From a06adce84b486cfe9c424eb0490854da373923d9 Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Tue, 28 Jul 2026 15:28:06 +0000 Subject: [PATCH] runtime: publish STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z --- ...ULL-LATEST-PLAN-FIX2-20260728T152616Z.json | 38 +++++++++++++++++++ ...FULL-LATEST-PLAN-FIX2-20260728T152616Z.txt | 34 +++++++++++++++++ runtime/latest.json | 20 +++++----- runtime/latest.txt | 18 ++++----- 4 files changed, 91 insertions(+), 19 deletions(-) create mode 100644 runtime/history/STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z.json create mode 100644 runtime/history/STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z.txt diff --git a/runtime/history/STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z.json b/runtime/history/STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z.json new file mode 100644 index 0000000..5dfa258 --- /dev/null +++ b/runtime/history/STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "verify", + "component": "stable-local-result-feed-and-full-latest-plan", + "started_at_utc": "2026-07-28T15:27:45Z", + "finished_at_utc": "2026-07-28T15:28:05Z", + "reference_register_checked": true, + "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", + "error_register_checked": true, + "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", + "command_sha256": "8833469ea61d5036fd284dc81a2bf20d19a53b9d2a2270d60fe193c68ad5eb15", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "b0c10fc8d85f0f3f4f7472b1d9eb94b6a5981089c68bb8a8f7f43b1e5e893409", + "sanitized_output_sha256": "5f01c420507160eb67cfd3d4bf6c1cd0791762ca77c744bfbcd288994adb0b6a", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z\",\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"PLAN_SHA256\":\"68746ed2758c37f52d2e66768999421d48468d4d46a3d3cf3abaeacf7baf9c79\",\"backup_changed\":false,\"changes_made\":false,\"cluster_changed\":false,\"command_id\":\"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z\",\"failure_code_contract\":{\"ADAPTER_CANDIDATE\":47,\"CURRENT_PUBLIC_SURFACE\":46,\"EDGE_CANDIDATE\":52,\"EDGE_DISCOVERY\":50,\"EDGE_SOURCE_LOCK\":51,\"LEDGER_PRECONDITION\":45,\"LOOKUP_CANDIDATE\":48,\"PRODUCTION_DRIFT\":53,\"ROOT_OR_HOST\":41,\"SERVICE_BASIC_HEALTH\":43,\"SERVICE_STABILITY\":44,\"SOURCE_LOCK\":42,\"TEMPORARY_CLEANUP\":54,\"UNEXPECTED\":99,\"UNIT_CANDIDATE\":49},\"gitea_changed\":false,\"minio_changed\":false,\"observations\":{\"candidate\":{\"adapter_sha256\":\"3879db9c8f918d72eb9c2d2949f805cea7d5d131fae0c1cd05ef5928b41cd08e\",\"edge_container_started_at\":\"2026-07-28T11:06:45.929887242Z\",\"edge_source_sha256\":\"bb8fff32953ac81b7c93a943308c939804262ea8db3c21a344a417adec45e8e8\",\"edge_target_sha256\":\"ae63d937b8d9189cd016784fb735d1fae32a363cb88ebcc7efdecc22665cc8aa\",\"lookup_sha256\":\"acb8a49e008d1c0f1a85219633ee2d4c390d2e60e0c2071ec17a2c5aeb42e57e\",\"unit_sha256\":\"c957d136ad93e1cd1386d42cb15732b798400652952f56ea0746c80e927bbd01\"},\"current_public\":{\"exact_full_output_present\":false,\"exact_http\":200,\"feed_http\":200,\"latest_http\":200},\"fixture\":{\"corruption_http\":409,\"exact_http\":200,\"feed_http\":200,\"latest_http\":200,\"latest_output_present\":true,\"latest_plan_sha_present\":true,\"restart_persistence\":true,\"sequence\":\"efea7986e5d4989d0b8deaa393c8e8a62658185acbc964b14a49a87152a5b9c4\"},\"service_stability\":{\"adapter\":{\"after\":{\"MainPID\":\"11360\",\"NRestarts\":\"22\"},\"before\":{\"MainPID\":\"11360\",\"NRestarts\":\"22\"}},\"lookup\":{\"after\":{\"MainPID\":\"466244\",\"NRestarts\":\"0\"},\"before\":{\"MainPID\":\"466244\",\"NRestarts\":\"0\"}},\"portal\":{\"after\":{\"MainPID\":\"466240\",\"NRestarts\":\"0\"},\"before\":{\"MainPID\":\"466240\",\"NRestarts\":\"0\"}}},\"source_hashes\":{\"/etc/systemd/system/homelab-command-portal.service\":\"8453eab30f5c3ccd285fc9f70fff18f564809bb27f7bf84f51f2ba593aa85263\",\"/etc/systemd/system/homelab-result-lookup.service\":\"4bcc607fd457313f75373ec3d8ec20e7020f13c7cb8a9523fd988a24b0f6609d\",\"/usr/local/sbin/homelab-chat-run\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"/usr/local/sbin/homelab-command-adapter\":\"a1a7a615c99568bf915d084cc476f0ebf54ab0eedf3ecd578c4b0e072f58c43d\",\"/usr/local/sbin/homelab-command-portal\":\"97c69bd4fccf7272dadc911281c1503f411bae2dc11dac4b22b87f33d678ae52\",\"/usr/local/sbin/homelab-result-lookup\":\"17f8d2a2ea219cdc02b0f8e821f8054b05c01de1253419b3d23349a2d383889c\"}},\"plan\":{\"anti_regression\":[\"AR-001-STABLE-URLS-NO-QUERY-STRING\",\"AR-002-FEED-AND-LATEST-SAME-SEQUENCE\",\"AR-003-LATEST-CONTAINS-FULL-OUTPUT\",\"AR-004-LATEST-CONTAINS-PLAN-SHA256\",\"AR-005-LOCAL-LEDGER-BEFORE-MINIO\",\"AR-006-IMMUTABLE-COLLISION-REJECTED\",\"AR-007-CORRUPTION-RETURNS-409\",\"AR-008-NO-GITEA-LOOKUP-DEPENDENCY\",\"AR-009-NO-MINIO-LOOKUP-DEPENDENCY\",\"AR-010-NO-PORTAL-LOOKUP-DEPENDENCY\",\"AR-011-HISTORICAL-NRESTARTS-ALLOWED\",\"AR-012-PID-AND-NRESTARTS-STABILITY\",\"AR-013-EDGE-SOURCE-SHA-LOCK\",\"AR-014-NGINX-CANDIDATE-MARKER-CARDINALITY\",\"AR-015-NO-SECOND-RUNNER\",\"AR-016-BACKUP-UNTOUCHED\",\"AR-017-FAILURE-RC-IDENTIFIES-STAGE\",\"AR-018-PLAN-SHA-BINDS-APPLY\",\"AR-019-RUNNER-DOES-NOT-USE-PVESH\",\"AR-020-EDGE-DIRECT-SSH-DEBIAN-SUDO\",\"AR-021-STRICT-HOST-KEY-CHECKING\",\"AR-022-SSH-BATCH-MODE-NO-PROMPT\",\"AR-023-SSH-REMOTE-COMMAND-IS-ONE-ARGV\",\"AR-024-EVERY-REMOTE-ARGV-ELEMENT-SHELL-QUOTED\",\"AR-025-PYTHON-C-STUB-ROUNDTRIP-THROUGH-BIN-SH\",\"AR-026-UNQUOTED-SEMICOLON-REGRESSION\"],\"apply_postconditions\":[\"new runtime smoke writes one immutable local ledger result\",\"permanent feed and latest expose the same result_sequence\",\"permanent latest command_id and capsule_sha256 match smoke\",\"permanent latest contains full output and PLAN_SHA256\",\"readback remains healthy with Portal stopped during controlled test\",\"readback remains healthy when Gitea and MinIO probes fail\",\"edge nginx container ID and StartedAt unchanged\",\"all changed files stable and services stable for 20 seconds\"],\"apply_preconditions\":[\"recompute and require this exact PLAN_SHA256\",\"all source SHA-256 locks unchanged\",\"direct SSH to debian@[PRIVATE_IP] succeeds with strict host-key checking and sudo -n; edge-vm and npmplus identity remain unchanged\",\"Adapter, Portal and Lookup stable for 20 