From f7e2c62dd68490c8450758299cb40982f79efdc6 Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Wed, 5 Aug 2026 07:05:05 +0000 Subject: [PATCH] runtime: publish HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z --- ...RESOLUTION-READ-ONLY-20260805T070400Z.json | 38 +++++++++++++++++++ ...-RESOLUTION-READ-ONLY-20260805T070400Z.txt | 34 +++++++++++++++++ runtime/latest.json | 20 +++++----- runtime/latest.txt | 18 ++++----- 4 files changed, 91 insertions(+), 19 deletions(-) create mode 100644 runtime/history/HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z.json create mode 100644 runtime/history/HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z.txt diff --git a/runtime/history/HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z.json b/runtime/history/HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z.json new file mode 100644 index 0000000..98dfe91 --- /dev/null +++ b/runtime/history/HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z", + "status": "FAIL", + "rc": 1, + "host": "pve01", + "mode": "verify", + "component": "cluster-knowledge-base-error-system", + "started_at_utc": "2026-08-05T07:05:03Z", + "finished_at_utc": "2026-08-05T07:05:04Z", + "reference_register_checked": true, + "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", + "error_register_checked": true, + "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", + "command_sha256": "c2efc9b349daf87cf20c1977db12a588a59f40b8db5a80d176e791b898d76253", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 1, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "0b8e29a53c59c5c34cb36c8db9939fc5315a7679d9636937c1e515984f835f85", + "sanitized_output_sha256": "0b8e29a53c59c5c34cb36c8db9939fc5315a7679d9636937c1e515984f835f85", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z\",\"command_rc\":1,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":1,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"FAIL\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z\",\"command_rc\":1,\"error\":\"exact homelab-ops bare repository not found in proven local or running-container locations\",\"error_type\":\"RuntimeError\",\"exact_result_basis\":{\"blocking_findings\":[\"HANDBOOK_CANDIDATE_AMBIGUOUS\",\"REPOSITORY_TESTS_FAILED\",\"CLUSTER_STATUS_UNREADABLE\"],\"capsule_sha256\":\"2d2886a07bf68d97acf144a4d94855d6558cdd0c1277e2c633a5a244f9aebb0f\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z\",\"command_rc\":0,\"control_plane_error\":{\"message\":\"existing runner returned a different rc after writing its public artifact; runtime publication or wrapper completion failed\",\"type\":\"RunnerWrapperMismatch\"},\"mutation_outcome\":\"NO_MUTATION\",\"output_complete\":true,\"output_truncated_in_json\":false,\"prevention_in_this_probe\":\"bounded structured output; no complete success logs; no adapter or result-access repair\",\"rollback_restored\":null,\"rollback_started\":false,\"runner_document_rc\":0,\"runner_json_sha256\":\"f219bbfbfd996e659820b7275a52a14258000d0a27eea3c09793c0eea8cb10c3\",\"runner_rc\":75,\"runner_status\":\"OK\",\"runner_text_sha256\":\"bb714fe8c1973f37e190c01d8582c15f2b92ea0b44adb5a358d5f3d03ba1848a\",\"runner_wrapper_matches_document\":false,\"state_status\":\"FAIL\"},\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":1,\"read_only\":true,\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"status\":\"FAIL\"}\n" +} diff --git a/runtime/history/HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z.txt b/runtime/history/HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z.txt new file mode 100644 index 0000000..4d3f449 --- /dev/null +++ b/runtime/history/HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z.txt @@ -0,0 +1,34 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z +STATUS=FAIL +RC=1 +HOST=pve01 +MODE=verify +COMPONENT=cluster-knowledge-base-error-system +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 +COMMAND_SHA256=c2efc9b349daf87cf20c1977db12a588a59f40b8db5a80d176e791b898d76253 +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=1 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=0b8e29a53c59c5c34cb36c8db9939fc5315a7679d9636937c1e515984f835f85 +SANITIZED_OUTPUT_SHA256=0b8e29a53c59c5c34cb36c8db9939fc5315a7679d9636937c1e515984f835f85 +OUTPUT_BEGIN +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z","command_rc":1,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":1,"rollback_restored":null,"rollback_started":false,"status":"FAIL","version":1} +{"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z","command_rc":1,"error":"exact homelab-ops bare repository not found in proven local or running-container locations","error_type":"RuntimeError","exact_result_basis":{"blocking_findings":["HANDBOOK_CANDIDATE_AMBIGUOUS","REPOSITORY_TESTS_FAILED","CLUSTER_STATUS_UNREADABLE"],"capsule_sha256":"2d2886a07bf68d97acf144a4d94855d6558cdd0c1277e2c633a5a244f9aebb0f","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z","command_rc":0,"control_plane_error":{"message":"existing runner returned a different rc after writing its public artifact; runtime publication or wrapper completion failed","type":"RunnerWrapperMismatch"},"mutation_outcome":"NO_MUTATION","output_complete":true,"output_truncated_in_json":false,"prevention_in_this_probe":"bounded structured output; no complete success logs; no adapter or result-access repair","rollback_restored":null,"rollback_started":false,"runner_document_rc":0,"runner_json_sha256":"f219bbfbfd996e659820b7275a52a14258000d0a27eea3c09793c0eea8cb10c3","runner_rc":75,"runner_status":"OK","runner_text_sha256":"bb714fe8c1973f37e190c01d8582c15f2b92ea0b44adb5a358d5f3d03ba1848a","runner_wrapper_matches_document":false,"state_status":"FAIL"},"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":1,"read_only":true,"rollback_restored":null,"rollback_started":false,"schema":1,"status":"FAIL"} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index 06c4efe..98dfe91 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z", - "status": "OK", - "rc": 0, + "command_id": "HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z", + "status": "FAIL", + "rc": 1, "host": "pve01", "mode": "verify", "component": "cluster-knowledge-base-error-system", - "started_at_utc": "2026-08-05T06:48:00Z", - "finished_at_utc": "2026-08-05T06:48:24Z", + "started_at_utc": "2026-08-05T07:05:03Z", + "finished_at_utc": "2026-08-05T07:05:04Z", "reference_register_checked": true, "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", "error_register_checked": true, "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", - "command_sha256": "829077ae842686fb1f36e274117ae6385fb6020f21e25b3af48ae632cde78bcc", + "command_sha256": "c2efc9b349daf87cf20c1977db12a588a59f40b8db5a80d176e791b898d76253", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -21,7 +21,7 @@ "result_contract_valid": true, "result_contract_status": null, "result_contract_error": null, - "command_rc": 0, + "command_rc": 1, "changes_made": false, "rollback_started": false, "rollback_restored": null, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "10eeba794a85e13eb9ddc29f821f0e0cf430c57b93acf878eb539e048389d8f6", - "sanitized_output_sha256": "11a658e5cc7243e6916e1903b779b9538dded188f7d8c27c775d3f68147adde9", + "raw_evidence_sha256": "0b8e29a53c59c5c34cb36c8db9939fc5315a7679d9636937c1e515984f835f85", + "sanitized_output_sha256": "0b8e29a53c59c5c34cb36c8db9939fc5315a7679d9636937c1e515984f835f85", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z\",\"command_rc\":0,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"blocking_findings\":[\"HANDBOOK_CANDIDATE_AMBIGUOUS\",\"REPOSITORY_TESTS_FAILED\",\"CLUSTER_STATUS_UNREADABLE\"],\"changes_made\":false,\"cluster_changed\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z\",\"command_rc\":0,\"error_system_assessment\":{\"deterministic_fingerprint_observed\":true,\"immutable_error_ledger_observed\":false,\"mandatory_components\":{\"linter\":{\"paths\":[],\"present\":false},\"regression_registry\":{\"paths\":[\"errors/regression-cases.json\"],\"present\":true},\"repository_validator\":{\"paths\":[\"tools/validate_repo.py\"],\"present\":true},\"superseded_policy\":{\"paths\":[],\"present\":false},\"tests\":{\"paths\":[\"tests/fixtures/gitea-legacy-auth-permission.json\",\"tests/test_access_contexts.py\",\"tests/test_cr_2026_0005.py\",\"tests/test_cr_2026_0006.py\",\"tests/test_cr_2026_0006_vm160_task.py\",\"tests/test_cr_2026_0007_skladchik_reauth.py\",\"tests/test_cr_2026_0007_skladchik_semantic_repair.py\",\"tests/test_cr_2026_0008_skladchik_snapshot_integrity.py\",\"tests/test_cr_2026_0009_skladchik_concurrency_guard.py\",\"tests/test_cr_2026_0011_skladchik_cookie_jar_reset.py\",\"tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py\",\"tests/test_cr_2026_0013_vm160_worker_bootstrap_transition.py\",\"tests/test_cr_2026_0015_pve03_r8152_rx_ring_canary.py\",\"tests/test_cr_2026_0018_execution_boundary_preparation.py\",\"tests/test_inventory_foundation.py\",\"tests/test_live_verification.py\",\"tests/test_no_repeat_policy.py\",\"tests/test_reg_014_015.py\",\"tests/test_repository.py\"],\"present\":true}},\"missing_mandatory_components\":[\"linter\",\"superseded_policy\"],\"observed_error_artifact_count\":160,\"pre_command_gate_observed\":false,\"proposed_v2\":{\"command_evidence_basis\":\"Каждая задача закрепляется на точном Gitea commit и SHA исходных файлов. Команда без evidence_basis или с устаревшим commit блокируется до нового READ_ONLY probe.\",\"deterministic_fingerprint\":\"SHA256 нормализованного набора component + operation + phase + rc + error_type + stable evidence; секреты и переменные значения исключаются до хеширования.\",\"error_ledger\":\"Одна неизменяемая JSON-запись на каждый доказанный отказ: error_id, command_id, capsule_sha256, component, operation, target, exact evidence, root cause, fixed_by, prevention_test, supersedes, first_seen, last_seen.\",\"exact_result_ingestion\":\"После exact-result автоматически формируется candidate incident; запись принимается только после сверки command_id, capsule_sha256, runner_json_sha256, wrapper/document RC и отсутствия truncation.\",\"pre_command_gate\":\"Перед выпуском любой капсулы обязательный поиск fingerprint/component/operation в реестре. Повтор известной ошибки блокируется, пока капсула не содержит подтверждённое prevention_test или документированное исключение.\",\"quality_metrics\":\"Счётчики: first-pass success rate, repeated-error rate, rollback rate, unknown-state commands, commands without exact-result verification. Цель — repeated-error rate = 0.\",\"regression_tests\":\"Каждая исправленная ошибка обязана иметь воспроизводимый тест в tests/errors; лinter запрещает закрывать ошибку без теста и ссылки fixed_by.\",\"supersession\":\"Старые задачи и обходные пути не удаляются молча: они получают статус superseded с заменой, причиной и запретом повторного запуска.\"},\"requires_v2\":true},\"gitea\":{\"default_head_archive\":{\"archive_sha256\":\"8f595e76a5baa7b2d8d2148f1a694e9acd22a90accb6e55f962fc47ff1432a5a\",\"branch\":\"main\",\"bytes\":376932,\"commit\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"files\":125},\"discovery_evidence\":[{\"id\":\"aa350cac62aa\",\"kind\":\"podman-probe\",\"paths_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"rc\":126,\"stderr\":\"Error: crun: capset: Operation not permitted: OCI permission denied\\n\"},{\"kind\":\"network-ls-remote\",\"rc\":0,\"stderr\":\"\",\"stdout_sha256\":\"b6697044d593fdddb9d66bc35bd58267cc6d07a31b756330aac2f147bc98bc6c\"},{\"kind\":\"network-mirror\",\"rc\":0,\"stderr\":\"Cloning into bare repository '/tmp/homelab-kb-network-fallback-k4x0gd1r/homelab-ops.git'...\\n\",\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}],\"identity\":{\"access_method\":\"authenticated-network-mirror\",\"default_branch\":\"main\",\"head\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"ref_count\":13,\"refs\":[{\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"committer_date\":\"2026-07-31T10:40:00Z\",\"ref\":\"refs/heads/site-gram1-ru-baseline-canonical-20260731\",\"subject\":\"gram1.ru: publish verified baseline pointer\"},{\"commit\":\"f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49\",\"committer_date\":\"2026-07-31T10:37:56+03:00\",\"ref\":\"refs/heads/site-gram1-ru-baseline-20260731\",\"subject\":\"GRAM1: capture initial site baseline 20260731T071400Z\"},{\"commit\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"committer_date\":\"2026-07-29T09:33:11Z\",\"ref\":\"refs/heads/main\",\"subject\":\"docs: mark Skladchik moderator assistant as planned\"},{\"commit\":\"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17\",\"committer_date\":\"2026-07-20T00:37:03+03:00\",\"ref\":\"refs/heads/cr-2026-0017-inventory-foundation\",\"subject\":\"CR-2026-0017: model access contexts and discover guest management\"},{\"commit\":\"60f53ea6fe6724196802a46de3de19c7889a51cc\",\"committer_date\":\"2026-07-19T17:57:23+03:00\",\"ref\":\"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary\",\"subject\":\"CR-2026-0015: add pve03 r8152 RX ring canary\"},{\"commit\":\"25b275f96b54551e26f07516c72651d85f235ad0\",\"committer_date\":\"2026-07-18T16:27:33+03:00\",\"ref\":\"refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition\",\"subject\":\"CR-2026-0013: allow VM160 worker bootstrap transition\"},{\"commit\":\"f5b22d867ea467987008408e3fb1fb0e17fa7b2e\",\"committer_date\":\"2026-07-18T14:17:33+03:00\",\"ref\":\"refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook\",\"subject\":\"CR-2026-0012: add one-command Skladchik Cookie refresh runbook\"},{\"commit\":\"bb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9\",\"committer_date\":\"2026-07-18T13:11:46+03:00\",\"ref\":\"refs/heads/cr-2026-0011-skladchik-cookie-jar-reset\",\"subject\":\"CR-2026-0011: force fresh Skladchik Cookie before jar persistence\"},{\"commit\":\"7bd1b050f8d64c7b55dfd51ead63f0adda87f2df\",\"committer_date\":\"2026-07-18T10:34:25+03:00\",\"ref\":\"refs/heads/cr-2026-0009-skladchik-concurrency-guard\",\"subject\":\"CR-2026-0010: separate current and target Skladchik edge SHAs\"},{\"commit\":\"1f7abe5acf856ad2a2abe10ef2a9452485edb073\",\"committer_date\":\"2026-07-18T09:26:07+03:00\",\"ref\":\"refs/heads/cr-2026-0008-skladchik-snapshot-integrity\",\"subject\":\"CR-2026-0008: repair Skladchik rollback snapshot integrity\"},{\"commit\":\"d399d24440f948b518761ecfd516521993861b43\",\"committer_date\":\"2026-07-18T08:57:02+03:00\",\"ref\":\"refs/heads/cr-2026-0007-skladchik-controlled-reauth\",\"subject\":\"CR-2026-0007: add controlled Skladchik reauthentication task\"},{\"commit\":\"16e84298035f5e4ec7e2b7d39967ad5e40ea3d4b\",\"committer_date\":\"2026-07-18T07:43:14+03:00\",\"ref\":\"refs/heads/cr-2026-0006-cluster-cloud-quorum\",\"subject\":\"CR-2026-0006: add VM160 cloud quorum canary task\"},{\"commit\":\"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\",\"committer_date\":\"2026-07-18T03:57:33+03:00\",\"ref\":\"refs/heads/cr-2026-0005-codex-bootstrap-activation\",\"subject\":\"CR-2026-0005 prepare reviewed logrotate bootstrap clearance\"}],\"refs_sha256\":\"1349b9021de5d4f1bb0406fd4895b3e0d1fd5c674f3686bad730a3e7a0695fb3\",\"repo_url\":\"https://git.gram1.ru/homelab-admin/homelab-ops\",\"source\":{\"kind\":\"direct\",\"path\":\"/tmp/homelab-kb-network-fallback-k4x0gd1r/homelab-ops.git\"}},\"scan\":{\"canonical_candidate\":{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n - UPnP/IGD discovery\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},\"canonical_candidate_ambiguous\":true,\"error_artifacts\":[{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n - UPnP/IGD discovery\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n - UPnP/IGD discovery\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n - UPnP/IGD discovery\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":1079183,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":102,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"бэкап\",\"restore\",\"восстанов\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"error_learning\":[\"regression\",\"incident\",\"superseded\"],\"external_services\":[\"внешн\",\"public\",\"reverse proxy\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"внутренн\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"repair\",\"troubleshoot\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"excerpt\":\"\",\"headings\":[],\"json_top_level_size\":1000,\"json_top_level_type\":\"list\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"url-userinfo\"],\"sha256\":\"aeb92358514ec5cd67d557f15ea295b3ae4f25df5f17a14556dae750b8496d1b\",\"total_score\":102},{\"bytes\":9499,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":88,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"internet\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"internal service\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"excerpt\":\"# DR from zero runbook, 2026-06-22\\n\\nChecked at UTC: `2026-06-22T09:00:38Z`.