From 800a66df7d7cb15a63eeda0d8c0dda822d72e268 Mon Sep 17 00:00:00 2001
From: homelab-runtime-publisher <homelab-runtime@localhost>
Date: Thu, 23 Jul 2026 05:04:31 +0000
Subject: [PATCH] runtime: publish READER-VM130-EXEC-INTERFACE-AUDIT-332

---
 ...READER-VM130-EXEC-INTERFACE-AUDIT-332.json |  30 +++++
 .../READER-VM130-EXEC-INTERFACE-AUDIT-332.txt |  93 ++++++++++++++
 runtime/latest.json                           |  14 +-
 runtime/latest.txt                            | 120 +++++++-----------
 4 files changed, 175 insertions(+), 82 deletions(-)
 create mode 100644 runtime/history/READER-VM130-EXEC-INTERFACE-AUDIT-332.json
 create mode 100644 runtime/history/READER-VM130-EXEC-INTERFACE-AUDIT-332.txt

diff --git a/runtime/history/READER-VM130-EXEC-INTERFACE-AUDIT-332.json b/runtime/history/READER-VM130-EXEC-INTERFACE-AUDIT-332.json
new file mode 100644
index 0000000..d0d6568
--- /dev/null
+++ b/runtime/history/READER-VM130-EXEC-INTERFACE-AUDIT-332.json
@@ -0,0 +1,30 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "READER-VM130-EXEC-INTERFACE-AUDIT-332",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "cluster-audit",
+  "started_at_utc": "2026-07-23T05:04:31Z",
+  "finished_at_utc": "2026-07-23T05:04:31Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
+  "error_register_checked": true,
+  "error_register_sha256": "08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752",
+  "command_sha256": "c3afb515a991225c64ea90bd9e285a44f09af255097fca7a30cae3c70af84c3e",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "changes_made": false,
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "761533b89826503b8ca2118991abaa2198d219e3e62eb6b18caf6d6b4518ad56",
+  "sanitized_output_sha256": "761533b89826503b8ca2118991abaa2198d219e3e62eb6b18caf6d6b4518ad56",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/test\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sha256sum\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/awk\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sed\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/bash\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/stat\nDETAIL=VM130_EXEC_SHA256=1959773393723b013af7c93cd29a7b833fd607c903d044e2fcef6accaa29c275\nDETAIL=VM130_EXEC_INTEGRITY=PASS\nDETAIL=VM130_EXEC_METADATA=root:root|750|1333|regular file\nDETAIL=VM130_EXEC_FIRST_LINE=#!/usr/bin/bash\nDETAIL=VM130_EXEC_SYNTAX=PASS\nDETAIL=VM130_EXEC_LINE_COUNT=53\nDETAIL=VM130_EXEC_SOURCE_BEGIN\n#!/usr/bin/bash\nset -Eeuo pipefail\n\nreadonly SSH=/usr/bin/ssh\nreadonly JQ=/usr/bin/jq\nreadonly MKTEMP=/usr/bin/mktemp\nreadonly RM=/usr/bin/rm\nreadonly CAT=/usr/bin/cat\nreadonly HOST=root@pve03\nreadonly VMID=130\n\nif (($# == 0)); then\n    echo \"VM130_EXEC_ERROR=NO_COMMAND\" >&2\n    exit 64\nfi\n\ntmpdir=\"$(\"$MKTEMP\" -d /tmp/homelab-vm130-exec.XXXXXX)\"\ncleanup() {\n    \"$RM\" -rf -- \"$tmpdir\"\n}\ntrap cleanup EXIT\n\nprintf -v remote_cmd \"%q \" /usr/sbin/qm guest exec \"$VMID\" -- \"$@\"\n\nset +e\n\"$SSH\" -o BatchMode=yes -o ConnectTimeout=8 \"$HOST\" \"$remote_cmd\" >\"$tmpdir/qga.json\" 2>\"$tmpdir/ssh.err\"\nssh_rc=$?