seconds\",\"production ledger root absent\",\"current public exact lookup route healthy\",\"candidate fixture matrix PASS\",\"edge source configuration SHA exact\"],\"changes_for_apply\":{\"edge_vm\":{\"container_restart\":false,\"modify\":[\"/opt/npmplus/nginx/proxy_host/9.conf\"],\"reload_only\":\"npmplus nginx\"},\"forbidden\":[\"modify backup\",\"modify cluster membership\",\"modify Gitea repositories\",\"modify MinIO objects\",\"create a second runner\",\"force push\"],\"pve01\":{\"create\":[\"/var/lib/homelab-result-ledger\"],\"do_not_restart\":[\"homelab-command-portal.service\",\"homelab-chat-run\"],\"modify\":[\"/usr/local/sbin/homelab-command-adapter\",\"/usr/local/sbin/homelab-result-lookup\",\"/etc/systemd/system/homelab-result-lookup.service\"],\"restart\":[\"homelab-command-adapter.service\",\"homelab-result-lookup.service\"]}},\"data_contract\":{\"allowed_methods\":[\"GET\",\"HEAD\"],\"cache\":\"no-store/no-cache/must-revalidate\",\"feed_version\":4,\"full_latest_fields\":[\"command_id\",\"capsule_sha256\",\"finished_at_utc\",\"result_sequence\",\"status\",\"runner_rc\",\"runner_document_rc\",\"runner_wrapper_matches_document\",\"PLAN_SHA256\",\"output\",\"result_contract\",\"runner_document\"],\"immutable_identity\":\"{capsule_sha256}/{command_id}.json\",\"integrity_failure_http\":409,\"missing_http\":404,\"recent_results_max\":32,\"writer_position\":\"after validated runner_document and before evidence bundle creation and MinIO upload\"},\"deterministic_material\":{\"adapter_transform_sha256\":\"e71b9090fd7af406c9d93b767c5d4a6744224aadd82f35264394f5df8545c87a\",\"edge_route_block_sha256\":\"ca1609b433b72dba0970aa51983651f5490aeaddafc1687cbd8980ab0a78313d\",\"ledger_helpers_sha256\":\"985ee0afd9551ac167cce578e272e60d5ec96158e473787296646b75d0b745b6\",\"lookup_candidate_sha256\":\"acb8a49e008d1c0f1a85219633ee2d4c390d2e60e0c2071ec17a2c5aeb42e57e\",\"unit_candidate_sha256\":\"c957d136ad93e1cd1386d42cb15732b798400652952f56ea0746c80e927bbd01\"},\"diagnosis\":{\"fix\":\"Build exactly one remote command string by applying shlex.quote to every remote argv element, then pass only that string after the SSH target.\",\"observed_failure\":\"EDGE_SSH_PROBE_RC:2:STDERR_SHA256=80352ae284cf808992637f4cf42a7a32008c7ff50228528516e53fb591f67397\",\"observed_failure_code\":50,\"observed_failure_stage\":\"EDGE_DISCOVERY\",\"root_cause\":\"FIX1 passed the Python -c program to OpenSSH as a separate local argv item. OpenSSH serializes remote command items into one remote-shell line without preserving local argv boundaries. The stub therefore reached the remote shell unquoted; its semicolon, parentheses and quotes were parsed as shell syntax, producing status 2 before the probe ran.\",\"superseded_command_id\":\"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z\"},\"edge_discovery_contract\":{\"batch_mode\":true,\"pvesh_forbidden\":true,\"qm_guest_exec_forbidden\":true,\"remote_argv\":[\"/usr/bin/sudo\",\"-n\",\"/usr/bin/python3\",\"-B\",\"-c\",\"\"],\"remote_command_transport\":\"single remote command string; each remote argv element is shell-quoted with shlex.quote\",\"remote_probe\":\"hostname, exact config SHA, base64 config, Docker container identity/state/network mode and nginx -t\",\"strict_host_key_checking\":true,\"sudo\":\"sudo -n\",\"target\":\"debian@[PRIVATE_IP]\",\"transport\":\"direct-ssh\",\"unquoted_python_c_forbidden\":true,\"writes\":false},\"failure_code_contract\":{\"ADAPTER_CANDIDATE\":47,\"CURRENT_PUBLIC_SURFACE\":46,\"EDGE_CANDIDATE\":52,\"EDGE_DISCOVERY\":50,\"EDGE_SOURCE_LOCK\":51,\"LEDGER_PRECONDITION\":45,\"LOOKUP_CANDIDATE\":48,\"PRODUCTION_DRIFT\":53,\"ROOT_OR_HOST\":41,\"SERVICE_BASIC_HEALTH\":43,\"SERVICE_STABILITY\":44,\"SOURCE_LOCK\":42,\"TEMPORARY_CLEANUP\":54,\"UNEXPECTED\":99,\"UNIT_CANDIDATE\":49},\"objective\":\"Make the two already trusted permanent URLs result-feed.json and latest.json read only from the local immutable result ledger. latest.json must contain the complete sanitized output and PLAN_SHA256. Gitea, MinIO and Portal must not be in the readback critical path.\",\"operation\":\"STABLE_LOCAL_RESULT_FEED_AND_FULL_LATEST_PLAN_FIX2\",\"read_only_plan\":true,\"rollback\":{\"container_restart_forbidden\":true,\"diagnostics_before_rollback\":true,\"nginx_test_before_reload\":true,\"remove_ledger_only_if_created_by_apply\":true,\"restore_exact_files\":true,\"verify_old_routes_after_restore\":true},\"schema\":1,\"service_health_contract\":{\"basic\":\"loaded, enabled, active, running, Result=success, ExecMainStatus=0, MainPID>1\",\"historical_nonzero_nrestarts_allowed\":true,\"stability_window_seconds\":20,\"stable\":\"MainPID and cumulative NRestarts unchanged\"},\"source_locks\":{\"/etc/systemd/system/homelab-command-portal.service\":\"8453eab30f5c3ccd285fc9f70fff18f564809bb27f7bf84f51f2ba593aa85263\",\"/etc/systemd/system/homelab-result-lookup.service\":\"4bcc607fd457313f75373ec3d8ec20e7020f13c7cb8a9523fd988a24b0f6609d\",\"/usr/local/sbin/homelab-chat-run\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"/usr/local/sbin/homelab-command-adapter\":\"a1a7a615c99568bf915d084cc476f0ebf54ab0eedf3ecd578c4b0e072f58c43d\",\"/usr/local/sbin/homelab-command-portal\":\"97c69bd4fccf7272dadc911281c1503f411bae2dc11dac4b22b87f33d678ae52\",\"/usr/local/sbin/homelab-result-lookup\":\"17f8d2a2ea219cdc02b0f8e821f8054b05c01de1253419b3d23349a2d383889c\",\"edge\":{\"config\":\"/opt/npmplus/nginx/proxy_host/9.conf\",\"container_id\":\"2f18b3d7f3865edf4bdb4ae658fbecc4f75145acab1ffac2fe57df1d889952c9\",\"container_image\":\"docker.io/zoeyvid/npmplus:2026-06-17-b1\",\"container_name\":\"npmplus\",\"current_sha256\":\"bb8fff32953ac81b7c93a943308c939804262ea8db3c21a344a417adec45e8e8\",\"node\":\"pve03\",\"ssh_batch_mode\":true,\"ssh_host\":\"[PRIVATE_IP]\",\"ssh_strict_host_key_checking\":true,\"ssh_target\":\"debian@[PRIVATE_IP]\",\"ssh_user\":\"debian\",\"sudo_noninteractive\":true,\"vm_name\":\"edge-vm\",\"vmid\":130}},\"stable_urls\":{\"feed\":\"https://git.gram1.ru/.well-known/homelab-runtime/result-feed.json\",\"latest\":\"https://git.gram1.ru/.well-known/homelab-runtime/latest.json\",\"query_parameters_required\":false},\"target\":\"pve01-and-edge-vm\"},\"private_addresses_included\":false,\"rollback_started\":false,\"sanitized\":true,\"schema\":1,\"secrets_included\":false,\"status\":\"PLAN_READY\"}\n" +} diff --git a/runtime/history/STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z.txt b/runtime/history/STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z.txt new file mode 100644 index 0000000..93234ad --- /dev/null +++ b/runtime/history/STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z.txt @@ -0,0 +1,34 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z +STATUS=OK +RC=0 +HOST=pve01 +MODE=verify +COMPONENT=stable-local-result-feed-and-full-latest-plan +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 +COMMAND_SHA256=8833469ea61d5036fd284dc81a2bf20d19a53b9d2a2270d60fe193c68ad5eb15 +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=b0c10fc8d85f0f3f4f7472b1d9eb94b6a5981089c68bb8a8f7f43b1e5e893409 +SANITIZED_OUTPUT_SHA256=5f01c420507160eb67cfd3d4bf6c1cd0791762ca77c744bfbcd288994adb0b6a +OUTPUT_BEGIN +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z","rollback_restored":null,"rollback_started":false,"status":"OK","version":1} +{"PLAN_SHA256":"68746ed2758c37f52d2e66768999421d48468d4d46a3d3cf3abaeacf7baf9c79","backup_changed":false,"changes_made":false,"cluster_changed":false,"command_id":"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z","failure_code_contract":{"ADAPTER_CANDIDATE":47,"CURRENT_PUBLIC_SURFACE":46,"EDGE_CANDIDATE":52,"EDGE_DISCOVERY":50,"EDGE_SOURCE_LOCK":51,"LEDGER_PRECONDITION":45,"LOOKUP_CANDIDATE":48,"PRODUCTION_DRIFT":53,"ROOT_OR_HOST":41,"SERVICE_BASIC_HEALTH":43,"SERVICE_STABILITY":44,"SOURCE_LOCK":42,"TEMPORARY_CLEANUP":54,"UNEXPECTED":99,"UNIT_CANDIDATE":49},"gitea_changed":false,"minio_changed":false,"observations":{"candidate":{"adapter_sha256":"3879db9c8f918d72eb9c2d2949f805cea7d5d131fae0c1cd05ef5928b41cd08e","edge_container_started_at":"2026-07-28T11:06:45.929887242Z","edge_source_sha256":"bb8fff32953ac81b7c93a943308c939804262ea8db3c21a344a417adec45e8e8","edge_target_sha256":"ae63d937b8d9189cd016784fb735d1fae32a363cb88ebcc7efdecc22665cc8aa","lookup_sha256":"acb8a49e008d1c0f1a85219633ee2d4c390d2e60e0c2071ec17a2c5aeb42e57e","unit_sha256":"c957d136ad93e1cd1386d42cb15732b798400652952f56ea0746c80e927bbd01"},"current_public":{"exact_full_output_present":false,"exact_http":200,"feed_http":200,"latest_http":200},"fixture":{"corruption_http":409,"exact_http":200,"feed_http":200,"latest_http":200,"latest_output_present":true,"latest_plan_sha_present":true,"restart_persistence":true,"sequence":"efea7986e5d4989d0b8deaa393c8e8a62658185acbc964b14a49a87152a5b9c4"},"service_stability":{"adapter":{"after":{"MainPID":"11360","NRestarts":"22"},"before":{"MainPID":"11360","NRestarts":"22"}},"lookup":{"after":{"MainPID":"466244","NRestarts":"0"},"before":{"MainPID":"466244","NRestarts":"0"}},"portal":{"after":{"MainPID":"466240","NRestarts":"0"},"before":{"MainPID":"466240","NRestarts":"0"}}},"source_hashes":{"/etc/systemd/system/homelab-command-portal.service":"8453eab30f5c3ccd285fc9f70fff18f564809bb27f7bf84f51f2ba593aa85263","/etc/systemd/system/homelab-result-lookup.service":"4bcc607fd457313f75373ec3d8ec20e7020f13c7cb8a9523fd988a24b0f6609d","/usr/local/sbin/homelab-chat-run":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","/usr/local/sbin/homelab-command-adapter":"a1a7a615c99568bf915d084cc476f0ebf54ab0eedf3ecd578c4b0e072f58c43d","/usr/local/sbin/homelab-command-portal":"97c69bd4fccf7272dadc911281c1503f411bae2dc11dac4b22b87f33d678ae52","/usr/local/sbin/homelab-result-lookup":"17f8d2a2ea219cdc02b0f8e821f8054b05c01de1253419b3d23349a2d383889c"}},"plan":{"anti_regression":["AR-001-STABLE-URLS-NO-QUERY-STRING","AR-002-FEED-AND-LATEST-SAME-SEQUENCE","AR-003-LATEST-CONTAINS-FULL-OUTPUT","AR-004-LATEST-CONTAINS-PLAN-SHA256","AR-005-LOCAL-LEDGER-BEFORE-MINIO","AR-006-IMMUTABLE-COLLISION-REJECTED","AR-007-CORRUPTION-RETURNS-409","AR-008-NO-GITEA-LOOKUP-DEPENDENCY","AR-009-NO-MINIO-LOOKUP-DEPENDENCY","AR-010-NO-PORTAL-LOOKUP-DEPENDENCY","AR-011-HISTORICAL-NRESTARTS-ALLOWED","AR-012-PID-AND-NRESTARTS-STABILITY","AR-013-EDGE-SOURCE-SHA-LOCK","AR-014-NGINX-CANDIDATE-MARKER-CARDINALITY","AR-015-NO-SECOND-RUNNER","AR-016-BACKUP-UNTOUCHED","AR-017-FAILURE-RC-IDENTIFIES-STAGE","AR-018-PLAN-SHA-BINDS-APPLY","AR-019-RUNNER-DOES-NOT-USE-PVESH","AR-020-EDGE-DIRECT-SSH-DEBIAN-SUDO","AR-021-STRICT-HOST-KEY-CHECKING","AR-022-SSH-BATCH-MODE-NO-PROMPT","AR-023-SSH-REMOTE-COMMAND-IS-ONE-ARGV","AR-024-EVERY-REMOTE-ARGV-ELEMENT-SHELL-QUOTED","AR-025-PYTHON-C-STUB-ROUNDTRIP-THROUGH-BIN-SH","AR-026-UNQUOTED-SEMICOLON-REGRESSION"],"apply_postconditions":["new runtime smoke writes one immutable local ledger result","permanent feed and latest expose the same result_sequence","permanent latest command_id and capsule_sha256 match smoke","permanent latest contains full output and PLAN_SHA256","readback remains healthy with Portal stopped during controlled test","readback remains healthy when Gitea and MinIO probes fail","edge nginx container ID and StartedAt unchanged","all changed files stable and services stable for 20 seconds"],"apply_preconditions":["recompute and require this exact PLAN_SHA256","all source SHA-256 locks unchanged","direct SSH to debian@[PRIVATE_IP] succeeds with strict host-key checking and sudo -n; edge-vm and npmplus identity remain unchanged","Adapter, Portal and Lookup stable for 20 seconds","production ledger root absent","current public exact lookup route healthy","candidate fixture matrix PASS","edge source configuration SHA exact"],"changes_for_apply":{"edge_vm":{"container_restart":false,"modify":["/opt/npmplus/nginx/proxy_host/9.conf"],"reload_only":"npmplus nginx"},"forbidden":["modify backup","modify cluster membership","modify Gitea repositories","modify MinIO objects","create a second runner","force push"],"pve01":{"create":["/var/lib/homelab-result-ledger"],"do_not_restart":["homelab-command-portal.service","homelab-chat-run"],"modify":["/usr/local/sbin/homelab-command-adapter","/usr/local/sbin/homelab-result-lookup","/etc/systemd/system/homelab-result-lookup.service"],"restart":["homelab-command-adapter.service","homelab-result-lookup.service"]}},"data_contract":{"allowed_methods":["GET","HEAD"],"cache":"no-store/no-cache/must-revalidate","feed_version":4,"full_latest_fields":["command_id","capsule_sha256","finished_at_utc","result_sequence","status","runner_rc","runner_document_rc","runner_wrapper_matches_document","PLAN_SHA256","output","result_contract","runner_document"],"immutable_identity":"{capsule_sha256}/{command_id}.json","integrity_failure_http":409,"missing_http":404,"recent_results_max":32,"writer_position":"after