runtime: publish CLUSTER-REFERENCE-PUBLISHER-SOURCE-EXTRACT-175

2026-07-22 10:47:36 +00:00
parent 18833c92dc
commit 8e73e329e4
4 changed files with 495 additions and 12 deletions
@@ -0,0 +1,251 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=CLUSTER-REFERENCE-PUBLISHER-SOURCE-EXTRACT-175
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=cluster-audit
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752
+COMMAND_SHA256=c7bfd2a11496ee580c4f487ad180de917052a698bfeb10fb1916d2dd2cf2acac
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGES_MADE=false
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=dbcffd7aedbdb836ef10a48eecc98523d23e2c0db4017bba124caeeaab4a1b47
+SANITIZED_OUTPUT_SHA256=f76fc120b3d22cac5e9945e9e3287749dff8d0bdd35bfb2399f961933259130e
+OUTPUT_BEGIN
+validation=PASS
+AUTHORITATIVE_PREVIOUS=CLUSTER-REFERENCE-PUBLISHER-RECOVERY-AUDIT-170:OK
+=== LOCAL_174_EVIDENCE ===
+/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174-20260722T104212Z.json
+/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174-20260722T104212Z-latest.txt
+/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174-20260722T104212Z.txt
+COMMAND_ID=CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174
+STATUS=OK
+RC=0
+ERROR_REGISTER_CHECK=OK
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171 PRESENT
+LOCAL_LEDGER=2026-07-22T10:25:15Z	CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171	1299fe30eb30386fec901e120ab525ece490edc5eca767d9216466ecd225bef5	0	OK	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.log
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172 PRESENT
+LOCAL_LEDGER=2026-07-22T10:31:23Z	CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172	1732aee566a83403f448dd74bbfed41489b1640081fd869e751d662ce82fabd8	0	OK	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.log
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173 PRESENT
+LOCAL_LEDGER=2026-07-22T10:36:43Z	CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173	5cdd947b6f70123b03dde2c7e4e6f2438293bf651fe1cf84f77374b982df1f7e	141	FAIL	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.log
+REFERENCE_CHECK=OK
+ERROR_REGISTER_CHECK=OK
+GAP_ERROR_REGISTERED=YES
+RUNNER_GAP_AUDIT=COMPLETE
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171 PRESENT
+LOCAL_LEDGER=2026-07-22T10:25:15Z	CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171	1299fe30eb30386fec901e120ab525ece490edc5eca767d9216466ecd225bef5	0	OK	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.log
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172 PRESENT
+LOCAL_LEDGER=2026-07-22T10:31:23Z	CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172	1732aee566a83403f448dd74bbfed41489b1640081fd869e751d662ce82fabd8	0	OK	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.log
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173 PRESENT
+LOCAL_LEDGER=2026-07-22T10:36:43Z	CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173	5cdd947b6f70123b03dde2c7e4e6f2438293bf651fe1cf84f77374b982df1f7e	141	FAIL	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.log
+REFERENCE_CHECK=OK
+ERROR_REGISTER_CHECK=OK
+GAP_ERROR_REGISTERED=YES
+RUNNER_GAP_AUDIT=COMPLETE
+=== WORKING_RUNTIME_PUBLICATION_SOURCE ===
+    "raw_evidence_retained_locally": True,
+    "raw_evidence_sha256": raw_sha,
+    "sanitized_output_sha256": sanitized_sha,
+    "output_truncated_in_json": output_truncated,
+    "full_sanitized_output_url": (
+        "https://git.gram1.ru/.well-known/"
+        "homelab-runtime/latest.txt"
+    ),
+    "output": output_preview,
+}
+
+Path(json_path).write_text(
+    json.dumps(
+        document,
