diff --git a/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z.json b/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z.json new file mode 100644 index 0000000..f8c9bda --- /dev/null +++ b/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "verify", + "component": "cluster-knowledge-base-error-system", + "started_at_utc": "2026-08-05T08:47:58Z", + "finished_at_utc": "2026-08-05T08:47:58Z", + "reference_register_checked": true, + "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", + "error_register_checked": true, + "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", + "command_sha256": "d3dd61bab9f4949e7f749d3d6f8efa5dcafd3b09abf96bcbf3119c1aee127bc9", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "9c385a174b858d468f1366d42c1b90cb713b245cb1e7ebcff39242de9d3439b3", + "sanitized_output_sha256": "9c385a174b858d468f1366d42c1b90cb713b245cb1e7ebcff39242de9d3439b3", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z\",\"command_rc\":0,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z\",\"command_rc\":0,\"correction_of_previous_logic_gaps\":[{\"exact_fix\":\"parse the exact Python AST, resolve environment-backed constants, derive path/header/query comparisons and probe only source-supported contracts\",\"proven_gap\":\"the exact Reader listener answered GET / with 404 and no JSON while the prior scanner found no auth candidates\",\"regression_test\":\"f-string capability routes, header aliases and compare_digest contracts must be resolved without exposing capability values\"}],\"error_fingerprint\":\"dd4ebd816db1715f38801e549b40d82b48b543981dc18cf6c6345157419ecd90\",\"latest_exact_result_basis\":{\"capsule_sha256\":\"c8a9a1a97b0b67593ce23bdf79a25d14552b86594c5aae3ec7d2fd71a560de51\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z\",\"command_rc\":0,\"control_plane_error\":null,\"error_fingerprint\":\"820f5c9a664dd86192521678e7c5790c5c6adcb442b513f49dadf4f23286d5eb\",\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_EXACT_AUTH_AND_ROUTE_CONTRACT_PROBE\",\"output_complete\":true,\"output_sha256\":\"ae1cb3bb2f5fe11da04b061be5e8c386bbebdff5242cb20eb9bcdbc1fe2d7291\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_HTTP_ENDPOINT_REACHED_BUT_NO_AUTHORITATIVE_JSON_RESPONSE\",\"runner_document_rc\":0,\"runner_json_sha256\":\"e4eff0a71258655d38624da74dc180cd89946620ab94f2ac222d2b04764aff70\",\"runner_rc\":0,\"runner_text_sha256\":\"631196a81a5d56751a14c7fa5001092d3421c0b0d3f88fdafdc528653db49e5f\",\"runner_wrapper_matches_document\":true,\"status\":\"OK\"},\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_HANDLER_CONTROL_FLOW_TRACE\",\"output_truncated_in_json\":false,\"owned_listeners\":[{\"address_class\":\"private\",\"address_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\",\"family\":\"ipv4\",\"inode\":\"24795\",\"port\":18788}],\"pre_command_known_error_gate\":{\"checked\":true,\"items\":[{\"id\":\"candidate-scan-limit-20260805\",\"prevention\":\"exact files only; hard source, response, route, probe and output limits\"},{\"id\":\"runner-wrapper-mismatch-20260805\",\"prevention\":\"single compact JSON below 42000 bytes; no raw sources or response bodies\"},{\"id\":\"gitea-owner-hardcoded-20260805\",\"prevention\":\"no repository owner or repository URL is assumed\"},{\"id\":\"gitea-git-auth-unavailable-20260805\",\"prevention\":\"no Git or Gitea authentication retry in this command\"},{\"id\":\"pvesh-adapter-context-unreadable-20260805\",\"prevention\":\"pvesh is not called\"},{\"id\":\"gitea-process-self-match-20260805\",\"prevention\":\"Reader identity is bound to exact systemd ControlGroup\"},{\"id\":\"sanitize-non-string-attributeerror-20260805\",\"prevention\":\"sanitize converts Any to str; embedded bool regression test\"},{\"id\":\"reader-v3-skipped-on-nonauthoritative-inventory-20260805\",\"prevention\":\"this command directly probes Reader V3\"},{\"id\":\"reader-path-env-misclassified-as-route-20260805\",\"prevention\":\"PATH/PYTHONPATH and colon-separated filesystem values are explicitly forbidden as HTTP routes\"},{\"id\":\"reader-loopback-only-probe-20260805\",\"prevention\":\"connections use the exact address of the socket owned by the Reader ControlGroup; 127.0.0.1 is not assumed\"},{\"id\":\"reader-capability-not-secret-20260805\",\"prevention\":\"all capability values are secret; values and concrete secret-bearing routes are never output\"},{\"id\":\"reader-v3-root-404-no-json-20260805\",\"prevention\":\"derive auth and route only from exact AST comparisons, source literals and process environment before probing\"}]},\"prevention_test\":{\"must_run_before_future_cluster_or_gitea_commands\":true,\"name\":\"reader_v3_exact_auth_route_contract_preflight\",\"requirements\":[\"verify exact Reader source SHA\",\"bind process and socket to exact systemd ControlGroup\",\"resolve auth and route from exact AST and process environment\",\"never output capability values or private addresses\",\"probe only source-supported request contracts\",\"accept inventory only from successful JSON with normalized guest