validated runner_document and before evidence bundle creation and MinIO upload"},"deterministic_material":{"adapter_transform_sha256":"e71b9090fd7af406c9d93b767c5d4a6744224aadd82f35264394f5df8545c87a","edge_route_block_sha256":"ca1609b433b72dba0970aa51983651f5490aeaddafc1687cbd8980ab0a78313d","ledger_helpers_sha256":"985ee0afd9551ac167cce578e272e60d5ec96158e473787296646b75d0b745b6","lookup_candidate_sha256":"acb8a49e008d1c0f1a85219633ee2d4c390d2e60e0c2071ec17a2c5aeb42e57e","unit_candidate_sha256":"c957d136ad93e1cd1386d42cb15732b798400652952f56ea0746c80e927bbd01"},"diagnosis":{"fix":"Build exactly one remote command string by applying shlex.quote to every remote argv element, then pass only that string after the SSH target.","observed_failure":"EDGE_SSH_PROBE_RC:2:STDERR_SHA256=80352ae284cf808992637f4cf42a7a32008c7ff50228528516e53fb591f67397","observed_failure_code":50,"observed_failure_stage":"EDGE_DISCOVERY","root_cause":"FIX1 passed the Python -c program to OpenSSH as a separate local argv item. OpenSSH serializes remote command items into one remote-shell line without preserving local argv boundaries. The stub therefore reached the remote shell unquoted; its semicolon, parentheses and quotes were parsed as shell syntax, producing status 2 before the probe ran.","superseded_command_id":"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z"},"edge_discovery_contract":{"batch_mode":true,"pvesh_forbidden":true,"qm_guest_exec_forbidden":true,"remote_argv":["/usr/bin/sudo","-n","/usr/bin/python3","-B","-c",""],"remote_command_transport":"single remote command string; each remote argv element is shell-quoted with shlex.quote","remote_probe":"hostname, exact config SHA, base64 config, Docker container identity/state/network mode and nginx -t","strict_host_key_checking":true,"sudo":"sudo -n","target":"debian@[PRIVATE_IP]","transport":"direct-ssh","unquoted_python_c_forbidden":true,"writes":false},"failure_code_contract":{"ADAPTER_CANDIDATE":47,"CURRENT_PUBLIC_SURFACE":46,"EDGE_CANDIDATE":52,"EDGE_DISCOVERY":50,"EDGE_SOURCE_LOCK":51,"LEDGER_PRECONDITION":45,"LOOKUP_CANDIDATE":48,"PRODUCTION_DRIFT":53,"ROOT_OR_HOST":41,"SERVICE_BASIC_HEALTH":43,"SERVICE_STABILITY":44,"SOURCE_LOCK":42,"TEMPORARY_CLEANUP":54,"UNEXPECTED":99,"UNIT_CANDIDATE":49},"objective":"Make the two already trusted permanent URLs result-feed.json and latest.json read only from the local immutable result ledger. latest.json must contain the complete sanitized output and PLAN_SHA256. Gitea, MinIO and Portal must not be in the readback critical path.","operation":"STABLE_LOCAL_RESULT_FEED_AND_FULL_LATEST_PLAN_FIX2","read_only_plan":true,"rollback":{"container_restart_forbidden":true,"diagnostics_before_rollback":true,"nginx_test_before_reload":true,"remove_ledger_only_if_created_by_apply":true,"restore_exact_files":true,"verify_old_routes_after_restore":true},"schema":1,"service_health_contract":{"basic":"loaded, enabled, active, running, Result=success, ExecMainStatus=0, MainPID>1","historical_nonzero_nrestarts_allowed":true,"stability_window_seconds":20,"stable":"MainPID and cumulative NRestarts unchanged"},"source_locks":{"/etc/systemd/system/homelab-command-portal.service":"8453eab30f5c3ccd285fc9f70fff18f564809bb27f7bf84f51f2ba593aa85263","/etc/systemd/system/homelab-result-lookup.service":"4bcc607fd457313f75373ec3d8ec20e7020f13c7cb8a9523fd988a24b0f6609d","/usr/local/sbin/homelab-chat-run":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","/usr/local/sbin/homelab-command-adapter":"a1a7a615c99568bf915d084cc476f0ebf54ab0eedf3ecd578c4b0e072f58c43d","/usr/local/sbin/homelab-command-portal":"97c69bd4fccf7272dadc911281c1503f411bae2dc11dac4b22b87f33d678ae52","/usr/local/sbin/homelab-result-lookup":"17f8d2a2ea219cdc02b0f8e821f8054b05c01de1253419b3d23349a2d383889c","edge":{"config":"/opt/npmplus/nginx/proxy_host/9.conf","container_id":"2f18b3d7f3865edf4bdb4ae658fbecc4f75145acab1ffac2fe57df1d889952c9","container_image":"docker.io/zoeyvid/npmplus:2026-06-17-b1","container_name":"npmplus","current_sha256":"bb8fff32953ac81b7c93a943308c939804262ea8db3c21a344a417adec45e8e8","node":"pve03","ssh_batch_mode":true,"ssh_host":"[PRIVATE_IP]","ssh_strict_host_key_checking":true,"ssh_target":"debian@[PRIVATE_IP]","ssh_user":"debian","sudo_noninteractive":true,"vm_name":"edge-vm","vmid":130}},"stable_urls":{"feed":"https://git.gram1.ru/.well-known/homelab-runtime/result-feed.json","latest":"https://git.gram1.ru/.well-known/homelab-runtime/latest.json","query_parameters_required":false},"target":"pve01-and-edge-vm"},"private_addresses_included":false,"rollback_started":false,"sanitized":true,"schema":1,"secrets_included":false,"status":"PLAN_READY"} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index 91502c5..5dfa258 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z", - "status": "FAIL", - "rc": 50, + "command_id": "STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z", + "status": "OK", + "rc": 0, "host": "pve01", "mode": "verify", "component": "stable-local-result-feed-and-full-latest-plan", - "started_at_utc": "2026-07-28T15:20:25Z", - "finished_at_utc": "2026-07-28T15:20:26Z", + "started_at_utc": "2026-07-28T15:27:45Z", + "finished_at_utc": "2026-07-28T15:28:05Z", "reference_register_checked": true, "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", "error_register_checked": true, "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", - "command_sha256": "1a1a70f9a2366c865ec0288ec70ecd672dc4b42fbe6f0ef8515610c0c993e5ce", + "command_sha256": "8833469ea61d5036fd284dc81a2bf20d19a53b9d2a2270d60fe193c68ad5eb15", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -21,7 +21,7 @@ "result_contract_valid": true, "result_contract_status": null, "result_contract_error": null, - "command_rc": 50, + "command_rc": 