From f7840d91d84af3aa67016fac03c26e9a27bf80c7 Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Thu, 30 Jul 2026 16:07:11 +0000 Subject: [PATCH] runtime: publish GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z --- ...SEDED-LOCK-IMPLEMENT-20260730T160621Z.json | 38 +++++++++++++++++++ ...RSEDED-LOCK-IMPLEMENT-20260730T160621Z.txt | 34 +++++++++++++++++ runtime/latest.json | 26 ++++++------- runtime/latest.txt | 23 +++++------ 4 files changed, 97 insertions(+), 24 deletions(-) create mode 100644 runtime/history/GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z.json create mode 100644 runtime/history/GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z.txt diff --git a/runtime/history/GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z.json b/runtime/history/GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z.json new file mode 100644 index 0000000..f2d0b4d --- /dev/null +++ b/runtime/history/GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z", + "status": "FAIL", + "rc": 1, + "host": "pve01", + "mode": "change", + "component": "gitea-machine-identity", + "started_at_utc": "2026-07-30T16:07:10Z", + "finished_at_utc": "2026-07-30T16:07:10Z", + "reference_register_checked": true, + "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", + "error_register_checked": true, + "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", + "command_sha256": "cf2b14c0155fe3ac3e34ed6950c0df4ac06859826b4b5e26cf14f57784f1527c", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": true, + "result_contract_valid": true, + "result_contract_status": "FAIL", + "result_contract_error": null, + "command_rc": 1, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "0d5dcb323f85974a9010cdd3edf9428f1d4536c6c8aedc55efadc15802160d0a", + "sanitized_output_sha256": "0d5dcb323f85974a9010cdd3edf9428f1d4536c6c8aedc55efadc15802160d0a", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z\",\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"FAIL\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z\",\"error\":\"RuntimeError: V3 package hash mismatch: phases/rollback.sh\",\"mutation_outcome\":\"NO_MUTATION\",\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"status\":\"FAIL\"}\n" +} diff --git a/runtime/history/GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z.txt b/runtime/history/GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z.txt new file mode 100644 index 0000000..8c48b58 --- /dev/null +++ b/runtime/history/GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z.txt @@ -0,0 +1,34 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z +STATUS=FAIL +RC=1 +HOST=pve01 +MODE=change +COMPONENT=gitea-machine-identity +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 +COMMAND_SHA256=cf2b14c0155fe3ac3e34ed6950c0df4ac06859826b4b5e26cf14f57784f1527c +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=true +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=FAIL +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=1 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=0d5dcb323f85974a9010cdd3edf9428f1d4536c6c8aedc55efadc15802160d0a +SANITIZED_OUTPUT_SHA256=0d5dcb323f85974a9010cdd3edf9428f1d4536c6c8aedc55efadc15802160d0a +OUTPUT_BEGIN +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z","rollback_restored":null,"rollback_started":false,"status":"FAIL","version":1} +{"changes_made":false,"command_id":"GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z","error":"RuntimeError: V3 package hash mismatch: phases/rollback.sh","mutation_outcome":"NO_MUTATION","rollback_restored":null,"rollback_started":false,"schema":1,"status":"FAIL"} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index 618f343..f2d0b4d 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,27 +1,27 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "GITEA-V4-ERROR-LOCK-CURRENT-STATE-PROBE-20260730T155250Z", - "status": "OK", - "rc": 0, + "command_id": "GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z", + "status": "FAIL", + "rc": 1, "host": "pve01", - "mode": "verify", + "mode": "change", "component": "gitea-machine-identity", - "started_at_utc": "2026-07-30T15:53:59Z", - "finished_at_utc": "2026-07-30T15:53:59Z", + "started_at_utc": "2026-07-30T16:07:10Z", + "finished_at_utc": "2026-07-30T16:07:10Z", "reference_register_checked": true, "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", "error_register_checked": true, "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", - "command_sha256": "747995da40a448bf2f73ab84a257caa7243f748e67e9e341a449a03a721f812c", + "command_sha256": "cf2b14c0155fe3ac3e34ed6950c0df4ac06859826b4b5e26cf14f57784f1527c", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, - "change_declared": false, + "change_declared": true, "result_contract_valid": true, - "result_contract_status": null, + "result_contract_status": "FAIL", "result_contract_error": null, - "command_rc": 0, + "command_rc": 1, "changes_made": false, "rollback_started": false, "rollback_restored": null, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "293b6fb05e2519d10de090a50dbf4aaeb8e5b465b85c3faaa41cf53e103fb2ee", - "sanitized_output_sha256": "2d52ac59f65da7c39c3a21e00e2c4ce14b0d3157da709143aa0062b74fdb0ef7", + "raw_evidence_sha256": "0d5dcb323f85974a9010cdd3edf9428f1d4536c6c8aedc55efadc15802160d0a", + "sanitized_output_sha256": "0d5dcb323f85974a9010cdd3edf9428f1d4536c6c8aedc55efadc15802160d0a", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "{\"changes_made\":false,\"command_id\":\"GITEA-V4-ERROR-LOCK-CURRENT-STATE-PROBE-20260730T155250Z\",\"command_rc\":0,\"evidence\":{\"admin_checks\":{\"v3_validate\":{\"argv\":[\"/opt/homelab-admin/bin/homelab-admin\",\"validate\",\"/root/gitea-machine-identity-controlled-migration-v3\"],\"cwd\":null,\"name\":\"v3_validate\",\"rc\":0,\"stderr\":\"\",\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout\":\"LINT_STATUS=OK\\nTASK_ID=gitea-machine-identity-controlled-migration-v3\\nPOLICY_ID=homelab-admin