rows\"]},\"process_environment\":{\"capability_name_present\":true,\"names\":[\"HOME\",\"HOMELAB_READER_CAPABILITY\",\"HOMELAB_READER_PORT\",\"INVOCATION_ID\",\"JOURNAL_STREAM\",\"LANG\",\"LOGNAME\",\"MEMORY_PRESSURE_WATCH\",\"MEMORY_PRESSURE_WRITE\",\"PATH\",\"SHELL\",\"SYSTEMD_EXEC_PID\",\"USER\"],\"secret_name_count\":1},\"protocol_probe\":{\"auth_candidate_count\":0,\"gitea_candidates\":[],\"guest_count\":0,\"probes\":[],\"request_contract_count\":0,\"successful_inventory_routes\":[]},\"rc\":0,\"read_only\":true,\"ready_for_guest_probe\":false,\"result_projection\":{\"bytes_before_projection\":6744,\"compacted\":false,\"max_bytes\":36000},\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_LISTENER_FOUND_BUT_AST_AUTH_ROUTE_CONTRACT_NOT_DERIVED\",\"schema\":1,\"source_files\":[{\"actual_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"bytes\":580,\"expected_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"matches_expected\":true,\"path\":\"/etc/systemd/system/homelab-reader-v3.service\"},{\"actual_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"bytes\":3539,\"expected_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"matches_expected\":true,\"path\":\"/usr/local/sbin/homelab-reader-server-v3\"}],\"source_semantics\":{\"ast_parse_ok\":false,\"auth_variants\":[{\"basis\":\"control\",\"header_names\":[],\"label\":\"none\"}],\"handler_count\":2,\"header_contract_count\":0,\"header_names\":[],\"parse_errors\":[{\"error\":\"invalid decimal literal (homelab-reader-v3.service, line 8)\",\"path_sha256\":\"af7ae852500810b83c8d7bad0284356de382714a71c8f64ba13778dbce5bf354\"}],\"protocol_markers\":[\"basehttprequesthandler\",\"content-type\",\"do_get\",\"http.server\",\"send_response\"],\"query_contract_count\":0,\"query_keys\":[],\"resolved_scope_names\":[\"CAPABILITY\",\"PORT\",\"allow_reuse_address\",\"server_version\"],\"route_template_count\":0,\"route_templates\":[],\"source_environment_references\":[\"HOMELAB_READER_CAPABILITY\",\"HOMELAB_READER_PORT\"]},\"source_state\":\"MATCH\",\"status\":\"OK\",\"systemd_identity\":{\"identity_valid\":true,\"pid_count\":1,\"probe\":{\"duration_seconds\":0.005,\"rc\":0,\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_bytes\":375,\"stdout_sha256\":\"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9\",\"stdout_truncated\":false},\"properties\":{\"ActiveState\":\"active\",\"ControlGroup\":\"/system.slice/homelab-reader-v3.service\",\"ExecStart_present\":true,\"ExecStart_sha256\":\"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379\",\"FragmentPath\":\"/etc/systemd/system/homelab-reader-v3.service\",\"LoadState\":\"loaded\",\"MainPID\":\"1282\",\"SubState\":\"running\"}}}\n" +} diff --git a/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z.txt b/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z.txt new file mode 100644 index 0000000..8abe363 --- /dev/null +++ b/runtime/history/HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z.txt @@ -0,0 +1,34 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z +STATUS=OK +RC=0 +HOST=pve01 +MODE=verify +COMPONENT=cluster-knowledge-base-error-system +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 +COMMAND_SHA256=d3dd61bab9f4949e7f749d3d6f8efa5dcafd3b09abf96bcbf3119c1aee127bc9 +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=9c385a174b858d468f1366d42c1b90cb713b245cb1e7ebcff39242de9d3439b3 +SANITIZED_OUTPUT_SHA256=9c385a174b858d468f1366d42c1b90cb713b245cb1e7ebcff39242de9d3439b3 +OUTPUT_BEGIN +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1} +{"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z","command_rc":0,"correction_of_previous_logic_gaps":[{"exact_fix":"parse the exact Python AST, resolve environment-backed constants, derive path/header/query comparisons and probe only source-supported contracts","proven_gap":"the exact Reader listener answered GET / with 404 and no JSON while the prior scanner found no auth candidates","regression_test":"f-string capability routes, header aliases and compare_digest contracts must be resolved without exposing capability values"}],"error_fingerprint":"dd4ebd816db1715f38801e549b40d82b48b543981dc18cf6c6345157419ecd90","latest_exact_result_basis":{"capsule_sha256":"c8a9a1a97b0b67593ce23bdf79a25d14552b86594c5aae3ec7d2fd71a560de51","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z","command_rc":0,"control_plane_error":null,"error_fingerprint":"820f5c9a664dd86192521678e7c5790c5c6adcb442b513f49dadf4f23286d5eb","mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_EXACT_AUTH_AND_ROUTE_CONTRACT_PROBE","output_complete":true,"output_sha256":"ae1cb3bb2f5fe11da04b061be5e8c386bbebdff5242cb20eb9bcdbc1fe2d7291","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_HTTP_ENDPOINT_REACHED_BUT_NO_AUTHORITATIVE_JSON_RESPONSE","runner_document_rc":0,"runner_json_sha256":"e4eff0a71258655d38624da74dc180cd89946620ab94f2ac222d2b04764aff70","runner_rc":0,"runner_text_sha256":"631196a81a5d56751a14c7fa5001092d3421c0b0d3f88fdafdc528653db49e5f","runner_wrapper_matches_document":true,"status":"OK"},"mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_HANDLER_CONTROL_FLOW_TRACE","output_truncated_in_json":false,"owned_listeners":[{"address_class":"private","address_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9","family":"ipv4","inode":"24795","port":18788}],"pre_command_known_error_gate":{"checked":true,"items":[{"id":"candidate-scan-limit-20260805","prevention":"exact files only; hard source, response, route, probe and output limits"},{"id":"runner-wrapper-mismatch-20260805","prevention":"single compact JSON below 42000 bytes; no raw sources or response bodies"},{"id":"gitea-owner-hardcoded-20260805","prevention":"no repository owner or repository URL is assumed"},{"id":"gitea-git-auth-unavailable-20260805","prevention":"no Git or Gitea authentication retry in this command"},{"id":"pvesh-adapter-context-unreadable-20260805","prevention":"pvesh is not called"},{"id":"gitea-process-self-match-20260805","prevention":"Reader identity is bound to exact systemd ControlGroup"},{"id":"sanitize-non-string-attributeerror-20260805","prevention":"sanitize converts Any to str; embedded bool regression