\nset -e\n\nif ((ssh_rc != 0)); then\n    echo \"VM130_EXEC_ERROR=SSH_FAILURE\" >&2\n    echo \"VM130_EXEC_SSH_RC=$ssh_rc\" >&2\n    \"$CAT\" \"$tmpdir/ssh.err\" >&2\n    exit 125\nfi\n\nif ! \"$JQ\" -e 'type==\"object\" and (.exited == 1) and (.exitcode | type == \"number\")' \"$tmpdir/qga.json\" >/dev/null 2>&1; then\n    echo \"VM130_EXEC_ERROR=INVALID_QGA_JSON\" >&2\n    \"$CAT\" \"$tmpdir/ssh.err\" >&2\n    \"$CAT\" \"$tmpdir/qga.json\" >&2\n    exit 126\nfi\n\n\"$JQ\" -j '.\"out-data\" // \"\"' \"$tmpdir/qga.json\"\n\"$JQ\" -j '.\"err-data\" // \"\"' \"$tmpdir/qga.json\" >&2\n\nguest_rc=\"$(\"$JQ\" -r '.exitcode' \"$tmpdir/qga.json\")\"\nif [[ ! \"$guest_rc\" =~ ^[0-9]+$ ]] || ((guest_rc > 255)); then\n    echo \"VM130_EXEC_ERROR=INVALID_GUEST_EXITCODE\" >&2\n    exit 126\nfi\n\nexit \"$guest_rc\"\nDETAIL=VM130_EXEC_SOURCE_END\nDETAIL=VM130_EXEC_SOURCE_TRUNCATED=NO\nCHANGES_MADE=NO\n"
+}
diff --git a/runtime/history/READER-VM130-EXEC-INTERFACE-AUDIT-332.txt b/runtime/history/READER-VM130-EXEC-INTERFACE-AUDIT-332.txt
new file mode 100644
index 0000000..5263d2a
--- /dev/null
+++ b/runtime/history/READER-VM130-EXEC-INTERFACE-AUDIT-332.txt
@@ -0,0 +1,93 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=READER-VM130-EXEC-INTERFACE-AUDIT-332
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=cluster-audit
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752
+COMMAND_SHA256=c3afb515a991225c64ea90bd9e285a44f09af255097fca7a30cae3c70af84c3e
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGES_MADE=false
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=761533b89826503b8ca2118991abaa2198d219e3e62eb6b18caf6d6b4518ad56
+SANITIZED_OUTPUT_SHA256=761533b89826503b8ca2118991abaa2198d219e3e62eb6b18caf6d6b4518ad56
+OUTPUT_BEGIN
+DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/test
+DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sha256sum
+DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/awk
+DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sed
+DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/bash
+DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/stat
+DETAIL=VM130_EXEC_SHA256=1959773393723b013af7c93cd29a7b833fd607c903d044e2fcef6accaa29c275
+DETAIL=VM130_EXEC_INTEGRITY=PASS
+DETAIL=VM130_EXEC_METADATA=root:root|750|1333|regular file
+DETAIL=VM130_EXEC_FIRST_LINE=#!/usr/bin/bash
+DETAIL=VM130_EXEC_SYNTAX=PASS
+DETAIL=VM130_EXEC_LINE_COUNT=53
+DETAIL=VM130_EXEC_SOURCE_BEGIN
+#!/usr/bin/bash
+set -Eeuo pipefail
+
+readonly SSH=/usr/bin/ssh
+readonly JQ=/usr/bin/jq
+readonly MKTEMP=/usr/bin/mktemp
+readonly RM=/usr/bin/rm
+readonly CAT=/usr/bin/cat
+readonly HOST=root@pve03
+readonly VMID=130
+
+if (($# == 0)); then
+    echo "VM130_EXEC_ERROR=NO_COMMAND" >&2
+    exit 64
+fi
+
+tmpdir="$("$MKTEMP" -d /tmp/homelab-vm130-exec.XXXXXX)"
+cleanup() {
+    "$RM" -rf -- "$tmpdir"
+}
+trap cleanup EXIT
+
+printf -v remote_cmd "%q " /usr/sbin/qm guest exec "$VMID" -- "$@"
+
+set +e
+"$SSH" -o BatchMode=yes -o ConnectTimeout=8 "$HOST" "$remote_cmd" >"$tmpdir/qga.json" 2>"$tmpdir/ssh.err"
+ssh_rc=$?
