runtime: publish CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171

runtime/history/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171.json

@@ -0,0 +1,30 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "cluster-audit",
+  "started_at_utc": "2026-07-22T10:25:15Z",
+  "finished_at_utc": "2026-07-22T10:25:15Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
+  "error_register_checked": true,
+  "error_register_sha256": "08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752",
+  "command_sha256": "1299fe30eb30386fec901e120ab525ece490edc5eca767d9216466ecd225bef5",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "changes_made": false,
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "ced96ca03c186b7a4b64cc4939add95121ad329963b7fddde6c5fcde8c47940f",
+  "sanitized_output_sha256": "ced96ca03c186b7a4b64cc4939add95121ad329963b7fddde6c5fcde8c47940f",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "PREVIOUS_RESULT=VERIFIED\n=== OPERATIONS_PUBLISH_CONTEXT ===\n1-# Operations\n2-\n3-List: homelab-reference list\n4-Read: homelab-reference get SECTION ID --layer effective\n5-Add: homelab-reference add SECTION JSON\n6-Edit: homelab-reference edit SECTION ID --set key=value\n7-Remove: homelab-reference remove SECTION ID\n8-Validate: homelab-reference validate\n9-Merge: homelab-reference merge\n10-Refresh: homelab-reference-refresh\n11:Publish: homelab-reference-publish\n12-\n13-Immutable runtime history for the exact COMMAND_ID is authoritative. latest.json is not authoritative.\n=== ACTIVE_CODE_REFERENCES ===\n=== REFRESH_RELEVANT_LINES ===\n5:S=json.loads((R/\"manifest.json\").read_text())[\"sections\"]\n34: f=int(json.loads((R/\"manifest.json\").read_text()).get(\"freshness_seconds\",{}).get(s,3600));z=(t+datetime.timedelta(seconds=f)).isoformat()\n131: st=load(\"state\",\"current\") if False else json.loads((R/\"state/current.json\").read_text());st.update({\"schema_version\":2,\"status\":\"AUTO_REFRESH_READY\",\"updated_at\":t.isoformat(),\"last_snapshot\":str(snap),\"observed_counts\":cnt,\"effective_counts\":eff,\"public_index\":str(R/\"public/index.json\"),\"collector\":str(pathlib.Path(__file__))});atom(R/\"state/current.json\",st)\n=== CLI_RELEVANT_LINES ===\n43:    manifest = json.loads((ROOT / \"manifest.json\").read_text(encoding=\"utf-8\"))\n44:    return manifest.get(\"sections\", [])\n65:def validate_section(layer, section):\n105:def cmd_status(args):\n106:    state_path = ROOT / \"state\" / \"current.json\"\n108:    print(\"status=\" + str(state.get(\"status\", \"UNKNOWN\")))\n120:        print(str(record.get(\"id\")) + \"\\t\" + str(record.get(\"name\", \"\")) + \"\\t\" + str(record.get(\"status\", \"\")))\n176:def cmd_validate(args):\n182:            errors.extend(validate_section(layer, section))\n205:p = sub.add_parser(\"status\"); p.set_defaults(func=cmd_status)\n211:p = sub.add_parser(\"validate\"); p.add_argument(\"section\", nargs=\"?\"); p.add_argument(\"--layer\", choices=LAYERS); p.set_defaults(func=cmd_validate)\n=== UNIT_FILES ===\n# /etc/systemd/system/homelab-reference-refresh.service\n[Unit]\nDescription=Refresh homelab cluster reference\nAfter=network-online.target pve-cluster.service\nWants=network-online.target\n\n[Service]\nType=oneshot\nExecStart=/usr/local/sbin/homelab-reference-refresh\nUser=root\nGroup=root\nNice=10\nIOSchedulingClass=best-effort\nIOSchedulingPriority=7\nNoNewPrivileges=true\nPrivateTmp=true\nProtectSystem=strict\nReadWritePaths=/etc/homelab/reference /var/backups/homelab-reference\nProtectHome=read-only\n\n# /etc/systemd/system/homelab-reference-refresh.timer\n[Unit]\nDescription=Periodic homelab reference refresh\n\n[Timer]\nOnBootSec=10min\nOnUnitActiveSec=30min\nRandomizedDelaySec=5min\nPersistent=true\nUnit=homelab-reference-refresh.service\n\n[Install]\nWantedBy=timers.target\n=== MANIFEST_CONTRACT ===\n2:  \"schema_version\": 2,\n4:  \"updated_at\": \"2026-07-22T08:12:10+00:00\",\n=== STATE_CONTRACT ===\n2:  \"schema_version\": 2,\n3:  \"status\": \"AUTO_REFRESH_READY\",\n4:  \"updated_at\": \"2026-07-22T10:01:14+00:00\",\nREFERENCE_CHECK=OK\nERROR_REGISTER_CHECK=OK\nSECRET_PRINTED=NO\nPUBLISHER_CONTRACT_AUDIT=COMPLETE\n"
+}

runtime/history/CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171.txt

@@ -0,0 +1,101 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=cluster-audit
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752
+COMMAND_SHA256=1299fe30eb30386fec901e120ab525ece490edc5eca767d9216466ecd225bef5
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGES_MADE=false
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=ced96ca03c186b7a4b64cc4939add95121ad329963b7fddde6c5fcde8c47940f
+SANITIZED_OUTPUT_SHA256=ced96ca03c186b7a4b64cc4939add95121ad329963b7fddde6c5fcde8c47940f
+OUTPUT_BEGIN
+PREVIOUS_RESULT=VERIFIED
+=== OPERATIONS_PUBLISH_CONTEXT ===
+1-# Operations
+2-
+3-List: homelab-reference list
+4-Read: homelab-reference get SECTION ID --layer effective
+5-Add: homelab-reference add SECTION JSON
+6-Edit: homelab-reference edit SECTION ID --set key=value
+7-Remove: homelab-reference remove SECTION ID
+8-Validate: homelab-reference validate
+9-Merge: homelab-reference merge
+10-Refresh: homelab-reference-refresh
+11:Publish: homelab-reference-publish
+12-
+13-Immutable runtime history for the exact COMMAND_ID is authoritative. latest.json is not authoritative.
+=== ACTIVE_CODE_REFERENCES ===
+=== REFRESH_RELEVANT_LINES ===
+5:S=json.loads((R/"manifest.json").read_text())["sections"]
+34: f=int(json.loads((R/"manifest.json").read_text()).get("freshness_seconds",{}).get(s,3600));z=(t+datetime.timedelta(seconds=f)).isoformat()
+131: st=load("state","current") if False else json.loads((R/"state/current.json").read_text());st.update({"schema_version":2,"status":"AUTO_REFRESH_READY","updated_at":t.isoformat(),"last_snapshot":str(snap),"observed_counts":cnt,"effective_counts":eff,"public_index":str(R/"public/index.json"),"collector":str(pathlib.Path(__file__))});atom(R/"state/current.json",st)
+=== CLI_RELEVANT_LINES ===
+43:    manifest = json.loads((ROOT / "manifest.json").read_text(encoding="utf-8"))
+44:    return manifest.get("sections", [])
+65:def validate_section(layer, section):
+105:def cmd_status(args):
+106:    state_path = ROOT / "state" / "current.json"
+108:    print("status=" + str(state.get("status", "UNKNOWN")))
+120:        print(str(record.get("id")) + "\t" + str(record.get("name", "")) + "\t" + str(record.get("status", "")))
+176:def cmd_validate(args):
+182:            errors.extend(validate_section(layer, section))
+205:p = sub.add_parser("status"); p.set_defaults(func=cmd_status)
+211:p = sub.add_parser("validate"); p.add_argument("section", nargs="?"); p.add_argument("--layer", choices=LAYERS); p.set_defaults(func=cmd_validate)
+=== UNIT_FILES ===
+# /etc/systemd/system/homelab-reference-refresh.service
+[Unit]
+Description=Refresh homelab cluster reference