0, "changes_made": false, "rollback_started": false, "rollback_restored": null, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "e2fe28aaad55a548931039793eac06531bb116629493a46f90eedc1b746f5976", - "sanitized_output_sha256": "e2fe28aaad55a548931039793eac06531bb116629493a46f90eedc1b746f5976", + "raw_evidence_sha256": "b0c10fc8d85f0f3f4f7472b1d9eb94b6a5981089c68bb8a8f7f43b1e5e893409", + "sanitized_output_sha256": "5f01c420507160eb67cfd3d4bf6c1cd0791762ca77c744bfbcd288994adb0b6a", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z\",\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"FAIL\",\"version\":1}\n{\"PLAN_SHA256\":\"1f94868b1403b9dc54f8dddc7c9987ac560d2549b7e98ccc98ac4e91ebbeae4e\",\"backup_changed\":false,\"changes_made\":false,\"cluster_changed\":false,\"command_id\":\"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z\",\"failure\":\"EDGE_SSH_PROBE_RC:2:STDERR_SHA256=80352ae284cf808992637f4cf42a7a32008c7ff50228528516e53fb591f67397\",\"failure_code\":50,\"failure_code_contract\":{\"ADAPTER_CANDIDATE\":47,\"CURRENT_PUBLIC_SURFACE\":46,\"EDGE_CANDIDATE\":52,\"EDGE_DISCOVERY\":50,\"EDGE_SOURCE_LOCK\":51,\"LEDGER_PRECONDITION\":45,\"LOOKUP_CANDIDATE\":48,\"PRODUCTION_DRIFT\":53,\"ROOT_OR_HOST\":41,\"SERVICE_BASIC_HEALTH\":43,\"SERVICE_STABILITY\":44,\"SOURCE_LOCK\":42,\"TEMPORARY_CLEANUP\":54,\"UNEXPECTED\":99,\"UNIT_CANDIDATE\":49},\"failure_stage\":\"EDGE_DISCOVERY\",\"gitea_changed\":false,\"minio_changed\":false,\"private_addresses_included\":false,\"rollback_started\":false,\"sanitized\":true,\"schema\":1,\"secrets_included\":false,\"status\":\"BLOCKED\"}\n" + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z\",\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"PLAN_SHA256\":\"68746ed2758c37f52d2e66768999421d48468d4d46a3d3cf3abaeacf7baf9c79\",\"backup_changed\":false,\"changes_made\":false,\"cluster_changed\":false,\"command_id\":\"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z\",\"failure_code_contract\":{\"ADAPTER_CANDIDATE\":47,\"CURRENT_PUBLIC_SURFACE\":46,\"EDGE_CANDIDATE\":52,\"EDGE_DISCOVERY\":50,\"EDGE_SOURCE_LOCK\":51,\"LEDGER_PRECONDITION\":45,\"LOOKUP_CANDIDATE\":48,\"PRODUCTION_DRIFT\":53,\"ROOT_OR_HOST\":41,\"SERVICE_BASIC_HEALTH\":43,\"SERVICE_STABILITY\":44,\"SOURCE_LOCK\":42,\"TEMPORARY_CLEANUP\":54,\"UNEXPECTED\":99,\"UNIT_CANDIDATE\":49},\"gitea_changed\":false,\"minio_changed\":false,\"observations\":{\"candidate\":{\"adapter_sha256\":\"3879db9c8f918d72eb9c2d2949f805cea7d5d131fae0c1cd05ef5928b41cd08e\",\"edge_container_started_at\":\"2026-07-28T11:06:45.929887242Z\",\"edge_source_sha256\":\"bb8fff32953ac81b7c93a943308c939804262ea8db3c21a344a417adec45e8e8\",\"edge_target_sha256\":\"ae63d937b8d9189cd016784fb735d1fae32a363cb88ebcc7efdecc22665cc8aa\",\"lookup_sha256\":\"acb8a49e008d1c0f1a85219633ee2d4c390d2e60e0c2071ec17a2c5aeb42e57e\",\"unit_sha256\":\"c957d136ad93e1cd1386d42cb15732b798400652952f56ea0746c80e927bbd01\"},\"current_public\":{\"exact_full_output_present\":false,\"exact_http\":200,\"feed_http\":200,\"latest_http\":200},\"fixture\":{\"corruption_http\":409,\"exact_http\":200,\"feed_http\":200,\"latest_http\":200,\"latest_output_present\":true,\"latest_plan_sha_present\":true,\"restart_persistence\":true,\"sequence\":\"efea7986e5d4989d0b8deaa393c8e8a62658185acbc964b14a49a87152a5b9c4\"},\"service_stability\":{\"adapter\":{\"after\":{\"MainPID\":\"11360\",\"NRestarts\":\"22\"},\"before\":{\"MainPID\":\"11360\",\"NRestarts\":\"22\"}},\"lookup\":{\"after\":{\"MainPID\":\"466244\",\"NRestarts\":\"0\"},\"before\":{\"MainPID\":\"466244\",\"NRestarts\":\"0\"}},\"portal\":{\"after\":{\"MainPID\":\"466240\",\"NRestarts\":\"0\"},\"before\":{\"MainPID\":\"466240\",\"NRestarts\":\"0\"}}},\"source_hashes\":{\"/etc/systemd/system/homelab-command-portal.service\":\"8453eab30f5c3ccd285fc9f70fff18f564809bb27f7bf84f51f2ba593aa85263\",\"/etc/systemd/system/homelab-result-lookup.service\":\"4bcc607fd457313f75373ec3d8ec20e7020f13c7cb8a9523fd988a24b0f6609d\",\"/usr/local/sbin/homelab-chat-run\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"/usr/local/sbin/homelab-command-adapter\":\"a1a7a615c99568bf915d084cc476f0ebf54ab0eedf3ecd578c4b0e072f58c43d\",\"/usr/local/sbin/homelab-command-portal\":\"97c69bd4fccf7272dadc911281c1503f411bae2dc11dac4b22b87f33d678ae52\",\"/usr/local/sbin/homelab-result-lookup\":\"17f8d2a2ea219cdc02b0f8e821f8054b05c01de1253419b3d23349a2d383889c\"}},\"plan\":{\"anti_regression\":[\"AR-001-STABLE-URLS-NO-QUERY-STRING\",\"AR-002-FEED-AND-LATEST-SAME-SEQUENCE\",\"AR-003-LATEST-CONTAINS-FULL-OUTPUT\",\"AR-004-LATEST-CONTAINS-PLAN-SHA256\",\"AR-005-LOCAL-LEDGER-BEFORE-MINIO\",\"AR-006-IMMUTABLE-COLLISION-REJECTED\",\"AR-007-CORRUPTION-RETURNS-409\",\"AR-008-NO-GITEA-LOOKUP-DEPENDENCY\",\"AR-009-NO-MINIO-LOOKUP-DEPENDENCY\",\"AR-010-NO-PORTAL-LOOKUP-DEPENDENCY\",\"AR-011-HISTORICAL-NRESTARTS-ALLOWED\",\"AR-012-PID-AND-NRESTARTS-STABILITY\",\"AR-013-EDGE-SOURCE-SHA-LOCK\",\"AR-014-NGINX-CANDIDATE-MARKER-CARDINALITY\",\"AR-015-NO-SECOND-RUNNER\",\"AR-016-BACKUP-UNTOUCHED\",\"AR-017-FAILURE-RC-IDENTIFIES-STAGE\",\"AR-018-PLAN-SHA-BINDS-APPLY\",\"AR-019-RUNNER-DOES-NOT-USE-PVESH\",\"AR-020-EDGE-DIRECT-SSH-DEBIAN-SUDO\",\"AR-021-STRICT-HOST-KEY-CHECKING\",\"AR-022-SSH-BATCH-MODE-NO-PROMPT\",\"AR-023-SSH-REMOTE-COMMAND-IS-ONE-ARGV\",\"AR-024-EVERY-REMOTE-ARGV-ELEMENT-SHELL-QUOTED\",\"AR-025-PYTHON-C-STUB-ROUNDTRIP-THROUGH-BIN-SH\",\"AR-026-UNQUOTED-SEMICOLON-REGRESSION\"],\"apply_postconditions\":[\"new runtime smoke writes one immutable local ledger result\",\"permanent feed and latest expose the same result_sequence\",\"permanent latest command_id and capsule_sha256 match smoke\",\"permanent latest contains full output and PLAN_SHA256\",\"readback remains healthy with Portal stopped during controlled test\",\"readback remains healthy when Gitea and MinIO probes fail\",\"edge nginx container ID and StartedAt unchanged\",\"all changed files stable and services stable for 20 seconds\"],\"apply_preconditions\":[\"recompute and require this exact PLAN_SHA256\",\"all source SHA-256 locks unchanged\",\"direct SSH to debian@[PRIVATE_IP] succeeds with strict host-key checking and sudo -n; edge-vm and npmplus identity remain unchanged\",\"Adapter, Portal and Lookup stable for 20 seconds\",\"production ledger root absent\",\"current public exact lookup route healthy\",\"candidate fixture matrix PASS\",\"edge source configuration SHA exact\"],\"changes_for_apply\":{\"edge_vm\":{\"container_restart\":false,\"modify\":[\"/opt/npmplus/nginx/proxy_host/9.conf\"],\"reload_only\":\"npmplus