test"},{"id":"reader-v3-skipped-on-nonauthoritative-inventory-20260805","prevention":"this command directly probes Reader V3"},{"id":"reader-path-env-misclassified-as-route-20260805","prevention":"PATH/PYTHONPATH and colon-separated filesystem values are explicitly forbidden as HTTP routes"},{"id":"reader-loopback-only-probe-20260805","prevention":"connections use the exact address of the socket owned by the Reader ControlGroup; 127.0.0.1 is not assumed"},{"id":"reader-capability-not-secret-20260805","prevention":"all capability values are secret; values and concrete secret-bearing routes are never output"},{"id":"reader-v3-root-404-no-json-20260805","prevention":"derive auth and route only from exact AST comparisons, source literals and process environment before probing"}]},"prevention_test":{"must_run_before_future_cluster_or_gitea_commands":true,"name":"reader_v3_exact_auth_route_contract_preflight","requirements":["verify exact Reader source SHA","bind process and socket to exact systemd ControlGroup","resolve auth and route from exact AST and process environment","never output capability values or private addresses","probe only source-supported request contracts","accept inventory only from successful JSON with normalized guest rows"]},"process_environment":{"capability_name_present":true,"names":["HOME","HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT","INVOCATION_ID","JOURNAL_STREAM","LANG","LOGNAME","MEMORY_PRESSURE_WATCH","MEMORY_PRESSURE_WRITE","PATH","SHELL","SYSTEMD_EXEC_PID","USER"],"secret_name_count":1},"protocol_probe":{"auth_candidate_count":0,"gitea_candidates":[],"guest_count":0,"probes":[],"request_contract_count":0,"successful_inventory_routes":[]},"rc":0,"read_only":true,"ready_for_guest_probe":false,"result_projection":{"bytes_before_projection":6744,"compacted":false,"max_bytes":36000},"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_LISTENER_FOUND_BUT_AST_AUTH_ROUTE_CONTRACT_NOT_DERIVED","schema":1,"source_files":[{"actual_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","bytes":580,"expected_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","matches_expected":true,"path":"/etc/systemd/system/homelab-reader-v3.service"},{"actual_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","bytes":3539,"expected_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","matches_expected":true,"path":"/usr/local/sbin/homelab-reader-server-v3"}],"source_semantics":{"ast_parse_ok":false,"auth_variants":[{"basis":"control","header_names":[],"label":"none"}],"handler_count":2,"header_contract_count":0,"header_names":[],"parse_errors":[{"error":"invalid decimal literal (homelab-reader-v3.service, line 8)","path_sha256":"af7ae852500810b83c8d7bad0284356de382714a71c8f64ba13778dbce5bf354"}],"protocol_markers":["basehttprequesthandler","content-type","do_get","http.server","send_response"],"query_contract_count":0,"query_keys":[],"resolved_scope_names":["CAPABILITY","PORT","allow_reuse_address","server_version"],"route_template_count":0,"route_templates":[],"source_environment_references":["HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT"]},"source_state":"MATCH","status":"OK","systemd_identity":{"identity_valid":true,"pid_count":1,"probe":{"duration_seconds":0.005,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":375,"stdout_sha256":"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9","stdout_truncated":false},"properties":{"ActiveState":"active","ControlGroup":"/system.slice/homelab-reader-v3.service","ExecStart_present":true,"ExecStart_sha256":"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379","FragmentPath":"/etc/systemd/system/homelab-reader-v3.service","LoadState":"loaded","MainPID":"1282","SubState":"running"}}} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index 60339e9..f8c9bda 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z", + "command_id": "HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z", "status": "OK", "rc": 0, "host": "pve01", "mode": "verify", "component": "cluster-knowledge-base-error-system", - "started_at_utc": "2026-08-05T08:32:12Z", - "finished_at_utc": "2026-08-05T08:32:12Z", + "started_at_utc": "2026-08-05T08:47:58Z", + "finished_at_utc": "2026-08-05T08:47:58Z", "reference_register_checked": true, "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", "error_register_checked": true, "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", - "command_sha256": "5adfe75e793018f15e1799e207029a4a5159643047a5c99a07d18f56b088784d", + "command_sha256": "d3dd61bab9f4949e7f749d3d6f8efa5dcafd3b09abf96bcbf3119c1aee127bc9", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "ae1cb3bb2f5fe11da04b061be5e8c386bbebdff5242cb20eb9bcdbc1fe2d7291", - "sanitized_output_sha256": "ae1cb3bb2f5fe11da04b061be5e8c386bbebdff5242cb20eb9bcdbc1fe2d7291", + "raw_evidence_sha256": "9c385a174b858d468f1366d42c1b90cb713b245cb1e7ebcff39242de9d3439b3", + "sanitized_output_sha256": "9c385a174b858d468f1366d42c1b90cb713b245cb1e7ebcff39242de9d3439b3", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z\",\"command_rc\":0,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z\",\"command_rc\":0,\"correction_of_previous_logic_gaps\":[{\"exact_fix\":\"PATH-like names and colon-separated filesystem values are rejected before route construction\",\"proven_gap\":\"PATH was accepted as an HTTP route because its environment name matched a broad path regex\",\"regression_test\":\"PATH cannot pass is_route_value or appear in route templates\"},{\"exact_fix\":\"connect to the exact listener address obtained from the Reader process network table\",\"proven_gap\":\"the previous