\\n\\nMarker: **DR from zero runbook, 2026-06-22**\\n\\n## Purpose\\n\\nThis runbook describes how to rebuild a minimum viable homelab from zero after a serious failure.\\n\\nIt is not a restore execution log. It is a step-by-step operator procedure.\\n\\n## Scope\\n\\nThe goal is to recover enough infrastructure to regain access, documentation, identity, routing, secrets, Git, backup visibility, and then stateful applications.\\n\\nMinimum viable homelab means:\\n\\n- SSH access works;\\n- VPN/Tailscale/NetBird access works or has a known temporary replacement;\\n- Git repository is available;\\n- SOPS/age secrets can be decrypted;\\n- MkDocs documentation is published;\\n- NPMplus routes can be restored;\\n- Authentik, Gitea, Vaultwarden, NetBox, and Uptime Kuma can be restored;\\n- backup/offhost locations are visible;\\n- health checks prove the restored state.\\n\\n## Current known source-of-truth commits\\n\\n- Backup coverage closure: completed before this runbook.\\n- MkDocs publish hardening: completed.\\n- Backup tiering table: completed.\\n- Current repo head when starting this runbook: `adb8c55`.\\n\\n## P0 restore order\\n\\n| Order | Component | Why first | Expec\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"DR from zero runbook, 2026-06-22\"},{\"level\":2,\"line\":7,\"title\":\"Purpose\"},{\"level\":2,\"line\":13,\"title\":\"Scope\"},{\"level\":2,\"line\":29,\"title\":\"Current known source-of-truth commits\"},{\"level\":2,\"line\":36,\"title\":\"P0 restore order\"},{\"level\":2,\"line\":55,\"title\":\"Critical backup sources\"},{\"level\":2,\"line\":71,\"title\":\"Phase 0 — stop and preserve evidence\"},{\"level\":2,\"line\":86,\"title\":\"Phase 1 — base host recovery\"},{\"level\":2,\"line\":104,\"title\":\"Phase 2 — network access\"},{\"level\":2,\"line\":119,\"title\":\"Phase 3 — clone repository\"},{\"level\":2,\"line\":136,\"title\":\"Phase 4 — restore secrets/SOPS\"},{\"level\":2,\"line\":155,\"title\":\"Phase 5 — restore documentation first\"},{\"level\":2,\"line\":173,\"title\":\"Phase 6 — recover NPMplus and Uptime Kuma\"},{\"level\":2,\"line\":197,\"title\":\"Phase 7 — recover Authentik\"},{\"level\":2,\"line\":215,\"title\":\"Phase 8 — recover Gitea\"},{\"level\":2,\"line\":230,\"title\":\"Phase 9 — recover Vaultwarden\"},{\"level\":2,\"line\":244,\"title\":\"Phase 10 — recover NetBox\"},{\"level\":2,\"line\":270,\"title\":\"Phase 11 — recover Edge VM\"},{\"level\":2,\"line\":291,\"title\":\"Phase 12 — recover user data services\"},{\"level\":2,\"line\":306,\"title\":\"Phase 13 — restore monitoring and alerting\"},{\"level\":2,\"line\":325,\"title\":\"Do not do\"},{\"level\":2,\"line\":334,\"title\":\"Final DR closure checklist\"},{\"level\":2,\"line\":353,\"title\":\"Next improvement after this runbook\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f8312cd7cd0a296c60950a60c7866a67b19a70016b93f68b3a76b78d5440cb63\",\"total_score\":102},{\"bytes\":9386,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Disaster Recovery Runbook\"},{\"level\":2,\"line\":6,\"title\":\"Current verified recovery anchors\"},{\"level\":2,\"line\":25,\"title\":\"Things that must exist outside the repo\"},{\"level\":2,\"line\":39,\"title\":\"Recovery priority\"},{\"level\":2,\"line\":51,\"title\":\"Phase 0: establish a control host\"},{\"level\":2,\"line\":65,\"title\":\"Phase 1: restore rclone access\"},{\"level\":2,\"line\":90,\"title\":\"Phase 2: restore the critical/small cloud bundle\"},{\"level\":1,\"line\":107,\"title\":\"Expected:\"},{\"level\":1,\"line\":108,\"title\":\"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c\"},{\"level\":2,\"line\":130,\"title\":\"Phase 3: recover small app/config backups\"},{\"level\":2,\"line\":163,\"title\":\"Phase 4: recover edge-vm large backup\"},{\"level\":1,\"line\":194,\"title\":\"Expected size:\"},{\"level\":1,\"line\":195,\"title\":\"16936767590\"},{\"level\":1,\"line\":196,\"title\":\"Expected SHA256:\"},{\"level\":1,\"line\":197,\"title\":\"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001\"},{\"level\":2,\"line\":202,\"title\":\"Phase 5: restore validation checklist\"},{\"level\":2,\"line\":218,\"title\":\"Phase 6: re-enable backup and offsite automation\"},{\"level\":2,\"line\":231,\"title\":\"Known failure lessons\"},{\"level\":2,\"line\":243,\"title\":\"Vaultwarden isolated restore drill result — 2026-06-18\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e\",\"total_score\":100},{\"bytes\":9386,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Disaster Recovery Runbook\"},{\"level\":2,\"line\":6,\"title\":\"Current verified recovery anchors\"},{\"level\":2,\"line\":25,\"title\":\"Things that must exist outside the repo\"},{\"level\":2,\"line\":39,\"title\":\"Recovery priority\"},{\"level\":2,\"line\":51,\"title\":\"Phase 0: establish a control host\"},{\"level\":2,\"line\":65,\"title\":\"Phase 1: restore rclone access\"},{\"level\":2,\"line\":90,\"title\":\"Phase 2: restore the critical/small cloud bundle\"},{\"level\":1,\"line\":107,\"title\":\"Expected:\"},{\"level\":1,\"line\":108,\"title\":\"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c\"},{\"level\":2,\"line\":130,\"title\":\"Phase 3: recover small app/config backups\"},{\"level\":2,\"line\":163,\"title\":\"Phase 4: recover edge-vm large backup\"},{\"level\":1,\"line\":194,\"title\":\"Expected size:\"},{\"level\":1,\"line\":195,\"title\":\"16936767590\"},{\"level\":1,\"line\":196,\"title\":\"Expected SHA256:\"},{\"level\":1,\"line\":197,\"title\":\"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001\"},{\"level\":2,\"line\":202,\"title\":\"Phase 5: restore validation checklist\"},{\"level\":2,\"line\":218,\"title\":\"Phase 6: re-enable backup and offsite automation\"},{\"level\":2,\"line\":231,\"title\":\"Known failure lessons\"},{\"level\":2,\"line\":243,\"title\":\"Vaultwarden isolated restore drill result — 2026-06-18\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e\",\"total_score\":100},{\"bytes\":16031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"internal service\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"05. Service Catalog\"},{\"level\":2,\"line\":5,\"title\":\"Edge VM\"},{\"level\":2,\"line\":12,\"title\":\"NPMplus\"},{\"level\":2,\"line\":22,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":30,\"title\":\"Gotify\"},{\"level\":2,\"line\":38,\"title\":\"Vaultwarden\"},{\"level\":2,\"line\":49,\"title\":\"Dockge\"},{\"level\":2,\"line\":61,\"title\":\"Homepage\"},{\"level\":2,\"line\":71,\"title\":\"Gitea\"},{\"level\":2,\"line\":84,\"title\":\"Nextcloud AIO\"},{\"level\":2,\"line\":95,\"title\":\"DNS stack\"},{\"level\":2,\"line\":102,\"title\":\"Backup\"},{\"level\":2,\"line\":109,\"title\":\"Edge applications added 2026-06-15/16\"},{\"level\":2,\"line\":132,\"title\":\"Backup health proxy\"},{\"level\":2,\"line\":155,\"title\":\"Edge VM capacity note\"},{\"level\":2,\"line\":366,\"title\":\"Homepage grouped dashboard update, 2026-06-22\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a\",\"total_score\":95},{\"bytes\":106031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":92,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"web ui\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"lxc\",\"qemu\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"локальн\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"99. Current state summary\"},{\"level\":2,\"line\":5,\"title\":\"Git repository\"},{\"level\":2,\"line\":12,\"title\":\"Operating rules\"},{\"level\":2,\"line\":21,\"title\":\"Current verified backup health\"},{\"level\":2,\"line\":32,\"title\":\"Backup scripts and services\"},{\"level\":2,\"line\":41,\"title\":\"Proxmox and network layout\"},{\"level\":2,\"line\":58,\"title\":\"NPMplus state\"},{\"level\":2,\"line\":81,\"title\":\"DNS rewrites\"},{\"level\":2,\"line\":101,\"title\":\"Edge applications\"},{\"level\":2,\"line\":118,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":131,\"title\":\"Cloudflare token rotation\"},{\"level\":2,\"line\":139,\"title\":\"Known working URLs\"},{\"level\":2,\"line\":166,\"title\":\"Pending after this documentation update\"},{\"level\":2,\"line\":181,\"title\":\"Edge application setup checkpoint — 2026-06-16T10:26:57Z\"},{\"level\":2,\"line\":194,\"title\":\"Immich media storage checkpoint — 2026-06-16T11:01:32Z\"},{\"level\":2,\"line\":204,\"title\":\"Immich media backup checkpoint — 2026-06-16T11:24:22Z\"},{\"level\":2,\"line\":219,\"title\":\"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z\"},{\"level\":2,\"line\":231,\"title\":\"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z\"},{\"level\":2,\"line\":245,\"title\":\"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z\"},{\"level\":2,\"line\":257,\"title\":\"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z\"},{\"level\":2,\"line\":266,\"title\":\"Closed validation checkpoint — 2026-06-16T16:51:40Z\"},{\"level\":2,\"line\":278,\"title\":\"Disk Space Health checkpoint — 2026-06-16T17:06:06Z\"},{\"level\":2,\"line\":298,\"title\":\"Memos backup checkpoint — 2026-06-16T17:33:39Z\"},{\"level\":2,\"line\":319,\"title\":\"Paperless backup checkpoint — 2026-06-16T17:50:49Z\"},{\"level\":2,\"line\":350,\"title\":\"Application restore validation checkpoint — 2026-06-16T18:01:17Z\"},{\"level\":2,\"line\":364,\"title\":\"Final full baseline checkpoint — 2026-06-16T18:10:15Z\"},{\"level\":2,\"line\":407,\"title\":\"Daily cluster status report\"},{\"level\":2,\"line\":420,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":447,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":482,\"title\":\"Контейнерная волна обновлений, 2026-06-19\"},{\"level\":2,\"line\":498,\"title\":\"CVE root-cause analysis, 2026-06-19\"},{\"level\":2,\"line\":514,\"title\":\"Browser / Chromium risk analysis, 2026-06-19\"},{\"level\":2,\"line\":527,\"title\":\"Base OS package CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":541,\"title\":\"Go runtime/dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":555,\"title\":\"Node/NPM dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":569,\"title\":\"Dockge / Karakeep candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":583,\"title\":\"Karakeep production update, 2026-06-19\"},{\"level\":2,\"line\":605,\"title\":\"Uptime Kuma candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":622,\"title\":\"Uptime Kuma production update, 2026-06-19\"},{\"level\":2,\"line\":644,\"title\":\"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19\"},{\"level\":2,\"line\":663,\"title\":\"Linkding candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":678,\"title\":\"Linkding production update, 2026-06-19\"},{\"level\":2,\"line\":698,\"title\":\"Current Trivy leaderboard after Linkding, 2026-06-19\"},{\"level\":2,\"line\":717,\"title\":\"Batch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":744,\"title\":\"Disk cleanup and Git push recovery, 2026-06-19\"},{\"level\":2,\"line\":758,\"title\":\"Next update candidates from batch scan, 2026-06-19\"},{\"level\":2,\"line\":770,\"title\":\"IT-Tools production update, 2026-06-19\"},{\"level\":2,\"line\":789,\"title\":\"NPMplus production update, 2026-06-19\"},{\"level\":2,\"line\":812,\"title\":\"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19\"},{\"level\":2,\"line\":827,\"title\":\"Paperless stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":852,\"title\":\"Immich app stable pair candidate scan, 2026-06-19\"},{\"level\":2,\"line\":878,\"title\":\"Immich app pair candidate scan result, 2026-06-19\"},{\"level\":2,\"line\":896,\"title\":\"Home Assistant stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":919,\"title\":\"MinIO release candidate scan, 2026-06-19\"},{\"level\":2,\"line\":942,\"title\":\"Mealie stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":965,\"title\":\"Authentik server image candidate scan, 2026-06-19\"},{\"level\":2,\"line\":988,\"title\":\"Karakeep Meilisearch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1011,\"title\":\"Karakeep Chrome candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1034,\"title\":\"Vaultwarden stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1057,\"title\":\"Vaultwarden production update, 2026-06-20\"},{\"level\":2,\"line\":1083,\"title\":\"Current Trivy leaderboard after Vaultwarden, 2026-06-20\"},{\"level\":2,\"line\":1098,\"title\":\"n8n stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1121,\"title\":\"n8n latest tag restore, 2026-06-20\"},{\"level\":2,\"line\":1137,\"title\":\"n8n 2.27.3 smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1163,\"title\":\"n8n production update, 2026-06-20\"},{\"level\":2,\"line\":1193,\"title\":\"Gotify stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1213,\"title\":\"Batch remaining open candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1234,\"title\":\"CrowdSec production update, 2026-06-20\"},{\"level\":2,\"line\":1262,\"title\":\"Final CVE pass summary, 2026-06-20\"},{\"level\":2,\"line\":1286,\"title\":\"n8n encryption key rotation, 2026-06-20\"},{\"level\":2,\"line\":1311,\"title\":\"Audit and backup inventory, 2026-06-20\"},{\"level\":2,\"line\":1326,\"title\":\"Immich Postgres restore smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1342,\"title\":\"Immich Postgres candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1352,\"title\":\"Dockge candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1362,\"title\":\"Paperless candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1372,\"title\":\"Karakeep and Immich Server real-tag scan, 2026-06-20\"},{\"level\":2,\"line\":1382,\"title\":\"Closing high-CVE ledger, 2026-06-20\"},{\"level\":2,\"line\":1392,\"title\":\"Candidate test directories cleanup, 2026-06-20\"},{\"level\":2,\"line\":1402,\"title\":\"Old n8n key