+After=network-online.target pve-cluster.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/homelab-reference-refresh
+User=root
+Group=root
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/etc/homelab/reference /var/backups/homelab-reference
+ProtectHome=read-only
+
+# /etc/systemd/system/homelab-reference-refresh.timer
+[Unit]
+Description=Periodic homelab reference refresh
+
+[Timer]
+OnBootSec=10min
+OnUnitActiveSec=30min
+RandomizedDelaySec=5min
+Persistent=true
+Unit=homelab-reference-refresh.service
+
+[Install]
+WantedBy=timers.target
+=== MANIFEST_CONTRACT ===
+2:  "schema_version": 2,
+4:  "updated_at": "2026-07-22T08:12:10+00:00",
+=== STATE_CONTRACT ===
+2:  "schema_version": 2,
+3:  "status": "AUTO_REFRESH_READY",
+4:  "updated_at": "2026-07-22T10:01:14+00:00",
+REFERENCE_CHECK=OK
+ERROR_REGISTER_CHECK=OK
+SECRET_PRINTED=NO
+PUBLISHER_CONTRACT_AUDIT=COMPLETE
+
+OUTPUT_END
+CHAT_OUTPUT_END

runtime/latest.json

@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "CLUSTER-REFERENCE-PUBLISHER-RECOVERY-AUDIT-170",
+  "command_id": "CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
   "mode": "read-only",
   "component": "cluster-audit",
-  "started_at_utc": "2026-07-22T10:21:27Z",
+  "started_at_utc": "2026-07-22T10:25:15Z",
-  "finished_at_utc": "2026-07-22T10:21:27Z",
+  "finished_at_utc": "2026-07-22T10:25:15Z",
   "reference_register_checked": true,
   "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
   "error_register_checked": true,
   "error_register_sha256": "08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752",
-  "command_sha256": "dd571dac6e2711ea37782eba289ffb62964cf0fc3a6b1c29fd3ff2272fd1b2fd",
+  "command_sha256": "1299fe30eb30386fec901e120ab525ece490edc5eca767d9216466ecd225bef5",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -22,9 +22,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "98173b4c0da3c806c1bdf647bd3d7127770285a961cbc99d27b738453ac6a541",
+  "raw_evidence_sha256": "ced96ca03c186b7a4b64cc4939add95121ad329963b7fddde6c5fcde8c47940f",
-  "sanitized_output_sha256": "98173b4c0da3c806c1bdf647bd3d7127770285a961cbc99d27b738453ac6a541",
+  "sanitized_output_sha256": "ced96ca03c186b7a4b64cc4939add95121ad329963b7fddde6c5fcde8c47940f",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "PREVIOUS_RESULT=VERIFIED\n=== FAILED_COMMAND_LEDGER ===\n2026-07-22T10:01:26Z\tCLUSTER-REFERENCE-READINESS-168\t13b79b59906aa1b60b84c878297d9dc0954bd8a683875d4014c9920d1a2df96d\t1\tFAIL\treference-update\n2026-07-22T10:06:43Z\tCLUSTER-REFERENCE-CLOSURE-169\tf7ea5778959962b03870244fa47207e50c6aafca4172050ede9ab195e8daa48b\t92\tFAIL\treference-update\n=== REQUIRED_PATHS ===\nPATH=/usr/local/sbin/homelab-reference TYPE=regular file MODE=750 OWNER=root:root SIZE=9260 MTIME=2026-07-22 12:13:22.186811308 +0300\nPATH=/usr/local/sbin/homelab-reference-refresh TYPE=regular file MODE=750 OWNER=root:root SIZE=10307 MTIME=2026-07-22 12:27:00.205969638 +0300\nMISSING=/usr/local/sbin/homelab-reference-publish\nPATH=/etc/homelab/reference/manifest.json TYPE=regular file MODE=640 OWNER=root:root SIZE=1780 MTIME=2026-07-22 11:12:10.951464358 +0300\nPATH=/etc/homelab/reference/state/current.json TYPE=regular file MODE=640 OWNER=root:root SIZE=2121 MTIME=2026-07-22 13:01:18.013759374 +0300\nPATH=/etc/systemd/system/homelab-reference-refresh.service TYPE=regular file MODE=644 OWNER=root:root SIZE=436 MTIME=2026-07-22 12:27:00.208599374 +0300\nPATH=/etc/systemd/system/homelab-reference-refresh.timer