+        ensure_ascii=False,
+        indent=2,
+    )
+    + "\n",
+    encoding="utf-8",
+)
+PY
+
+{
+    echo 'CHAT_OUTPUT_BEGIN'
+    echo "COMMAND_ID=$COMMAND_ID"
+    echo "STATUS=$STATUS"
+    echo "RC=$RC"
+    echo "HOST=$HOST_SHORT"
+    echo "MODE=$MODE"
+    echo "COMPONENT=$COMPONENT"
+    echo 'REFERENCE_REGISTER_CHECK=OK'
+    echo "REFERENCE_SHA256=$REFERENCE_SHA256"
+    echo 'ERROR_REGISTER_CHECK=OK'
+    echo "ERROR_REGISTER_SHA256=$ERROR_REGISTER_SHA256"
+    echo "COMMAND_SHA256=$COMMAND_SHA256"
+    echo "DUPLICATE_FAILED_COMMAND_BLOCKED=$REPEAT_BLOCKED"
+    echo "EXECUTION_STARTED=$RUN_STARTED"
+    echo "CHANGES_MADE=$CHANGES_MADE"
+    echo 'SANITIZED=yes'
+    echo 'SECRETS_INCLUDED=no'
+    echo 'PRIVATE_ADDRESSES_INCLUDED=no'
+    echo "RAW_EVIDENCE_SHA256=$RAW_SHA256"
+    echo "SANITIZED_OUTPUT_SHA256=$SANITIZED_SHA256"
+    echo 'OUTPUT_BEGIN'
+    cat "$SANITIZED_FILE"
+    echo
+    echo 'OUTPUT_END'
+    echo 'CHAT_OUTPUT_END'
+} >"$TXT_FILE"
+
+chmod 0600 \
+    "$RAW_FILE" \
+    "$SANITIZED_FILE" \
+    "$JSON_FILE" \
+    "$TXT_FILE"
+
+TARGET=debian@[PRIVATE_IP]
+REMOTE_PREFIX="/tmp/homelab-runtime-${COMMAND_ID}-$$"
+
+SSH_OPTS=(
+    -o BatchMode=yes
+    -o ConnectTimeout=10
+    -o ConnectionAttempts=1
+    -o StrictHostKeyChecking=yes
+    -o UserKnownHostsFile=[SENSITIVE_PATH]
+)
+
+scp \
+    -q \
+    "${SSH_OPTS[@]}" \
+    "$JSON_FILE" \
+    "${TARGET}:${REMOTE_PREFIX}.json"
+
+scp \
+    -q \
+    "${SSH_OPTS[@]}" \
+    "$TXT_FILE" \
+    "${TARGET}:${REMOTE_PREFIX}.txt"
+
+ssh "${SSH_OPTS[@]}" "$TARGET" "
+    set +e
+
+    sudo -n /usr/local/sbin/homelab-runtime-receive \
+        '$COMMAND_ID' \
+        '${REMOTE_PREFIX}.json' \
+        '${REMOTE_PREFIX}.txt'
+
+    receiver_rc=\$?
+
+    rm -f \
+        '${REMOTE_PREFIX}.json' \
+        '${REMOTE_PREFIX}.txt'
+
+    exit \$receiver_rc
+"
+
+PUBLIC_URL='https://git.gram1.ru/.well-known/homelab-runtime/latest.json'
+PUBLIC_VISIBLE=false
+
+for ATTEMPT in $(seq 1 30); do
+    CONTENT="$(
+        curl -fsS \
+            --max-time 15 \
+            "$PUBLIC_URL" 2>/dev/null ||
+        true
+    )"
+
+    if printf '%s\n' "$CONTENT" |
+       grep -Fq "\"command_id\": \"$COMMAND_ID\""; then
+        PUBLIC_VISIBLE=true
+        break
+    fi
+
+    sleep 2
+done
+
+if [ "$PUBLIC_VISIBLE" != true ]; then
+    echo 'RESULT=FAIL'
+    echo 'REASON=PUBLIC_RUNTIME_RESULT_NOT_VISIBLE'
+    echo "COMMAND_ID=$COMMAND_ID"
+    echo "LOCAL_RAW_FILE=$RAW_FILE"
+    exit 75
+fi
+
+printf '%s\t%s\t%s\t%s\t%s\t%s\n' \
+    "$FINISHED_AT" \
+    "$COMMAND_ID" \
+    "$COMMAND_SHA256" \
+    "$RC" \
+    "$STATUS" \
+    "$COMPONENT" >>"$LEDGER"
+
+echo
+echo '===== HOMELAB CHAT RUN COMPLETE ====='
+echo "COMMAND_ID=$COMMAND_ID"
+echo "STATUS=$STATUS"
+echo "RC=$RC"
+echo 'REFERENCE_REGISTER_CHECK=OK'
+echo 'ERROR_REGISTER_CHECK=OK'
+echo "DUPLICATE_FAILED_COMMAND_BLOCKED=$REPEAT_BLOCKED"
+echo 'GITEA_PUBLICATION=OK'
+echo "PUBLIC_URL=$PUBLIC_URL"
+echo "LOCAL_RAW_FILE=$RAW_FILE"
+echo 'SHELL_SESSION_PRESERVED=yes'
+
+exit "$RC"
+=== REFERENCE_PUBLISH_CONTRACT ===
+1-# Operations
+2-
+3-List: homelab-reference list
+4-Read: homelab-reference get SECTION ID --layer effective
+5-Add: homelab-reference add SECTION JSON
+6-Edit: homelab-reference edit SECTION ID --set key=value
+7-Remove: homelab-reference remove SECTION ID
+8-Validate: homelab-reference validate
+9-Merge: homelab-reference merge
+10-Refresh: homelab-reference-refresh
+11:Publish: homelab-reference-publish
+12-
+13-Immutable runtime history for the exact COMMAND_ID is authoritative. latest.json is not authoritative.