backup removal preflight, 2026-06-20\"},{\"level\":2,\"line\":1412,\"title\":\"NetBird peers health hardening, 2026-06-20\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\",\"path_score\":3,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c\",\"total_score\":95},{\"bytes\":16031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"internal service\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"05. Service Catalog\"},{\"level\":2,\"line\":5,\"title\":\"Edge VM\"},{\"level\":2,\"line\":12,\"title\":\"NPMplus\"},{\"level\":2,\"line\":22,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":30,\"title\":\"Gotify\"},{\"level\":2,\"line\":38,\"title\":\"Vaultwarden\"},{\"level\":2,\"line\":49,\"title\":\"Dockge\"},{\"level\":2,\"line\":61,\"title\":\"Homepage\"},{\"level\":2,\"line\":71,\"title\":\"Gitea\"},{\"level\":2,\"line\":84,\"title\":\"Nextcloud AIO\"},{\"level\":2,\"line\":95,\"title\":\"DNS stack\"},{\"level\":2,\"line\":102,\"title\":\"Backup\"},{\"level\":2,\"line\":109,\"title\":\"Edge applications added 2026-06-15/16\"},{\"level\":2,\"line\":132,\"title\":\"Backup health proxy\"},{\"level\":2,\"line\":155,\"title\":\"Edge VM capacity note\"},{\"level\":2,\"line\":366,\"title\":\"Homepage grouped dashboard update, 2026-06-22\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a\",\"total_score\":95},{\"bytes\":106031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":92,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"web ui\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"lxc\",\"qemu\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"локальн\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"99. Current state summary\"},{\"level\":2,\"line\":5,\"title\":\"Git repository\"},{\"level\":2,\"line\":12,\"title\":\"Operating rules\"},{\"level\":2,\"line\":21,\"title\":\"Current verified backup health\"},{\"level\":2,\"line\":32,\"title\":\"Backup scripts and services\"},{\"level\":2,\"line\":41,\"title\":\"Proxmox and network layout\"},{\"level\":2,\"line\":58,\"title\":\"NPMplus state\"},{\"level\":2,\"line\":81,\"title\":\"DNS rewrites\"},{\"level\":2,\"line\":101,\"title\":\"Edge applications\"},{\"level\":2,\"line\":118,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":131,\"title\":\"Cloudflare token rotation\"},{\"level\":2,\"line\":139,\"title\":\"Known working URLs\"},{\"level\":2,\"line\":166,\"title\":\"Pending after this documentation update\"},{\"level\":2,\"line\":181,\"title\":\"Edge application setup checkpoint — 2026-06-16T10:26:57Z\"},{\"level\":2,\"line\":194,\"title\":\"Immich media storage checkpoint — 2026-06-16T11:01:32Z\"},{\"level\":2,\"line\":204,\"title\":\"Immich media backup checkpoint — 2026-06-16T11:24:22Z\"},{\"level\":2,\"line\":219,\"title\":\"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z\"},{\"level\":2,\"line\":231,\"title\":\"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z\"},{\"level\":2,\"line\":245,\"title\":\"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z\"},{\"level\":2,\"line\":257,\"title\":\"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z\"},{\"level\":2,\"line\":266,\"title\":\"Closed validation checkpoint — 2026-06-16T16:51:40Z\"},{\"level\":2,\"line\":278,\"title\":\"Disk Space Health checkpoint — 2026-06-16T17:06:06Z\"},{\"level\":2,\"line\":298,\"title\":\"Memos backup checkpoint — 2026-06-16T17:33:39Z\"},{\"level\":2,\"line\":319,\"title\":\"Paperless backup checkpoint — 2026-06-16T17:50:49Z\"},{\"level\":2,\"line\":350,\"title\":\"Application restore validation checkpoint — 2026-06-16T18:01:17Z\"},{\"level\":2,\"line\":364,\"title\":\"Final full baseline checkpoint — 2026-06-16T18:10:15Z\"},{\"level\":2,\"line\":407,\"title\":\"Daily cluster status report\"},{\"level\":2,\"line\":420,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":447,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":482,\"title\":\"Контейнерная волна обновлений, 2026-06-19\"},{\"level\":2,\"line\":498,\"title\":\"CVE root-cause analysis, 2026-06-19\"},{\"level\":2,\"line\":514,\"title\":\"Browser / Chromium risk analysis, 2026-06-19\"},{\"level\":2,\"line\":527,\"title\":\"Base OS package CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":541,\"title\":\"Go runtime/dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":555,\"title\":\"Node/NPM dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":569,\"title\":\"Dockge / Karakeep candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":583,\"title\":\"Karakeep production update, 2026-06-19\"},{\"level\":2,\"line\":605,\"title\":\"Uptime Kuma candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":622,\"title\":\"Uptime Kuma production update, 2026-06-19\"},{\"level\":2,\"line\":644,\"title\":\"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19\"},{\"level\":2,\"line\":663,\"title\":\"Linkding candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":678,\"title\":\"Linkding production update, 2026-06-19\"},{\"level\":2,\"line\":698,\"title\":\"Current Trivy leaderboard after Linkding, 2026-06-19\"},{\"level\":2,\"line\":717,\"title\":\"Batch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":744,\"title\":\"Disk cleanup and Git push recovery, 2026-06-19\"},{\"level\":2,\"line\":758,\"title\":\"Next update candidates from batch scan, 2026-06-19\"},{\"level\":2,\"line\":770,\"title\":\"IT-Tools production update, 2026-06-19\"},{\"level\":2,\"line\":789,\"title\":\"NPMplus production update, 2026-06-19\"},{\"level\":2,\"line\":812,\"title\":\"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19\"},{\"level\":2,\"line\":827,\"title\":\"Paperless stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":852,\"title\":\"Immich app stable pair candidate scan, 2026-06-19\"},{\"level\":2,\"line\":878,\"title\":\"Immich app pair candidate scan result, 2026-06-19\"},{\"level\":2,\"line\":896,\"title\":\"Home Assistant stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":919,\"title\":\"MinIO release candidate scan, 2026-06-19\"},{\"level\":2,\"line\":942,\"title\":\"Mealie stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":965,\"title\":\"Authentik server image candidate scan, 2026-06-19\"},{\"level\":2,\"line\":988,\"title\":\"Karakeep Meilisearch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1011,\"title\":\"Karakeep Chrome candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1034,\"title\":\"Vaultwarden stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1057,\"title\":\"Vaultwarden production update, 2026-06-20\"},{\"level\":2,\"line\":1083,\"title\":\"Current Trivy leaderboard after Vaultwarden, 2026-06-20\"},{\"level\":2,\"line\":1098,\"title\":\"n8n stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1121,\"title\":\"n8n latest tag restore, 2026-06-20\"},{\"level\":2,\"line\":1137,\"title\":\"n8n 2.27.3 smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1163,\"title\":\"n8n production update, 2026-06-20\"},{\"level\":2,\"line\":1193,\"title\":\"Gotify stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1213,\"title\":\"Batch remaining open candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1234,\"title\":\"CrowdSec production update, 2026-06-20\"},{\"level\":2,\"line\":1262,\"title\":\"Final CVE pass summary, 2026-06-20\"},{\"level\":2,\"line\":1286,\"title\":\"n8n encryption key rotation, 2026-06-20\"},{\"level\":2,\"line\":1311,\"title\":\"Audit and backup inventory, 2026-06-20\"},{\"level\":2,\"line\":1326,\"title\":\"Immich Postgres restore smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1342,\"title\":\"Immich Postgres candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1352,\"title\":\"Dockge candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1362,\"title\":\"Paperless candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1372,\"title\":\"Karakeep and Immich Server real-tag scan, 2026-06-20\"},{\"level\":2,\"line\":1382,\"title\":\"Closing high-CVE ledger, 2026-06-20\"},{\"level\":2,\"line\":1392,\"title\":\"Candidate test directories cleanup, 2026-06-20\"},{\"level\":2,\"line\":1402,\"title\":\"Old n8n key backup removal preflight, 2026-06-20\"},{\"level\":2,\"line\":1412,\"title\":\"NetBird peers health hardening, 2026-06-20\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\",\"path_score\":3,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c\",\"total_score\":95},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":38408,\"commit\":\"60f53ea6fe6724196802a46de3de19c7889a51cc\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\",\"quorum\",\"corosync\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"network\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary\"],\"sensitive_findings\":[],\"sha256\":\"07c9854ab0232d1f2766cdab114d0d398a4dcc1a5b41ea7fde77646e5f42804e\",\"total_score\":86},{\"bytes\":61327,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Services bootstrap snapshot — 2026-06-17\"},{\"level\":2,\"line\":3,\"title\":\"Scope\"},{\"level\":2,\"line\":9,\"title\":\"Edge VM\"},{\"level\":2,\"line\":19,\"title\":\"NetBird VPS\"},{\"level\":2,\"line\":34,\"title\":\"NetBird backup status\"},{\"level\":3,\"line\":37,\"title\":\"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb\"},{\"level\":2,\"line\":40,\"title\":\"NetBird backup timers\"},{\"level\":2,\"line\":46,\"title\":\"Important follow-ups\"},{\"level\":2,\"line\":54,\"title\":\"NetBird Uptime Kuma monitors\"},{\"level\":2,\"line\":64,\"title\":\"NetBird homelab peers\"},{\"level\":3,\"line\":69,\"title\":\"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0 UNKNOWN 100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 \"},{\"level\":2,\"line\":72,\"title\":\"NetBird peers health monitor\"},{\"level\":2,\"line\":88,\"title\":\"File Browser credential remediation\"},{\"level\":2,\"line\":98,\"title\":\"Proxmox private SSL via NetBird FQDN\"},{\"level\":2,\"line\":116,\"title\":\"File Browser backup, offhost sync, and restore validation\"},{\"level\":2,\"line\":150,\"title\":\"App stacks batch backup chain\"},{\"level\":2,\"line\":194,\"title\":\"Final backup and health baseline\"},{\"level\":2,\"line\":202,\"title\":\"Private NPMplus hosts via NetBird\"},{\"level\":2,\"line\":231,\"title\":\"Homepage VPN Authentik forward-auth\"},{\"level\":2,\"line\":244,\"title\":\"Homepage Authentik forward-auth rollback\"},{\"level\":2,\"line\":257,\"title\":\"Private VPN hosts safe baseline after Authentik rollback\"},{\"level\":2,\"line\":271,\"title\":\"Private VPN Hosts Kuma monitor\"},{\"level\":2,\"line\":289,\"title\":\"Private VPN Hosts health timer\"},{\"level\":2,\"line\":304,\"title\":\"Private VPN Hosts timer auto-cycle verified\"},{\"level\":2,\"line\":314,\"title\":\"Final ops snapshot — private VPN hosts\"},{\"level\":2,\"line\":326,\"title\":\"NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":348,\"title\":\"Corrected NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":367,\"title\":\"NPMplus + Kuma backup chain Kuma monitors\"},{\"level\":2,\"line\":382,\"title\":\"NPMplus + Kuma config backup timer\"},{\"level\":2,\"line\":398,\"title\":\"Authentik backup chain\"},{\"level\":2,\"line\":408,\"title\":\"Authentik backup chain Kuma monitors\"},{\"level\":2,\"line\":417,\"title\":\"Authentik backup timer\"},{\"level\":2,\"line\":431,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":441,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":445,\"title\":\"Gitea backup chain Kuma monitors\"},{\"level\":2,\"line\":454,\"title\":\"Gitea backup timer\"},{\"level\":2,\"line\":465,\"title\":\"Vaultwarden backup chain\"},{\"level\":2,\"line\":475,\"title\":\"Vaultwarden backup chain Kuma monitors\"},{\"level\":2,\"line\":484,\"title\":\"Vaultwarden backup timer\"},{\"level\":2,\"line\":495,\"title\":\"Edge VM manual vzdump backup\"},{\"level\":2,\"line\":502,\"title\":\"Edge VM vzdump offhost copy\"},{\"level\":2,\"line\":508,\"title\":\"Edge VM vzdump restore verification\"},{\"level\":2,\"line\":515,\"title\":\"Edge VM vzdump Kuma monitors\"},{\"level\":2,\"line\":528,\"title\":\"Edge VM vzdump weekly timer\"},{\"level\":2,\"line\":543,\"title\":\"Immich media backup existing automation inventory\"},{\"level\":2,\"line\":553,\"title\":\"Immich media restore verification\"},{\"level\":2,\"line\":560,\"title\":\"Immich media restore Kuma monitor\"},{\"level\":2,\"line\":570,\"title\":\"Immich media restore Kuma monitor correction\"},{\"level\":2,\"line\":577,\"title\":\"P0 backup baseline closure\"},{\"level\":2,\"line\":589,\"title\":\"P1 Mail.ru Cloud offsite inventory\"},{\"level\":2,\"line\":651,\"title\":\"P1 Mail.ru Cloud rclone config drift resolved\"},{\"level\":2,\"line\":667,\"title\":\"P1 Mail.ru Cloud canary\"},{\"level\":2,\"line\":675,\"title\":\"P1 Mail.ru Cloud production payload inventory\"},{\"level\":2,\"line\":710,\"title\":\"P1 Mail.ru Cloud critical baseline upload\"},{\"level\":2,\"line\":720,\"title\":\"P1 Mail.ru Cloud Kuma monitors\"},{\"level\":2,\"line\":732,\"title\":\"P1 Mail.ru Cloud edge-vm chunked large upload\"},{\"level\":2,\"line\":742,\"title\":\"P1 Mail.ru Cloud Edge VM Kuma monitor\"},{\"level\":2,\"line\":753,\"title\":\"P1 Mail.ru Cloud offsite seed closure\"},{\"level\":2,\"line\":776,\"title\":\"P1 Mail.ru Cloud critical upload automation\"},{\"level\":2,\"line\":791,\"title\":\"P1 Mail.ru Cloud edge-vm upload automation\"},{\"level\":2,\"line\":807,\"title\":\"P1 Mail.ru Cloud automation and retention closure\"},{\"level\":2,\"line\":829,\"title\":\"P1 Mail.ru Cloud restore drill automation\"},{\"level\":2,\"line\":843,\"title\":\"P2 Disaster Recovery runbook\"},{\"level\":2,\"line\":853,\"title\":\"P2 Critical bundle bootstrap drill\"},{\"level\":2,\"line\":870,\"title\":\"P2 Disaster Recovery bootstrap closure\"},{\"level\":2,\"line\":892,\"title\":\"Vaultwarden isolated restore drill — 2026-06-18\"},{\"level\":2,\"line\":929,\"title\":\"Daily cluster status report — 2026-06-18\"},{\"level\":2,\"line\":985,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":1012,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":1047,\"title\":\"Trivy scan mode after 2026-06-19 update wave\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"sensitive-assignment\"],\"sha256\":\"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6\",\"total_score\":86},{\"bytes\":89904,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 alert routing preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab\",\"total_score\":86},{\"bytes\":61327,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Services bootstrap snapshot — 2026-06-17\"},{\"level\":2,\"line\":3,\"title\":\"Scope\"},{\"level\":2,\"line\":9,\"title\":\"Edge VM\"},{\"level\":2,\"line\":19,\"title\":\"NetBird VPS\"},{\"level\":2,\"line\":34,\"title\":\"NetBird backup status\"},{\"level\":3,\"line\":37,\"title\":\"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb\"},{\"level\":2,\"line\":40,\"title\":\"NetBird backup timers\"},{\"level\":2,\"line\":46,\"title\":\"Important follow-ups\"},{\"level\":2,\"line\":54,\"title\":\"NetBird Uptime Kuma monitors\"},{\"level\":2,\"line\":64,\"title\":\"NetBird homelab peers\"},{\"level\":3,\"line\":69,\"title\":\"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0 UNKNOWN 100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 \"},{\"level\":2,\"line\":72,\"title\":\"NetBird peers health monitor\"},{\"level\":2,\"line\":88,\"title\":\"File