-guardrails-v1.2\\nRULES_CHECKED=14\\nSOURCE_FILES_CHECKED=11\\nTASK_VALID=YES\\nTASK_ID=gitea-machine-identity-controlled-migration-v3\\nTASK_SCOPE=controlled_apply\\nPRODUCTION_CHANGE=YES\\n\",\"stdout_sha256\":\"b07c614303811067f0dc0ccb7d15a3924c7473373c652717d546e0c3866d884d\",\"stdout_truncated\":false},\"v4_validate\":{\"skipped\":\"admin_or_v4_missing\"},\"version\":{\"argv\":[\"/opt/homelab-admin/bin/homelab-admin\",\"version\"],\"cwd\":null,\"name\":\"homelab_admin_version\",\"rc\":0,\"stderr\":\"\",\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout\":\"HOMELAB_ADMIN_VERSION=0.3.1-controlled-apply\\n\",\"stdout_sha256\":\"537d898cc84f4983bfdaa318beb771abd108ed71d51f62455794c73a37830c96\",\"stdout_truncated\":false}},\"candidate_files\":{\"/root/gitea-machine-identity-controlled-migration-v3/task.json\":{\"exists\":true,\"is_dir\":false,\"is_file\":true,\"mode\":\"0o644\",\"path\":\"/root/gitea-machine-identity-controlled-migration-v3/task.json\",\"sha256\":\"ca71849e686ea8195610d6dcd23841399952cd7fed0574aa0284a7a9bc0ae267\",\"size\":6774,\"text\":\"{\\n \\\"schema_version\\\": 2,\\n \\\"task_id\\\": \\\"gitea-machine-identity-controlled-migration-v3\\\",\\n \\\"target_host\\\": \\\"pve01.gram1.ru\\\",\\n \\\"mutation_scope\\\": \\\"controlled_apply\\\",\\n \\\"production_change\\\": true,\\n \\\"failure_mode\\\": \\\"fail_fast\\\",\\n \\\"reads\\\": [\\n \\\"/srv/homelab-ops\\\",\\n \\\"/srv/homelab-desired-state\\\",\\n \\\"/root/.gitconfig\\\",\\n \\\"/root/.git-credentials\\\",\\n \\\"[SENSITIVE_PATH] \\\"[SENSITIVE_PATH] \\\"https://git.gram1.ru/api/v1/version\\\",\\n \\\"https://git.gram1.ru/api/v1/user\\\",\\n \\\"https://git.gram1.ru/api/v1/repos/homelab-admin/homelab-ops/collaborators\\\",\\n \\\"ssh:root@[PRIVATE_IP]:docker-gitea-state\\\",\\n \\\"git:https://git.gram1.ru/homelab-admin/homelab-ops.git:main\\\"\\n ],\\n \\\"writes\\\": [\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3\\\",\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/.task-id\\\",\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/known_hosts.vm170\\\",\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/plan.json\\\",\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/root.gitconfig.before\\\",\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/root.git-credentials.before\\\",\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/remote-apply.out\\\",\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/remote-recovery.out\\\",\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/probe-repo\\\",\\n \\\"/etc/homelab-admin/credentials/gitea-homelab-ops\\\",\\n \\\"/usr/local/libexec/homelab-git-credential\\\",\\n \\\"/root/.gitconfig\\\",\\n \\\"/root/.git-credentials\\\",\\n \\\"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/tasks/gitea-machine-identity-controlled-migration-v3\\\",\\n \\\"ssh:root@[PRIVATE_IP]:gitea-user:homelab-ops-bot\\\",\\n \\\"ssh:root@[PRIVATE_IP]:gitea-collaborator:homelab-admin/homelab-ops/homelab-ops-bot\\\",\\n \\\"$HOMELAB_RUN_DIR/preflight.json\\\",\\n \\\"$HOMELAB_RUN_DIR/prepare.json\\\",\\n \\\"$HOMELAB_RUN_DIR/dry-run.json\\\",\\n \\\"$HOMELAB_RUN_DIR/apply.json\\\",\\n \\\"$HOMELAB_RUN_DIR/verify.json\\\",\\n \\\"$HOMELAB_RUN_DIR/rollback.json\\\",\\n \\\"$HOMELAB_RUN_DIR/seal.json\\\",\\n \\\"$HOMELAB_RUN_DIR/legacy-identity-preflight.txt\\\",\\n \\\"$HOMELAB_RUN_DIR/legacy-identity-apply.txt\\\",\\n \\\"$HOMELAB_RUN_DIR/vm170-capability.txt\\\",\\n \\\"$HOMELAB_RUN_DIR/vm170-verify-state.txt\\\",\\n \\\"$HOMELAB_RUN_DIR/vm170-rollback.txt\\\",\\n \\\"$HOMELAB_RUN_DIR/vm170-seal.txt\\\",\\n \\\"$HOMELAB_RUN_DIR/machine-identity-verify.txt\\\"\\n ],\\n \\\"mutates\\\": [\\n \\\"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3\\\",\\n \\\"/etc/homelab-admin/credentials/gitea-homelab-ops\\\",\\n \\\"/usr/local/libexec/homelab-git-credential\\\",\\n \\\"/root/.gitconfig\\\",\\n \\\"/root/.git-credentials\\\",\\n \\\"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/tasks/gitea-machine-identity-controlled-migration-v3\\\",\\n \\\"ssh:root@[PRIVATE_IP]:gitea-user:homelab-ops-bot\\\",\\n \\\"ssh:root@[PRIVATE_IP]:gitea-collaborator:homelab-admin/homelab-ops/homelab-ops-bot\\\"\\n ],\\n \\\"expected_outputs\\\": [\\n {\\n \\\"path\\\": \\\"$HOMELAB_RUN_DIR/preflight.json\\\",\\n \\\"producer\\\": \\\"phases/preflight.sh\\\",\\n \\\"verification\\\": \\\"legacy identity is repo admin and target bot is absent without Gitea CLI\\\"\\n },\\n {\\n \\\"path\\\": \\\"$HOMELAB_RUN_DIR/prepare.json\\\",\\n \\\"producer\\\": \\\"phases/prepare.sh\\\",\\n \\\"verification\\\": \\\"exact local rollback copies and pinned VM170 host key are staged\\\"\\n },\\n {\\n \\\"path\\\": \\\"$HOMELAB_RUN_DIR/dry-run.json\\\",\\n \\\"producer\\\": \\\"phases/dry-run.sh\\\",\\n \\\"verification\\\": \\\"single bounded CLI help invocation proves exact bot and token flags\\\"\\n },\\n {\\n \\\"path\\\": \\\"$HOMELAB_RUN_DIR/apply.json\\\",\\n \\\"producer\\\": \\\"phases/apply.sh\\\",\\n \\\"verification\\\": \\\"bot plus scoped material, collaborator access and repository helper are installed\\\"\\n },\\n {\\n \\\"path\\\": \\\"$HOMELAB_RUN_DIR/verify.json\\\",\\n \\\"producer\\\": \\\"phases/verify.sh\\\",\\n \\\"verification\\\": \\\"repo access, scope isolation, non-admin state and push dry-run are exact\\\"\\n },\\n {\\n \\\"path\\\": \\\"$HOMELAB_RUN_DIR/rollback.json\\\",\\n \\\"producer\\\": \\\"phases/rollback.sh\\\",\\n \\\"verification\\\": \\\"legacy local state restored and task-created bot removed\\\"\\n },\\n {\\n \\\"path\\\": \\\"$HOMELAB_RUN_DIR/seal.json\\\",\\n \\\"producer\\\": \\\"phases/seal.sh\\\",\\n \\\"verification\\\": \\\"remote rollback state and local staging removed\\\"\\n }\\n ],\\n \\\"runtime_matrix\\\": [\\n {\\n \\\"host\\\": \\\"pve01.gram1.ru\\\",\\n \\\"runtime\\\": \\\"python3\\\",\\n \\\"compile\\\": \\\"python3 -m py_compile\\\"\\n }\\n ],\\n \\\"rollback\\\": {\\n \\\"command\\\": \\\"HOMELAB_CONTROLLED_APPLY_CONFIRM=gitea-machine-identity-controlled-migration-v3 homelab-admin run TASK_DIR rollback\\\",\\n \\\"verification\\\": \\\"exact legacy Git files restored; homelab-ops-bot absent; protected push URL DISABLED\\\"\\n },\\n \\\"no_change_assertions\\\": [\\n \\\"srv_homelab_ops_content\\\",\\n \\\"srv_homelab_ops_push_url\\\",\\n \\\"srv_homelab_desired_state\\\",\\n \\\"gitea_repository_content\\\",\\n \\\"gitea_repository_owner\\\",\\n \\\"gitea_runner_registration\\\",\\n \\\"gitea_runner_configuration\\\",\\n \\\"gitea_existing_users\\\",\\n \\\"vm170_packages\\\",\\n \\\"vm170_containers\\\",\\n \\\"dns\\\",\\n \\\"netbox\\\",\\n \\\"backup_jobs\\\",\\n \\\"preflight_has_zero_gitea_cli_calls\\\",\\n \\\"dry_run_has_zero_account_mutations\\\",\\n \\\"no_bootstrap_administrator\\\"\\n ],\\n \\\"source_of_truth\\\": {\\n \\\"repository\\\": \\\"homelab-admin/homelab-ops\\\",\\n \\\"machine_user\\\": \\\"homelab-ops-bot\\\",\\n \\\"machine_user_type\\\": \\\"bot\\\",\\n \\\"machine_user_admin\\\": false,\\n \\\"repository_permission\\\": \\\"write\\\",\\n \\\"material_scope\\\": \\\"write:repository\\\",\\n \\\"credential_file\\\": \\\"/etc/homelab-admin/credentials/gitea-homelab-ops\\\",\\n \\\"credential_helper\\\": \\\"/usr/local/libexec/homelab-git-credential\\\",\\n \\\"protected_worktree_push_url\\\": \\\"DISABLED\\\",\\n \\\"legacy_material_revocation\\\": \\\"out_of_scope_unknown_token_id\\\",\\n \\\"failed_unit_policy\\\": \\\"At most three exact known unrelated failed units.\\\",\\n \\\"preflight_gitea_cli_calls\\\": 0,\\n \\\"apply_gitea_create_calls\\\": 1,\\n \\\"bootstrap_administrator_created\\\": false,\\n \\\"machine_scope_negative_probe\\\": \\\"/api/v1/user must return 403\\\",\\n \\\"next_stage\\\": \\\"VM190_BACKUP_AND_RESTORE_TEST\\\"\\n },\\n \\\"python_files\\\": [\\n \\\"tools/test_task.py\\\",\\n \\\"tools/legacy_identity_api.py\\\",\\n \\\"tools/verify_machine_credential.py\\\"\\n ],\\n \\\"remote_scripts\\\": [\\n \\\"assets/vm170-machine-identity.sh\\\"\\n ],\\n \\\"phases\\\": {\\n \\\"preflight\\\": \\\"phases/preflight.sh\\\",\\n \\\"prepare\\\": \\\"phases/prepare.sh\\\",\\n \\\"dry-run\\\": \\\"phases/dry-run.sh\\\",\\n \\\"apply\\\": \\\"phases/apply.sh\\\",\\n \\\"verify\\\": \\\"phases/verify.sh\\\",\\n \\\"rollback\\\": \\\"phases/rollback.sh\\\",\\n \\\"seal\\\": \\\"phases/seal.sh\\\"\\n },\\n \\\"guards\\\": {\\n \\\"desired_state_clean\\\": true,\\n \\\"failed_units_max\\\": 3,\\n \\\"active_backup_restore_max\\\": 0\\n }\\n}\\n\"},\"/root/gitea-machine-identity-controlled-migration-v4/task.json\":{\"exists\":false,\"path\":\"/root/gitea-machine-identity-controlled-migration-v4/task.json\"},\"/root/homelab-ops-cr-2026-0005/config/superseded-tasks.json\":{\"exists\":false,\"path\":\"/root/homelab-ops-cr-2026-0005/config/superseded-tasks.json\"},\"/root/homelab-ops-cr-2026-0005/errors/regression-cases.json\":{\"exists\":true,\"is_dir\":false,\"is_file\":true,\"mode\":\"0o644\",\"path\":\"/root/homelab-ops-cr-2026-0005/errors/regression-cases.json\",\"sha256\":\"3ccb66b1a6c58002120b0d6c863aa6cbc21b16446a37b4f944bce6809f9451ea\",\"size\":4192,\"text\":\"{\\n \\\"schema_version\\\": 1,\\n \\\"cases\\\": [\\n {\\n \\\"id\\\": \\\"REG-001-RUNTIME-TYPE-DISPATCH\\\",\\n \\\"incident\\\": \\\"Python linter was checked with bash -n.\\\",\\n \\\"required_control\\\": \\\"Select validator from file type and shebang.\\\",\\n \\\"test\\\": \\\"tests.test_repository.RepositoryTests.test_runtime_dispatch_policy\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-002-VM-OWNER-DISCOVERY\\\",\\n \\\"incident\\\": \\\"Local qm was used on a node that did not own VM180.\\\",\\n \\\"required_control\\\": \\\"Resolve owner through cluster resources before node-local commands.\\\",\\n \\\"test\\\": \\\"tests.test_repository.RepositoryTests.test_vm180_owner\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-003-STRUCTURED-OPTION-TYPE\\\",\\n \\\"incident\\\": \\\"A structured XenForo option was treated as a string.\\\",\\n \\\"required_control\\\": \\\"Inspect runtime/entity type before transformation.\\\",\\n \\\"test\\\": \\\"tests.test_repository.RepositoryTests.test_xenforo_type_rule\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-004-GENERATED-REPO-MUTATION\\\",\\n \\\"incident\\\": \\\"A generated snapshot was considered as a development repository.\\\",\\n \\\"required_control\\\": \\\"Never edit /srv/homelab-desired-state.\\\",\\n \\\"test\\\": \\\"tests.test_repository.RepositoryTests.test_generated_repo_rule\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-005-MANUAL-SHA-CASCADE\\\",\\n \\\"incident\\\": \\\"Embedded hashes diverged across nested scripts.\\\",\\n \\\"required_control\\\": \\\"Generate one manifest and verify artifacts automatically.\\\",\\n \\\"test\\\": \\\"tests.test_repository.RepositoryTests.test_manifest_present\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-006-BARE-REPO-HEAD\\\",\\n \\\"incident\\\": \\\"The dry-run pushed main to a bare repository whose HEAD still referenced master, so clone checked out no files.\\\",\\n \\\"required_control\\\": \\\"Set the bare repository symbolic HEAD to refs/heads/main and clone main explicitly.\\\",\\n \\\"test\\\": \\\"package tools/validate_bootstrap.py and tests.test_repository.RepositoryTests.test_bare_repo_head_regression\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-007-SYSTEMCTL-FIRST-FIELD\\\",\\n \\\"incident\\\": \\\"Formatted systemctl --failed output was passed as a whole unit name.\\\",\\n \\\"required_control\\\": \\\"Parse and sort only the first field containing the exact systemd unit name.\\\",\\n \\\"test\\\": \\\"tests.test_cr_2026_0005.CR20260005Tests.test_systemctl_failed_first_field\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-008-PRINTF-DASH-FORMAT\\\",\\n \\\"incident\\\": \\\"printf interpreted a marker beginning with hyphens as an option.