probe assumed 127.0.0.1 although the owned listener was bound to a specific non-loopback address\",\"regression_test\":\"specific listeners are probed at their exact internal address; the address is never output\"},{\"exact_fix\":\"capability names and values are secret and are replaced by in all output\",\"proven_gap\":\"HOMELAB_READER_CAPABILITY was not classified as secret\",\"regression_test\":\"secret value cannot appear in route templates or output\"}],\"error_fingerprint\":\"820f5c9a664dd86192521678e7c5790c5c6adcb442b513f49dadf4f23286d5eb\",\"latest_exact_result_basis\":{\"capsule_sha256\":\"4d3ddb435f7ab3c7211374d080966c708764dccd4c1a8158e752348838f89e8a\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-ROUTE-READ-ONLY-20260805T080500Z\",\"command_rc\":0,\"control_plane_error\":null,\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_PROTOCOL_SPECIFIC_PROBE\",\"output_complete\":true,\"output_sha256\":\"1c712519eb2e1171ae0066e849d3ca2c71c460342f5aa3f8733a75b3360d358b\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_RUNTIME_AND_INTERFACE_PARTIALLY_DISCOVERED_BUT_NO_AUTHORITATIVE_INVENTORY_RESPONSE\",\"runner_document_rc\":0,\"runner_json_sha256\":\"778267e8222f26022de07e4364043f110da28905d238b6d91ce87407e8a5ccd5\",\"runner_rc\":0,\"runner_text_sha256\":\"52fb0b4883655abe8a39c62f94da8ce34fa0e6711dff5ef468fb0802557931f9\",\"runner_wrapper_matches_document\":true,\"status\":\"OK\"},\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_EXACT_AUTH_AND_ROUTE_CONTRACT_PROBE\",\"output_truncated_in_json\":false,\"owned_listeners\":[{\"address_class\":\"private\",\"address_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\",\"family\":\"ipv4\",\"inode\":\"24795\",\"port\":18788}],\"pre_command_known_error_gate\":{\"checked\":true,\"items\":[{\"id\":\"candidate-scan-limit-20260805\",\"prevention\":\"exact files only; hard source, response, route, probe and output limits\"},{\"id\":\"runner-wrapper-mismatch-20260805\",\"prevention\":\"single compact JSON below 42000 bytes; no raw sources or response bodies\"},{\"id\":\"gitea-owner-hardcoded-20260805\",\"prevention\":\"no repository owner or repository URL is assumed\"},{\"id\":\"gitea-git-auth-unavailable-20260805\",\"prevention\":\"no Git or Gitea authentication retry in this command\"},{\"id\":\"pvesh-adapter-context-unreadable-20260805\",\"prevention\":\"pvesh is not called\"},{\"id\":\"gitea-process-self-match-20260805\",\"prevention\":\"Reader identity is bound to exact systemd ControlGroup\"},{\"id\":\"sanitize-non-string-attributeerror-20260805\",\"prevention\":\"sanitize converts Any to str; embedded bool regression test\"},{\"id\":\"reader-v3-skipped-on-nonauthoritative-inventory-20260805\",\"prevention\":\"this command directly probes Reader V3\"},{\"id\":\"reader-path-env-misclassified-as-route-20260805\",\"prevention\":\"PATH/PYTHONPATH and colon-separated filesystem values are explicitly forbidden as HTTP routes\"},{\"id\":\"reader-loopback-only-probe-20260805\",\"prevention\":\"connections use the exact address of the socket owned by the Reader ControlGroup; 127.0.0.1 is not assumed\"},{\"id\":\"reader-capability-not-secret-20260805\",\"prevention\":\"all capability values are secret; values and concrete secret-bearing routes are never output\"}]},\"prevention_test\":{\"must_run_before_future_cluster_or_gitea_commands\":true,\"name\":\"reader_v3_protocol_specific_preflight\",\"requirements\":[\"verify exact Reader unit and server source SHA\",\"bind process and sockets to exact ControlGroup\",\"treat capability as secret\",\"reject PATH-like values as routes\",\"connect only to exact owned listener endpoints\",\"derive routes only from source, exact environment, or protocol-standard root\",\"accept inventory only from successful JSON with normalized guest rows\"]},\"process_environment\":{\"capability_name_present\":true,\"names\":[\"HOME\",\"HOMELAB_READER_CAPABILITY\",\"HOMELAB_READER_PORT\",\"INVOCATION_ID\",\"JOURNAL_STREAM\",\"LANG\",\"LOGNAME\",\"MEMORY_PRESSURE_WATCH\",\"MEMORY_PRESSURE_WRITE\",\"PATH\",\"SHELL\",\"SYSTEMD_EXEC_PID\",\"USER\"],\"secret_name_count\":1},\"protocol_probe\":{\"auth_candidate_count\":0,\"gitea_candidates\":[],\"guest_count\":0,\"header_names\":[],\"probes\":[{\"auth\":\"none\",\"body_bytes\":10,\"body_sha256\":\"709009e02c8e364113b28205aadde30cce270d709073f28153c85fdc5036c96d\",\"body_truncated\":false,\"content_type\":\"text/plain; charset=utf-8\",\"duration_seconds\":0.001,\"endpoint_index\":0,\"json\":null,\"method\":\"GET\",\"response_header_names\":[\"cache-control\",\"content-length\",\"content-type\",\"date\",\"expires\",\"pragma\",\"server\",\"surrogate-control\",\"x-robots-tag\"],\"route_source\":\"exact_source_literal\",\"route_template\":\"/\",\"status\":404}],\"successful_inventory_routes\":[]},\"rc\":0,\"read_only\":true,\"ready_for_guest_probe\":false,\"result_projection\":{\"bytes\":7162,\"compacted\":false,\"max_bytes\":42000},\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_HTTP_ENDPOINT_REACHED_BUT_NO_AUTHORITATIVE_JSON_RESPONSE\",\"schema\":1,\"source_files\":[{\"actual_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"bytes\":580,\"expected_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"matches_expected\":true,\"path\":\"/etc/systemd/system/homelab-reader-v3.service\"},{\"actual_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"bytes\":3539,\"expected_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"matches_expected\":true,\"path\":\"/usr/local/sbin/homelab-reader-server-v3\"}],\"source_semantics\":{\"http_detected\":true,\"protocol_markers\":[\"basehttprequesthandler\",\"content-type\",\"do_get\",\"http.server\"],\"route_template_count\":1,\"route_templates\":[{\"method\":\"GET\",\"secret_bearing\":false,\"source\":\"exact_source_literal\",\"source_file_sha256\":\"6222c97692545e54270df7e5b953d64a1764681ddb375f3c3855402285eae36b\",\"template\":\"/\"}],\"source_environment_references\":[\"HOMELAB_READER_CAPABILITY\",\"HOMELAB_READER_PORT\"]},\"source_state\":\"MATCH\",\"status\":\"OK\",\"systemd_identity\":{\"identity_valid\":true,\"pid_count\":1,\"probe\":{\"duration_seconds\":0.005,\"rc\":0,\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_bytes\":375,\"stdout_sha256\":\"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9\",\"stdout_truncated\":false},\"properties\":{\"ActiveState\":\"active\",\"ControlGroup\":\"/system.slice/homelab-reader-v3.service\",\"ExecStart_present\":true,\"ExecStart_sha256\":\"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379\",\"FragmentPath\":\"/etc/systemd/system/homelab-reader-v3.service\",\"LoadState\":\"loaded\",\"MainPID\":\"1282\",\"SubState\":\"running\"}}}\n" + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z\",\"command_rc\":0,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z\",\"command_rc\":0,\"correction_of_previous_logic_gaps\":[{\"exact_fix\":\"parse the exact Python AST, resolve environment-backed constants, derive path/header/query comparisons and probe only source-supported contracts\",\"proven_gap\":\"the exact Reader listener answered GET / with 404 and no JSON while the prior scanner found no auth candidates\",\"regression_test\":\"f-string capability routes, header aliases and compare_digest contracts must be resolved without exposing capability values\"}],\"error_fingerprint\":\"dd4ebd816db1715f38801e549b40d82b48b543981dc18cf6c6345157419ecd90\",\"latest_exact_result_basis\":{\"capsule_sha256\":\"c8a9a1a97b0b67593ce23bdf79a25d14552b86594c5aae3ec7d2fd71a560de51\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z\",\"command_rc\":0,\"control_plane_error\":null,\"error_fingerprint\":\"820f5c9a664dd86192521678e7c5790c5c6adcb442b513f49dadf4f23286d5eb\",\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_EXACT_AUTH_AND_ROUTE_CONTRACT_PROBE\",\"output_complete\":true,\"output_sha256\":\"ae1cb3bb2f5fe11da04b061be5e8c386bbebdff5242cb20eb9bcdbc1fe2d7291\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_HTTP_ENDPOINT_REACHED_BUT_NO_AUTHORITATIVE_JSON_RESPONSE\",\"runner_document_rc\":0,\"runner_json_sha256\":\"e4eff0a71258655d38624da74dc180cd89946620ab94f2ac222d2b04764aff70\",\"runner_rc\":0,\"runner_text_sha256\":\"631196a81a5d56751a14c7fa5001092d3421c0b0d3f88fdafdc528653db49e5f\",\"runner_wrapper_matches_document\":true,\"status\":\"OK\"},\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_READER_V3_HANDLER_CONTROL_FLOW_TRACE\",\"output_truncated_in_json\":false,\"owned_listeners\":[{\"address_class\":\"private\",\"address_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\",\"family\":\"ipv4\",\"inode\":\"24795\",\"port\":18788}],\"pre_command_known_error_gate\":{\"checked\":true,\"items\":[{\"id\":\"candidate-scan-limit-20260805\",\"prevention\":\"exact files only; hard source, response, route, probe and output limits\"},{\"id\":\"runner-wrapper-mismatch-20260805\",\"prevention\":\"single compact JSON below 42000 bytes; no raw sources or response bodies\"},{\"id\":\"gitea-owner-hardcoded-20260805\",\"prevention\":\"no repository owner or repository URL is assumed\"},{\"id\":\"gitea-git-auth-unavailable-20260805\",\"prevention\":\"no Git or Gitea authentication retry in this command\"},{\"id\":\"pvesh-adapter-context-unreadable-20260805\",\"prevention\":\"pvesh is not called\"},{\"id\":\"gitea-process-self-match-20260805\",\"prevention\":\"Reader identity is bound to exact systemd ControlGroup\"},{\"id\":\"sanitize-non-string-attributeerror-20260805\",\"prevention\":\"sanitize converts Any to str; embedded bool regression test\"},{\"id\":\"reader-v3-skipped-on-nonauthoritative-inventory-20260805\",\"prevention\":\"this command directly probes Reader V3\"},{\"id\":\"reader-path-env-misclassified-as-route-20260805\",\"prevention\":\"PATH/PYTHONPATH and colon-separated filesystem values are explicitly forbidden as HTTP routes\"},{\"id\":\"reader-loopback-only-probe-20260805\",\"prevention\":\"connections use the exact address of the socket owned by the Reader ControlGroup; 127.0.0.1 is not assumed\"},{\"id\":\"reader-capability-not-secret-20260805\",\"prevention\":\"all capability values are secret; values and concrete secret-bearing routes are never output\"},{\"id\":\"reader-v3-root-404-no-json-20260805\",\"prevention\":\"derive auth and route only from exact AST comparisons, source literals and process environment before probing\"}]},\"prevention_test\":{\"must_run_before_future_cluster_or_gitea_commands\":true,\"name\":\"reader_v3_exact_auth_route_contract_preflight\",\"requirements\":[\"verify exact Reader source SHA\",\"bind process and socket to exact systemd ControlGroup\",\"resolve auth and route from exact AST and process environment\",\"never output capability values or private addresses\",\"probe only source-supported request contracts\",\"accept inventory only from successful JSON with normalized guest