+set -e
+
+if ((ssh_rc != 0)); then
+    echo "VM130_EXEC_ERROR=SSH_FAILURE" >&2
+    echo "VM130_EXEC_SSH_RC=$ssh_rc" >&2
+    "$CAT" "$tmpdir/ssh.err" >&2
+    exit 125
+fi
+
+if ! "$JQ" -e 'type=="object" and (.exited == 1) and (.exitcode | type == "number")' "$tmpdir/qga.json" >/dev/null 2>&1; then
+    echo "VM130_EXEC_ERROR=INVALID_QGA_JSON" >&2
+    "$CAT" "$tmpdir/ssh.err" >&2
+    "$CAT" "$tmpdir/qga.json" >&2
+    exit 126
+fi
+
+"$JQ" -j '."out-data" // ""' "$tmpdir/qga.json"
+"$JQ" -j '."err-data" // ""' "$tmpdir/qga.json" >&2
+
+guest_rc="$("$JQ" -r '.exitcode' "$tmpdir/qga.json")"
+if [[ ! "$guest_rc" =~ ^[0-9]+$ ]] || ((guest_rc > 255)); then
+    echo "VM130_EXEC_ERROR=INVALID_GUEST_EXITCODE" >&2
+    exit 126
+fi
+
+exit "$guest_rc"
+DETAIL=VM130_EXEC_SOURCE_END
+DETAIL=VM130_EXEC_SOURCE_TRUNCATED=NO
+CHANGES_MADE=NO
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index 531aae3..d0d6568 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "READER-VM130-PUT-INTERFACE-AUDIT-331",
+  "command_id": "READER-VM130-EXEC-INTERFACE-AUDIT-332",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
   "mode": "read-only",
   "component": "cluster-audit",
-  "started_at_utc": "2026-07-23T05:02:19Z",
-  "finished_at_utc": "2026-07-23T05:02:19Z",
+  "started_at_utc": "2026-07-23T05:04:31Z",
+  "finished_at_utc": "2026-07-23T05:04:31Z",
   "reference_register_checked": true,
   "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
   "error_register_checked": true,
   "error_register_sha256": "08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752",
-  "command_sha256": "e8c9b036754a539b1282f1d1a4f3c2e6aacd2c36db93f7ab61f759039c7b9dc3",
+  "command_sha256": "c3afb515a991225c64ea90bd9e285a44f09af255097fca7a30cae3c70af84c3e",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -22,9 +22,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "b8700f3f22291a9240833ee3553ab23c76aa5fb1d21c5659f330f36ffa8931f4",
-  "sanitized_output_sha256": "b8700f3f22291a9240833ee3553ab23c76aa5fb1d21c5659f330f36ffa8931f4",
+  "raw_evidence_sha256": "761533b89826503b8ca2118991abaa2198d219e3e62eb6b18caf6d6b4518ad56",
+  "sanitized_output_sha256": "761533b89826503b8ca2118991abaa2198d219e3e62eb6b18caf6d6b4518ad56",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/test\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sha256sum\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/awk\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sed\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/bash\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/stat\nDETAIL=PUT_HELPER_SHA256=1166303044c104bcce68a5557b297ea034205ae8c497da7199e8a9f1cffc6bd8\nDETAIL=PUT_HELPER_INTEGRITY=PASS\nDETAIL=PUT_HELPER_METADATA=root:root|750|3227|regular file\nDETAIL=PUT_HELPER_FIRST_LINE=#!