TYPE=regular file MODE=644 OWNER=root:root SIZE=214 MTIME=2026-07-22 12:27:00.208624687 +0300\n=== RECOVERY_CANDIDATES ===\n=== SOURCE_REFERENCES ===\n/etc/homelab/reference/docs/OPERATIONS.md\n=== PRIOR_PUBLICATION_EVIDENCE ===\n=== CURRENT_REFERENCE_STATE ===\nvalidation=PASS\nREFERENCE_STATUS=AUTO_REFRESH_READY\nNEXT_ACTION=None\nUPDATED_AT=2026-07-22T10:01:14+00:00\nResult=success\nExecMainStatus=0\nId=homelab-reference-refresh.service\nLoadState=loaded\nActiveState=inactive\nSubState=dead\nUnitFileState=static\n\nResult=success\nId=homelab-reference-refresh.timer\nLoadState=loaded\nActiveState=active\nSubState=waiting\nUnitFileState=enabled\nREFERENCE_CHECK=OK\nERROR_REGISTER_CHECK=OK\nSECRET_PRINTED=NO\nPUBLISHER_RECOVERY_AUDIT=COMPLETE\n"
+  "output": "PREVIOUS_RESULT=VERIFIED\n=== OPERATIONS_PUBLISH_CONTEXT ===\n1-# Operations\n2-\n3-List: homelab-reference list\n4-Read: homelab-reference get SECTION ID --layer effective\n5-Add: homelab-reference add SECTION JSON\n6-Edit: homelab-reference edit SECTION ID --set key=value\n7-Remove: homelab-reference remove SECTION ID\n8-Validate: homelab-reference validate\n9-Merge: homelab-reference merge\n10-Refresh: homelab-reference-refresh\n11:Publish: homelab-reference-publish\n12-\n13-Immutable runtime history for the exact COMMAND_ID is authoritative. latest.json is not authoritative.\n=== ACTIVE_CODE_REFERENCES ===\n=== REFRESH_RELEVANT_LINES ===\n5:S=json.loads((R/\"manifest.json\").read_text())[\"sections\"]\n34: f=int(json.loads((R/\"manifest.json\").read_text()).get(\"freshness_seconds\",{}).get(s,3600));z=(t+datetime.timedelta(seconds=f)).isoformat()\n131: st=load(\"state\",\"current\") if False else json.loads((R/\"state/current.json\").read_text());st.update({\"schema_version\":2,\"status\":\"AUTO_REFRESH_READY\",\"updated_at\":t.isoformat(),\"last_snapshot\":str(snap),\"observed_counts\":cnt,\"effective_counts\":eff,\"public_index\":str(R/\"public/index.json\"),\"collector\":str(pathlib.Path(__file__))});atom(R/\"state/current.json\",st)\n=== CLI_RELEVANT_LINES ===\n43:    manifest = json.loads((ROOT / \"manifest.json\").read_text(encoding=\"utf-8\"))\n44:    return manifest.get(\"sections\", [])\n65:def validate_section(layer, section):\n105:def cmd_status(args):\n106:    state_path = ROOT / \"state\" / \"current.json\"\n108:    print(\"status=\" + str(state.get(\"status\", \"UNKNOWN\")))\n120:        print(str(record.get(\"id\")) + \"\\t\" + str(record.get(\"name\", \"\")) + \"\\t\" + str(record.get(\"status\", \"\")))\n176:def cmd_validate(args):\n182:            errors.extend(validate_section(layer, section))\n205:p = sub.add_parser(\"status\"); p.set_defaults(func=cmd_status)\n211:p = sub.add_parser(\"validate\"); p.add_argument(\"section\", nargs=\"?\"); p.add_argument(\"--layer\", choices=LAYERS); p.set_defaults(func=cmd_validate)\n=== UNIT_FILES ===\n# /etc/systemd/system/homelab-reference-refresh.service\n[Unit]\nDescription=Refresh homelab cluster reference\nAfter=network-online.target pve-cluster.service\nWants=network-online.target\n\n[Service]\nType=oneshot\nExecStart=/usr/local/sbin/homelab-reference-refresh\nUser=root\nGroup=root\nNice=10\nIOSchedulingClass=best-effort\nIOSchedulingPriority=7\nNoNewPrivileges=true\nPrivateTmp=true\nProtectSystem=strict\nReadWritePaths=/etc/homelab/reference /var/backups/homelab-reference\nProtectHome=read-only\n\n# /etc/systemd/system/homelab-reference-refresh.timer\n[Unit]\nDescription=Periodic