rows\"]},\"process_environment\":{\"capability_name_present\":true,\"names\":[\"HOME\",\"HOMELAB_READER_CAPABILITY\",\"HOMELAB_READER_PORT\",\"INVOCATION_ID\",\"JOURNAL_STREAM\",\"LANG\",\"LOGNAME\",\"MEMORY_PRESSURE_WATCH\",\"MEMORY_PRESSURE_WRITE\",\"PATH\",\"SHELL\",\"SYSTEMD_EXEC_PID\",\"USER\"],\"secret_name_count\":1},\"protocol_probe\":{\"auth_candidate_count\":0,\"gitea_candidates\":[],\"guest_count\":0,\"probes\":[],\"request_contract_count\":0,\"successful_inventory_routes\":[]},\"rc\":0,\"read_only\":true,\"ready_for_guest_probe\":false,\"result_projection\":{\"bytes_before_projection\":6744,\"compacted\":false,\"max_bytes\":36000},\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"READER_V3_LISTENER_FOUND_BUT_AST_AUTH_ROUTE_CONTRACT_NOT_DERIVED\",\"schema\":1,\"source_files\":[{\"actual_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"bytes\":580,\"expected_sha256\":\"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1\",\"matches_expected\":true,\"path\":\"/etc/systemd/system/homelab-reader-v3.service\"},{\"actual_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"bytes\":3539,\"expected_sha256\":\"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536\",\"matches_expected\":true,\"path\":\"/usr/local/sbin/homelab-reader-server-v3\"}],\"source_semantics\":{\"ast_parse_ok\":false,\"auth_variants\":[{\"basis\":\"control\",\"header_names\":[],\"label\":\"none\"}],\"handler_count\":2,\"header_contract_count\":0,\"header_names\":[],\"parse_errors\":[{\"error\":\"invalid decimal literal (homelab-reader-v3.service, line 8)\",\"path_sha256\":\"af7ae852500810b83c8d7bad0284356de382714a71c8f64ba13778dbce5bf354\"}],\"protocol_markers\":[\"basehttprequesthandler\",\"content-type\",\"do_get\",\"http.server\",\"send_response\"],\"query_contract_count\":0,\"query_keys\":[],\"resolved_scope_names\":[\"CAPABILITY\",\"PORT\",\"allow_reuse_address\",\"server_version\"],\"route_template_count\":0,\"route_templates\":[],\"source_environment_references\":[\"HOMELAB_READER_CAPABILITY\",\"HOMELAB_READER_PORT\"]},\"source_state\":\"MATCH\",\"status\":\"OK\",\"systemd_identity\":{\"identity_valid\":true,\"pid_count\":1,\"probe\":{\"duration_seconds\":0.005,\"rc\":0,\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_bytes\":375,\"stdout_sha256\":\"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9\",\"stdout_truncated\":false},\"properties\":{\"ActiveState\":\"active\",\"ControlGroup\":\"/system.slice/homelab-reader-v3.service\",\"ExecStart_present\":true,\"ExecStart_sha256\":\"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379\",\"FragmentPath\":\"/etc/systemd/system/homelab-reader-v3.service\",\"LoadState\":\"loaded\",\"MainPID\":\"1282\",\"SubState\":\"running\"}}}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 3362aba..8abe363 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,5 +1,5 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z +COMMAND_ID=HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z STATUS=OK RC=0 HOST=pve01 @@ -9,7 +9,7 @@ REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 -COMMAND_SHA256=5adfe75e793018f15e1799e207029a4a5159643047a5c99a07d18f56b088784d +COMMAND_SHA256=d3dd61bab9f4949e7f749d3d6f8efa5dcafd3b09abf96bcbf3119c1aee127bc9 DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false @@ -24,11 +24,11 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=ae1cb3bb2f5fe11da04b061be5e8c386bbebdff5242cb20eb9bcdbc1fe2d7291 -SANITIZED_OUTPUT_SHA256=ae1cb3bb2f5fe11da04b061be5e8c386bbebdff5242cb20eb9bcdbc1fe2d7291 +RAW_EVIDENCE_SHA256=9c385a174b858d468f1366d42c1b90cb713b245cb1e7ebcff39242de9d3439b3 +SANITIZED_OUTPUT_SHA256=9c385a174b858d468f1366d42c1b90cb713b245cb1e7ebcff39242de9d3439b3 OUTPUT_BEGIN -HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1} -{"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z","command_rc":0,"correction_of_previous_logic_gaps":[{"exact_fix":"PATH-like names and colon-separated filesystem values are rejected before route construction","proven_gap":"PATH was accepted as an HTTP route because its environment name matched a broad path regex","regression_test":"PATH cannot pass is_route_value or appear in route templates"},{"exact_fix":"connect to the exact listener address obtained from the Reader process network table","proven_gap":"the previous probe assumed 127.0.0.1 although the owned listener was bound to a specific non-loopback address","regression_test":"specific listeners are probed at their exact internal address; the address is never output"},{"exact_fix":"capability names and values are secret and are replaced by in all output","proven_gap":"HOMELAB_READER_CAPABILITY was not classified as secret","regression_test":"secret value cannot appear in route templates or output"}],"error_fingerprint":"820f5c9a664dd86192521678e7c5790c5c6adcb442b513f49dadf4f23286d5eb","latest_exact_result_basis":{"capsule_sha256":"4d3ddb435f7ab3c7211374d080966c708764dccd4c1a8158e752348838f89e8a","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-ROUTE-READ-ONLY-20260805T080500Z","command_rc":0,"control_plane_error":null,"mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_PROTOCOL_SPECIFIC_PROBE","output_complete":true,"output_sha256":"1c712519eb2e1171ae0066e849d3ca2c71c460342f5aa3f8733a75b3360d358b","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_RUNTIME_AND_INTERFACE_PARTIALLY_DISCOVERED_BUT_NO_AUTHORITATIVE_INVENTORY_RESPONSE","runner_document_rc":0,"runner_json_sha256":"778267e8222f26022de07e4364043f110da28905d238b6d91ce87407e8a5ccd5","runner_rc":0,"runner_text_sha256":"52fb0b4883655abe8a39c62f94da8ce34fa0e6711dff5ef468fb0802557931f9","runner_wrapper_matches_document":true,"status":"OK"},"mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_EXACT_AUTH_AND_ROUTE_CONTRACT_PROBE","output_truncated_in_json":false,"owned_listeners":[{"address_class":"private","address_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9","family":"ipv4","inode":"24795","port":18788}],"pre_command_known_error_gate":{"checked":true,"items":[{"id":"candidate-scan-limit-20260805","prevention":"exact