nginx\"},\"forbidden\":[\"modify backup\",\"modify cluster membership\",\"modify Gitea repositories\",\"modify MinIO objects\",\"create a second runner\",\"force push\"],\"pve01\":{\"create\":[\"/var/lib/homelab-result-ledger\"],\"do_not_restart\":[\"homelab-command-portal.service\",\"homelab-chat-run\"],\"modify\":[\"/usr/local/sbin/homelab-command-adapter\",\"/usr/local/sbin/homelab-result-lookup\",\"/etc/systemd/system/homelab-result-lookup.service\"],\"restart\":[\"homelab-command-adapter.service\",\"homelab-result-lookup.service\"]}},\"data_contract\":{\"allowed_methods\":[\"GET\",\"HEAD\"],\"cache\":\"no-store/no-cache/must-revalidate\",\"feed_version\":4,\"full_latest_fields\":[\"command_id\",\"capsule_sha256\",\"finished_at_utc\",\"result_sequence\",\"status\",\"runner_rc\",\"runner_document_rc\",\"runner_wrapper_matches_document\",\"PLAN_SHA256\",\"output\",\"result_contract\",\"runner_document\"],\"immutable_identity\":\"{capsule_sha256}/{command_id}.json\",\"integrity_failure_http\":409,\"missing_http\":404,\"recent_results_max\":32,\"writer_position\":\"after validated runner_document and before evidence bundle creation and MinIO upload\"},\"deterministic_material\":{\"adapter_transform_sha256\":\"e71b9090fd7af406c9d93b767c5d4a6744224aadd82f35264394f5df8545c87a\",\"edge_route_block_sha256\":\"ca1609b433b72dba0970aa51983651f5490aeaddafc1687cbd8980ab0a78313d\",\"ledger_helpers_sha256\":\"985ee0afd9551ac167cce578e272e60d5ec96158e473787296646b75d0b745b6\",\"lookup_candidate_sha256\":\"acb8a49e008d1c0f1a85219633ee2d4c390d2e60e0c2071ec17a2c5aeb42e57e\",\"unit_candidate_sha256\":\"c957d136ad93e1cd1386d42cb15732b798400652952f56ea0746c80e927bbd01\"},\"diagnosis\":{\"fix\":\"Build exactly one remote command string by applying shlex.quote to every remote argv element, then pass only that string after the SSH target.\",\"observed_failure\":\"EDGE_SSH_PROBE_RC:2:STDERR_SHA256=80352ae284cf808992637f4cf42a7a32008c7ff50228528516e53fb591f67397\",\"observed_failure_code\":50,\"observed_failure_stage\":\"EDGE_DISCOVERY\",\"root_cause\":\"FIX1 passed the Python -c program to OpenSSH as a separate local argv item. OpenSSH serializes remote command items into one remote-shell line without preserving local argv boundaries. The stub therefore reached the remote shell unquoted; its semicolon, parentheses and quotes were parsed as shell syntax, producing status 2 before the probe ran.\",\"superseded_command_id\":\"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z\"},\"edge_discovery_contract\":{\"batch_mode\":true,\"pvesh_forbidden\":true,\"qm_guest_exec_forbidden\":true,\"remote_argv\":[\"/usr/bin/sudo\",\"-n\",\"/usr/bin/python3\",\"-B\",\"-c\",\"\"],\"remote_command_transport\":\"single remote command string; each remote argv element is shell-quoted with shlex.quote\",\"remote_probe\":\"hostname, exact config SHA, base64 config, Docker container identity/state/network mode and nginx -t\",\"strict_host_key_checking\":true,\"sudo\":\"sudo -n\",\"target\":\"debian@[PRIVATE_IP]\",\"transport\":\"direct-ssh\",\"unquoted_python_c_forbidden\":true,\"writes\":false},\"failure_code_contract\":{\"ADAPTER_CANDIDATE\":47,\"CURRENT_PUBLIC_SURFACE\":46,\"EDGE_CANDIDATE\":52,\"EDGE_DISCOVERY\":50,\"EDGE_SOURCE_LOCK\":51,\"LEDGER_PRECONDITION\":45,\"LOOKUP_CANDIDATE\":48,\"PRODUCTION_DRIFT\":53,\"ROOT_OR_HOST\":41,\"SERVICE_BASIC_HEALTH\":43,\"SERVICE_STABILITY\":44,\"SOURCE_LOCK\":42,\"TEMPORARY_CLEANUP\":54,\"UNEXPECTED\":99,\"UNIT_CANDIDATE\":49},\"objective\":\"Make the two already trusted permanent URLs result-feed.json and latest.json read only from the local immutable result ledger. latest.json must contain the complete sanitized output and PLAN_SHA256. Gitea, MinIO and Portal must not be in the readback critical path.\",\"operation\":\"STABLE_LOCAL_RESULT_FEED_AND_FULL_LATEST_PLAN_FIX2\",\"read_only_plan\":true,\"rollback\":{\"container_restart_forbidden\":true,\"diagnostics_before_rollback\":true,\"nginx_test_before_reload\":true,\"remove_ledger_only_if_created_by_apply\":true,\"restore_exact_files\":true,\"verify_old_routes_after_restore\":true},\"schema\":1,\"service_health_contract\":{\"basic\":\"loaded, enabled, active, running, Result=success, ExecMainStatus=0, MainPID>1\",\"historical_nonzero_nrestarts_allowed\":true,\"stability_window_seconds\":20,\"stable\":\"MainPID and cumulative NRestarts unchanged\"},\"source_locks\":{\"/etc/systemd/system/homelab-command-portal.service\":\"8453eab30f5c3ccd285fc9f70fff18f564809bb27f7bf84f51f2ba593aa85263\",\"/etc/systemd/system/homelab-result-lookup.service\":\"4bcc607fd457313f75373ec3d8ec20e7020f13c7cb8a9523fd988a24b0f6609d\",\"/usr/local/sbin/homelab-chat-run\":\"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\",\"/usr/local/sbin/homelab-command-adapter\":\"a1a7a615c99568bf915d084cc476f0ebf54ab0eedf3ecd578c4b0e072f58c43d\",\"/usr/local/sbin/homelab-command-portal\":\"97c69bd4fccf7272dadc911281c1503f411bae2dc11dac4b22b87f33d678ae52\",\"/usr/local/sbin/homelab-result-lookup\":\"17f8d2a2ea219cdc02b0f8e821f8054b05c01de1253419b3d23349a2d383889c\",\"edge\":{\"config\":\"/opt/npmplus/nginx/proxy_host/9.conf\",\"container_id\":\"2f18b3d7f3865edf4bdb4ae658fbecc4f75145acab1ffac2fe57df1d889952c9\",\"container_image\":\"docker.io/zoeyvid/npmplus:2026-06-17-b1\",\"container_name\":\"npmplus\",\"current_sha256\":\"bb8fff32953ac81b7c93a943308c939804262ea8db3c21a344a417adec45e8e8\",\"node\":\"pve03\",\"ssh_batch_mode\":true,\"ssh_host\":\"[PRIVATE_IP]\",\"ssh_strict_host_key_checking\":true,\"ssh_target\":\"debian@[PRIVATE_IP]\",\"ssh_user\":\"debian\",\"sudo_noninteractive\":true,\"vm_name\":\"edge-vm\",\"vmid\":130}},\"stable_urls\":{\"feed\":\"https://git.gram1.ru/.well-known/homelab-runtime/result-feed.json\",\"latest\":\"https://git.gram1.ru/.well-known/homelab-runtime/latest.json\",\"query_parameters_required\":false},\"target\":\"pve01-and-edge-vm\"},\"private_addresses_included\":false,\"rollback_started\":false,\"sanitized\":true,\"schema\":1,\"secrets_included\":false,\"status\":\"PLAN_READY\"}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index c30c502..93234ad 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,7 +1,7 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z -STATUS=FAIL -RC=50 +COMMAND_ID=STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z +STATUS=OK +RC=0 HOST=pve01 MODE=verify COMPONENT=stable-local-result-feed-and-full-latest-plan @@ -9,14 +9,14 @@ REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 -COMMAND_SHA256=1a1a70f9a2366c865ec0288ec70ecd672dc4b42fbe6f0ef8515610c0c993e5ce +COMMAND_SHA256=8833469ea61d5036fd284dc81a2bf20d19a53b9d2a2270d60fe193c68ad5eb15 DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false RESULT_CONTRACT_VALID=true RESULT_CONTRACT_STATUS=NOT_APPLICABLE RESULT_CONTRACT_ERROR=NONE -COMMAND_RC=50 +COMMAND_RC=0 CHANGES_MADE=false ROLLBACK_STARTED=false ROLLBACK_RESTORED=null @@ -24,11 +24,11 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=e2fe28aaad55a548931039793eac06531bb116629493a46f90eedc1b746f5976 -SANITIZED_OUTPUT_SHA256=e2fe28aaad55a548931039793eac06531bb116629493a46f90eedc1b746f5976 +RAW_EVIDENCE_SHA256=b0c10fc8d85f0f3f4f7472b1d9eb94b6a5981089c68bb8a8f7f43b1e5e893409 +SANITIZED_OUTPUT_SHA256=5f01c420507160eb67cfd3d4bf6c1cd0791762ca77c744bfbcd288994adb0b6a OUTPUT_BEGIN -HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z","rollback_restored":null,"rollback_started":false,"status":"FAIL","version":1} -{"PLAN_SHA256":"1f94868b1403b9dc54f8dddc7c9987ac560d2549b7e98ccc98ac4e91ebbeae4e","backup_changed":false,"changes_made":false,"cluster_changed":false,"command_id":"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z","failure":"EDGE_SSH_PROBE_RC:2:STDERR_SHA256=80352ae284cf808992637f4cf42a7a32008c7ff50228528516e53fb591f67397","failure_code":50,"failure_code_contract":{"ADAPTER_CANDIDATE":47,"CURRENT_PUBLIC_SURFACE":46,"EDGE_CANDIDATE":52,"EDGE_DISCOVERY":50,"EDGE_SOURCE_LOCK":51,"LEDGER_PRECONDITION":45,"LOOKUP_CANDIDATE":48,"PRODUCTION_DRIFT":53,"ROOT_OR_HOST":41,"SERVICE_BASIC_HEALTH":43,"SERVICE_STABILITY":44,"SOURCE_LOCK":42,"TEMPORARY_CLEANUP":54,"UNEXPECTED":99,"UNIT_CANDIDATE":49},"failure_stage":"EDGE_DISCOVERY","gitea_changed":false,"minio_changed":false,"private_addresses_included":false,"rollback_started":false,"sanitized":true,"schema":1,"secrets_included":false,"status":"BLOCKED"} +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z","rollback_restored":null,"rollback_started":false,"status":"OK","version":1} +{"PLAN_SHA256":"68746ed2758c37f52d2e66768999421d48468d4d46a3d3cf3abaeacf7baf9c79","backup_changed":false,"changes_made":false,"cluster_changed":false,"command_id":"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX2-20260728T152616Z","failure_code_contract":{"ADAPTER_CANDIDATE":47,"CURRENT_PUBLIC_SURFACE":46,"EDGE_CANDIDATE":52,"EDGE_DISCOVERY":50,"EDGE_SOURCE_LOCK":51,"LEDGER_PRECONDITION":45,"LOOKUP_CANDIDATE":48,"PRODUCTION_DRIFT":53,"ROOT_OR_HOST":41,"SERVICE_BASIC_HEALTH":43,"SERVICE_STABILITY":44,"SOURCE_LOCK":42,"TEMPORARY_CLEANUP":54,"UNEXPECTED":99,"UNIT_CANDIDATE":49},"gitea_changed":false,"minio_changed":false,"observations":{"candidate":{"adapter_sha256":"3879db9c8f918d72eb9c2d2949f805cea7d5d131fae0c1cd05ef5928b41cd08e","edge_container_started_at":"2026-07-28T11:06:45.929887242Z","edge_source_sha256":"bb8fff32953ac81b7c93a943308c939804262ea8db3c21a344a417adec45e8e8","edge_target_sha256":"ae63d937b8d9189cd016784fb735d1fae32a363cb88ebcc7efdecc22665cc8aa","lookup_sha256":"acb8a49e008d1c0f1a85219633ee2d4c390d2e60e0c2071ec17a2c5aeb42e57e","unit_sha256":"c957d136ad93e1cd1386d42cb15732b798400652952f56ea0746c80e927bbd01"},"current_public":{"exact_full_output_present":false,"exact_http":200,"feed_http":200,"latest_http":200},"fixture":{"corruption_http":409,"exact_http":200,"feed_http":200,"latest_http":200,"latest_output_present":true,"latest_plan_sha_present":true,"restart_persistence":true,"sequence":"efea7986e5d4989d0b8deaa393c8e8a62658185acbc964b14a49a87152a5b9c4"},"service_stability":{"adapter":{"after":{"MainPID":"11360","NRestarts":"22"},"before":{"MainPID":"11360","NRestarts":"22"}},"lookup":{"after":{"MainPID":"466244","NRestarts":"0"},"before":{"MainPID":"466244","NRestarts":"0"}},"portal":{"after":{"MainPID":"466240","NRestarts":"0"},"before":{"MainPID":"466240","NRestarts":"0"}}},"source_hashes":{"/etc/systemd/system/homelab-command-portal.service":"8453eab30f5c3ccd285fc9f70fff18f564809bb27f7bf84f51f2ba593aa85263","/etc/systemd/system/homelab-result-lookup.service":"4bcc607fd457313f75373ec3d8ec20e7020f13c7cb8a9523fd988a24b0f6609d","/usr/local/sbin/homelab-chat-run":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","/usr/local/sbin/homelab-command-adapter":"a1a7a615c99568bf915d084cc476f0ebf54ab0eedf3ecd578c4b0e072f58c43d","/usr/local/sbin/homelab-command-portal":"97c69bd4fccf7272dadc911281c1503f411bae2dc11dac4b22b87f33d678ae52","/usr/local/sbin/homelab-result-lookup":"17f8d2a2ea219cdc02b0f8e821f8054b05c01de1253419b3d23349a2d383889c"}},"plan":{"anti_regression":["AR-001-STABLE-URLS-NO-QUERY-STRING","AR-002-FEED-AND-LATEST-SAME-SEQUENCE","AR-003-LATEST-CONTAINS-FULL-OUTPUT","AR-004-LATEST-CONTAINS-PLAN-SHA256","AR-005-LOCAL-LEDGER-BEFORE-MINIO","AR-006-IMMUTABLE-COLLISION-REJECTED","AR-007-CORRUPTION-RETURNS-409","AR-008-NO-GITEA-LOOKUP-DEPENDENCY","AR-009-NO-MINIO-LOOKUP-DEPENDENCY","AR-010-NO-PORTAL-LOOKUP-DEPENDENCY","AR-011-HISTORICAL-NRESTARTS-ALLOWED","AR-012-PID-AND-NRESTARTS-STABILITY","AR-013-EDGE-SOURCE-SHA-LOCK","AR-014-NGINX-CANDIDATE-MARKER-CARDINALITY","AR-015-NO-SECOND-RUNNER","AR-016-BACKUP-UNTOUCHED","AR-017-FAILURE-RC-IDENTIFIES-STAGE","AR-018-PLAN-SHA-BINDS-APPLY","AR-019-RUNNER-DOES-NOT-USE-PVESH","AR-020-EDGE-DIRECT-SSH-DEBIAN-SUDO","AR-021-STRICT-HOST-KEY-CHECKING","AR-022-SSH-BATCH-MODE-NO-PROMPT","AR-023-SSH-REMOTE-COMMAND-IS-ONE-ARGV","AR-024-EVERY-REMOTE-ARGV-ELEMENT-SHELL-QUOTED","AR-025-PYTHON-C-STUB-ROUNDTRIP-THROUGH-BIN-SH","AR-026-UNQUOTED-SEMICOLON-REGRESSION"],"apply_postconditions":["new runtime smoke writes one immutable local ledger result","permanent feed and latest expose the same result_sequence","permanent latest command_id and capsule_sha256 match smoke","permanent latest contains full output and PLAN_SHA256","readback remains healthy with Portal stopped during controlled test","readback remains healthy when Gitea and MinIO probes fail","edge nginx container ID and StartedAt unchanged","all changed files stable and services stable for 20 