homelab reference refresh\n\n[Timer]\nOnBootSec=10min\nOnUnitActiveSec=30min\nRandomizedDelaySec=5min\nPersistent=true\nUnit=homelab-reference-refresh.service\n\n[Install]\nWantedBy=timers.target\n=== MANIFEST_CONTRACT ===\n2:  \"schema_version\": 2,\n4:  \"updated_at\": \"2026-07-22T08:12:10+00:00\",\n=== STATE_CONTRACT ===\n2:  \"schema_version\": 2,\n3:  \"status\": \"AUTO_REFRESH_READY\",\n4:  \"updated_at\": \"2026-07-22T10:01:14+00:00\",\nREFERENCE_CHECK=OK\nERROR_REGISTER_CHECK=OK\nSECRET_PRINTED=NO\nPUBLISHER_CONTRACT_AUDIT=COMPLETE\n"
 }

runtime/latest.txt

@@ -1,5 +1,5 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=CLUSTER-REFERENCE-PUBLISHER-RECOVERY-AUDIT-170
+COMMAND_ID=CLUSTER-REFERENCE-PUBLISHER-CONTRACT-AUDIT-171
 STATUS=OK
 RC=0
 HOST=pve01
@@ -9,55 +9,93 @@ REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752
-COMMAND_SHA256=dd571dac6e2711ea37782eba289ffb62964cf0fc3a6b1c29fd3ff2272fd1b2fd
+COMMAND_SHA256=1299fe30eb30386fec901e120ab525ece490edc5eca767d9216466ecd225bef5
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGES_MADE=false
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=98173b4c0da3c806c1bdf647bd3d7127770285a961cbc99d27b738453ac6a541
+RAW_EVIDENCE_SHA256=ced96ca03c186b7a4b64cc4939add95121ad329963b7fddde6c5fcde8c47940f
-SANITIZED_OUTPUT_SHA256=98173b4c0da3c806c1bdf647bd3d7127770285a961cbc99d27b738453ac6a541
+SANITIZED_OUTPUT_SHA256=ced96ca03c186b7a4b64cc4939add95121ad329963b7fddde6c5fcde8c47940f
 OUTPUT_BEGIN
 PREVIOUS_RESULT=VERIFIED
-=== FAILED_COMMAND_LEDGER ===
+=== OPERATIONS_PUBLISH_CONTEXT ===
-2026-07-22T10:01:26Z	CLUSTER-REFERENCE-READINESS-168	13b79b59906aa1b60b84c878297d9dc0954bd8a683875d4014c9920d1a2df96d	1	FAIL	reference-update
+1-# Operations
-2026-07-22T10:06:43Z	CLUSTER-REFERENCE-CLOSURE-169	f7ea5778959962b03870244fa47207e50c6aafca4172050ede9ab195e8daa48b	92	FAIL	reference-update
+2-
-=== REQUIRED_PATHS ===
+3-List: homelab-reference list
-PATH=/usr/local/sbin/homelab-reference TYPE=regular file MODE=750 OWNER=root:root SIZE=9260 MTIME=2026-07-22 12:13:22.186811308 +0300
+4-Read: homelab-reference get SECTION ID --layer effective
-PATH=/usr/local/sbin/homelab-reference-refresh TYPE=regular file MODE=750 OWNER=root:root SIZE=10307 MTIME=2026-07-22 12:27:00.205969638 +0300
+5-Add: homelab-reference add SECTION JSON
-MISSING=/usr/local/sbin/homelab-reference-publish
+6-Edit: homelab-reference edit SECTION ID --set key=value
-PATH=/etc/homelab/reference/manifest.json TYPE=regular file MODE=640 OWNER=root:root SIZE=1780 MTIME=2026-07-22 11:12:10.951464358 +0300
+7-Remove: homelab-reference remove SECTION ID
-PATH=/etc/homelab/reference/state/current.json TYPE=regular file MODE=640 OWNER=root:root SIZE=2121 MTIME=2026-07-22 13:01:18.013759374 +0300
+8-Validate: homelab-reference validate
-PATH=/etc/systemd/system/homelab-reference-refresh.service TYPE=regular file MODE=644 OWNER=root:root SIZE=436 MTIME=2026-07-22 12:27:00.208599374 +0300
+9-Merge: homelab-reference merge
-PATH=/etc/systemd/system/homelab-reference-refresh.timer TYPE=regular file MODE=644 OWNER=root:root SIZE=214 MTIME=2026-07-22 12:27:00.208624687 +0300
+10-Refresh: homelab-reference-refresh
-=== RECOVERY_CANDIDATES ===
+11:Publish: homelab-reference-publish
-=== SOURCE_REFERENCES ===
+12-
-/etc/homelab/reference/docs/OPERATIONS.md
+13-Immutable runtime history for the exact COMMAND_ID is authoritative. latest.json is not authoritative.