files only; hard source, response, route, probe and output limits"},{"id":"runner-wrapper-mismatch-20260805","prevention":"single compact JSON below 42000 bytes; no raw sources or response bodies"},{"id":"gitea-owner-hardcoded-20260805","prevention":"no repository owner or repository URL is assumed"},{"id":"gitea-git-auth-unavailable-20260805","prevention":"no Git or Gitea authentication retry in this command"},{"id":"pvesh-adapter-context-unreadable-20260805","prevention":"pvesh is not called"},{"id":"gitea-process-self-match-20260805","prevention":"Reader identity is bound to exact systemd ControlGroup"},{"id":"sanitize-non-string-attributeerror-20260805","prevention":"sanitize converts Any to str; embedded bool regression test"},{"id":"reader-v3-skipped-on-nonauthoritative-inventory-20260805","prevention":"this command directly probes Reader V3"},{"id":"reader-path-env-misclassified-as-route-20260805","prevention":"PATH/PYTHONPATH and colon-separated filesystem values are explicitly forbidden as HTTP routes"},{"id":"reader-loopback-only-probe-20260805","prevention":"connections use the exact address of the socket owned by the Reader ControlGroup; 127.0.0.1 is not assumed"},{"id":"reader-capability-not-secret-20260805","prevention":"all capability values are secret; values and concrete secret-bearing routes are never output"}]},"prevention_test":{"must_run_before_future_cluster_or_gitea_commands":true,"name":"reader_v3_protocol_specific_preflight","requirements":["verify exact Reader unit and server source SHA","bind process and sockets to exact ControlGroup","treat capability as secret","reject PATH-like values as routes","connect only to exact owned listener endpoints","derive routes only from source, exact environment, or protocol-standard root","accept inventory only from successful JSON with normalized guest rows"]},"process_environment":{"capability_name_present":true,"names":["HOME","HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT","INVOCATION_ID","JOURNAL_STREAM","LANG","LOGNAME","MEMORY_PRESSURE_WATCH","MEMORY_PRESSURE_WRITE","PATH","SHELL","SYSTEMD_EXEC_PID","USER"],"secret_name_count":1},"protocol_probe":{"auth_candidate_count":0,"gitea_candidates":[],"guest_count":0,"header_names":[],"probes":[{"auth":"none","body_bytes":10,"body_sha256":"709009e02c8e364113b28205aadde30cce270d709073f28153c85fdc5036c96d","body_truncated":false,"content_type":"text/plain; charset=utf-8","duration_seconds":0.001,"endpoint_index":0,"json":null,"method":"GET","response_header_names":["cache-control","content-length","content-type","date","expires","pragma","server","surrogate-control","x-robots-tag"],"route_source":"exact_source_literal","route_template":"/","status":404}],"successful_inventory_routes":[]},"rc":0,"read_only":true,"ready_for_guest_probe":false,"result_projection":{"bytes":7162,"compacted":false,"max_bytes":42000},"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_HTTP_ENDPOINT_REACHED_BUT_NO_AUTHORITATIVE_JSON_RESPONSE","schema":1,"source_files":[{"actual_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","bytes":580,"expected_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","matches_expected":true,"path":"/etc/systemd/system/homelab-reader-v3.service"},{"actual_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","bytes":3539,"expected_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","matches_expected":true,"path":"/usr/local/sbin/homelab-reader-server-v3"}],"source_semantics":{"http_detected":true,"protocol_markers":["basehttprequesthandler","content-type","do_get","http.server"],"route_template_count":1,"route_templates":[{"method":"GET","secret_bearing":false,"source":"exact_source_literal","source_file_sha256":"6222c97692545e54270df7e5b953d64a1764681ddb375f3c3855402285eae36b","template":"/"}],"source_environment_references":["HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT"]},"source_state":"MATCH","status":"OK","systemd_identity":{"identity_valid":true,"pid_count":1,"probe":{"duration_seconds":0.005,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":375,"stdout_sha256":"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9","stdout_truncated":false},"properties":{"ActiveState":"active","ControlGroup":"/system.slice/homelab-reader-v3.service","ExecStart_present":true,"ExecStart_sha256":"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379","FragmentPath":"/etc/systemd/system/homelab-reader-v3.service","LoadState":"loaded","MainPID":"1282","SubState":"running"}}} +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1} +{"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-EXACT-AUTH-ROUTE-CONTRACT-READ-ONLY-20260805T083200Z","command_rc":0,"correction_of_previous_logic_gaps":[{"exact_fix":"parse the exact Python AST, resolve environment-backed constants, derive path/header/query comparisons and probe only source-supported contracts","proven_gap":"the exact Reader listener answered GET / with 404 and no JSON while the prior scanner found no auth candidates","regression_test":"f-string capability routes, header aliases and compare_digest contracts must be resolved without exposing capability