+5:S=json.loads((R/"manifest.json").read_text())["sections"]
+34: f=int(json.loads((R/"manifest.json").read_text()).get("freshness_seconds",{}).get(s,3600));z=(t+datetime.timedelta(seconds=f)).isoformat()
+124: rec={"cluster":[{"id":"cluster-homelab","hostname":socket.gethostname(),"kernel":os.uname().release,"pve_version":pv,"quorum_status":qu}],"nodes":[{**x,"id":"node-"+slug(x.get("node") or x.get("id"))} for x in nodes],"guests":[{"id":"guest-"+slug(x.get("vmid")),"vmid":x.get("vmid"),"name":x.get("name"),"type":x.get("type"),"node":x.get("node"),"status":x.get("status"),"tags":x.get("tags")} for x in guests],"containers":[{"id":"container-"+slug(x.get("vmid")),"vmid":x.get("vmid"),"name":x.get("name"),"node":x.get("node"),"status":x.get("status"),"tags":x.get("tags")} for x in guests if x.get("type")=="lxc"],"services":list(sv.values()),"applications":apps+comp,"networks":[{"id":"network-state","interfaces":addr,"routes":routes}],"dns":[{"id":"resolver-state","resolv_conf":dns}],"domains":[{"id":"domain-"+slug(x),"name":x} for x in sorted(dom)],"certificates":cert,"ingress":ing,"storage":[{**x,"id":"storage-"+slug(x.get("storage") or x.get("id"))} for x in stor],"backups":bk,"monitoring":[x for x in sv.values() if re.search(r"prometheus|grafana|zabbix|uptime|kuma|alertmanager|exporter|health|monitor",x.get("name",""),re.I)],"external_services":list(eps.values()),"dependencies":[{"id":"dependency-"+slug(x["id"]),"from":x["id"],"to":x.get("image"),"type":"container-image"} for x in apps if x.get("image")],"access":ac,"security":[{"id":"reference-security-policy","status":"enforced","secret_values_stored":False,"public_mirror_sanitized":True}]}
+125: cnt={s:write(s,x,"automatic-reference-collector",t) for s,x in rec.items()};eff={};pd=R/"public"/"effective";pd.mkdir(parents=True,exist_ok=True)
+128: atom(R/"public"/"index.json",{"schema_version":2,"reference_id":"homelab-cluster-reference-public","generated_at":t.isoformat(),"sections":eff,"secrets_included":False,"private_addresses_included":False})
+131: st=load("state","current") if False else json.loads((R/"state/current.json").read_text());st.update({"schema_version":2,"status":"AUTO_REFRESH_READY","updated_at":t.isoformat(),"last_snapshot":str(snap),"observed_counts":cnt,"effective_counts":eff,"public_index":str(R/"public/index.json"),"collector":str(pathlib.Path(__file__))});atom(R/"state/current.json",st)
+132: print("REFERENCE_REFRESH=PASS");print("OBSERVED_RECORDS="+str(sum(cnt.values())));print("EFFECTIVE_RECORDS="+str(sum(eff.values())));print("PUBLIC_MIRROR="+str(R/"public"))
+REFERENCE_CHECK=OK
+ERROR_REGISTER_CHECK=OK
+SECRET_PRINTED=NO
+PRIVATE_ADDRESS_PRINTED=NO
+PUBLISHER_SOURCE_EXTRACTION=COMPLETE
+
+OUTPUT_END
+CHAT_OUTPUT_END
@@ -1,5 +1,5 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174
+COMMAND_ID=CLUSTER-REFERENCE-PUBLISHER-SOURCE-EXTRACT-175
 STATUS=OK
 RC=0
 HOST=pve01
@@ -9,18 +9,26 @@ REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752
-COMMAND_SHA256=933ef3a5af1dc26cec92edcef570489a941d70f4cbae56df342b344e88f5f79f
+COMMAND_SHA256=c7bfd2a11496ee580c4f487ad180de917052a698bfeb10fb1916d2dd2cf2acac
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGES_MADE=false
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=3cb8cf3ed697b692630e88b57d8a36e942f8f28b4ec4b70853b74416089cb11d
-SANITIZED_OUTPUT_SHA256=3cb8cf3ed697b692630e88b57d8a36e942f8f28b4ec4b70853b74416089cb11d