/usr/bin/bash\nDETAIL=PUT_HELPER_SYNTAX=PASS\nDETAIL=PUT_HELPER_LINE_COUNT=83\nDETAIL=PUT_HELPER_SOURCE_BEGIN\n#!/usr/bin/bash\nset -Eeuo pipefail\n\nreadonly VM_HELPER=/usr/local/sbin/homelab-vm130-exec\nreadonly VM_HELPER_SHA256=1959773393723b013af7c93cd29a7b833fd607c903d044e2fcef6accaa29c275\nreadonly SSH=/usr/bin/ssh\nreadonly JQ=/usr/bin/jq\nreadonly SHA256SUM=/usr/bin/sha256sum\nreadonly STAT=/usr/bin/stat\nreadonly MKTEMP=/usr/bin/mktemp\nreadonly RM=/usr/bin/rm\nreadonly CAT=/usr/bin/cat\nreadonly HOST=root@pve03\nreadonly VMID=130\nreadonly MAX_SIZE=1048576\n\nfail() {\n    printf 'VM130_PUT_ERROR=%s\\n' \"$1\" >&2\n    exit \"${2:-1}\"\n}\n\n(( $# == 2 )) || fail USAGE 64\nsource_file=$1\nremote_name=$2\n\n[[ \"$remote_name\" =~ ^homelab-[A-Za-z0-9._-]{1,96}$ ]] || fail REMOTE_NAME 65\nremote_file=\"/tmp/$remote_name\"\n\n[[ -x \"$VM_HELPER\" ]] || fail VM_HELPER_MISSING 69\nactual_vm_sha=$(\"$SHA256SUM\" \"$VM_HELPER\" | /usr/bin/awk '{print $1}')\n[[ \"$actual_vm_sha\" == \"$VM_HELPER_SHA256\" ]] || fail VM_HELPER_INTEGRITY 70\n\n[[ -f \"$source_file\" && ! -L \"$source_file\" ]] || fail SOURCE_TYPE 66\nsource_meta=$(\"$STAT\" -c '%U:%G|%a|%s|%F' \"$source_file\")\nIFS='|' read -r source_owner source_mode source_size source_type <<<\"$source_meta\"\n[[ \"$source_owner\" == root:root && \"$source_mode\" == 600 && \"$source_type\" == regular*file ]] || fail SOURCE_METADATA 66\n[[ \"$source_size\" =~ ^[0-9]+$ ]] && (( source_size > 0 && source_size <= MAX_SIZE )) || fail SOURCE_SIZE 66\nsource_sha=$(\"$SHA256SUM\" \"$source_file\" | /usr/bin/awk '{print $1}')\n\nif \"$VM_HELPER\" /usr/bin/test -e \"$remote_file\"; then\n    fail REMOTE_EXISTS 68\nfi\n\ntmpdir=$(\"$MKTEMP\" -d /tmp/homelab-vm130-put.XXXXXX)\nremote_created=NO\ncleanup() {\n    rc=$?\n    if [[ \"$remote_created\" == YES && \"$rc\" -ne 0 ]]; then\n        \"$VM_HELPER\" /usr/bin/rm -f -- \"$remote_file\" >/dev/null 2>&1 || true\n    fi\n    \"$RM\" -rf -- \"$tmpdir\"\n}\ntrap cleanup EXIT\n\nprintf -v remote_cmd '%q ' /usr/sbin/qm guest exec \"$VMID\" --pass-stdin 1 -- /usr/bin/dd \"of=$remote_file\" status=none\nif raw=$(\"$SSH\" -o BatchMode=yes -o ConnectTimeout=8 \"$HOST\" \"$remote_cmd\" <\"$source_file\" 2>\"$tmpdir/ssh.err\"); then\n    ssh_rc=0\nelse\n    ssh_rc=$?