values"}],"error_fingerprint":"dd4ebd816db1715f38801e549b40d82b48b543981dc18cf6c6345157419ecd90","latest_exact_result_basis":{"capsule_sha256":"c8a9a1a97b0b67593ce23bdf79a25d14552b86594c5aae3ec7d2fd71a560de51","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-READER-V3-PROTOCOL-SPECIFIC-READ-ONLY-20260805T082100Z","command_rc":0,"control_plane_error":null,"error_fingerprint":"820f5c9a664dd86192521678e7c5790c5c6adcb442b513f49dadf4f23286d5eb","mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_EXACT_AUTH_AND_ROUTE_CONTRACT_PROBE","output_complete":true,"output_sha256":"ae1cb3bb2f5fe11da04b061be5e8c386bbebdff5242cb20eb9bcdbc1fe2d7291","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_HTTP_ENDPOINT_REACHED_BUT_NO_AUTHORITATIVE_JSON_RESPONSE","runner_document_rc":0,"runner_json_sha256":"e4eff0a71258655d38624da74dc180cd89946620ab94f2ac222d2b04764aff70","runner_rc":0,"runner_text_sha256":"631196a81a5d56751a14c7fa5001092d3421c0b0d3f88fdafdc528653db49e5f","runner_wrapper_matches_document":true,"status":"OK"},"mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_READER_V3_HANDLER_CONTROL_FLOW_TRACE","output_truncated_in_json":false,"owned_listeners":[{"address_class":"private","address_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9","family":"ipv4","inode":"24795","port":18788}],"pre_command_known_error_gate":{"checked":true,"items":[{"id":"candidate-scan-limit-20260805","prevention":"exact files only; hard source, response, route, probe and output limits"},{"id":"runner-wrapper-mismatch-20260805","prevention":"single compact JSON below 42000 bytes; no raw sources or response bodies"},{"id":"gitea-owner-hardcoded-20260805","prevention":"no repository owner or repository URL is assumed"},{"id":"gitea-git-auth-unavailable-20260805","prevention":"no Git or Gitea authentication retry in this command"},{"id":"pvesh-adapter-context-unreadable-20260805","prevention":"pvesh is not called"},{"id":"gitea-process-self-match-20260805","prevention":"Reader identity is bound to exact systemd ControlGroup"},{"id":"sanitize-non-string-attributeerror-20260805","prevention":"sanitize converts Any to str; embedded bool regression test"},{"id":"reader-v3-skipped-on-nonauthoritative-inventory-20260805","prevention":"this command directly probes Reader V3"},{"id":"reader-path-env-misclassified-as-route-20260805","prevention":"PATH/PYTHONPATH and colon-separated filesystem values are explicitly forbidden as HTTP routes"},{"id":"reader-loopback-only-probe-20260805","prevention":"connections use the exact address of the socket owned by the Reader ControlGroup; 127.0.0.1 is not assumed"},{"id":"reader-capability-not-secret-20260805","prevention":"all capability values are secret; values and concrete secret-bearing routes are never output"},{"id":"reader-v3-root-404-no-json-20260805","prevention":"derive auth and route only from exact AST comparisons, source literals and process environment before probing"}]},"prevention_test":{"must_run_before_future_cluster_or_gitea_commands":true,"name":"reader_v3_exact_auth_route_contract_preflight","requirements":["verify exact Reader source SHA","bind process and socket to exact systemd ControlGroup","resolve auth and route from exact AST and process environment","never output capability values or private addresses","probe only source-supported request contracts","accept inventory only from successful JSON with normalized guest rows"]},"process_environment":{"capability_name_present":true,"names":["HOME","HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT","INVOCATION_ID","JOURNAL_STREAM","LANG","LOGNAME","MEMORY_PRESSURE_WATCH","MEMORY_PRESSURE_WRITE","PATH","SHELL","SYSTEMD_EXEC_PID","USER"],"secret_name_count":1},"protocol_probe":{"auth_candidate_count":0,"gitea_candidates":[],"guest_count":0,"probes":[],"request_contract_count":0,"successful_inventory_routes":[]},"rc":0,"read_only":true,"ready_for_guest_probe":false,"result_projection":{"bytes_before_projection":6744,"compacted":false,"max_bytes":36000},"rollback_restored":null,"rollback_started":false,"root_cause_classification":"READER_V3_LISTENER_FOUND_BUT_AST_AUTH_ROUTE_CONTRACT_NOT_DERIVED","schema":1,"source_files":[{"actual_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","bytes":580,"expected_sha256":"d672b74b390efa787ffd5a090e8c8eea8fdf038075421231a9d9b3053ea926b1","matches_expected":true,"path":"/etc/systemd/system/homelab-reader-v3.service"},{"actual_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","bytes":3539,"expected_sha256":"092780e76ff18dfe2920c51f8b97dd09d194fd6cbdb59c3755c9fbf6530f3536","matches_expected":true,"path":"/usr/local/sbin/homelab-reader-server-v3"}],"source_semantics":{"ast_parse_ok":false,"auth_variants":[{"basis":"control","header_names":[],"label":"none"}],"handler_count":2,"header_contract_count":0,"header_names":[],"parse_errors":[{"error":"invalid decimal literal (homelab-reader-v3.service, line 8)","path_sha256":"af7ae852500810b83c8d7bad0284356de382714a71c8f64ba13778dbce5bf354"}],"protocol_markers":["basehttprequesthandler","content-type","do_get","http.server","send_response"],"query_contract_count":0,"query_keys":[],"resolved_scope_names":["CAPABILITY","PORT","allow_reuse_address","server_version"],"route_template_count":0,"route_templates":[],"source_environment_references":["HOMELAB_READER_CAPABILITY","HOMELAB_READER_PORT"]},"source_state":"MATCH","status":"OK","systemd_identity":{"identity_valid":true,"pid_count":1,"probe":{"duration_seconds":0.005,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":375,"stdout_sha256":"49094d65d3787c1479e6408e1fefb7af3758d0fa55e1d37bf22907442aab35e9","stdout_truncated":false},"properties":{"ActiveState":"active","ControlGroup":"/system.slice/homelab-reader-v3.service","ExecStart_present":true,"ExecStart_sha256":"2500fde09569176736b4f2f1dd29d6289b6a6ae6a59b52b6a3c31f797f567379","FragmentPath":"/etc/systemd/system/homelab-reader-v3.service","LoadState":"loaded","MainPID":"1282","SubState":"running"}}} OUTPUT_END CHAT_OUTPUT_END