Browser credential remediation\"},{\"level\":2,\"line\":98,\"title\":\"Proxmox private SSL via NetBird FQDN\"},{\"level\":2,\"line\":116,\"title\":\"File Browser backup, offhost sync, and restore validation\"},{\"level\":2,\"line\":150,\"title\":\"App stacks batch backup chain\"},{\"level\":2,\"line\":194,\"title\":\"Final backup and health baseline\"},{\"level\":2,\"line\":202,\"title\":\"Private NPMplus hosts via NetBird\"},{\"level\":2,\"line\":231,\"title\":\"Homepage VPN Authentik forward-auth\"},{\"level\":2,\"line\":244,\"title\":\"Homepage Authentik forward-auth rollback\"},{\"level\":2,\"line\":257,\"title\":\"Private VPN hosts safe baseline after Authentik rollback\"},{\"level\":2,\"line\":271,\"title\":\"Private VPN Hosts Kuma monitor\"},{\"level\":2,\"line\":289,\"title\":\"Private VPN Hosts health timer\"},{\"level\":2,\"line\":304,\"title\":\"Private VPN Hosts timer auto-cycle verified\"},{\"level\":2,\"line\":314,\"title\":\"Final ops snapshot — private VPN hosts\"},{\"level\":2,\"line\":326,\"title\":\"NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":348,\"title\":\"Corrected NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":367,\"title\":\"NPMplus + Kuma backup chain Kuma monitors\"},{\"level\":2,\"line\":382,\"title\":\"NPMplus + Kuma config backup timer\"},{\"level\":2,\"line\":398,\"title\":\"Authentik backup chain\"},{\"level\":2,\"line\":408,\"title\":\"Authentik backup chain Kuma monitors\"},{\"level\":2,\"line\":417,\"title\":\"Authentik backup timer\"},{\"level\":2,\"line\":431,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":441,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":445,\"title\":\"Gitea backup chain Kuma monitors\"},{\"level\":2,\"line\":454,\"title\":\"Gitea backup timer\"},{\"level\":2,\"line\":465,\"title\":\"Vaultwarden backup chain\"},{\"level\":2,\"line\":475,\"title\":\"Vaultwarden backup chain Kuma monitors\"},{\"level\":2,\"line\":484,\"title\":\"Vaultwarden backup timer\"},{\"level\":2,\"line\":495,\"title\":\"Edge VM manual vzdump backup\"},{\"level\":2,\"line\":502,\"title\":\"Edge VM vzdump offhost copy\"},{\"level\":2,\"line\":508,\"title\":\"Edge VM vzdump restore verification\"},{\"level\":2,\"line\":515,\"title\":\"Edge VM vzdump Kuma monitors\"},{\"level\":2,\"line\":528,\"title\":\"Edge VM vzdump weekly timer\"},{\"level\":2,\"line\":543,\"title\":\"Immich media backup existing automation inventory\"},{\"level\":2,\"line\":553,\"title\":\"Immich media restore verification\"},{\"level\":2,\"line\":560,\"title\":\"Immich media restore Kuma monitor\"},{\"level\":2,\"line\":570,\"title\":\"Immich media restore Kuma monitor correction\"},{\"level\":2,\"line\":577,\"title\":\"P0 backup baseline closure\"},{\"level\":2,\"line\":589,\"title\":\"P1 Mail.ru Cloud offsite inventory\"},{\"level\":2,\"line\":651,\"title\":\"P1 Mail.ru Cloud rclone config drift resolved\"},{\"level\":2,\"line\":667,\"title\":\"P1 Mail.ru Cloud canary\"},{\"level\":2,\"line\":675,\"title\":\"P1 Mail.ru Cloud production payload inventory\"},{\"level\":2,\"line\":710,\"title\":\"P1 Mail.ru Cloud critical baseline upload\"},{\"level\":2,\"line\":720,\"title\":\"P1 Mail.ru Cloud Kuma monitors\"},{\"level\":2,\"line\":732,\"title\":\"P1 Mail.ru Cloud edge-vm chunked large upload\"},{\"level\":2,\"line\":742,\"title\":\"P1 Mail.ru Cloud Edge VM Kuma monitor\"},{\"level\":2,\"line\":753,\"title\":\"P1 Mail.ru Cloud offsite seed closure\"},{\"level\":2,\"line\":776,\"title\":\"P1 Mail.ru Cloud critical upload automation\"},{\"level\":2,\"line\":791,\"title\":\"P1 Mail.ru Cloud edge-vm upload automation\"},{\"level\":2,\"line\":807,\"title\":\"P1 Mail.ru Cloud automation and retention closure\"},{\"level\":2,\"line\":829,\"title\":\"P1 Mail.ru Cloud restore drill automation\"},{\"level\":2,\"line\":843,\"title\":\"P2 Disaster Recovery runbook\"},{\"level\":2,\"line\":853,\"title\":\"P2 Critical bundle bootstrap drill\"},{\"level\":2,\"line\":870,\"title\":\"P2 Disaster Recovery bootstrap closure\"},{\"level\":2,\"line\":892,\"title\":\"Vaultwarden isolated restore drill — 2026-06-18\"},{\"level\":2,\"line\":929,\"title\":\"Daily cluster status report — 2026-06-18\"},{\"level\":2,\"line\":985,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":1012,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":1047,\"title\":\"Trivy scan mode after 2026-06-19 update wave\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"sensitive-assignment\"],\"sha256\":\"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6\",\"total_score\":86},{\"bytes\":89904,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 alert routing preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab\",\"total_score\":86},{\"bytes\":89904,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 alert routing preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab\",\"total_score\":86},{\"bytes\":8415,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":74,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"prometheus\"],\"network_and_dns\":[\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-05 CrowdSec LAPI monitoring coverage inventory\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Coverage summary\"},{\"level\":2,\"line\":31,\"title\":\"Runtime monitoring containers\"},{\"level\":2,\"line\":41,\"title\":\"Repo evidence sample\"},{\"level\":2,\"line\":69,\"title\":\"Kuma match sample\"},{\"level\":2,\"line\":76,\"title\":\"Prometheus related files\"},{\"level\":2,\"line\":80,\"title\":\"Edge health-file sample\"},{\"level\":2,\"line\":107,\"title\":\"pve01 health-file sample\"},{\"level\":2,\"line\":113,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25\",\"total_score\":83},{\"bytes\":4739,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"repair\",\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"NPMplus route-change safety runbook\"},{\"level\":2,\"line\":3,\"title\":\"Purpose\"},{\"level\":2,\"line\":9,\"title\":\"Scope\"},{\"level\":2,\"line\":23,\"title\":\"Forbidden actions unless explicitly approved\"},{\"level\":2,\"line\":36,\"title\":\"Required read-only preflight\"},{\"level\":2,\"line\":57,\"title\":\"Generated config discovery\"},{\"level\":2,\"line\":65,\"title\":\"Target and protocol decision tree\"},{\"level\":2,\"line\":74,\"title\":\"Required patch sequence\"},{\"level\":2,\"line\":93,\"title\":\"Rollback requirements\"},{\"level\":2,\"line\":99,\"title\":\"Redirect-loop checks\"},{\"level\":2,\"line\":111,\"title\":\"Adjacent component awareness\"},{\"level\":2,\"line\":125,\"title\":\"Adjacent smoke checks\"},{\"level\":2,\"line\":135,\"title\":\"Terminal command requirements\"},{\"level\":2,\"line\":148,\"title\":\"Closeout requirements\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"364e3146093a497342a308b35afcd38821564da0f72cfa3bc1b24e4b3b0d81a1\",\"total_score\":83},{\"bytes\":8415,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":74,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"prometheus\"],\"network_and_dns\":[\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-05 CrowdSec LAPI monitoring coverage inventory\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Coverage summary\"},{\"level\":2,\"line\":31,\"title\":\"Runtime monitoring containers\"},{\"level\":2,\"line\":41,\"title\":\"Repo evidence sample\"},{\"level\":2,\"line\":69,\"title\":\"Kuma match sample\"},{\"level\":2,\"line\":76,\"title\":\"Prometheus related files\"},{\"level\":2,\"line\":80,\"title\":\"Edge health-file sample\"},{\"level\":2,\"line\":107,\"title\":\"pve01 health-file sample\"},{\"level\":2,\"line\":113,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25\",\"total_score\":83},{\"bytes\":4739,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"repair\",\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"NPMplus route-change safety runbook\"},{\"level\":2,\"line\":3,\"title\":\"Purpose\"},{\"level\":2,\"line\":9,\"title\":\"Scope\"},{\"level\":2,\"line\":23,\"title\":\"Forbidden actions unless explicitly approved\"},{\"level\":2,\"line\":36,\"title\":\"Required read-only preflight\"},{\"level\":2,\"line\":57,\"title\":\"Generated config discovery\"},{\"level\":2,\"line\":65,\"title\":\"Target and protocol decision tree\"},{\"level\":2,\"line\":74,\"title\":\"Required patch sequence\"},{\"level\":2,\"line\":93,\"title\":\"Rollback requirements\"},{\"level\":2,\"line\":99,\"title\":\"Redirect-loop checks\"},{\"level\":2,\"line\":111,\"title\":\"Adjacent component awareness\"},{\"level\":2,\"line\":125,\"title\":\"Adjacent smoke checks\"},{\"level\":2,\"line\":135,\"title\":\"Terminal command requirements\"},{\"level\":2,\"line\":148,\"title\":\"Closeout requirements\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"364e3146093a497342a308b35afcd38821564da0f72cfa3bc1b24e4b3b0d81a1\",\"total_score\":83},{\"bytes\":8415,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":74,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"prometheus\"],\"network_and_dns\":[\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-05 CrowdSec LAPI monitoring coverage inventory\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Coverage summary\"},{\"level\":2,\"line\":31,\"title\":\"Runtime monitoring containers\"},{\"level\":2,\"line\":41,\"title\":\"Repo evidence sample\"},{\"level\":2,\"line\":69,\"title\":\"Kuma match sample\"},{\"level\":2,\"line\":76,\"title\":\"Prometheus related files\"},{\"level\":2,\"line\":80,\"title\":\"Edge health-file sample\"},{\"level\":2,\"line\":107,\"title\":\"pve01 health-file sample\"},{\"level\":2,\"line\":113,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25\",\"total_score\":83},{\"bytes\":2463,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2 Ideal Cluster program init\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Starting counters\"},{\"level\":2,\"line\":15,\"title\":\"Baseline\"},{\"level\":2,\"line\":21,\"title\":\"Safety model\"},{\"level\":2,\"line\":30,\"title\":\"Workstreams\"},{\"level\":3,\"line\":32,\"title\":\"P2-A DR and restore maturity\"},{\"level\":3,\"line\":40,\"title\":\"P2-B Network and ingress source of truth\"},{\"level\":3,\"line\":47,\"title\":\"P2-C Access control and service policy\"},{\"level\":3,\"line\":54,\"title\":\"P2-D Observability closure\"},{\"level\":3,\"line\":62,\"title\":\"P2-E Backup coverage for services\"},{\"level\":3,\"line\":70,\"title\":\"P2-F Security hardening\"},{\"level\":3,\"line\":78,\"title\":\"P2-G NetBox and documentation source of truth\"},{\"level\":2,\"line\":86,\"title\":\"First selected task\"},{\"level\":2,\"line\":90,\"title\":\"Safety boundary\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1\",\"total_score\":81},{\"bytes\":2463,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2 Ideal Cluster program init\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Starting counters\"},{\"level\":2,\"line\":15,\"title\":\"Baseline\"},{\"level\":2,\"line\":21,\"title\":\"Safety model\"},{\"level\":2,\"line\":30,\"title\":\"Workstreams\"},{\"level\":3,\"line\":32,\"title\":\"P2-A DR and restore maturity\"},{\"level\":3,\"line\":40,\"title\":\"P2-B Network and ingress source of truth\"},{\"level\":3,\"line\":47,\"title\":\"P2-C Access control and service policy\"},{\"level\":3,\"line\":54,\"title\":\"P2-D Observability closure\"},{\"level\":3,\"line\":62,\"title\":\"P2-E Backup coverage for services\"},{\"level\":3,\"line\":70,\"title\":\"P2-F Security hardening\"},{\"level\":3,\"line\":78,\"title\":\"P2-G NetBox and documentation source of truth\"},{\"level\":2,\"line\":86,\"title\":\"First selected task\"},{\"level\":2,\"line\":90,\"title\":\"Safety boundary\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1\",\"total_score\":81},{\"bytes\":2463,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2 Ideal Cluster program init\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Starting counters\"},{\"level\":2,\"line\":15,\"title\":\"Baseline\"},{\"level\":2,\"line\":21,\"title\":\"Safety model\"},{\"level\":2,\"line\":30,\"title\":\"Workstreams\"},{\"level\":3,\"line\":32,\"title\":\"P2-A DR and restore maturity\"},{\"level\":3,\"line\":40,\"title\":\"P2-B Network and ingress source of truth\"},{\"level\":3,\"line\":47,\"title\":\"P2-C Access control and service policy\"},{\"level\":3,\"line\":54,\"title\":\"P2-D Observability closure\"},{\"level\":3,\"line\":62,\"title\":\"P2-E Backup coverage for services\"},{\"level\":3,\"line\":70,\"title\":\"P2-F Security hardening\"},{\"level\":3,\"line\":78,\"title\":\"P2-G NetBox and documentation source of truth\"},{\"level\":2,\"line\":86,\"title\":\"First selected task\"},{\"level\":2,\"line\":90,\"title\":\"Safety boundary\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1\",\"total_score\":81},{\"bytes\":504281,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"internet\",\"nginx\"],\"guests_and_workloads\":[\"container\",\"lxc\",\"workload\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\",\"ошиб\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"MkDocs refresh discovery\"},{\"level\":2,\"line\":7,\"title\":\"Raw output\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"sensitive-assignment\"],\"sha256\":\"1ac8fe15ebd06db8ef3a9c6127fe5efe7ecbb76d395abbe551c249b249492d21\",\"total_score\":80},{\"bytes\":3398,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"dns\",\"domain\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"00. Restore from zero for beginners\"},{\"level\":2,\"line\":7,\"title\":\"0. What must be available before restore\"},{\"level\":2,\"line\":17,\"title\":\"1. Restore physical and network layer\"},{\"level\":2,\"line\":25,\"title\":\"2. Restore Proxmox nodes\"},{\"level\":2,\"line\":35,\"title\":\"3. Restore DNS first\"},{\"level\":2,\"line\":48,\"title\":\"4. Restore edge-vm\"},{\"level\":2,\"line\":66,\"title\":\"5. Restore Nextcloud VM\"},{\"level\":2,\"line\":78,\"title\":\"6. Validate router NAT\"},{\"level\":2,\"line\":88,\"title\":\"7. Validate main URLs\"},{\"level\":2,\"line\":100,\"title\":\"8. Validate backup health\"},{\"level\":2,\"line\":110,\"title\":\"9. Validate monitoring\"},{\"level\":2,\"line\":125,\"title\":\"10. After restore\"},{\"level\":2,\"line\":134,\"title\":\"11. Known mistakes to avoid\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"5e430e17e36b23faa90caa38b019485cf09640c94011828e18841b0e361e4470\",\"total_score\":78},{\"bytes\":3785,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"internal service\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"01. Add new service runbook\"},{\"level\":2,\"line\":5,\"title\":\"Rule zero\"},{\"level\":2,\"line\":9,\"title\":\"1. Precheck\"},{\"level\":2,\"line\":22,\"title\":\"2. DNS\"},{\"level\":2,\"line\":32,\"title\":\"3. Install container\"},{\"level\":2,\"line\":46,\"title\":\"4. Local validation\"},{\"level\":2,\"line\":56,\"title\":\"5. NPMplus\"},{\"level\":2,\"line\":68,\"title\":\"6. Certificate\"},{\"level\":2,\"line\":88,\"title\":\"7. Monitoring\"},{\"level\":2,\"line\":103,\"title\":\"8. Homepage\"},{\"level\":2,\"line\":109,\"title\":\"9. Service note\"},{\"level\":2,\"line\":127,\"title\":\"10. Backup\"},{\"level\":2,\"line\":135,\"title\":\"11. Baseline\"},{\"level\":2,\"line\":141,\"title\":\"12. MASTER_STATUS\"},{\"level\":2,\"line\":147,\"title\":\"13. Git documentation\"},{\"level\":2,\"line\":155,\"title\":\"Known