seconds"],"apply_preconditions":["recompute and require this exact PLAN_SHA256","all source SHA-256 locks unchanged","direct SSH to debian@[PRIVATE_IP] succeeds with strict host-key checking and sudo -n; edge-vm and npmplus identity remain unchanged","Adapter, Portal and Lookup stable for 20 seconds","production ledger root absent","current public exact lookup route healthy","candidate fixture matrix PASS","edge source configuration SHA exact"],"changes_for_apply":{"edge_vm":{"container_restart":false,"modify":["/opt/npmplus/nginx/proxy_host/9.conf"],"reload_only":"npmplus nginx"},"forbidden":["modify backup","modify cluster membership","modify Gitea repositories","modify MinIO objects","create a second runner","force push"],"pve01":{"create":["/var/lib/homelab-result-ledger"],"do_not_restart":["homelab-command-portal.service","homelab-chat-run"],"modify":["/usr/local/sbin/homelab-command-adapter","/usr/local/sbin/homelab-result-lookup","/etc/systemd/system/homelab-result-lookup.service"],"restart":["homelab-command-adapter.service","homelab-result-lookup.service"]}},"data_contract":{"allowed_methods":["GET","HEAD"],"cache":"no-store/no-cache/must-revalidate","feed_version":4,"full_latest_fields":["command_id","capsule_sha256","finished_at_utc","result_sequence","status","runner_rc","runner_document_rc","runner_wrapper_matches_document","PLAN_SHA256","output","result_contract","runner_document"],"immutable_identity":"{capsule_sha256}/{command_id}.json","integrity_failure_http":409,"missing_http":404,"recent_results_max":32,"writer_position":"after validated runner_document and before evidence bundle creation and MinIO upload"},"deterministic_material":{"adapter_transform_sha256":"e71b9090fd7af406c9d93b767c5d4a6744224aadd82f35264394f5df8545c87a","edge_route_block_sha256":"ca1609b433b72dba0970aa51983651f5490aeaddafc1687cbd8980ab0a78313d","ledger_helpers_sha256":"985ee0afd9551ac167cce578e272e60d5ec96158e473787296646b75d0b745b6","lookup_candidate_sha256":"acb8a49e008d1c0f1a85219633ee2d4c390d2e60e0c2071ec17a2c5aeb42e57e","unit_candidate_sha256":"c957d136ad93e1cd1386d42cb15732b798400652952f56ea0746c80e927bbd01"},"diagnosis":{"fix":"Build exactly one remote command string by applying shlex.quote to every remote argv element, then pass only that string after the SSH target.","observed_failure":"EDGE_SSH_PROBE_RC:2:STDERR_SHA256=80352ae284cf808992637f4cf42a7a32008c7ff50228528516e53fb591f67397","observed_failure_code":50,"observed_failure_stage":"EDGE_DISCOVERY","root_cause":"FIX1 passed the Python -c program to OpenSSH as a separate local argv item. OpenSSH serializes remote command items into one remote-shell line without preserving local argv boundaries. The stub therefore reached the remote shell unquoted; its semicolon, parentheses and quotes were parsed as shell syntax, producing status 2 before the probe ran.","superseded_command_id":"STABLE-LOCAL-RESULT-FEED-AND-FULL-LATEST-PLAN-FIX1-20260728T151831Z"},"edge_discovery_contract":{"batch_mode":true,"pvesh_forbidden":true,"qm_guest_exec_forbidden":true,"remote_argv":["/usr/bin/sudo","-n","/usr/bin/python3","-B","-c",""],"remote_command_transport":"single remote command string; each remote argv element is shell-quoted with shlex.quote","remote_probe":"hostname, exact config SHA, base64 config, Docker container identity/state/network mode and nginx -t","strict_host_key_checking":true,"sudo":"sudo -n","target":"debian@[PRIVATE_IP]","transport":"direct-ssh","unquoted_python_c_forbidden":true,"writes":false},"failure_code_contract":{"ADAPTER_CANDIDATE":47,"CURRENT_PUBLIC_SURFACE":46,"EDGE_CANDIDATE":52,"EDGE_DISCOVERY":50,"EDGE_SOURCE_LOCK":51,"LEDGER_PRECONDITION":45,"LOOKUP_CANDIDATE":48,"PRODUCTION_DRIFT":53,"ROOT_OR_HOST":41,"SERVICE_BASIC_HEALTH":43,"SERVICE_STABILITY":44,"SOURCE_LOCK":42,"TEMPORARY_CLEANUP":54,"UNEXPECTED":99,"UNIT_CANDIDATE":49},"objective":"Make the two already trusted permanent URLs result-feed.json and latest.json read only from the local immutable result ledger. latest.json must contain the complete sanitized output and PLAN_SHA256. Gitea, MinIO and Portal must not be in the readback critical path.","operation":"STABLE_LOCAL_RESULT_FEED_AND_FULL_LATEST_PLAN_FIX2","read_only_plan":true,"rollback":{"container_restart_forbidden":true,"diagnostics_before_rollback":true,"nginx_test_before_reload":true,"remove_ledger_only_if_created_by_apply":true,"restore_exact_files":true,"verify_old_routes_after_restore":true},"schema":1,"service_health_contract":{"basic":"loaded, enabled, active, running, Result=success, ExecMainStatus=0, MainPID>1","historical_nonzero_nrestarts_allowed":true,"stability_window_seconds":20,"stable":"MainPID and cumulative NRestarts unchanged"},"source_locks":{"/etc/systemd/system/homelab-command-portal.service":"8453eab30f5c3ccd285fc9f70fff18f564809bb27f7bf84f51f2ba593aa85263","/etc/systemd/system/homelab-result-lookup.service":"4bcc607fd457313f75373ec3d8ec20e7020f13c7cb8a9523fd988a24b0f6609d","/usr/local/sbin/homelab-chat-run":"b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d","/usr/local/sbin/homelab-command-adapter":"a1a7a615c99568bf915d084cc476f0ebf54ab0eedf3ecd578c4b0e072f58c43d","/usr/local/sbin/homelab-command-portal":"97c69bd4fccf7272dadc911281c1503f411bae2dc11dac4b22b87f33d678ae52","/usr/local/sbin/homelab-result-lookup":"17f8d2a2ea219cdc02b0f8e821f8054b05c01de1253419b3d23349a2d383889c","edge":{"config":"/opt/npmplus/nginx/proxy_host/9.conf","container_id":"2f18b3d7f3865edf4bdb4ae658fbecc4f75145acab1ffac2fe57df1d889952c9","container_image":"docker.io/zoeyvid/npmplus:2026-06-17-b1","container_name":"npmplus","current_sha256":"bb8fff32953ac81b7c93a943308c939804262ea8db3c21a344a417adec45e8e8","node":"pve03","ssh_batch_mode":true,"ssh_host":"[PRIVATE_IP]","ssh_strict_host_key_checking":true,"ssh_target":"debian@[PRIVATE_IP]","ssh_user":"debian","sudo_noninteractive":true,"vm_name":"edge-vm","vmid":130}},"stable_urls":{"feed":"https://git.gram1.ru/.well-known/homelab-runtime/result-feed.json","latest":"https://git.gram1.ru/.well-known/homelab-runtime/latest.json","query_parameters_required":false},"target":"pve01-and-edge-vm"},"private_addresses_included":false,"rollback_started":false,"sanitized":true,"schema":1,"secrets_included":false,"status":"PLAN_READY"} OUTPUT_END CHAT_OUTPUT_END