\nfi\n(( ssh_rc == 0 )) || {\n    \"$CAT\" \"$tmpdir/ssh.err\" >&2\n    fail SSH_FAILURE 125\n}\n\"$JQ\" -e 'type==\"object\" and (.exited==1) and (.exitcode|type==\"number\")' <<<\"$raw\" >/dev/null 2>&1 || fail INVALID_QGA_JSON 126\nguest_rc=$(\"$JQ\" -r '.exitcode' <<<\"$raw\")\nguest_out=$(\"$JQ\" -r '.\"out-data\" // empty' <<<\"$raw\")\nguest_err=$(\"$JQ\" -r '.\"err-data\" // empty' <<<\"$raw\")\n[[ \"$guest_rc\" == 0 && -z \"$guest_out\" && -z \"$guest_err\" ]] || fail GUEST_WRITE 74\nremote_created=YES\n\n\"$VM_HELPER\" /usr/bin/chown root:root \"$remote_file\"\n\"$VM_HELPER\" /usr/bin/chmod 0600 \"$remote_file\"\nremote_meta=$(\"$VM_HELPER\" /usr/bin/stat -c '%U:%G|%a|%s|%F' \"$remote_file\")\nIFS='|' read -r remote_owner remote_mode remote_size remote_type <<<\"$remote_meta\"\n[[ \"$remote_owner\" == root:root && \"$remote_mode\" == 600 && \"$remote_size\" == \"$source_size\" && \"$remote_type\" == regular*file ]] || fail REMOTE_METADATA 74\nremote_sha=$(\"$VM_HELPER\" /usr/bin/sha256sum \"$remote_file\" | /usr/bin/awk '{print $1}')\n[[ \"$remote_sha\" == \"$source_sha\" ]] || fail REMOTE_INTEGRITY 74\n\nprintf 'VM130_PUT=READY\\n'\nprintf 'REMOTE_FILE=%s\\n' \"$remote_file\"\nprintf 'SIZE=%s\\n' \"$source_size\"\nprintf 'SHA256=%s\\n' \"$source_sha\"\nDETAIL=PUT_HELPER_SOURCE_END\nDETAIL=PUT_HELPER_SOURCE_TRUNCATED=NO\nCHANGES_MADE=NO\n"
+  "output": "DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/test\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sha256sum\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/awk\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sed\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/bash\nDETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/stat\nDETAIL=VM130_EXEC_SHA256=1959773393723b013af7c93cd29a7b833fd607c903d044e2fcef6accaa29c275\nDETAIL=VM130_EXEC_INTEGRITY=PASS\nDETAIL=VM130_EXEC_METADATA=root:root|750|1333|regular file\nDETAIL=VM130_EXEC_FIRST_LINE=#!/usr/bin/bash\nDETAIL=VM130_EXEC_SYNTAX=PASS\nDETAIL=VM130_EXEC_LINE_COUNT=53\nDETAIL=VM130_EXEC_SOURCE_BEGIN\n#!/usr/bin/bash\nset -Eeuo pipefail\n\nreadonly SSH=/usr/bin/ssh\nreadonly JQ=/usr/bin/jq\nreadonly MKTEMP=/usr/bin/mktemp\nreadonly RM=/usr/bin/rm\nreadonly CAT=/usr/bin/cat\nreadonly HOST=root@pve03\nreadonly VMID=130\n\nif (($# == 0)); then\n    echo \"VM130_EXEC_ERROR=NO_COMMAND\" >&2\n    exit 64\nfi\n\ntmpdir=\"$(\"$MKTEMP\" -d /tmp/homelab-vm130-exec.XXXXXX)\"\ncleanup() {\n    \"$RM\" -rf -- \"$tmpdir\"\n}\ntrap cleanup EXIT\n\nprintf -v remote_cmd \"%q \" /usr/sbin/qm guest exec \"$VMID\" -- \"$@\"\n\nset +e\n\"$SSH\" -o BatchMode=yes -o ConnectTimeout=8 \"$HOST\" \"$remote_cmd\" >\"$tmpdir/qga.json\" 2>\"$tmpdir/ssh.err\"\nssh_rc=$?