mistakes to avoid\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c8634bd21ce16651970e1a6bdfba6fba9fd84fac030cd53a41798dc92b3ca81c\",\"total_score\":77},{\"bytes\":15818,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28\",\"total_score\":76},{\"bytes\":31410,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"journal\",\"metric\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\",\"volume\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"path_score\":12,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da\",\"total_score\":76},{\"bytes\":15818,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28\",\"total_score\":76},{\"bytes\":31410,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"journal\",\"metric\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\",\"volume\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"path_score\":12,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da\",\"total_score\":76},{\"bytes\":15818,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28\",\"total_score\":76},{\"bytes\":31410,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"journal\",\"metric\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\",\"volume\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"path_score\":12,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da\",\"total_score\":76},{\"bytes\":4960,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-12 final ideal cluster closeout\"},{\"level\":2,\"line\":7,\"title\":\"Plain explanation\"},{\"level\":2,\"line\":17,\"title\":\"Final state\"},{\"level\":2,\"line\":32,\"title\":\"P3 task summary\"},{\"level\":2,\"line\":48,\"title\":\"Residual gaps to true 100\"},{\"level\":2,\"line\":60,\"title\":\"Checks\"},{\"level\":2,\"line\":73,\"title\":\"Next task\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b\",\"total_score\":75},{\"bytes\":4960,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-12 final ideal cluster closeout\"},{\"level\":2,\"line\":7,\"title\":\"Plain explanation\"},{\"level\":2,\"line\":17,\"title\":\"Final state\"},{\"level\":2,\"line\":32,\"title\":\"P3 task summary\"},{\"level\":2,\"line\":48,\"title\":\"Residual gaps to true 100\"},{\"level\":2,\"line\":60,\"title\":\"Checks\"},{\"level\":2,\"line\":73,\"title\":\"Next task\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b\",\"total_score\":75},{\"bytes\":4960,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-12 final ideal cluster closeout\"},{\"level\":2,\"line\":7,\"title\":\"Plain explanation\"},{\"level\":2,\"line\":17,\"title\":\"Final state\"},{\"level\":2,\"line\":32,\"title\":\"P3 task summary\"},{\"level\":2,\"line\":48,\"title\":\"Residual gaps to true 100\"},{\"level\":2,\"line\":60,\"title\":\"Checks\"},{\"level\":2,\"line\":73,\"title\":\"Next task\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b\",\"total_score\":75},{\"bytes\":1585,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"error_learning\":[\"incident\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"grafana\"],\"storage\":[\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab recovery runbooks\"},{\"level\":2,\"line\":5,\"title\":\"Global first command\"},{\"level\":2,\"line\":12,\"title\":\"Runbooks\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/04_homelab-desired-state/runbooks/INDEX.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"fbaa19446121d3bdb225c82e33e274a91bc414e3786e2f0df49145db1f95f851\",\"total_score\":75},{\"bytes\":56894,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":18,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92\",\"total_score\":74},{\"bytes\":20108,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-09 health surface WARN/OTHER status register\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":13,\"title\":\"Counters\"},{\"level\":2,\"line\":22,\"title\":\"Summary\"},{\"level\":2,\"line\":31,\"title\":\"Proposed class counts\"},{\"level\":2,\"line\":39,\"title\":\"Service hint counts\"},{\"level\":2,\"line\":47,\"title\":\"Register rows\"},{\"level\":2,\"line\":136,\"title\":\"Category meanings\"},{\"level\":2,\"line\":146,\"title\":\"Rules\"},{\"level\":2,\"line\":154,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":158,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2\",\"total_score\":74},{\"bytes\":56894,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":18,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92\",\"total_score\":74},{\"bytes\":20108,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-09 health surface WARN/OTHER status register\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":13,\"title\":\"Counters\"},{\"level\":2,\"line\":22,\"title\":\"Summary\"},{\"level\":2,\"line\":31,\"title\":\"Proposed class counts\"},{\"level\":2,\"line\":39,\"title\":\"Service hint counts\"},{\"level\":2,\"line\":47,\"title\":\"Register rows\"},{\"level\":2,\"line\":136,\"title\":\"Category meanings\"},{\"level\":2,\"line\":146,\"title\":\"Rules\"},{\"level\":2,\"line\":154,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":158,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2\",\"total_score\":74},{\"bytes\":56894,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":18,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92\",\"total_score\":74},{\"bytes\":20108,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-09 health surface WARN/OTHER status register\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":13,\"title\":\"Counters\"},{\"level\":2,\"line\":22,\"title\":\"Summary\"},{\"level\":2,\"line\":31,\"title\":\"Proposed class counts\"},{\"level\":2,\"line\":39,\"title\":\"Service hint counts\"},{\"level\":2,\"line\":47,\"title\":\"Register rows\"},{\"level\":2,\"line\":136,\"title\":\"Category meanings\"},{\"level\":2,\"line\":146,\"title\":\"Rules\"},{\"level\":2,\"line\":154,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":158,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2\",\"total_score\":74},{\"bytes\":171784,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f\",\"total_score\":73},{\"bytes\":1555,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":62,\"coverage\":{\"access_and_admin\":[\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"monitoring_and_logs\":[\"prometheus\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Proxmox exporter runbook\"},{\"level\":2,\"line\":3,\"title\":\"Location\"},{\"level\":2,\"line\":11,\"title\":\"Secret handling\"},{\"level\":2,\"line\":19,\"title\":\"Exporter health\"},{\"level\":2,\"line\":31,\"title\":\"Prometheus checks\"},{\"level\":2,\"line\":50,\"title\":\"PVE permissions\"},{\"level\":2,\"line\":57,\"title\":\"Rollback\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/proxmox-exporter.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"ebcd3f4d48f72038a99d5d8f795c224942723be4ab4db46803664895ff975bad\",\"total_score\":73},{\"bytes\":171784,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f\",\"total_score\":73},{\"bytes\":171784,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f\",\"total_score\":73},{\"bytes\":84145,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"guests_and_workloads\":[\"container\",\"qemu\",\"workload\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"tls\"],\"storage\":[\"lvm\",\"thin\",\"disk\",\"volume\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 edge cleanup preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-edge-cleanup-preflight-20260624T192250Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620\",\"total_score\":72},{\"bytes\":19149,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"url\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"corosync\"],\"monitoring_and_logs\":[\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"dns\"],\"storage\":[\"storage\",\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1 AdGuardHome sync image policy preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4\",\"total_score\":72},{\"bytes\":2268,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":58,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\",\"nginx\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-23 Next safe backlog after NPMplus runbook close\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Next task\"},{\"level\":2,\"line\":13,\"title\":\"Reason\"},{\"level\":2,\"line\":19,\"title\":\"Input facts\"},{\"level\":2,\"line\":29,\"title\":\"P1-24 expected output\"},{\"level\":2,\"line\":41,\"title\":\"P1-24 safety boundary\"},{\"level\":2,\"line\":58,\"title\":\"Required carry-forward guardrails\"},{\"level\":2,\"line\":75,\"title\":\"Command protocol\"},{\"level\":2,\"line\":82,\"title\":\"DOCX policy\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf\",\"total_score\":72},{\"bytes\":84145,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"guests_and_workloads\":[\"container\",\"qemu\",\"workload\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"tls\"],\"storage\":[\"lvm\",\"thin\",\"disk\",\"volume\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 edge cleanup preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-edge-cleanup-preflight-20260624T192250Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620\",\"total_score\":72},{\"bytes\":19149,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"url\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"corosync\"],\"monitoring_and_logs\":[\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"dns\"],\"storage\":[\"storage\",\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1 AdGuardHome sync image policy preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4\",\"total_score\":72},{\"bytes\":2268,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":58,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\",\"nginx\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-23 Next safe backlog after NPMplus runbook close\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Next task\"},{\"level\":2,\"line\":13,\"title\":\"Reason\"},{\"level\":2,\"line\":19,\"title\":\"Input facts\"},{\"level\":2,\"line\":29,\"title\":\"P1-24 expected output\"},{\"level\":2,\"line\":41,\"title\":\"P1-24 safety boundary\"},{\"level\":2,\"line\":58,\"title\":\"Required carry-forward guardrails\"},{\"level\":2,\"line\":75,\"title\":\"Command protocol\"},{\"level\":2,\"line\":82,\"title\":\"DOCX policy\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf\",\"total_score\":72},{\"bytes\":84145,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"guests_and_workloads\":[\"container\",\"qemu\",\"workload\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"tls\"],\"storage\":[\"lvm\",\"thin\",\"disk\",\"volume\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 edge cleanup preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-edge-cleanup-preflight-20260624T192250Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620\",\"total_score\":72},{\"bytes\":19149,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"url\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"corosync\"],\"monitoring_and_logs\":[\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"dns\"],\"storage\":[\"storage\",\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1 AdGuardHome sync image policy preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4\",\"total_score\":72},{\"bytes\":2268,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":58,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\",\"nginx\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-23 Next safe backlog after NPMplus runbook close\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Next task\"},{\"level\":2,\"line\":13,\"title\":\"Reason\"},{\"level\":2,\"line\":19,\"title\":\"Input facts\"},{\"level\":2,\"line\":29,\"title\":\"P1-24 expected output\"},{\"level\":2,\"line\":41,\"title\":\"P1-24 safety boundary\"},{\"level\":2,\"line\":58,\"title\":\"Required carry-forward guardrails\"},{\"level\":2,\"line\":75,\"title\":\"Command protocol\"},{\"level\":2,\"line\":82,\"title\":\"DOCX policy\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf\",\"total_score\":72},{\"bytes\":43565,\"commit\":\"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17\",\"content_score\":62,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\"],\"change_safety\":[\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\"],\"storage\":[\"thin\"]},\"headings\":[],\"json_top_level_size\":5,\"json_top_level_type\":\"dict\",\"path\":\"inventory/services.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0017-inventory-foundation\"],\"sensitive_findings\":[],\"sha256\":\"189ab606f9de7b379b03510aef024def88ab91a1e2782d0c7d74fe93fa61509b\",\"total_score\":71},{\"bytes\":2281,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"access_and_admin\":[\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"monitoring_and_logs\":[\"metric\",\"prometheus\"],\"storage\":[\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"smartmontools + node_exporter textfile runbook\"},{\"level\":2,\"line\":3,\"title\":\"Scope\"},{\"level\":2,\"line\":18,\"title\":\"Local checks on a PVE node\"},{\"level\":2,\"line\":40,\"title\":\"Prometheus checks from edge-vm\"},{\"level\":2,\"line\":54,\"title\":\"Expected metrics\"},{\"level\":2,\"line\":63,\"title\":\"Rollback\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/smartmontools-node-exporter.