\\\",\\n \\\"required_control\\\": \\\"Use an explicit safe format string for all marker output.\\\",\\n \\\"test\\\": \\\"tests.test_cr_2026_0005.CR20260005Tests.test_phase_guardrails\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-009-PMXCFS-DIRECT-CONTENT-WRITE\\\",\\n \\\"incident\\\": \\\"install -m attempted chmod semantics unsupported by pmxcfs.\\\",\\n \\\"required_control\\\": \\\"Write pmxcfs file content directly and verify bytes and metadata separately.\\\",\\n \\\"test\\\": \\\"tests.test_cr_2026_0005.CR20260005Tests.test_policy_markers\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-010-REMOTE-SHELL-QUOTING\\\",\\n \\\"incident\\\": \\\"An unquoted remote stat format was interpreted by the remote shell.\\\",\\n \\\"required_control\\\": \\\"Use versioned remote scripts or fully structured argument passing.\\\",\\n \\\"test\\\": \\\"tests.test_cr_2026_0005.CR20260005Tests.test_policy_markers\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-011-STANDARD-SEAL-DISCOVERY\\\",\\n \\\"incident\\\": \\\"A task completion was assumed without a standard seal path.\\\",\\n \\\"required_control\\\": \\\"Write and verify the canonical task seal explicitly.\\\",\\n \\\"test\\\": \\\"tests.test_cr_2026_0005.CR20260005Tests.test_standard_seal\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-012-DEV-NULL-TEMP-SENTINEL\\\",\\n \\\"incident\\\": \\\"A cleanup variable was incorrectly bound to /dev/null.\\\",\\n \\\"required_control\\\": \\\"Never use /dev/null as a temporary path or cleanup target.\\\",\\n \\\"test\\\": \\\"tests.test_cr_2026_0005.CR20260005Tests.test_phase_guardrails\\\"\\n },\\n {\\n \\\"id\\\": \\\"REG-013-TASK-SEMANTIC-COHERENCE\\\",\\n \\\"incident\\\": \\\"A task named for /dev/null retained unrelated backup-tail reads, writes, mutations and assets.\\\",\\n \\\"required_control\\\": \\\"Validate semantic coherence between task identity, description, evidence and declared mutation scope.\\\",\\n \\\"test\\\": \\\"tests.test_cr_2026_0005.CR20260005Tests.test_task_semantic_coherence\\\"\\n }\\n ]\\n}\\n\"},\"/root/homelab-ops-cr-2026-0005/policies/superseded-tasks.json\":{\"exists\":false,\"path\":\"/root/homelab-ops-cr-2026-0005/policies/superseded-tasks.json\"},\"/root/homelab-ops-cr-2026-0005/tasks/gitea-machine-identity-controlled-migration-v3/task.json\":{\"exists\":false,\"path\":\"/root/homelab-ops-cr-2026-0005/tasks/gitea-machine-identity-controlled-migration-v3/task.json\"},\"/root/homelab-ops-cr-2026-0005/tasks/gitea-machine-identity-controlled-migration-v4/task.json\":{\"exists\":false,\"path\":\"/root/homelab-ops-cr-2026-0005/tasks/gitea-machine-identity-controlled-migration-v4/task.json\"}},\"git\":{\"branch\":{\"argv\":[\"git\",\"branch\",\"--show-current\"],\"cwd\":\"/root/homelab-ops-cr-2026-0005\",\"name\":\"git_branch\",\"rc\":0,\"stderr\":\"\",\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout\":\"cr-2026-0005-codex-bootstrap-activation\\n\",\"stdout_sha256\":\"23742b320dc35d798564315de82e7b0ebed62767738040a8528dedb0c23d9472\",\"stdout_truncated\":false},\"head\":{\"argv\":[\"git\",\"rev-parse\",\"HEAD\"],\"cwd\":\"/root/homelab-ops-cr-2026-0005\",\"name\":\"git_head\",\"rc\":0,\"stderr\":\"\",\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout\":\"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\\n\",\"stdout_sha256\":\"c25145162faff49f6f450dc74c60b9e8c93629a690d4b207c6ead3497fe3d19d\",\"stdout_truncated\":false},\"remote\":{\"argv\":[\"git\",\"remote\",\"-v\"],\"cwd\":\"/root/homelab-ops-cr-2026-0005\",\"name\":\"git_remote\",\"rc\":0,\"stderr\":\"\",\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout\":\"origin\\thttps://git.gram1.ru/homelab-admin/homelab-ops.git (fetch)\\norigin\\tDISABLED (push)\\n\",\"stdout_sha256\":\"f83d964adf056fd68c2adf394406f03044639b020f77d961083f50057417cd83\",\"stdout_truncated\":false},\"status\":{\"argv\":[\"git\",\"status\",\"--short\",\"--branch\"],\"cwd\":\"/root/homelab-ops-cr-2026-0005\",\"name\":\"git_status\",\"rc\":0,\"stderr\":\"\",\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout\":\"## cr-2026-0005-codex-bootstrap-activation\\n\",\"stdout_sha256\":\"e62eb84bc5a5eb185ee9a21167e95d73dee249f167f28f4d59671054a8afc0ed\",\"stdout_truncated\":false}},\"identity\":{\"command_id\":\"GITEA-V4-ERROR-LOCK-CURRENT-STATE-PROBE-20260730T155250Z\",\"euid\":0,\"hostname\":\"pve01\",\"read_only\":true,\"uid\":0},\"paths\":{\"admin\":{\"exists\":true,\"is_dir\":false,\"is_file\":true,\"mode\":\"0o750\",\"path\":\"/opt/homelab-admin/bin/homelab-admin\",\"sha256\":\"5398600c15b63f3872116e6d1ae6f65e2d7a5d1752349c9de0de07d801967bd1\",\"size\":9589},\"linter\":{\"exists\":true,\"is_dir\":false,\"is_file\":true,\"mode\":\"0o750\",\"path\":\"/opt/homelab-admin/libexec/homelab-admin-lint\",\"sha256\":\"deaa17bdfa41db95abed26a81d67e04c1ecaf68dc397f7eea6bd74c5228cdfef\",\"size\":21099},\"review_root\":{\"exists\":true,\"path\":\"/root/homelab-ops-cr-2026-0005\"},\"v3_root\":{\"exists\":true,\"path\":\"/root/gitea-machine-identity-controlled-migration-v3\"},\"v4_root\":{\"exists\":false,\"path\":\"/root/gitea-machine-identity-controlled-migration-v4\"}},\"repo_tests\":{\"argv\":[\"/usr/bin/python3\",\"-B\",\"-m\",\"unittest\",\"discover\",\"-s\",\"/root/homelab-ops-cr-2026-0005/tests\",\"-v\"],\"cwd\":\"/root/homelab-ops-cr-2026-0005\",\"name\":\"unittest_discover\",\"rc\":0,\"stderr\":\"test_apply_exact_scope (test_cr_2026_0005.CR20260005Tests.test_apply_exact_scope) ... ok\\ntest_declared_phase_outputs (test_cr_2026_0005.CR20260005Tests.test_declared_phase_outputs) ... ok\\ntest_journal_pipeline_safety (test_cr_2026_0005.CR20260005Tests.test_journal_pipeline_safety) ... ok\\ntest_no_pmxcfs_or_remote_mutation (test_cr_2026_0005.CR20260005Tests.test_no_pmxcfs_or_remote_mutation) ... ok\\ntest_phase_guardrails (test_cr_2026_0005.CR20260005Tests.test_phase_guardrails) ... ok\\ntest_policy_markers (test_cr_2026_0005.CR20260005Tests.test_policy_markers) ... ok\\ntest_regression_cases (test_cr_2026_0005.CR20260005Tests.test_regression_cases) ... ok\\ntest_standard_seal (test_cr_2026_0005.CR20260005Tests.test_standard_seal) ... ok\\ntest_systemctl_failed_first_field (test_cr_2026_0005.CR20260005Tests.test_systemctl_failed_first_field) ... ok\\ntest_task_semantic_coherence (test_cr_2026_0005.CR20260005Tests.test_task_semantic_coherence) ... ok\\ntest_access_paths_have_no_credentials (test_repository.RepositoryTests.test_access_paths_have_no_credentials) ... ok\\ntest_bare_repo_head_regression (test_repository.RepositoryTests.test_bare_repo_head_regression) ... ok\\ntest_generated_repo_rule (test_repository.RepositoryTests.test_generated_repo_rule) ... ok\\ntest_manifest_present (test_repository.RepositoryTests.test_manifest_present) ... ok\\ntest_runtime_dispatch_policy (test_repository.RepositoryTests.test_runtime_dispatch_policy) ... ok\\ntest_vm180_owner (test_repository.RepositoryTests.test_vm180_owner) ... ok\\ntest_xenforo_type_rule (test_repository.RepositoryTests.test_xenforo_type_rule) ... ok\\n\\n----------------------------------------------------------------------\\nRan 17 tests in 0.002s\\n\\nOK\\n\",\"stderr_sha256\":\"5a7bc836b25cc5b52cdd921735b6b9f05eb97603023a1df1926212265bcdb0a4\",\"stderr_truncated\":false,\"stdout\":\"\",\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"repo_validation\":{\"argv\":[\"/usr/bin/python3\",\"-B\",\"/root/homelab-ops-cr-2026-0005/tools/validate_repo.py\",\"/root/homelab-ops-cr-2026-0005\"],\"cwd\":\"/root/homelab-ops-cr-2026-0005\",\"name\":\"validate_repo\",\"rc\":0,\"stderr\":\"\",\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout\":\"REPO_VALIDATION=OK\\nFILES_CHECKED=48\\nREGRESSION_CASES=13\\n\",\"stdout_sha256\":\"95dd8eaec214cc5dde2e7bb7ec90c499fc2e896e1be036571e5bb9663acc368a\",\"stdout_truncated\":false},\"token_scan\":{\"matches\":{\"REG-014-GITEA-VERSION-AUTHENTICATION\":[],\"REG-015-GITEA-OWNER-PERMISSION\":[],\"SUPERSEDED_TASK\":[],\"gitea-machine-identity-controlled-migration-v3\":[],\"gitea-machine-identity-controlled-migration-v4\":[],\"superseded\":[]},\"review_root_exists\":true,\"scan_limit_reached\":false,\"scanned_files\":48,\"skipped_files\":0}},\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"read_only\":true,\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"status\":\"OK\",\"summary\":{\"next_action_classification\":\"IMPLEMENT_OR_APPLY_V4_ERROR_LOCK\",\"repo_tests_rc\":0,\"repo_validation_rc\":0,\"review_branch\":\"cr-2026-0005-codex-bootstrap-activation\",\"review_clean\":true,\"review_head\":\"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\",\"review_v4_task_exists\":false,\"v3_validate_rc\":0,\"v4_root_exists\":false,\"v4_validate_rc\":null}}\n" + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z\",\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"FAIL\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z\",\"error\":\"RuntimeError: V3 package hash mismatch: phases/rollback.sh\",\"mutation_outcome\":\"NO_MUTATION\",\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"status\":\"FAIL\"}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 79de4de..8c48b58 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,22 +1,22 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=GITEA-V4-ERROR-LOCK-CURRENT-STATE-PROBE-20260730T155250Z -STATUS=OK -RC=0 +COMMAND_ID=GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z +STATUS=FAIL +RC=1 HOST=pve01 -MODE=verify +MODE=change COMPONENT=gitea-machine-identity REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 -COMMAND_SHA256=747995da40a448bf2f73ab84a257caa7243f748e67e9e341a449a03a721f812c +COMMAND_SHA256=cf2b14c0155fe3ac3e34ed6950c0df4ac06859826b4b5e26cf14f57784f1527c DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true -CHANGE_DECLARED=false +CHANGE_DECLARED=true RESULT_CONTRACT_VALID=true -RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_STATUS=FAIL RESULT_CONTRACT_ERROR=NONE -COMMAND_RC=0 +COMMAND_RC=1 CHANGES_MADE=false ROLLBACK_STARTED=false ROLLBACK_RESTORED=null @@ -24,10 +24,11 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=293b6fb05e2519d10de090a50dbf4aaeb8e5b465b85c3faaa41cf53e103fb2ee -SANITIZED_OUTPUT_SHA256=2d52ac59f65da7c39c3a21e00e2c4ce14b0d3157da709143aa0062b74fdb0ef7 +RAW_EVIDENCE_SHA256=0d5dcb323f85974a9010cdd3edf9428f1d4536c6c8aedc55efadc15802160d0a +SANITIZED_OUTPUT_SHA256=0d5dcb323f85974a9010cdd3edf9428f1d4536c6c8aedc55efadc15802160d0a OUTPUT_BEGIN -{"changes_made":false,"command_id":"GITEA-V4-ERROR-LOCK-CURRENT-STATE-PROBE-20260730T155250Z","command_rc":0,"evidence":{"admin_checks":{"v3_validate":{"argv":["/opt/homelab-admin/bin/homelab-admin","validate","/root/gitea-machine-identity-controlled-migration-v3"],"cwd":null,"name":"v3_validate","rc":0,"stderr":"","stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout":"LINT_STATUS=OK\nTASK_ID=gitea-machine-identity-controlled-migration-v3\nPOLICY_ID=homelab-admin-guardrails-v1.2\nRULES_CHECKED=14\nSOURCE_FILES_CHECKED=11\nTASK_VALID=YES\nTASK_ID=gitea-machine-identity-controlled-migration-v3\nTASK_SCOPE=controlled_apply\nPRODUCTION_CHANGE=YES\n","stdout_sha256":"b07c614303811067f0dc0ccb7d15a3924c7473373c652717d546e0c3866d884d","stdout_truncated":false},"v4_validate":{"skipped":"admin_or_v4_missing"},"version":{"argv":["/opt/homelab-admin/bin/homelab-admin","version"],"cwd":null,"name":"homelab_admin_version","rc":0,"stderr":"","stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout":"HOMELAB_ADMIN_VERSION=0.3.1-controlled-apply\n","stdout_sha256":"537d898cc84f4983bfdaa318beb771abd108ed71d51f62455794c73a37830c96","stdout_truncated":false}},"candidate_files":{"/root/gitea-machine-identity-controlled-migration-v3/task.json":{"exists":true,"is_dir":false,"is_file":true,"mode":"0o644","path":"/root/gitea-machine-identity-controlled-migration-v3/task.json","sha256":"ca71849e686ea8195610d6dcd23841399952cd7fed0574aa0284a7a9bc0ae267","size":6774,"text":"{\n \"schema_version\": 2,\n \"task_id\": \"gitea-machine-identity-controlled-migration-v3\",\n \"target_host\": \"pve01.gram1.ru\",\n \"mutation_scope\": \"controlled_apply\",\n \"production_change\": true,\n \"failure_mode\": \"fail_fast\",\n \"reads\": [\n \"/srv/homelab-ops\",\n \"/srv/homelab-desired-state\",\n \"/root/.gitconfig\",\n \"/root/.git-credentials\",\n \"[SENSITIVE_PATH] \"[SENSITIVE_PATH] \"https://git.gram1.ru/api/v1/version\",\n \"https://git.gram1.ru/api/v1/user\",\n \"https://git.gram1.ru/api/v1/repos/homelab-admin/homelab-ops/collaborators\",\n \"ssh:root@[PRIVATE_IP]:docker-gitea-state\",\n \"git:https://git.gram1.ru/homelab-admin/homelab-ops.git:main\"\n ],\n \"writes\": [\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3\",\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/.task-id\",\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/known_hosts.vm170\",\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/plan.json\",\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/root.gitconfig.before\",\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/root.git-credentials.before\",\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/remote-apply.out\",\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/remote-recovery.out\",\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3/probe-repo\",\n \"/etc/homelab-admin/credentials/gitea-homelab-ops\",\n \"/usr/local/libexec/homelab-git-credential\",\n \"/root/.gitconfig\",\n \"/root/.git-credentials\",\n \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/tasks/gitea-machine-identity-controlled-migration-v3\",\n \"ssh:root@[PRIVATE_IP]:gitea-user:homelab-ops-bot\",\n \"ssh:root@[PRIVATE_IP]:gitea-collaborator:homelab-admin/homelab-ops/homelab-ops-bot\",\n \"$HOMELAB_RUN_DIR/preflight.json\",\n \"$HOMELAB_RUN_DIR/prepare.json\",\n \"$HOMELAB_RUN_DIR/dry-run.json\",\n \"$HOMELAB_RUN_DIR/apply.json\",\n \"$HOMELAB_RUN_DIR/verify.json\",\n \"$HOMELAB_RUN_DIR/rollback.json\",\n \"$HOMELAB_RUN_DIR/seal.json\",\n \"$HOMELAB_RUN_DIR/legacy-identity-preflight.txt\",\n \"$HOMELAB_RUN_DIR/legacy-identity-apply.txt\",\n \"$HOMELAB_RUN_DIR/vm170-capability.txt\",\n \"$HOMELAB_RUN_DIR/vm170-verify-state.txt\",\n \"$HOMELAB_RUN_DIR/vm170-rollback.txt\",\n \"$HOMELAB_RUN_DIR/vm170-seal.txt\",\n \"$HOMELAB_RUN_DIR/machine-identity-verify.txt\"\n ],\n \"mutates\": [\n \"/var/lib/homelab-admin/staging/gitea-machine-identity-controlled-migration-v3\",\n \"/etc/homelab-admin/credentials/gitea-homelab-ops\",\n \"/usr/local/libexec/homelab-git-credential\",\n \"/root/.gitconfig\",\n \"/root/.git-credentials\",\n \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/tasks/gitea-machine-identity-controlled-migration-v3\",\n \"ssh:root@[PRIVATE_IP]:gitea-user:homelab-ops-bot\",\n \"ssh:root@[PRIVATE_IP]:gitea-collaborator:homelab-admin/homelab-ops/homelab-ops-bot\"\n ],\n \"expected_outputs\": [\n {\n \"path\": \"$HOMELAB_RUN_DIR/preflight.json\",\n \"producer\": \"phases/preflight.sh\",\n \"verification\": \"legacy identity is repo admin and target bot is absent without Gitea CLI\"\n },\n {\n \"path\": \"$HOMELAB_RUN_DIR/prepare.json\",\n \"producer\": \"phases/prepare.sh\",\n \"verification\": \"exact local rollback copies and pinned VM170 host key are staged\"\n },\n {\n \"path\": \"$HOMELAB_RUN_DIR/dry-run.json\",\n \"producer\": \"phases/dry-run.sh\",\n \"verification\": \"single bounded CLI help invocation proves exact bot and token flags\"\n },\n {\n \"path\": \"$HOMELAB_RUN_DIR/apply.json\",\n \"producer\": \"phases/apply.sh\",\n \"verification\": \"bot plus scoped material, collaborator access and repository helper are installed\"\n },\n {\n \"path\": \"$HOMELAB_RUN_DIR/verify.json\",\n \"producer\": \"phases/verify.sh\",\n \"verification\": \"repo access, scope isolation, non-admin state and push dry-run are exact\"\n },\n {\n \"path\": \"$HOMELAB_RUN_DIR/rollback.json\",\n \"producer\": \"phases/rollback.sh\",\n \"verification\": \"legacy local state restored and task-created bot removed\"\n },\n {\n \"path\": \"$HOMELAB_RUN_DIR/seal.json\",\n \"producer\": \"phases/seal.sh\",\n \"verification\": \"remote rollback state and local staging removed\"\n }\n ],\n \"runtime_matrix\": [\n {\n \"host\": \"pve01.gram1.ru\",\n \"runtime\": \"python3\",\n \"compile\": \"python3 -m py_compile\"\n }\n ],\n \"rollback\": {\n \"command\": \"HOMELAB_CONTROLLED_APPLY_CONFIRM=gitea-machine-identity-controlled-migration-v3 homelab-admin run TASK_DIR rollback\",\n \"verification\": \"exact legacy Git files restored; homelab-ops-bot absent; protected push URL DISABLED\"\n },\n \"no_change_assertions\": [\n \"srv_homelab_ops_content\",\n \"srv_homelab_ops_push_url\",\n \"srv_homelab_desired_state\",\n \"gitea_repository_content\",\n \"gitea_repository_owner\",\n \"gitea_runner_registration\",\n \"gitea_runner_configuration\",\n \"gitea_existing_users\",\n \"vm170_packages\",\n \"vm170_containers\",\n \"dns\",\n \"netbox\",\n \"backup_jobs\",\n \"preflight_has_zero_gitea_cli_calls\",\n \"dry_run_has_zero_account_mutations\",\n \"no_bootstrap_administrator\"\n ],\n \"source_of_truth\": {\n \"repository\": \"homelab-admin/homelab-ops\",\n \"machine_user\": \"homelab-ops-bot\",\n \"machine_user_type\": \"bot\",\n \"machine_user_admin\": false,\n \"repository_permission\": \"write\",\n \"material_scope\": \"write:repository\",\n \"credential_file\": \"/etc/homelab-admin/credentials/gitea-homelab-ops\",\n \"credential_helper\": \"/usr/local/libexec/homelab-git-credential\",\n \"protected_worktree_push_url\": \"DISABLED\",\n \"legacy_material_revocation\": \"out_of_scope_unknown_token_id\",\n \"failed_unit_policy\": \"At most three exact known unrelated failed units.