\nset -e\n\nif ((ssh_rc != 0)); then\n    echo \"VM130_EXEC_ERROR=SSH_FAILURE\" >&2\n    echo \"VM130_EXEC_SSH_RC=$ssh_rc\" >&2\n    \"$CAT\" \"$tmpdir/ssh.err\" >&2\n    exit 125\nfi\n\nif ! \"$JQ\" -e 'type==\"object\" and (.exited == 1) and (.exitcode | type == \"number\")' \"$tmpdir/qga.json\" >/dev/null 2>&1; then\n    echo \"VM130_EXEC_ERROR=INVALID_QGA_JSON\" >&2\n    \"$CAT\" \"$tmpdir/ssh.err\" >&2\n    \"$CAT\" \"$tmpdir/qga.json\" >&2\n    exit 126\nfi\n\n\"$JQ\" -j '.\"out-data\" // \"\"' \"$tmpdir/qga.json\"\n\"$JQ\" -j '.\"err-data\" // \"\"' \"$tmpdir/qga.json\" >&2\n\nguest_rc=\"$(\"$JQ\" -r '.exitcode' \"$tmpdir/qga.json\")\"\nif [[ ! \"$guest_rc\" =~ ^[0-9]+$ ]] || ((guest_rc > 255)); then\n    echo \"VM130_EXEC_ERROR=INVALID_GUEST_EXITCODE\" >&2\n    exit 126\nfi\n\nexit \"$guest_rc\"\nDETAIL=VM130_EXEC_SOURCE_END\nDETAIL=VM130_EXEC_SOURCE_TRUNCATED=NO\nCHANGES_MADE=NO\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index c71d7af..5263d2a 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,5 +1,5 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=READER-VM130-PUT-INTERFACE-AUDIT-331
+COMMAND_ID=READER-VM130-EXEC-INTERFACE-AUDIT-332
 STATUS=OK
 RC=0
 HOST=pve01
@@ -9,15 +9,15 @@ REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752
-COMMAND_SHA256=e8c9b036754a539b1282f1d1a4f3c2e6aacd2c36db93f7ab61f759039c7b9dc3
+COMMAND_SHA256=c3afb515a991225c64ea90bd9e285a44f09af255097fca7a30cae3c70af84c3e
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGES_MADE=false
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=b8700f3f22291a9240833ee3553ab23c76aa5fb1d21c5659f330f36ffa8931f4
-SANITIZED_OUTPUT_SHA256=b8700f3f22291a9240833ee3553ab23c76aa5fb1d21c5659f330f36ffa8931f4
+RAW_EVIDENCE_SHA256=761533b89826503b8ca2118991abaa2198d219e3e62eb6b18caf6d6b4518ad56
+SANITIZED_OUTPUT_SHA256=761533b89826503b8ca2118991abaa2198d219e3e62eb6b18caf6d6b4518ad56
 OUTPUT_BEGIN
 DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/test
 DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sha256sum
@@ -25,98 +25,68 @@ DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/awk
 DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sed
 DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/bash
 DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/stat
-DETAIL=PUT_HELPER_SHA256=1166303044c104bcce68a5557b297ea034205ae8c497da7199e8a9f1cffc6bd8
-DETAIL=PUT_HELPER_INTEGRITY=PASS
-DETAIL=PUT_HELPER_METADATA=root:root|750|3227|regular file
-DETAIL=PUT_HELPER_FIRST_LINE=#!/usr/bin/bash
-DETAIL=PUT_HELPER_SYNTAX=PASS
-DETAIL=PUT_HELPER_LINE_COUNT=83