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"8bbdc976a24aadb0943ef386486d11f58f4e8b16b6589f519d2b5d99b2bdcaca\",\"total_score\":71},{\"bytes\":32948,\"commit\":\"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"cluster\",\"node\",\"quorum\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0017-inventory-foundation\"],\"sensitive_findings\":[],\"sha256\":\"3e79648b565bad680dbafbda376155ce48e74bd9deaeda58b3425906ac025ab0\",\"total_score\":70},{\"bytes\":26500,\"commit\":\"f5b22d867ea467987008408e3fb1fb0e17fa7b2e\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"cluster\",\"node\",\"quorum\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook\"],\"sensitive_findings\":[],\"sha256\":\"5dab56a2e73e4a3582d4792b91a0c803d485e68b40791bc456315748b15490a0\",\"total_score\":70},{\"bytes\":29485,\"commit\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"cluster\",\"node\",\"quorum\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition\",\"refs/heads/main\",\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"8051e3e761493a1b7088a0f3ed7e0aa9218673f453ca88171178364d26701f64\",\"total_score\":70},{\"bytes\":5868,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-20 Exposure matrix repo preflight\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":12,\"title\":\"Safety boundary\"},{\"level\":2,\"line\":22,\"title\":\"Matching file paths\"},{\"level\":2,\"line\":105,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30\",\"total_score\":70},{\"bytes\":8774,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e\",\"total_score\":70},{\"bytes\":7063,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-02 privilege risk classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Classification summary\"},{\"level\":2,\"line\":27,\"title\":\"Review table\"},{\"level\":2,\"line\":40,\"title\":\"Detailed classification\"},{\"level\":3,\"line\":42,\"title\":\"authentik-worker-1\"},{\"level\":3,\"line\":68,\"title\":\"cadvisor\"},{\"level\":3,\"line\":93,\"title\":\"dockge\"},{\"level\":3,\"line\":119,\"title\":\"npmplus\"},{\"level\":3,\"line\":146,\"title\":\"homeassistant\"},{\"level\":3,\"line\":173,\"title\":\"homelab-registry-cache\"},{\"level\":3,\"line\":199,\"title\":\"kopia\"},{\"level\":3,\"line\":225,\"title\":\"socket-proxy\"},{\"level\":2,\"line\":253,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2\",\"total_score\":70},{\"bytes\":16075,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a\",\"total_score\":70},{\"bytes\":61338,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":19,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0\",\"total_score\":70},{\"bytes\":15688,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface findings classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Overall classification\"},{\"level\":2,\"line\":28,\"title\":\"Source summary\"},{\"level\":2,\"line\":40,\"title\":\"Category counts\"},{\"level\":2,\"line\":47,\"title\":\"Classified findings\"},{\"level\":2,\"line\":132,\"title\":\"Interpretation\"},{\"level\":2,\"line\":138,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b\",\"total_score\":70},{\"bytes\":18777,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":23,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca\",\"total_score\":70},{\"bytes\":9282,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface normalization plan\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Starting classification\"},{\"level\":2,\"line\":33,\"title\":\"Normalization tracks\"},{\"level\":2,\"line\":42,\"title\":\"Implementation sequence\"},{\"level\":2,\"line\":51,\"title\":\"Sample findings carried forward\"},{\"level\":2,\"line\":98,\"title\":\"Guardrails\"},{\"level\":2,\"line\":107,\"title\":\"Future close criteria\"},{\"level\":2,\"line\":115,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":121,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507\",\"total_score\":70},{\"bytes\":5868,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-20 Exposure matrix repo preflight\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":12,\"title\":\"Safety boundary\"},{\"level\":2,\"line\":22,\"title\":\"Matching file paths\"},{\"level\":2,\"line\":105,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30\",\"total_score\":70},{\"bytes\":8774,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e\",\"total_score\":70},{\"bytes\":7063,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-02 privilege risk classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Classification summary\"},{\"level\":2,\"line\":27,\"title\":\"Review table\"},{\"level\":2,\"line\":40,\"title\":\"Detailed classification\"},{\"level\":3,\"line\":42,\"title\":\"authentik-worker-1\"},{\"level\":3,\"line\":68,\"title\":\"cadvisor\"},{\"level\":3,\"line\":93,\"title\":\"dockge\"},{\"level\":3,\"line\":119,\"title\":\"npmplus\"},{\"level\":3,\"line\":146,\"title\":\"homeassistant\"},{\"level\":3,\"line\":173,\"title\":\"homelab-registry-cache\"},{\"level\":3,\"line\":199,\"title\":\"kopia\"},{\"level\":3,\"line\":225,\"title\":\"socket-proxy\"},{\"level\":2,\"line\":253,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2\",\"total_score\":70},{\"bytes\":16075,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a\",\"total_score\":70},{\"bytes\":61338,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":19,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0\",\"total_score\":70},{\"bytes\":15688,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface findings classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Overall classification\"},{\"level\":2,\"line\":28,\"title\":\"Source summary\"},{\"level\":2,\"line\":40,\"title\":\"Category counts\"},{\"level\":2,\"line\":47,\"title\":\"Classified findings\"},{\"level\":2,\"line\":132,\"title\":\"Interpretation\"},{\"level\":2,\"line\":138,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b\",\"total_score\":70},{\"bytes\":18777,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":23,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca\",\"total_score\":70},{\"bytes\":9282,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface normalization plan\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Starting classification\"},{\"level\":2,\"line\":33,\"title\":\"Normalization tracks\"},{\"level\":2,\"line\":42,\"title\":\"Implementation sequence\"},{\"level\":2,\"line\":51,\"title\":\"Sample findings carried forward\"},{\"level\":2,\"line\":98,\"title\":\"Guardrails\"},{\"level\":2,\"line\":107,\"title\":\"Future close criteria\"},{\"level\":2,\"line\":115,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":121,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507\",\"total_score\":70},{\"bytes\":5868,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-20 Exposure matrix repo preflight\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":12,\"title\":\"Safety boundary\"},{\"level\":2,\"line\":22,\"title\":\"Matching file paths\"},{\"level\":2,\"line\":105,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30\",\"total_score\":70},{\"bytes\":8774,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e\",\"total_score\":70},{\"bytes\":7063,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-02 privilege risk classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Classification summary\"},{\"level\":2,\"line\":27,\"title\":\"Review table\"},{\"level\":2,\"line\":40,\"title\":\"Detailed classification\"},{\"level\":3,\"line\":42,\"title\":\"authentik-worker-1\"},{\"level\":3,\"line\":68,\"title\":\"cadvisor\"},{\"level\":3,\"line\":93,\"title\":\"dockge\"},{\"level\":3,\"line\":119,\"title\":\"npmplus\"},{\"level\":3,\"line\":146,\"title\":\"homeassistant\"},{\"level\":3,\"line\":173,\"title\":\"homelab-registry-cache\"},{\"level\":3,\"line\":199,\"title\":\"kopia\"},{\"level\":3,\"line\":225,\"title\":\"socket-proxy\"},{\"level\":2,\"line\":253,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2\",\"total_score\":70},{\"bytes\":16075,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a\",\"total_score\":70},{\"bytes\":61338,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":19,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0\",\"total_score\":70},{\"bytes\":15688,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface findings classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Overall classification\"},{\"level\":2,\"line\":28,\"title\":\"Source summary\"},{\"level\":2,\"line\":40,\"title\":\"Category counts\"},{\"level\":2,\"line\":47,\"title\":\"Classified findings\"},{\"level\":2,\"line\":132,\"title\":\"Interpretation\"},{\"level\":2,\"line\":138,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b\",\"total_score\":70},{\"bytes\":18777,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":23,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca\",\"total_score\":70},{\"bytes\":9282,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface normalization plan\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Starting classification\"},{\"level\":2,\"line\":33,\"title\":\"Normalization tracks\"},{\"level\":2,\"line\":42,\"title\":\"Implementation sequence\"},{\"level\":2,\"line\":51,\"title\":\"Sample findings carried forward\"},{\"level\":2,\"line\":98,\"title\":\"Guardrails\"},{\"level\":2,\"line\":107,\"title\":\"Future close criteria\"},{\"level\":2,\"line\":115,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":121,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507\",\"total_score\":70},{\"bytes\":946,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":56,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"error_learning\":[\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Runbook: cluster-admin-incident-engine\"},{\"level\":2,\"line\":3,\"title\":\"Current verified backup state\"},{\"level\":2,\"line\":12,\"title\":\"First checks\"},{\"level\":2,\"line\":19,\"title\":\"Safe recovery rule\"},{\"level\":2,\"line\":22,\"title\":\"Evidence commands\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/04_homelab-desired-state/runbooks/cluster-admin-incident-engine.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"304ca47a962dbc921b18f465bbc433580e71e2fdecf6b868ff4cfc30daebac34\",\"total_score\":70},{\"bytes\":26140,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"superseded\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-11-health-surface-p1-file-operator-decision-package-20260625T234808Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3d85ce8de8cc17b76fde6fa144b918000f052c847780529b9caa98ccc0f10c80\",\"total_score\":69},{\"bytes\":3023,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[],\"json_top_level_size\":9,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"4983daf23fd88331c0985a6a794cebfb06731768766e277f10ac847174eba312\",\"total_score\":69},{\"bytes\":2982,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"error_learning\":[\"regression\"],\"external_services\":[\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"domain\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-01 evidence-based cluster score model\"},{\"level\":2,\"line\":5,\"title\":\"Final score for this baseline\"},{\"level\":2,\"line\":11,\"title\":\"Key findings\"},{\"level\":2,\"line\":21,\"title\":\"Score domains\"},{\"level\":2,\"line\":33,\"title\":\"Actions required to reach 100/100\"},{\"level\":2,\"line\":49,\"title\":\"Safety state\"},{\"level\":2,\"line\":56,\"title\":\"Next task\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-01-cluster-ideal-state-evidence-based-score-model-20260626T040011Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"17ea887feea2f371871c0e3155bcc3f3dd979dca0627d32e4f01da6ba8241e42\",\"total_score\":69},{\"bytes\":2502,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":52,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\"],\"error_learning\":[\"regression\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-11 final CI/no-regression/runbooks inventory\"},{\"level\":2,\"line\":5,\"title\":\"Plain explanation\"},{\"level\":2,\"line\":11,\"title\":\"Summary\"},{\"level\":2,\"line\":25,\"title\":\"Close artifacts\"},{\"level\":2,\"line\":38,\"title\":\"Redaction\"},{\"level\":2,\"line\":42,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.md\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c610e8118037cdf7239ce61bac44dda4dfc8af4ca4c9d7166829e0ef56241bcb\",\"total_score\":69},{\"bytes\":1375,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":58,\"coverage\":{\"access_and_admin\":[\"access\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\"],\"change_safety\":[\"rollback\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"repair_and_troubleshooting\":[\"diagnostic\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Scrutiny pve01 runbook\"},{\"level\":2,\"line\":3,\"title\":\"Location\"},{\"level\":2,\"line\":10,\"title\":\"Health check\"},{\"level\":2,\"line\":26,\"title\":\"Logs\"},{\"level\":2,\"line\":32,\"title\":\"Data\"},{\"level\":2,\"line\":41,\"title\":\"Access\"},{\"level\":2,\"line\":51,\"title\":\"Relationship with Prometheus SMART monitoring\"},{\"level\":2,\"line\":59,\"title\":\"Rollback\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/scrutiny-pve01.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"e8e03dc156536ae569e4f42bb7baf715495c91ad24d3e16924bd329ce74dc12c\",\"total_score\":69},{\"bytes\":26140,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"superseded\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-11-health-surface-p1-file-operator-decision-package-20260625T234808Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3d85ce8de8cc17b76fde6fa144b918000f052c847780529b9caa98ccc0f10c80\",\"total_score\":69},{\"bytes\":3023,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[],\"json_top_level_size\":9,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"4983daf23fd88331c0985a6a794cebfb06731768766e277f10ac847174eba312\",\"total_score\":69}],\"error_artifacts_omitted\":60,\"handbook_candidates\":[{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n - UPnP/IGD discovery\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n - UPnP/IGD discovery\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n - UPnP/IGD discovery\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":1079183,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":102,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"бэкап\",\"restore\",\"восстанов\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"error_learning\":[\"regression\",\"incident\",\"superseded\"],\"external_services\":[\"внешн\",\"public\",\"reverse proxy\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"внутренн\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"repair\",\"troubleshoot\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"excerpt\":\"\",\"headings\":[],\"json_top_level_size\":1000,\"json_top_level_type\":\"list\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"url-userinfo\"],\"sha256\":\"aeb92358514ec5cd67d557f15ea295b3ae4f25df5f17a14556dae750b8496d1b\",\"total_score\":102},{\"bytes\":9499,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":88,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"internet\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"internal service\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"excerpt\":\"# DR from zero runbook, 2026-06-22\\n\\nChecked at UTC: `2026-06-22T09:00:38Z`.\\n\\nMarker: **DR from zero runbook, 2026-06-22**\\n\\n## Purpose\\n\\nThis runbook describes how to rebuild a minimum viable homelab from zero after a serious failure.\\n\\nIt is not a restore execution log. It is a step-by-step operator procedure.\\n\\n## Scope\\n\\nThe goal is to recover enough infrastructure to regain access, documentation, identity, routing, secrets, Git, backup visibility, and then stateful applications.\\n\\nMinimum viable homelab means:\\n\\n- SSH access works;\\n- VPN/Tailscale/NetBird access works or has a known temporary replacement;\\n- Git repository is available;\\n- SOPS/age secrets can be decrypted;\\n- MkDocs documentation is published;\\n- NPMplus routes can be restored;\\n- Authentik, Gitea, Vaultwarden, NetBox, and Uptime Kuma can be restored;\\n- backup/offhost locations are visible;\\n- health checks prove the restored state.\\n\\n## Current known source-of-truth commits\\n\\n- Backup coverage closure: completed before this runbook.\\n- MkDocs publish hardening: completed.\\n- Backup tiering table: completed.\\n- Current repo head when starting this runbook: `adb8c55`.