samples\",\"start Portal and require three stable healthz v2 samples\"],\"source_lock\":{\"/usr/local/sbin/homelab-chat-run\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"/usr/local/sbin/homelab-command-adapter\":\"8d0af84dcfcf6ddbfd1c4e6cbb059cef66b4cfc6c75bfd66da649acc229c7f5e\",\"/usr/local/sbin/homelab-command-portal\":\"8056faf4ef6348f0b06319ad3c49fbfeeadf25b6370f857ea19569bd27652ee2\",\"/var/lib/homelab-command-adapter/result-signing\":\"ABSENT\"},\"target\":\"pve01\",\"target_lock\":{\"/usr/local/sbin/homelab-chat-run\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"/usr/local/sbin/homelab-command-adapter\":\"2601d502303028717864c5e6fed5ba49ebca0e467cac529498cae32ddcc97900\",\"/usr/local/sbin/homelab-command-portal\":\"8a2996c0c15240d3ff31bf76032e1920f23473535bd789eff8f2b6f71976a350\"}},\"rollback_started\":false,\"runner_sha256\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"source_adapter_sha256\":\"8d0af84dcfcf6ddbfd1c4e6cbb059cef66b4cfc6c75bfd66da649acc229c7f5e\",\"source_portal_sha256\":\"8056faf4ef6348f0b06319ad3c49fbfeeadf25b6370f857ea19569bd27652ee2\",\"static_tests\":{\"adapter_compile\":true,\"adapter_self_test\":true,\"command_lookup\":true,\"command_route_present\":true,\"document_sha_valid\":true,\"evidence_fields\":true,\"health_version_2\":true,\"key_directory_gid_root\":true,\"key_directory_mode_0700\":true,\"key_directory_uid_root\":true,\"key_pair_verification\":true,\"key_route_present\":true,\"latest_result_matches\":true,\"no_state_listing_route\":true,\"portal_compile\":true,\"portal_self_test\":true,\"private_key_gid_root\":true,\"private_key_mode_0600\":true,\"private_key_uid_root\":true,\"public_key_gid_root\":true,\"public_key_matches\":true,\"public_key_mode_0600\":true,\"public_key_uid_root\":true,\"runner_unmodified\":true,\"signature_valid\":true,\"terminal_status\":true},\"status\":\"PASS\",\"target_adapter_sha256\":\"2601d502303028717864c5e6fed5ba49ebca0e467cac529498cae32ddcc97900\",\"target_portal_sha256\":\"8a2996c0c15240d3ff31bf76032e1920f23473535bd789eff8f2b6f71976a350\"}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index db2a8c1..8887c1a 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,7 +1,7 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=RESULT-API-PLAN-20260727T080229Z -STATUS=FAIL -RC=1 +COMMAND_ID=RESULT-API-PLAN-FIX1-20260727T081254Z +STATUS=OK +RC=0 HOST=pve01 MODE=verify COMPONENT=result-integration @@ -9,14 +9,14 @@ REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 -COMMAND_SHA256=ad2f0fca5a5de73567bdf0a575301a6d9e7417b2ee4359e7ba4677549fac49ac +COMMAND_SHA256=9644a497547baa62f28f72c9441e4b258bf9d39522c9194ae9f85f774933641d DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false RESULT_CONTRACT_VALID=true RESULT_CONTRACT_STATUS=NOT_APPLICABLE RESULT_CONTRACT_ERROR=NONE -COMMAND_RC=1 +COMMAND_RC=0 CHANGES_MADE=false ROLLBACK_STARTED=false ROLLBACK_RESTORED=null @@ -24,18 +24,10 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=68ad58daa2047e58029205572c05dce673c3091831bbe301b95a779fad124081 -SANITIZED_OUTPUT_SHA256=68ad58daa2047e58029205572c05dce673c3091831bbe301b95a779fad124081 +RAW_EVIDENCE_SHA256=a6c37d6a632ede775490bc690b6c72649a7b2598a93737d615cd7819bff01f92 +SANITIZED_OUTPUT_SHA256=a6c37d6a632ede775490bc690b6c72649a7b2598a93737d615cd7819bff01f92 OUTPUT_BEGIN -Traceback (most recent call last): - File "/var/lib/homelab-command-adapter/capsules/97a6dc8d4353d4f414a2c6eab15ceb2f6f8344c1f15265673cbbc62fe735155b/payload/result_api_plan.py", line 1298, in - raise SystemExit(main()) - ~~~~^^ - File "/var/lib/homelab-command-adapter/capsules/97a6dc8d4353d4f414a2c6eab15ceb2f6f8344c1f15265673cbbc62fe735155b/payload/result_api_plan.py", line 999, in main - module.verify_result_signing_material() - ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^ - File "/tmp/tmppaqxv0uy/adapter.py", line 1343, in verify_result_signing_material -result_api_adapter_candidate.AdapterError: result signing material permissions invalid: /tmp/tmppaqxv0uy/keys/private.pem +{"PLAN_SHA256":"356df52cee0e86ffc9aa8280c5c325a15a0c1c422700ab0c8034ae3cf65a1381","changes_made":false,"checks":{"adapter_healthy":true,"adapter_source_lock":true,"current_running_once":true,"host_pve01":true,"no_invalid_states":true,"no_other_running":true,"portal_healthy":true,"portal_source_lock":true,"root":true,"runner_preserved_lock":true,"signing_dir_absent":true},"plan":{"anti_regression":["key_directory_uid_root","key_directory_gid_root","key_directory_mode_0700","private_key_uid_root","private_key_gid_root","private_key_mode_0600","public_key_uid_root","public_key_gid_root","public_key_mode_0600","adapter_compile","portal_compile","adapter_self_test","portal_self_test","key_pair_verification","command_lookup","terminal_status","evidence_fields","document_sha_valid","signature_valid","latest_result_matches","public_key_matches","health_version_2","command_route_present","key_route_present","no_state_listing_route","runner_unmodified"],"change_flags":{"backup":false,"cluster":false,"gitea":false,"production":true},"exact_change_scope":{"backup":false,"cluster":false,"create":["/var/lib/homelab-command-adapter/result-signing","/var/lib/homelab-command-adapter/result-signing/private.pem","/var/lib/homelab-command-adapter/result-signing/public.pem"],"gitea":false,"modify":["/usr/local/sbin/homelab-command-adapter","/usr/local/sbin/homelab-command-portal"],"preserve":["/usr/local/sbin/homelab-chat-run","existing