-DETAIL=PUT_HELPER_SOURCE_BEGIN
+DETAIL=VM130_EXEC_SHA256=1959773393723b013af7c93cd29a7b833fd607c903d044e2fcef6accaa29c275
+DETAIL=VM130_EXEC_INTEGRITY=PASS
+DETAIL=VM130_EXEC_METADATA=root:root|750|1333|regular file
+DETAIL=VM130_EXEC_FIRST_LINE=#!/usr/bin/bash
+DETAIL=VM130_EXEC_SYNTAX=PASS
+DETAIL=VM130_EXEC_LINE_COUNT=53
+DETAIL=VM130_EXEC_SOURCE_BEGIN
 #!/usr/bin/bash
 set -Eeuo pipefail
 
-readonly VM_HELPER=/usr/local/sbin/homelab-vm130-exec
-readonly VM_HELPER_SHA256=1959773393723b013af7c93cd29a7b833fd607c903d044e2fcef6accaa29c275
 readonly SSH=/usr/bin/ssh
 readonly JQ=/usr/bin/jq
-readonly SHA256SUM=/usr/bin/sha256sum
-readonly STAT=/usr/bin/stat
 readonly MKTEMP=/usr/bin/mktemp
 readonly RM=/usr/bin/rm
 readonly CAT=/usr/bin/cat
 readonly HOST=root@pve03
 readonly VMID=130
-readonly MAX_SIZE=1048576
 
-fail() {
-    printf 'VM130_PUT_ERROR=%s\n' "$1" >&2
-    exit "${2:-1}"
-}
-
-(( $# == 2 )) || fail USAGE 64
-source_file=$1
-remote_name=$2
-
-[[ "$remote_name" =~ ^homelab-[A-Za-z0-9._-]{1,96}$ ]] || fail REMOTE_NAME 65
-remote_file="/tmp/$remote_name"
-
-[[ -x "$VM_HELPER" ]] || fail VM_HELPER_MISSING 69
-actual_vm_sha=$("$SHA256SUM" "$VM_HELPER" | /usr/bin/awk '{print $1}')
-[[ "$actual_vm_sha" == "$VM_HELPER_SHA256" ]] || fail VM_HELPER_INTEGRITY 70
-
-[[ -f "$source_file" && ! -L "$source_file" ]] || fail SOURCE_TYPE 66
-source_meta=$("$STAT" -c '%U:%G|%a|%s|%F' "$source_file")
-IFS='|' read -r source_owner source_mode source_size source_type <<<"$source_meta"
-[[ "$source_owner" == root:root && "$source_mode" == 600 && "$source_type" == regular*file ]] || fail SOURCE_METADATA 66
-[[ "$source_size" =~ ^[0-9]+$ ]] && (( source_size > 0 && source_size <= MAX_SIZE )) || fail SOURCE_SIZE 66
-source_sha=$("$SHA256SUM" "$source_file" | /usr/bin/awk '{print $1}')
-
-if "$VM_HELPER" /usr/bin/test -e "$remote_file"; then
-    fail REMOTE_EXISTS 68
+if (($# == 0)); then
+    echo "VM130_EXEC_ERROR=NO_COMMAND" >&2
+    exit 64
 fi
 
-tmpdir=$("$MKTEMP" -d /tmp/homelab-vm130-put.XXXXXX)
-remote_created=NO
+tmpdir="$("$MKTEMP" -d /tmp/homelab-vm130-exec.XXXXXX)"
 cleanup() {
-    rc=$?
-    if [[ "$remote_created" == YES && "$rc" -ne 0 ]]; then
-        "$VM_HELPER" /usr/bin/rm -f -- "$remote_file" >/dev/null 2>&1 || true
-    fi
     "$RM" -rf -- "$tmpdir"
 }
 trap cleanup EXIT
 
-printf -v remote_cmd '%q ' /usr/sbin/qm guest exec "$VMID" --pass-stdin 1 -- /usr/bin/dd "of=$remote_file" status=none
-if raw=$("$SSH" -o BatchMode=yes -o ConnectTimeout=8 "$HOST" "$remote_cmd" <"$source_file" 2>"$tmpdir/ssh.err"); then
-    ssh_rc=0
-else
-    ssh_rc=$?