+RAW_EVIDENCE_SHA256=dbcffd7aedbdb836ef10a48eecc98523d23e2c0db4017bba124caeeaab4a1b47
+SANITIZED_OUTPUT_SHA256=f76fc120b3d22cac5e9945e9e3287749dff8d0bdd35bfb2399f961933259130e
 OUTPUT_BEGIN
 validation=PASS
 AUTHORITATIVE_PREVIOUS=CLUSTER-REFERENCE-PUBLISHER-RECOVERY-AUDIT-170:OK
+=== LOCAL_174_EVIDENCE ===
+/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174-20260722T104212Z.json
+/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174-20260722T104212Z-latest.txt
+/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174-20260722T104212Z.txt
+COMMAND_ID=CLUSTER-REFERENCE-RUNNER-GAP-AUDIT-174
+STATUS=OK
+RC=0
+ERROR_REGISTER_CHECK=OK
 REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171 PRESENT
 LOCAL_LEDGER=2026-07-22T10:25:15Z	CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171	1299fe30eb30386fec901e120ab525ece490edc5eca767d9216466ecd225bef5	0	OK	cluster-audit
 LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.json
@@ -39,11 +47,205 @@ LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECO
 LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z-latest.txt
 LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.txt
 LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.log
-=== RUNTIME_PUBLISHERS ===
 REFERENCE_CHECK=OK
 ERROR_REGISTER_CHECK=OK
 GAP_ERROR_REGISTERED=YES
 RUNNER_GAP_AUDIT=COMPLETE
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171 PRESENT
+LOCAL_LEDGER=2026-07-22T10:25:15Z	CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171	1299fe30eb30386fec901e120ab525ece490edc5eca767d9216466ecd225bef5	0	OK	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171-20260722T102515Z.log
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172 PRESENT
+LOCAL_LEDGER=2026-07-22T10:31:23Z	CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172	1732aee566a83403f448dd74bbfed41489b1640081fd869e751d662ce82fabd8	0	OK	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-IMPLEMENTATION-INPUTS-172-20260722T103123Z.log
+REMOTE_HISTORY=CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173 PRESENT
+LOCAL_LEDGER=2026-07-22T10:36:43Z	CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173	5cdd947b6f70123b03dde2c7e4e6f2438293bf651fe1cf84f77374b982df1f7e	141	FAIL	cluster-audit
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.json
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z-latest.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/public/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.txt
+LOCAL_FILE=/var/lib/homelab-chat-run/raw/CLUSTER-REFERENCE-PUBLISHER-GAP-RECONCILE-173-20260722T103643Z.log
+REFERENCE_CHECK=OK
+ERROR_REGISTER_CHECK=OK
+GAP_ERROR_REGISTERED=YES
+RUNNER_GAP_AUDIT=COMPLETE
+=== WORKING_RUNTIME_PUBLICATION_SOURCE ===
+    "raw_evidence_retained_locally": True,
+    "raw_evidence_sha256": raw_sha,
+    "sanitized_output_sha256": sanitized_sha,
+    "output_truncated_in_json": output_truncated,
+    "full_sanitized_output_url": (
+        "https://git.gram1.ru/.well-known/"
+        "homelab-runtime/latest.txt"
+    ),
+    "output": output_preview,
+}
+
+Path(json_path).write_text(
+    json.dumps(
+        document,
+        ensure_ascii=False,
+        indent=2,
+    )
+    + "\n",
+    encoding="utf-8",
+)
+PY
+
+{
+    echo 'CHAT_OUTPUT_BEGIN'
+    echo "COMMAND_ID=$COMMAND_ID"
+    echo "STATUS=$STATUS"
+    echo "RC=$RC"
+    echo "HOST=$HOST_SHORT"