state files","existing evidence objects","Gitea runtime history","backup","cluster"],"production":true},"generated_secret_policy":{"algorithm":"Ed25519","directory":"/var/lib/homelab-command-adapter/result-signing","directory_mode":"0700","generation":"openssl genpkey during APPLY only","owner":"root:root","private_key":"/var/lib/homelab-command-adapter/result-signing/private.pem","private_key_never_output":true,"private_mode":"0600","public_key":"/var/lib/homelab-command-adapter/result-signing/public.pem","public_key_id_recorded_after_generation":true,"public_mode":"0600"},"operation":"INSTALL_SIGNED_READONLY_RESULT_API","postconditions":["Adapter and Portal target SHA installed","Runner SHA unchanged","signing directory mode 0700 root:root","private key mode 0600 root:root","public key mode 0600 root:root","public/private key pair verifies","Adapter and Portal stable NRestarts=0","healthz version 2 returns signed latest_result","public key PEM is retrievable","exact command result route works","document_sha256 recomputes","Ed25519 signature verifies","no secret/private address/local path fields","existing states and evidence unchanged"],"public_contract":{"discovery_url":"https://run.vpn.gram1.ru/healthz","health_version":2,"latest_result_in_healthz":true,"no_listing":true,"public_key_url":"https://run.vpn.gram1.ru/.well-known/homelab-result-key.pem","result_url_template":"https://run.vpn.gram1.ru/.well-known/homelab-result//.json","signature_algorithm":"Ed25519","terminal_only":true},"risk":"REVERSIBLE","rollback":{"diagnostics_before_rollback":["source and target SHA","systemd state and exact RC","journal since APPLY start","healthz response","process tree","state summary","key public ID only"],"fresh_directory":"/var/lib/homelab-change-rollback/RESULT-API-APPLY-20260727","remove_created_only":["/var/lib/homelab-command-adapter/result-signing"],"restore_only":["/usr/local/sbin/homelab-command-adapter","/usr/local/sbin/homelab-command-portal"]},"schema":1,"service_sequence":["stop Portal and verify inactive","stop Adapter and verify inactive","create fresh rollback copies","generate signing key in temporary directory under the actual service identity","explicitly chown key directory and both keys to root:root","enforce directory 0700 and both key files 0600","verify generated key pair","atomically install key directory","atomically install Adapter and Portal","start Adapter and require three stable healthy samples","start Portal and require three stable healthz v2 samples"],"source_lock":{"/usr/local/sbin/homelab-chat-run":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","/usr/local/sbin/homelab-command-adapter":"8d0af84dcfcf6ddbfd1c4e6cbb059cef66b4cfc6c75bfd66da649acc229c7f5e","/usr/local/sbin/homelab-command-portal":"8056faf4ef6348f0b06319ad3c49fbfeeadf25b6370f857ea19569bd27652ee2","/var/lib/homelab-command-adapter/result-signing":"ABSENT"},"target":"pve01","target_lock":{"/usr/local/sbin/homelab-chat-run":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","/usr/local/sbin/homelab-command-adapter":"2601d502303028717864c5e6fed5ba49ebca0e467cac529498cae32ddcc97900","/usr/local/sbin/homelab-command-portal":"8a2996c0c15240d3ff31bf76032e1920f23473535bd789eff8f2b6f71976a350"}},"rollback_started":false,"runner_sha256":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","source_adapter_sha256":"8d0af84dcfcf6ddbfd1c4e6cbb059cef66b4cfc6c75bfd66da649acc229c7f5e","source_portal_sha256":"8056faf4ef6348f0b06319ad3c49fbfeeadf25b6370f857ea19569bd27652ee2","static_tests":{"adapter_compile":true,"adapter_self_test":true,"command_lookup":true,"command_route_present":true,"document_sha_valid":true,"evidence_fields":true,"health_version_2":true,"key_directory_gid_root":true,"key_directory_mode_0700":true,"key_directory_uid_root":true,"key_pair_verification":true,"key_route_present":true,"latest_result_matches":true,"no_state_listing_route":true,"portal_compile":true,"portal_self_test":true,"private_key_gid_root":true,"private_key_mode_0600":true,"private_key_uid_root":true,"public_key_gid_root":true,"public_key_matches":true,"public_key_mode_0600":true,"public_key_uid_root":true,"runner_unmodified":true,"signature_valid":true,"terminal_status":true},"status":"PASS","target_adapter_sha256":"2601d502303028717864c5e6fed5ba49ebca0e467cac529498cae32ddcc97900","target_portal_sha256":"8a2996c0c15240d3ff31bf76032e1920f23473535bd789eff8f2b6f71976a350"} OUTPUT_END CHAT_OUTPUT_END