\",\n \"preflight_gitea_cli_calls\": 0,\n \"apply_gitea_create_calls\": 1,\n \"bootstrap_administrator_created\": false,\n \"machine_scope_negative_probe\": \"/api/v1/user must return 403\",\n \"next_stage\": \"VM190_BACKUP_AND_RESTORE_TEST\"\n },\n \"python_files\": [\n \"tools/test_task.py\",\n \"tools/legacy_identity_api.py\",\n \"tools/verify_machine_credential.py\"\n ],\n \"remote_scripts\": [\n \"assets/vm170-machine-identity.sh\"\n ],\n \"phases\": {\n \"preflight\": \"phases/preflight.sh\",\n \"prepare\": \"phases/prepare.sh\",\n \"dry-run\": \"phases/dry-run.sh\",\n \"apply\": \"phases/apply.sh\",\n \"verify\": \"phases/verify.sh\",\n \"rollback\": \"phases/rollback.sh\",\n \"seal\": \"phases/seal.sh\"\n },\n \"guards\": {\n \"desired_state_clean\": true,\n \"failed_units_max\": 3,\n \"active_backup_restore_max\": 0\n }\n}\n"},"/root/gitea-machine-identity-controlled-migration-v4/task.json":{"exists":false,"path":"/root/gitea-machine-identity-controlled-migration-v4/task.json"},"/root/homelab-ops-cr-2026-0005/config/superseded-tasks.json":{"exists":false,"path":"/root/homelab-ops-cr-2026-0005/config/superseded-tasks.json"},"/root/homelab-ops-cr-2026-0005/errors/regression-cases.json":{"exists":true,"is_dir":false,"is_file":true,"mode":"0o644","path":"/root/homelab-ops-cr-2026-0005/errors/regression-cases.json","sha256":"3ccb66b1a6c58002120b0d6c863aa6cbc21b16446a37b4f944bce6809f9451ea","size":4192,"text":"{\n \"schema_version\": 1,\n \"cases\": [\n {\n \"id\": \"REG-001-RUNTIME-TYPE-DISPATCH\",\n \"incident\": \"Python linter was checked with bash -n.\",\n \"required_control\": \"Select validator from file type and shebang.\",\n \"test\": \"tests.test_repository.RepositoryTests.test_runtime_dispatch_policy\"\n },\n {\n \"id\": \"REG-002-VM-OWNER-DISCOVERY\",\n \"incident\": \"Local qm was used on a node that did not own VM180.\",\n \"required_control\": \"Resolve owner through cluster resources before node-local commands.\",\n \"test\": \"tests.test_repository.RepositoryTests.test_vm180_owner\"\n },\n {\n \"id\": \"REG-003-STRUCTURED-OPTION-TYPE\",\n \"incident\": \"A structured XenForo option was treated as a string.\",\n \"required_control\": \"Inspect runtime/entity type before transformation.\",\n \"test\": \"tests.test_repository.RepositoryTests.test_xenforo_type_rule\"\n },\n {\n \"id\": \"REG-004-GENERATED-REPO-MUTATION\",\n \"incident\": \"A generated snapshot was considered as a development repository.\",\n \"required_control\": \"Never edit /srv/homelab-desired-state.\",\n \"test\": \"tests.test_repository.RepositoryTests.test_generated_repo_rule\"\n },\n {\n \"id\": \"REG-005-MANUAL-SHA-CASCADE\",\n \"incident\": \"Embedded hashes diverged across nested scripts.\",\n \"required_control\": \"Generate one manifest and verify artifacts automatically.\",\n \"test\": \"tests.test_repository.RepositoryTests.test_manifest_present\"\n },\n {\n \"id\": \"REG-006-BARE-REPO-HEAD\",\n \"incident\": \"The dry-run pushed main to a bare repository whose HEAD still referenced master, so clone checked out no files.\",\n \"required_control\": \"Set the bare repository symbolic HEAD to refs/heads/main and clone main explicitly.\",\n \"test\": \"package tools/validate_bootstrap.py and tests.test_repository.RepositoryTests.test_bare_repo_head_regression\"\n },\n {\n \"id\": \"REG-007-SYSTEMCTL-FIRST-FIELD\",\n \"incident\": \"Formatted systemctl --failed output was passed as a whole unit name.\",\n \"required_control\": \"Parse and sort only the first field containing the exact systemd unit name.\",\n \"test\": \"tests.test_cr_2026_0005.CR20260005Tests.test_systemctl_failed_first_field\"\n },\n {\n \"id\": \"REG-008-PRINTF-DASH-FORMAT\",\n \"incident\": \"printf interpreted a marker beginning with hyphens as an option.\",\n \"required_control\": \"Use an explicit safe format string for all marker output.\",\n \"test\": \"tests.test_cr_2026_0005.CR20260005Tests.test_phase_guardrails\"\n },\n {\n \"id\": \"REG-009-PMXCFS-DIRECT-CONTENT-WRITE\",\n \"incident\": \"install -m attempted chmod semantics unsupported by pmxcfs.\",\n \"required_control\": \"Write pmxcfs file content directly and verify bytes and metadata separately.\",\n \"test\": \"tests.test_cr_2026_0005.CR20260005Tests.test_policy_markers\"\n },\n {\n \"id\": \"REG-010-REMOTE-SHELL-QUOTING\",\n \"incident\": \"An unquoted remote stat format was interpreted by the remote shell.\",\n \"required_control\": \"Use versioned remote scripts or fully structured argument passing.\",\n \"test\": \"tests.test_cr_2026_0005.CR20260005Tests.test_policy_markers\"\n },\n {\n \"id\": \"REG-011-STANDARD-SEAL-DISCOVERY\",\n \"incident\": \"A task completion was assumed without a standard seal path.\",\n \"required_control\": \"Write and verify the canonical task seal explicitly.\",\n \"test\": \"tests.test_cr_2026_0005.CR20260005Tests.test_standard_seal\"\n },\n {\n \"id\": \"REG-012-DEV-NULL-TEMP-SENTINEL\",\n \"incident\": \"A cleanup variable was incorrectly bound to /dev/null.\",\n \"required_control\": \"Never use /dev/null as a temporary path or cleanup target.\",\n \"test\": \"tests.test_cr_2026_0005.CR20260005Tests.test_phase_guardrails\"\n },\n {\n \"id\": \"REG-013-TASK-SEMANTIC-COHERENCE\",\n \"incident\": \"A task named for /dev/null retained unrelated backup-tail reads, writes, mutations and assets.\",\n \"required_control\": \"Validate semantic coherence between task identity, description, evidence and declared mutation scope.