-fi
-(( ssh_rc == 0 )) || {
+printf -v remote_cmd "%q " /usr/sbin/qm guest exec "$VMID" -- "$@"
+
+set +e
+"$SSH" -o BatchMode=yes -o ConnectTimeout=8 "$HOST" "$remote_cmd" >"$tmpdir/qga.json" 2>"$tmpdir/ssh.err"
+ssh_rc=$?
+set -e
+
+if ((ssh_rc != 0)); then
+    echo "VM130_EXEC_ERROR=SSH_FAILURE" >&2
+    echo "VM130_EXEC_SSH_RC=$ssh_rc" >&2
     "$CAT" "$tmpdir/ssh.err" >&2
-    fail SSH_FAILURE 125
-}
-"$JQ" -e 'type=="object" and (.exited==1) and (.exitcode|type=="number")' <<<"$raw" >/dev/null 2>&1 || fail INVALID_QGA_JSON 126
-guest_rc=$("$JQ" -r '.exitcode' <<<"$raw")
-guest_out=$("$JQ" -r '."out-data" // empty' <<<"$raw")
-guest_err=$("$JQ" -r '."err-data" // empty' <<<"$raw")
-[[ "$guest_rc" == 0 && -z "$guest_out" && -z "$guest_err" ]] || fail GUEST_WRITE 74
-remote_created=YES
+    exit 125
+fi
 
-"$VM_HELPER" /usr/bin/chown root:root "$remote_file"
-"$VM_HELPER" /usr/bin/chmod 0600 "$remote_file"
-remote_meta=$("$VM_HELPER" /usr/bin/stat -c '%U:%G|%a|%s|%F' "$remote_file")
-IFS='|' read -r remote_owner remote_mode remote_size remote_type <<<"$remote_meta"
-[[ "$remote_owner" == root:root && "$remote_mode" == 600 && "$remote_size" == "$source_size" && "$remote_type" == regular*file ]] || fail REMOTE_METADATA 74
-remote_sha=$("$VM_HELPER" /usr/bin/sha256sum "$remote_file" | /usr/bin/awk '{print $1}')
-[[ "$remote_sha" == "$source_sha" ]] || fail REMOTE_INTEGRITY 74
+if ! "$JQ" -e 'type=="object" and (.exited == 1) and (.exitcode | type == "number")' "$tmpdir/qga.json" >/dev/null 2>&1; then
+    echo "VM130_EXEC_ERROR=INVALID_QGA_JSON" >&2
+    "$CAT" "$tmpdir/ssh.err" >&2
+    "$CAT" "$tmpdir/qga.json" >&2
+    exit 126
+fi
 
-printf 'VM130_PUT=READY\n'
-printf 'REMOTE_FILE=%s\n' "$remote_file"
-printf 'SIZE=%s\n' "$source_size"
-printf 'SHA256=%s\n' "$source_sha"
-DETAIL=PUT_HELPER_SOURCE_END
-DETAIL=PUT_HELPER_SOURCE_TRUNCATED=NO
+"$JQ" -j '."out-data" // ""' "$tmpdir/qga.json"
+"$JQ" -j '."err-data" // ""' "$tmpdir/qga.json" >&2
+
+guest_rc="$("$JQ" -r '.exitcode' "$tmpdir/qga.json")"
+if [[ ! "$guest_rc" =~ ^[0-9]+$ ]] || ((guest_rc > 255)); then
+    echo "VM130_EXEC_ERROR=INVALID_GUEST_EXITCODE" >&2
+    exit 126
+fi
+
+exit "$guest_rc"
+DETAIL=VM130_EXEC_SOURCE_END
+DETAIL=VM130_EXEC_SOURCE_TRUNCATED=NO
 CHANGES_MADE=NO
 
 OUTPUT_END