+    echo "MODE=$MODE"
+    echo "COMPONENT=$COMPONENT"
+    echo 'REFERENCE_REGISTER_CHECK=OK'
+    echo "REFERENCE_SHA256=$REFERENCE_SHA256"
+    echo 'ERROR_REGISTER_CHECK=OK'
+    echo "ERROR_REGISTER_SHA256=$ERROR_REGISTER_SHA256"
+    echo "COMMAND_SHA256=$COMMAND_SHA256"
+    echo "DUPLICATE_FAILED_COMMAND_BLOCKED=$REPEAT_BLOCKED"
+    echo "EXECUTION_STARTED=$RUN_STARTED"
+    echo "CHANGES_MADE=$CHANGES_MADE"
+    echo 'SANITIZED=yes'
+    echo 'SECRETS_INCLUDED=no'
+    echo 'PRIVATE_ADDRESSES_INCLUDED=no'
+    echo "RAW_EVIDENCE_SHA256=$RAW_SHA256"
+    echo "SANITIZED_OUTPUT_SHA256=$SANITIZED_SHA256"
+    echo 'OUTPUT_BEGIN'
+    cat "$SANITIZED_FILE"
+    echo
+    echo 'OUTPUT_END'
+    echo 'CHAT_OUTPUT_END'
+} >"$TXT_FILE"
+
+chmod 0600 \
+    "$RAW_FILE" \
+    "$SANITIZED_FILE" \
+    "$JSON_FILE" \
+    "$TXT_FILE"
+
+TARGET=debian@[PRIVATE_IP]
+REMOTE_PREFIX="/tmp/homelab-runtime-${COMMAND_ID}-$$"
+
+SSH_OPTS=(
+    -o BatchMode=yes
+    -o ConnectTimeout=10
+    -o ConnectionAttempts=1
+    -o StrictHostKeyChecking=yes
+    -o UserKnownHostsFile=[SENSITIVE_PATH]
+)
+
+scp \
+    -q \
+    "${SSH_OPTS[@]}" \
+    "$JSON_FILE" \
+    "${TARGET}:${REMOTE_PREFIX}.json"
+
+scp \
+    -q \
+    "${SSH_OPTS[@]}" \
+    "$TXT_FILE" \
+    "${TARGET}:${REMOTE_PREFIX}.txt"
+
+ssh "${SSH_OPTS[@]}" "$TARGET" "
+    set +e
+
+    sudo -n /usr/local/sbin/homelab-runtime-receive \
+        '$COMMAND_ID' \
+        '${REMOTE_PREFIX}.json' \
+        '${REMOTE_PREFIX}.txt'
+
+    receiver_rc=\$?
+
+    rm -f \
+        '${REMOTE_PREFIX}.json' \
+        '${REMOTE_PREFIX}.txt'
+
+    exit \$receiver_rc
+"
+
+PUBLIC_URL='https://git.gram1.ru/.well-known/homelab-runtime/latest.json'
+PUBLIC_VISIBLE=false
+
+for ATTEMPT in $(seq 1 30); do
+    CONTENT="$(
+        curl -fsS \
+            --max-time 15 \
+            "$PUBLIC_URL" 2>/dev/null ||
+        true
+    )"
+
+    if printf '%s\n' "$CONTENT" |
+       grep -Fq "\"command_id\": \"$COMMAND_ID\""; then
+        PUBLIC_VISIBLE=true
+        break
+    fi
+
+    sleep 2
+done
+
+if [ "$PUBLIC_VISIBLE" != true ]; then
+    echo 'RESULT=FAIL'
+    echo 'REASON=PUBLIC_RUNTIME_RESULT_NOT_VISIBLE'
+    echo "COMMAND_ID=$COMMAND_ID"
+    echo "LOCAL_RAW_FILE=$RAW_FILE"
+    exit 75
+fi
+
+printf '%s\t%s\t%s\t%s\t%s\t%s\n' \
+    "$FINISHED_AT" \
+    "$COMMAND_ID" \
+    "$COMMAND_SHA256" \
+    "$RC" \
+    "$STATUS" \
+    "$COMPONENT" >>"$LEDGER"
+
+echo
+echo '===== HOMELAB CHAT RUN COMPLETE ====='
+echo "COMMAND_ID=$COMMAND_ID"
+echo "STATUS=$STATUS"
+echo "RC=$RC"
+echo 'REFERENCE_REGISTER_CHECK=OK'
+echo 'ERROR_REGISTER_CHECK=OK'
+echo "DUPLICATE_FAILED_COMMAND_BLOCKED=$REPEAT_BLOCKED"
+echo 'GITEA_PUBLICATION=OK'
+echo "PUBLIC_URL=$PUBLIC_URL"
+echo "LOCAL_RAW_FILE=$RAW_FILE"
+echo 'SHELL_SESSION_PRESERVED=yes'
+
+exit "$RC"
+=== REFERENCE_PUBLISH_CONTRACT ===
+1-# Operations
+2-
+3-List: homelab-reference list
+4-Read: homelab-reference get SECTION ID --layer effective
+5-Add: homelab-reference add SECTION JSON
+6-Edit: homelab-reference edit SECTION ID --set key=value
+7-Remove: homelab-reference remove SECTION ID
+8-Validate: homelab-reference validate
+9-Merge: homelab-reference merge
+10-Refresh: homelab-reference-refresh
+11:Publish: homelab-reference-publish
+12-
+13-Immutable runtime history for the exact COMMAND_ID is authoritative. latest.json is not authoritative.