\\n\\n## P0 restore order\\n\\n| Order | Component | Why first | Expec\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"DR from zero runbook, 2026-06-22\"},{\"level\":2,\"line\":7,\"title\":\"Purpose\"},{\"level\":2,\"line\":13,\"title\":\"Scope\"},{\"level\":2,\"line\":29,\"title\":\"Current known source-of-truth commits\"},{\"level\":2,\"line\":36,\"title\":\"P0 restore order\"},{\"level\":2,\"line\":55,\"title\":\"Critical backup sources\"},{\"level\":2,\"line\":71,\"title\":\"Phase 0 — stop and preserve evidence\"},{\"level\":2,\"line\":86,\"title\":\"Phase 1 — base host recovery\"},{\"level\":2,\"line\":104,\"title\":\"Phase 2 — network access\"},{\"level\":2,\"line\":119,\"title\":\"Phase 3 — clone repository\"},{\"level\":2,\"line\":136,\"title\":\"Phase 4 — restore secrets/SOPS\"},{\"level\":2,\"line\":155,\"title\":\"Phase 5 — restore documentation first\"},{\"level\":2,\"line\":173,\"title\":\"Phase 6 — recover NPMplus and Uptime Kuma\"},{\"level\":2,\"line\":197,\"title\":\"Phase 7 — recover Authentik\"},{\"level\":2,\"line\":215,\"title\":\"Phase 8 — recover Gitea\"},{\"level\":2,\"line\":230,\"title\":\"Phase 9 — recover Vaultwarden\"},{\"level\":2,\"line\":244,\"title\":\"Phase 10 — recover NetBox\"},{\"level\":2,\"line\":270,\"title\":\"Phase 11 — recover Edge VM\"},{\"level\":2,\"line\":291,\"title\":\"Phase 12 — recover user data services\"},{\"level\":2,\"line\":306,\"title\":\"Phase 13 — restore monitoring and alerting\"},{\"level\":2,\"line\":325,\"title\":\"Do not do\"},{\"level\":2,\"line\":334,\"title\":\"Final DR closure checklist\"},{\"level\":2,\"line\":353,\"title\":\"Next improvement after this runbook\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f8312cd7cd0a296c60950a60c7866a67b19a70016b93f68b3a76b78d5440cb63\",\"total_score\":102},{\"bytes\":9386,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Disaster Recovery Runbook\"},{\"level\":2,\"line\":6,\"title\":\"Current verified recovery anchors\"},{\"level\":2,\"line\":25,\"title\":\"Things that must exist outside the repo\"},{\"level\":2,\"line\":39,\"title\":\"Recovery priority\"},{\"level\":2,\"line\":51,\"title\":\"Phase 0: establish a control host\"},{\"level\":2,\"line\":65,\"title\":\"Phase 1: restore rclone access\"},{\"level\":2,\"line\":90,\"title\":\"Phase 2: restore the critical/small cloud bundle\"},{\"level\":1,\"line\":107,\"title\":\"Expected:\"},{\"level\":1,\"line\":108,\"title\":\"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c\"},{\"level\":2,\"line\":130,\"title\":\"Phase 3: recover small app/config backups\"},{\"level\":2,\"line\":163,\"title\":\"Phase 4: recover edge-vm large backup\"},{\"level\":1,\"line\":194,\"title\":\"Expected size:\"},{\"level\":1,\"line\":195,\"title\":\"16936767590\"},{\"level\":1,\"line\":196,\"title\":\"Expected SHA256:\"},{\"level\":1,\"line\":197,\"title\":\"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001\"},{\"level\":2,\"line\":202,\"title\":\"Phase 5: restore validation checklist\"},{\"level\":2,\"line\":218,\"title\":\"Phase 6: re-enable backup and offsite automation\"},{\"level\":2,\"line\":231,\"title\":\"Known failure lessons\"},{\"level\":2,\"line\":243,\"title\":\"Vaultwarden isolated restore drill result — 2026-06-18\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e\",\"total_score\":100},{\"bytes\":9386,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Disaster Recovery Runbook\"},{\"level\":2,\"line\":6,\"title\":\"Current verified recovery anchors\"},{\"level\":2,\"line\":25,\"title\":\"Things that must exist outside the repo\"},{\"level\":2,\"line\":39,\"title\":\"Recovery priority\"},{\"level\":2,\"line\":51,\"title\":\"Phase 0: establish a control host\"},{\"level\":2,\"line\":65,\"title\":\"Phase 1: restore rclone access\"},{\"level\":2,\"line\":90,\"title\":\"Phase 2: restore the critical/small cloud bundle\"},{\"level\":1,\"line\":107,\"title\":\"Expected:\"},{\"level\":1,\"line\":108,\"title\":\"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c\"},{\"level\":2,\"line\":130,\"title\":\"Phase 3: recover small app/config backups\"},{\"level\":2,\"line\":163,\"title\":\"Phase 4: recover edge-vm large backup\"},{\"level\":1,\"line\":194,\"title\":\"Expected size:\"},{\"level\":1,\"line\":195,\"title\":\"16936767590\"},{\"level\":1,\"line\":196,\"title\":\"Expected SHA256:\"},{\"level\":1,\"line\":197,\"title\":\"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001\"},{\"level\":2,\"line\":202,\"title\":\"Phase 5: restore validation checklist\"},{\"level\":2,\"line\":218,\"title\":\"Phase 6: re-enable backup and offsite automation\"},{\"level\":2,\"line\":231,\"title\":\"Known failure lessons\"},{\"level\":2,\"line\":243,\"title\":\"Vaultwarden isolated restore drill result — 2026-06-18\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e\",\"total_score\":100},{\"bytes\":16031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"internal service\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"05. Service Catalog\"},{\"level\":2,\"line\":5,\"title\":\"Edge VM\"},{\"level\":2,\"line\":12,\"title\":\"NPMplus\"},{\"level\":2,\"line\":22,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":30,\"title\":\"Gotify\"},{\"level\":2,\"line\":38,\"title\":\"Vaultwarden\"},{\"level\":2,\"line\":49,\"title\":\"Dockge\"},{\"level\":2,\"line\":61,\"title\":\"Homepage\"},{\"level\":2,\"line\":71,\"title\":\"Gitea\"},{\"level\":2,\"line\":84,\"title\":\"Nextcloud AIO\"},{\"level\":2,\"line\":95,\"title\":\"DNS stack\"},{\"level\":2,\"line\":102,\"title\":\"Backup\"},{\"level\":2,\"line\":109,\"title\":\"Edge applications added 2026-06-15/16\"},{\"level\":2,\"line\":132,\"title\":\"Backup health proxy\"},{\"level\":2,\"line\":155,\"title\":\"Edge VM capacity note\"},{\"level\":2,\"line\":366,\"title\":\"Homepage grouped dashboard update, 2026-06-22\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a\",\"total_score\":95},{\"bytes\":106031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":92,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"web ui\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"lxc\",\"qemu\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"локальн\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"99. Current state summary\"},{\"level\":2,\"line\":5,\"title\":\"Git repository\"},{\"level\":2,\"line\":12,\"title\":\"Operating rules\"},{\"level\":2,\"line\":21,\"title\":\"Current verified backup health\"},{\"level\":2,\"line\":32,\"title\":\"Backup scripts and services\"},{\"level\":2,\"line\":41,\"title\":\"Proxmox and network layout\"},{\"level\":2,\"line\":58,\"title\":\"NPMplus state\"},{\"level\":2,\"line\":81,\"title\":\"DNS rewrites\"},{\"level\":2,\"line\":101,\"title\":\"Edge applications\"},{\"level\":2,\"line\":118,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":131,\"title\":\"Cloudflare token rotation\"},{\"level\":2,\"line\":139,\"title\":\"Known working URLs\"},{\"level\":2,\"line\":166,\"title\":\"Pending after this documentation update\"},{\"level\":2,\"line\":181,\"title\":\"Edge application setup checkpoint — 2026-06-16T10:26:57Z\"},{\"level\":2,\"line\":194,\"title\":\"Immich media storage checkpoint — 2026-06-16T11:01:32Z\"},{\"level\":2,\"line\":204,\"title\":\"Immich media backup checkpoint — 2026-06-16T11:24:22Z\"},{\"level\":2,\"line\":219,\"title\":\"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z\"},{\"level\":2,\"line\":231,\"title\":\"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z\"},{\"level\":2,\"line\":245,\"title\":\"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z\"},{\"level\":2,\"line\":257,\"title\":\"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z\"},{\"level\":2,\"line\":266,\"title\":\"Closed validation checkpoint — 2026-06-16T16:51:40Z\"},{\"level\":2,\"line\":278,\"title\":\"Disk Space Health checkpoint — 2026-06-16T17:06:06Z\"},{\"level\":2,\"line\":298,\"title\":\"Memos backup checkpoint — 2026-06-16T17:33:39Z\"},{\"level\":2,\"line\":319,\"title\":\"Paperless backup checkpoint — 2026-06-16T17:50:49Z\"},{\"level\":2,\"line\":350,\"title\":\"Application restore validation checkpoint — 2026-06-16T18:01:17Z\"},{\"level\":2,\"line\":364,\"title\":\"Final full baseline checkpoint — 2026-06-16T18:10:15Z\"},{\"level\":2,\"line\":407,\"title\":\"Daily cluster status report\"},{\"level\":2,\"line\":420,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":447,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":482,\"title\":\"Контейнерная волна обновлений, 2026-06-19\"},{\"level\":2,\"line\":498,\"title\":\"CVE root-cause analysis, 2026-06-19\"},{\"level\":2,\"line\":514,\"title\":\"Browser / Chromium risk analysis, 2026-06-19\"},{\"level\":2,\"line\":527,\"title\":\"Base OS package CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":541,\"title\":\"Go runtime/dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":555,\"title\":\"Node/NPM dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":569,\"title\":\"Dockge / Karakeep candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":583,\"title\":\"Karakeep production update, 2026-06-19\"},{\"level\":2,\"line\":605,\"title\":\"Uptime Kuma candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":622,\"title\":\"Uptime Kuma production update, 2026-06-19\"},{\"level\":2,\"line\":644,\"title\":\"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19\"},{\"level\":2,\"line\":663,\"title\":\"Linkding candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":678,\"title\":\"Linkding production update, 2026-06-19\"},{\"level\":2,\"line\":698,\"title\":\"Current Trivy leaderboard after Linkding, 2026-06-19\"},{\"level\":2,\"line\":717,\"title\":\"Batch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":744,\"title\":\"Disk cleanup and Git push recovery, 2026-06-19\"},{\"level\":2,\"line\":758,\"title\":\"Next update candidates from batch scan, 2026-06-19\"},{\"level\":2,\"line\":770,\"title\":\"IT-Tools production update, 2026-06-19\"},{\"level\":2,\"line\":789,\"title\":\"NPMplus production update, 2026-06-19\"},{\"level\":2,\"line\":812,\"title\":\"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19\"},{\"level\":2,\"line\":827,\"title\":\"Paperless stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":852,\"title\":\"Immich app stable pair candidate scan, 2026-06-19\"},{\"level\":2,\"line\":878,\"title\":\"Immich app pair candidate scan result, 2026-06-19\"},{\"level\":2,\"line\":896,\"title\":\"Home Assistant stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":919,\"title\":\"MinIO release candidate scan, 2026-06-19\"},{\"level\":2,\"line\":942,\"title\":\"Mealie stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":965,\"title\":\"Authentik server image candidate scan, 2026-06-19\"},{\"level\":2,\"line\":988,\"title\":\"Karakeep Meilisearch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1011,\"title\":\"Karakeep Chrome candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1034,\"title\":\"Vaultwarden stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1057,\"title\":\"Vaultwarden production update, 2026-06-20\"},{\"level\":2,\"line\":1083,\"title\":\"Current Trivy leaderboard after Vaultwarden, 2026-06-20\"},{\"level\":2,\"line\":1098,\"title\":\"n8n stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1121,\"title\":\"n8n latest tag restore, 2026-06-20\"},{\"level\":2,\"line\":1137,\"title\":\"n8n 2.27.3 smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1163,\"title\":\"n8n production update, 2026-06-20\"},{\"level\":2,\"line\":1193,\"title\":\"Gotify stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1213,\"title\":\"Batch remaining open candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1234,\"title\":\"CrowdSec production update, 2026-06-20\"},{\"level\":2,\"line\":1262,\"title\":\"Final CVE pass summary, 2026-06-20\"},{\"level\":2,\"line\":1286,\"title\":\"n8n encryption key rotation, 2026-06-20\"},{\"level\":2,\"line\":1311,\"title\":\"Audit and backup inventory, 2026-06-20\"},{\"level\":2,\"line\":1326,\"title\":\"Immich Postgres restore smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1342,\"title\":\"Immich Postgres candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1352,\"title\":\"Dockge candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1362,\"title\":\"Paperless candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1372,\"title\":\"Karakeep and Immich Server real-tag scan, 2026-06-20\"},{\"level\":2,\"line\":1382,\"title\":\"Closing high-CVE ledger, 2026-06-20\"},{\"level\":2,\"line\":1392,\"title\":\"Candidate test directories cleanup, 2026-06-20\"},{\"level\":2,\"line\":1402,\"title\":\"Old n8n key backup removal preflight, 2026-06-20\"},{\"level\":2,\"line\":1412,\"title\":\"NetBird peers health hardening, 2026-06-20\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\",\"path_score\":3,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c\",\"total_score\":95},{\"bytes\":16031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"internal service\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"05. Service Catalog\"},{\"level\":2,\"line\":5,\"title\":\"Edge VM\"},{\"level\":2,\"line\":12,\"title\":\"NPMplus\"},{\"level\":2,\"line\":22,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":30,\"title\":\"Gotify\"},{\"level\":2,\"line\":38,\"title\":\"Vaultwarden\"},{\"level\":2,\"line\":49,\"title\":\"Dockge\"},{\"level\":2,\"line\":61,\"title\":\"Homepage\"},{\"level\":2,\"line\":71,\"title\":\"Gitea\"},{\"level\":2,\"line\":84,\"title\":\"Nextcloud AIO\"},{\"level\":2,\"line\":95,\"title\":\"DNS stack\"},{\"level\":2,\"line\":102,\"title\":\"Backup\"},{\"level\":2,\"line\":109,\"title\":\"Edge applications added 2026-06-15/16\"},{\"level\":2,\"line\":132,\"title\":\"Backup health proxy\"},{\"level\":2,\"line\":155,\"title\":\"Edge VM capacity note\"},{\"level\":2,\"line\":366,\"title\":\"Homepage grouped dashboard update, 2026-06-22\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a\",\"total_score\":95},{\"bytes\":106031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":92,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"web ui\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"lxc\",\"qemu\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"локальн\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"99. Current state summary\"},{\"level\":2,\"line\":5,\"title\":\"Git repository\"},{\"level\":2,\"line\":12,\"title\":\"Operating rules\"},{\"level\":2,\"line\":21,\"title\":\"Current verified backup health\"},{\"level\":2,\"line\":32,\"title\":\"Backup scripts and services\"},{\"level\":2,\"line\":41,\"title\":\"Proxmox and network layout\"},{\"level\":2,\"line\":58,\"title\":\"NPMplus state\"},{\"level\":2,\"line\":81,\"title\":\"DNS rewrites\"},{\"level\":2,\"line\":101,\"title\":\"Edge applications\"},{\"level\":2,\"line\":118,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":131,\"title\":\"Cloudflare token rotation\"},{\"level\":2,\"line\":139,\"title\":\"Known working URLs\"},{\"level\":2,\"line\":166,\"title\":\"Pending after this documentation update\"},{\"level\":2,\"line\":181,\"title\":\"Edge application setup checkpoint — 2026-06-16T10:26:57Z\"},{\"level\":2,\"line\":194,\"title\":\"Immich media storage checkpoint — 2026-06-16T11:01:32Z\"},{\"level\":2,\"line\":204,\"title\":\"Immich media backup checkpoint — 2026-06-16T11:24:22Z\"},{\"level\":2,\"line\":219,\"title\":\"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z\"},{\"level\":2,\"line\":231,\"title\":\"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z\"},{\"level\":2,\"line\":245,\"title\":\"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z\"},{\"level\":2,\"line\":257,\"title\":\"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z\"},{\"level\":2,\"line\":266,\"title\":\"Closed validation checkpoint — 2026-06-16T16:51:40Z\"},{\"level\":2,\"line\":278,\"title\":\"Disk Space Health checkpoint — 2026-06-16T17:06:06Z\"},{\"level\":2,\"line\":298,\"title\":\"Memos backup checkpoint — 2026-06-16T17:33:39Z\"},{\"level\":2,\"line\":319,\"title\":\"Paperless backup checkpoint — 2026-06-16T17:50:49Z\"},{\"level\":2,\"line\":350,\"title\":\"Application