\",\n \"test\": \"tests.test_cr_2026_0005.CR20260005Tests.test_task_semantic_coherence\"\n }\n ]\n}\n"},"/root/homelab-ops-cr-2026-0005/policies/superseded-tasks.json":{"exists":false,"path":"/root/homelab-ops-cr-2026-0005/policies/superseded-tasks.json"},"/root/homelab-ops-cr-2026-0005/tasks/gitea-machine-identity-controlled-migration-v3/task.json":{"exists":false,"path":"/root/homelab-ops-cr-2026-0005/tasks/gitea-machine-identity-controlled-migration-v3/task.json"},"/root/homelab-ops-cr-2026-0005/tasks/gitea-machine-identity-controlled-migration-v4/task.json":{"exists":false,"path":"/root/homelab-ops-cr-2026-0005/tasks/gitea-machine-identity-controlled-migration-v4/task.json"}},"git":{"branch":{"argv":["git","branch","--show-current"],"cwd":"/root/homelab-ops-cr-2026-0005","name":"git_branch","rc":0,"stderr":"","stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout":"cr-2026-0005-codex-bootstrap-activation\n","stdout_sha256":"23742b320dc35d798564315de82e7b0ebed62767738040a8528dedb0c23d9472","stdout_truncated":false},"head":{"argv":["git","rev-parse","HEAD"],"cwd":"/root/homelab-ops-cr-2026-0005","name":"git_head","rc":0,"stderr":"","stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout":"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\n","stdout_sha256":"c25145162faff49f6f450dc74c60b9e8c93629a690d4b207c6ead3497fe3d19d","stdout_truncated":false},"remote":{"argv":["git","remote","-v"],"cwd":"/root/homelab-ops-cr-2026-0005","name":"git_remote","rc":0,"stderr":"","stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout":"origin\thttps://git.gram1.ru/homelab-admin/homelab-ops.git (fetch)\norigin\tDISABLED (push)\n","stdout_sha256":"f83d964adf056fd68c2adf394406f03044639b020f77d961083f50057417cd83","stdout_truncated":false},"status":{"argv":["git","status","--short","--branch"],"cwd":"/root/homelab-ops-cr-2026-0005","name":"git_status","rc":0,"stderr":"","stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout":"## cr-2026-0005-codex-bootstrap-activation\n","stdout_sha256":"e62eb84bc5a5eb185ee9a21167e95d73dee249f167f28f4d59671054a8afc0ed","stdout_truncated":false}},"identity":{"command_id":"GITEA-V4-ERROR-LOCK-CURRENT-STATE-PROBE-20260730T155250Z","euid":0,"hostname":"pve01","read_only":true,"uid":0},"paths":{"admin":{"exists":true,"is_dir":false,"is_file":true,"mode":"0o750","path":"/opt/homelab-admin/bin/homelab-admin","sha256":"5398600c15b63f3872116e6d1ae6f65e2d7a5d1752349c9de0de07d801967bd1","size":9589},"linter":{"exists":true,"is_dir":false,"is_file":true,"mode":"0o750","path":"/opt/homelab-admin/libexec/homelab-admin-lint","sha256":"deaa17bdfa41db95abed26a81d67e04c1ecaf68dc397f7eea6bd74c5228cdfef","size":21099},"review_root":{"exists":true,"path":"/root/homelab-ops-cr-2026-0005"},"v3_root":{"exists":true,"path":"/root/gitea-machine-identity-controlled-migration-v3"},"v4_root":{"exists":false,"path":"/root/gitea-machine-identity-controlled-migration-v4"}},"repo_tests":{"argv":["/usr/bin/python3","-B","-m","unittest","discover","-s","/root/homelab-ops-cr-2026-0005/tests","-v"],"cwd":"/root/homelab-ops-cr-2026-0005","name":"unittest_discover","rc":0,"stderr":"test_apply_exact_scope (test_cr_2026_0005.CR20260005Tests.test_apply_exact_scope) ... ok\ntest_declared_phase_outputs (test_cr_2026_0005.CR20260005Tests.test_declared_phase_outputs) ... ok\ntest_journal_pipeline_safety (test_cr_2026_0005.CR20260005Tests.test_journal_pipeline_safety) ... ok\ntest_no_pmxcfs_or_remote_mutation (test_cr_2026_0005.CR20260005Tests.test_no_pmxcfs_or_remote_mutation) ... ok\ntest_phase_guardrails (test_cr_2026_0005.CR20260005Tests.test_phase_guardrails) ... ok\ntest_policy_markers (test_cr_2026_0005.CR20260005Tests.test_policy_markers) ... ok\ntest_regression_cases (test_cr_2026_0005.CR20260005Tests.test_regression_cases) ... ok\ntest_standard_seal (test_cr_2026_0005.CR20260005Tests.test_standard_seal) ... ok\ntest_systemctl_failed_first_field (test_cr_2026_0005.CR20260005Tests.test_systemctl_failed_first_field) ... ok\ntest_task_semantic_coherence (test_cr_2026_0005.CR20260005Tests.test_task_semantic_coherence) ... ok\ntest_access_paths_have_no_credentials (test_repository.RepositoryTests.test_access_paths_have_no_credentials) ... ok\ntest_bare_repo_head_regression (test_repository.RepositoryTests.test_bare_repo_head_regression) ... ok\ntest_generated_repo_rule (test_repository.RepositoryTests.test_generated_repo_rule) ... ok\ntest_manifest_present (test_repository.RepositoryTests.test_manifest_present) ... ok\ntest_runtime_dispatch_policy (test_repository.RepositoryTests.test_runtime_dispatch_policy) ... ok\ntest_vm180_owner (test_repository.RepositoryTests.test_vm180_owner) ... ok\ntest_xenforo_type_rule (test_repository.RepositoryTests.test_xenforo_type_rule) ... ok\n\n----------------------------------------------------------------------\nRan 17 tests in 0.002s\n\nOK\n","stderr_sha256":"5a7bc836b25cc5b52cdd921735b6b9f05eb97603023a1df1926212265bcdb0a4","stderr_truncated":false,"stdout":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"repo_validation":{"argv":["/usr/bin/python3","-B","/root/homelab-ops-cr-2026-0005/tools/validate_repo.py","/root/homelab-ops-cr-2026-0005"],"cwd":"/root/homelab-ops-cr-2026-0005","name":"validate_repo","rc":0,"stderr":"","stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout":"REPO_VALIDATION=OK\nFILES_CHECKED=48\nREGRESSION_CASES=13\n","stdout_sha256":"95dd8eaec214cc5dde2e7bb7ec90c499fc2e896e1be036571e5bb9663acc368a","stdout_truncated":false},"token_scan":{"matches":{"REG-014-GITEA-VERSION-AUTHENTICATION":[],"REG-015-GITEA-OWNER-PERMISSION":[],"SUPERSEDED_TASK":[],"gitea-machine-identity-controlled-migration-v3":[],"gitea-machine-identity-controlled-migration-v4":[],"superseded":[]},"review_root_exists":true,"scan_limit_reached":false,"scanned_files":48,"skipped_files":0}},"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"read_only":true,"rollback_restored":null,"rollback_started":false,"schema":1,"status":"OK","summary":{"next_action_classification":"IMPLEMENT_OR_APPLY_V4_ERROR_LOCK","repo_tests_rc":0,"repo_validation_rc":0,"review_branch":"cr-2026-0005-codex-bootstrap-activation","review_clean":true,"review_head":"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc","review_v4_task_exists":false,"v3_validate_rc":0,"v4_root_exists":false,"v4_validate_rc":null}} +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z","rollback_restored":null,"rollback_started":false,"status":"FAIL","version":1} +{"changes_made":false,"command_id":"GITEA-V4-AND-SUPERSEDED-LOCK-IMPLEMENT-20260730T160621Z","error":"RuntimeError: V3 package hash mismatch: phases/rollback.sh","mutation_outcome":"NO_MUTATION","rollback_restored":null,"rollback_started":false,"schema":1,"status":"FAIL"} OUTPUT_END CHAT_OUTPUT_END