+5:S=json.loads((R/"manifest.json").read_text())["sections"]
+34: f=int(json.loads((R/"manifest.json").read_text()).get("freshness_seconds",{}).get(s,3600));z=(t+datetime.timedelta(seconds=f)).isoformat()
+124: rec={"cluster":[{"id":"cluster-homelab","hostname":socket.gethostname(),"kernel":os.uname().release,"pve_version":pv,"quorum_status":qu}],"nodes":[{**x,"id":"node-"+slug(x.get("node") or x.get("id"))} for x in nodes],"guests":[{"id":"guest-"+slug(x.get("vmid")),"vmid":x.get("vmid"),"name":x.get("name"),"type":x.get("type"),"node":x.get("node"),"status":x.get("status"),"tags":x.get("tags")} for x in guests],"containers":[{"id":"container-"+slug(x.get("vmid")),"vmid":x.get("vmid"),"name":x.get("name"),"node":x.get("node"),"status":x.get("status"),"tags":x.get("tags")} for x in guests if x.get("type")=="lxc"],"services":list(sv.values()),"applications":apps+comp,"networks":[{"id":"network-state","interfaces":addr,"routes":routes}],"dns":[{"id":"resolver-state","resolv_conf":dns}],"domains":[{"id":"domain-"+slug(x),"name":x} for x in sorted(dom)],"certificates":cert,"ingress":ing,"storage":[{**x,"id":"storage-"+slug(x.get("storage") or x.get("id"))} for x in stor],"backups":bk,"monitoring":[x for x in sv.values() if re.search(r"prometheus|grafana|zabbix|uptime|kuma|alertmanager|exporter|health|monitor",x.get("name",""),re.I)],"external_services":list(eps.values()),"dependencies":[{"id":"dependency-"+slug(x["id"]),"from":x["id"],"to":x.get("image"),"type":"container-image"} for x in apps if x.get("image")],"access":ac,"security":[{"id":"reference-security-policy","status":"enforced","secret_values_stored":False,"public_mirror_sanitized":True}]}
+125: cnt={s:write(s,x,"automatic-reference-collector",t) for s,x in rec.items()};eff={};pd=R/"public"/"effective";pd.mkdir(parents=True,exist_ok=True)
+128: atom(R/"public"/"index.json",{"schema_version":2,"reference_id":"homelab-cluster-reference-public","generated_at":t.isoformat(),"sections":eff,"secrets_included":False,"private_addresses_included":False})
+131: st=load("state","current") if False else json.loads((R/"state/current.json").read_text());st.update({"schema_version":2,"status":"AUTO_REFRESH_READY","updated_at":t.isoformat(),"last_snapshot":str(snap),"observed_counts":cnt,"effective_counts":eff,"public_index":str(R/"public/index.json"),"collector":str(pathlib.Path(__file__))});atom(R/"state/current.json",st)
+132: print("REFERENCE_REFRESH=PASS");print("OBSERVED_RECORDS="+str(sum(cnt.values())));print("EFFECTIVE_RECORDS="+str(sum(eff.values())));print("PUBLIC_MIRROR="+str(R/"public"))
+REFERENCE_CHECK=OK
+ERROR_REGISTER_CHECK=OK
+SECRET_PRINTED=NO
+PRIVATE_ADDRESS_PRINTED=NO
+PUBLISHER_SOURCE_EXTRACTION=COMPLETE

 OUTPUT_END
 CHAT_OUTPUT_END