-=== PRIOR_PUBLICATION_EVIDENCE ===
+=== ACTIVE_CODE_REFERENCES ===
-=== CURRENT_REFERENCE_STATE ===
+=== REFRESH_RELEVANT_LINES ===
-validation=PASS
+5:S=json.loads((R/"manifest.json").read_text())["sections"]
-REFERENCE_STATUS=AUTO_REFRESH_READY
+34: f=int(json.loads((R/"manifest.json").read_text()).get("freshness_seconds",{}).get(s,3600));z=(t+datetime.timedelta(seconds=f)).isoformat()
-NEXT_ACTION=None
+131: st=load("state","current") if False else json.loads((R/"state/current.json").read_text());st.update({"schema_version":2,"status":"AUTO_REFRESH_READY","updated_at":t.isoformat(),"last_snapshot":str(snap),"observed_counts":cnt,"effective_counts":eff,"public_index":str(R/"public/index.json"),"collector":str(pathlib.Path(__file__))});atom(R/"state/current.json",st)
-UPDATED_AT=2026-07-22T10:01:14+00:00
+=== CLI_RELEVANT_LINES ===
-Result=success
+43:    manifest = json.loads((ROOT / "manifest.json").read_text(encoding="utf-8"))
-ExecMainStatus=0
+44:    return manifest.get("sections", [])
-Id=homelab-reference-refresh.service
+65:def validate_section(layer, section):
-LoadState=loaded
+105:def cmd_status(args):
-ActiveState=inactive
+106:    state_path = ROOT / "state" / "current.json"
-SubState=dead
+108:    print("status=" + str(state.get("status", "UNKNOWN")))
-UnitFileState=static
+120:        print(str(record.get("id")) + "\t" + str(record.get("name", "")) + "\t" + str(record.get("status", "")))
+176:def cmd_validate(args):
+182:            errors.extend(validate_section(layer, section))
+205:p = sub.add_parser("status"); p.set_defaults(func=cmd_status)
+211:p = sub.add_parser("validate"); p.add_argument("section", nargs="?"); p.add_argument("--layer", choices=LAYERS); p.set_defaults(func=cmd_validate)
+=== UNIT_FILES ===
+# /etc/systemd/system/homelab-reference-refresh.service
+[Unit]
+Description=Refresh homelab cluster reference
+After=network-online.target pve-cluster.service
+Wants=network-online.target
 
-Result=success
+[Service]
-Id=homelab-reference-refresh.timer
+Type=oneshot
-LoadState=loaded
+ExecStart=/usr/local/sbin/homelab-reference-refresh
-ActiveState=active
+User=root
-SubState=waiting
+Group=root
-UnitFileState=enabled
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/etc/homelab/reference /var/backups/homelab-reference
+ProtectHome=read-only
+
+# /etc/systemd/system/homelab-reference-refresh.timer
+[Unit]
+Description=Periodic homelab reference refresh
+
+[Timer]
+OnBootSec=10min
+OnUnitActiveSec=30min
+RandomizedDelaySec=5min
+Persistent=true
+Unit=homelab-reference-refresh.service
+
+[Install]
+WantedBy=timers.target
+=== MANIFEST_CONTRACT ===
+2:  "schema_version": 2,
+4:  "updated_at": "2026-07-22T08:12:10+00:00",
+=== STATE_CONTRACT ===
+2:  "schema_version": 2,
+3:  "status": "AUTO_REFRESH_READY",
+4:  "updated_at": "2026-07-22T10:01:14+00:00",
 REFERENCE_CHECK=OK
 ERROR_REGISTER_CHECK=OK
 SECRET_PRINTED=NO
-PUBLISHER_RECOVERY_AUDIT=COMPLETE
+PUBLISHER_CONTRACT_AUDIT=COMPLETE
 
 OUTPUT_END
 CHAT_OUTPUT_END