restore validation checkpoint — 2026-06-16T18:01:17Z\"},{\"level\":2,\"line\":364,\"title\":\"Final full baseline checkpoint — 2026-06-16T18:10:15Z\"},{\"level\":2,\"line\":407,\"title\":\"Daily cluster status report\"},{\"level\":2,\"line\":420,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":447,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":482,\"title\":\"Контейнерная волна обновлений, 2026-06-19\"},{\"level\":2,\"line\":498,\"title\":\"CVE root-cause analysis, 2026-06-19\"},{\"level\":2,\"line\":514,\"title\":\"Browser / Chromium risk analysis, 2026-06-19\"},{\"level\":2,\"line\":527,\"title\":\"Base OS package CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":541,\"title\":\"Go runtime/dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":555,\"title\":\"Node/NPM dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":569,\"title\":\"Dockge / Karakeep candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":583,\"title\":\"Karakeep production update, 2026-06-19\"},{\"level\":2,\"line\":605,\"title\":\"Uptime Kuma candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":622,\"title\":\"Uptime Kuma production update, 2026-06-19\"},{\"level\":2,\"line\":644,\"title\":\"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19\"},{\"level\":2,\"line\":663,\"title\":\"Linkding candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":678,\"title\":\"Linkding production update, 2026-06-19\"},{\"level\":2,\"line\":698,\"title\":\"Current Trivy leaderboard after Linkding, 2026-06-19\"},{\"level\":2,\"line\":717,\"title\":\"Batch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":744,\"title\":\"Disk cleanup and Git push recovery, 2026-06-19\"},{\"level\":2,\"line\":758,\"title\":\"Next update candidates from batch scan, 2026-06-19\"},{\"level\":2,\"line\":770,\"title\":\"IT-Tools production update, 2026-06-19\"},{\"level\":2,\"line\":789,\"title\":\"NPMplus production update, 2026-06-19\"},{\"level\":2,\"line\":812,\"title\":\"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19\"},{\"level\":2,\"line\":827,\"title\":\"Paperless stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":852,\"title\":\"Immich app stable pair candidate scan, 2026-06-19\"},{\"level\":2,\"line\":878,\"title\":\"Immich app pair candidate scan result, 2026-06-19\"},{\"level\":2,\"line\":896,\"title\":\"Home Assistant stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":919,\"title\":\"MinIO release candidate scan, 2026-06-19\"},{\"level\":2,\"line\":942,\"title\":\"Mealie stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":965,\"title\":\"Authentik server image candidate scan, 2026-06-19\"},{\"level\":2,\"line\":988,\"title\":\"Karakeep Meilisearch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1011,\"title\":\"Karakeep Chrome candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1034,\"title\":\"Vaultwarden stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1057,\"title\":\"Vaultwarden production update, 2026-06-20\"},{\"level\":2,\"line\":1083,\"title\":\"Current Trivy leaderboard after Vaultwarden, 2026-06-20\"},{\"level\":2,\"line\":1098,\"title\":\"n8n stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1121,\"title\":\"n8n latest tag restore, 2026-06-20\"},{\"level\":2,\"line\":1137,\"title\":\"n8n 2.27.3 smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1163,\"title\":\"n8n production update, 2026-06-20\"},{\"level\":2,\"line\":1193,\"title\":\"Gotify stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1213,\"title\":\"Batch remaining open candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1234,\"title\":\"CrowdSec production update, 2026-06-20\"},{\"level\":2,\"line\":1262,\"title\":\"Final CVE pass summary, 2026-06-20\"},{\"level\":2,\"line\":1286,\"title\":\"n8n encryption key rotation, 2026-06-20\"},{\"level\":2,\"line\":1311,\"title\":\"Audit and backup inventory, 2026-06-20\"},{\"level\":2,\"line\":1326,\"title\":\"Immich Postgres restore smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1342,\"title\":\"Immich Postgres candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1352,\"title\":\"Dockge candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1362,\"title\":\"Paperless candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1372,\"title\":\"Karakeep and Immich Server real-tag scan, 2026-06-20\"},{\"level\":2,\"line\":1382,\"title\":\"Closing high-CVE ledger, 2026-06-20\"},{\"level\":2,\"line\":1392,\"title\":\"Candidate test directories cleanup, 2026-06-20\"},{\"level\":2,\"line\":1402,\"title\":\"Old n8n key backup removal preflight, 2026-06-20\"},{\"level\":2,\"line\":1412,\"title\":\"NetBird peers health hardening, 2026-06-20\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\",\"path_score\":3,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c\",\"total_score\":95},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":38408,\"commit\":\"60f53ea6fe6724196802a46de3de19c7889a51cc\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\",\"quorum\",\"corosync\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"network\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary\"],\"sensitive_findings\":[],\"sha256\":\"07c9854ab0232d1f2766cdab114d0d398a4dcc1a5b41ea7fde77646e5f42804e\",\"total_score\":86},{\"bytes\":61327,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Services bootstrap snapshot — 2026-06-17\"},{\"level\":2,\"line\":3,\"title\":\"Scope\"},{\"level\":2,\"line\":9,\"title\":\"Edge VM\"},{\"level\":2,\"line\":19,\"title\":\"NetBird VPS\"},{\"level\":2,\"line\":34,\"title\":\"NetBird backup status\"},{\"level\":3,\"line\":37,\"title\":\"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb\"},{\"level\":2,\"line\":40,\"title\":\"NetBird backup timers\"},{\"level\":2,\"line\":46,\"title\":\"Important follow-ups\"},{\"level\":2,\"line\":54,\"title\":\"NetBird Uptime Kuma monitors\"},{\"level\":2,\"line\":64,\"title\":\"NetBird homelab peers\"},{\"level\":3,\"line\":69,\"title\":\"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0 UNKNOWN 100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 \"},{\"level\":2,\"line\":72,\"title\":\"NetBird peers health monitor\"},{\"level\":2,\"line\":88,\"title\":\"File Browser credential remediation\"},{\"level\":2,\"line\":98,\"title\":\"Proxmox private SSL via NetBird FQDN\"},{\"level\":2,\"line\":116,\"title\":\"File Browser backup, offhost sync, and restore validation\"},{\"level\":2,\"line\":150,\"title\":\"App stacks batch backup chain\"},{\"level\":2,\"line\":194,\"title\":\"Final backup and health baseline\"},{\"level\":2,\"line\":202,\"title\":\"Private NPMplus hosts via NetBird\"},{\"level\":2,\"line\":231,\"title\":\"Homepage VPN Authentik forward-auth\"},{\"level\":2,\"line\":244,\"title\":\"Homepage Authentik forward-auth rollback\"},{\"level\":2,\"line\":257,\"title\":\"Private VPN hosts safe baseline after Authentik rollback\"},{\"level\":2,\"line\":271,\"title\":\"Private VPN Hosts Kuma monitor\"},{\"level\":2,\"line\":289,\"title\":\"Private VPN Hosts health timer\"},{\"level\":2,\"line\":304,\"title\":\"Private VPN Hosts timer auto-cycle verified\"},{\"level\":2,\"line\":314,\"title\":\"Final ops snapshot — private VPN hosts\"},{\"level\":2,\"line\":326,\"title\":\"NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":348,\"title\":\"Corrected NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":367,\"title\":\"NPMplus + Kuma backup chain Kuma monitors\"},{\"level\":2,\"line\":382,\"title\":\"NPMplus + Kuma config backup timer\"},{\"level\":2,\"line\":398,\"title\":\"Authentik backup chain\"},{\"level\":2,\"line\":408,\"title\":\"Authentik backup chain Kuma monitors\"},{\"level\":2,\"line\":417,\"title\":\"Authentik backup timer\"},{\"level\":2,\"line\":431,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":441,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":445,\"title\":\"Gitea backup chain Kuma monitors\"},{\"level\":2,\"line\":454,\"title\":\"Gitea backup timer\"},{\"level\":2,\"line\":465,\"title\":\"Vaultwarden backup chain\"},{\"level\":2,\"line\":475,\"title\":\"Vaultwarden backup chain Kuma monitors\"},{\"level\":2,\"line\":484,\"title\":\"Vaultwarden backup timer\"},{\"level\":2,\"line\":495,\"title\":\"Edge VM manual vzdump backup\"},{\"level\":2,\"line\":502,\"title\":\"Edge VM vzdump offhost copy\"},{\"level\":2,\"line\":508,\"title\":\"Edge VM vzdump restore verification\"},{\"level\":2,\"line\":515,\"title\":\"Edge VM vzdump Kuma monitors\"},{\"level\":2,\"line\":528,\"title\":\"Edge VM vzdump weekly timer\"},{\"level\":2,\"line\":543,\"title\":\"Immich media backup existing automation inventory\"},{\"level\":2,\"line\":553,\"title\":\"Immich media restore verification\"},{\"level\":2,\"line\":560,\"title\":\"Immich media restore Kuma monitor\"},{\"level\":2,\"line\":570,\"title\":\"Immich media restore Kuma monitor correction\"},{\"level\":2,\"line\":577,\"title\":\"P0 backup baseline closure\"},{\"level\":2,\"line\":589,\"title\":\"P1 Mail.ru Cloud offsite inventory\"},{\"level\":2,\"line\":651,\"title\":\"P1 Mail.ru Cloud rclone config drift resolved\"},{\"level\":2,\"line\":667,\"title\":\"P1 Mail.ru Cloud canary\"},{\"level\":2,\"line\":675,\"title\":\"P1 Mail.ru Cloud production payload inventory\"},{\"level\":2,\"line\":710,\"title\":\"P1 Mail.ru Cloud critical baseline upload\"},{\"level\":2,\"line\":720,\"title\":\"P1 Mail.ru Cloud Kuma monitors\"},{\"level\":2,\"line\":732,\"title\":\"P1 Mail.ru Cloud edge-vm chunked large upload\"},{\"level\":2,\"line\":742,\"title\":\"P1 Mail.ru Cloud Edge VM Kuma monitor\"},{\"level\":2,\"line\":753,\"title\":\"P1 Mail.ru Cloud offsite seed closure\"},{\"level\":2,\"line\":776,\"title\":\"P1 Mail.ru Cloud critical upload automation\"},{\"level\":2,\"line\":791,\"title\":\"P1 Mail.ru Cloud edge-vm upload automation\"},{\"level\":2,\"line\":807,\"title\":\"P1 Mail.ru Cloud automation and retention closure\"},{\"level\":2,\"line\":829,\"title\":\"P1 Mail.ru Cloud restore drill automation\"},{\"level\":2,\"line\":843,\"title\":\"P2 Disaster Recovery runbook\"},{\"level\":2,\"line\":853,\"title\":\"P2 Critical bundle bootstrap drill\"},{\"level\":2,\"line\":870,\"title\":\"P2 Disaster Recovery bootstrap closure\"},{\"level\":2,\"line\":892,\"title\":\"Vaultwarden isolated restore drill — 2026-06-18\"},{\"level\":2,\"line\":929,\"title\":\"Daily cluster status report — 2026-06-18\"},{\"level\":2,\"line\":985,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":1012,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":1047,\"title\":\"Trivy scan mode after 2026-06-19 update wave\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"sensitive-assignment\"],\"sha256\":\"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6\",\"total_score\":86},{\"bytes\":89904,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 alert routing preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab\",\"total_score\":86}],\"handbook_candidates_omitted\":20,\"history\":{\"log\":\"COMMIT\\tf9d3ba8caf65005605aa8aee2ede7e4e7e94ee49\\t2026-07-31T10:37:56+03:00\\thomelab-site-baseline\\tGRAM1: capture initial site baseline 20260731T071400Z\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\\n\\nCOMMIT\\tf12d914540d40b3c221786c81be0ec17f42c91a5\\t2026-07-20T00:16:16+03:00\\tHOMELAB Ops Reviewer\\tCR-2026-0017: record one-pass live inventory verification\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\td831f34685a9305412f949c1e845842af78661a1\\t2026-07-20T00:05:34+03:00\\tHOMELAB Ops Reviewer\\tCR-2026-0017: add unified homelab inventory foundation\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t60f53ea6fe6724196802a46de3de19c7889a51cc\\t2026-07-19T13:49:08+03:00\\tHOMELAB Bootstrap Reviewer\\tCR-2026-0015: add pve03 r8152 RX ring canary\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t25b275f96b54551e26f07516c72651d85f235ad0\\t2026-07-18T16:27:33+03:00\\thomelab-ops-bootstrap\\tCR-2026-0013: allow VM160 worker bootstrap transition\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\tf5b22d867ea467987008408e3fb1fb0e17fa7b2e\\t2026-07-18T14:17:33+03:00\\thomelab-ops-bootstrap\\tCR-2026-0012: add one-command Skladchik Cookie refresh runbook\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\tbb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9\\t2026-07-18T13:11:46+03:00\\thomelab-ops-bootstrap\\tCR-2026-0011: force fresh Skladchik Cookie before jar persistence\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t7bd1b050f8d64c7b55dfd51ead63f0adda87f2df\\t2026-07-18T10:34:25+03:00\\thomelab-ops-bootstrap\\tCR-2026-0010: separate current and target Skladchik edge SHAs\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t10a747b86ef498aabd3a71b1e32dfb6c80547ddb\\t2026-07-18T09:59:55+03:00\\thomelab-ops-bootstrap\\tCR-2026-0009: guard Skladchik monitor concurrency\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t1f7abe5acf856ad2a2abe10ef2a9452485edb073\\t2026-07-18T09:26:07+03:00\\thomelab-ops-bootstrap\\tCR-2026-0008: repair Skladchik rollback snapshot integrity\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\td399d24440f948b518761ecfd516521993861b43\\t2026-07-18T08:10:58+03:00\\thomelab-ops-bootstrap\\tCR-2026-0007: add controlled Skladchik reauthentication task\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t65855c4108dd0dd961803ad8233e5a805c00993b\\t2026-07-18T06:15:45+03:00\\thomelab-ops-bootstrap\\tCR-2026-0006: lock cluster cloud quorum failures\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\tb8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\\t2026-07-18T03:57:33+03:00\\tHOMELAB Bootstrap Reviewer\\tCR-2026-0005 prepare reviewed logrotate bootstrap clearance\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t14d8bb0467e5890a7166444afda90a0185552eba\\t2026-07-16T01:29:16+03:00\\thomelab-ops-bootstrap\\tbootstrap homelab-ops v2\\nA\\terrors/regression-cases.json\\n\",\"log_bytes\":7893,\"log_sha256\":\"6952e258f02107d8b918fe6d37d51146ba54c5a3fa27110434001f2046127c7e\",\"log_truncated\":false,\"paths\":[\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"errors/regression-cases.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\"]},\"mandatory_error_artifacts\":{\"linter\":{\"paths\":[],\"present\":false},\"regression_registry\":{\"paths\":[\"errors/regression-cases.json\"],\"present\":true},\"repository_validator\":{\"paths\":[\"tools/validate_repo.py\"],\"present\":true},\"superseded_policy\":{\"paths\":[],\"present\":false},\"tests\":{\"paths\":[\"tests/fixtures/gitea-legacy-auth-permission.json\",\"tests/test_access_contexts.py\",\"tests/test_cr_2026_0005.py\",\"tests/test_cr_2026_0006.py\",\"tests/test_cr_2026_0006_vm160_task.py\",\"tests/test_cr_2026_0007_skladchik_reauth.py\",\"tests/test_cr_2026_0007_skladchik_semantic_repair.py\",\"tests/test_cr_2026_0008_skladchik_snapshot_integrity.py\",\"tests/test_cr_2026_0009_skladchik_concurrency_guard.py\",\"tests/test_cr_2026_0011_skladchik_cookie_jar_reset.py\",\"tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py\",\"tests/test_cr_2026_0013_vm160_worker_bootstrap_transition.py\",\"tests/test_cr_2026_0015_pve03_r8152_rx_ring_canary.py\",\"tests/test_cr_2026_0018_execution_boundary_preparation.py\",\"tests/test_inventory_foundation.py\",\"tests/test_live_verification.py\",\"tests/test_no_repeat_policy.py\",\"tests/test_reg_014_015.py\",\"tests/test_repository.py\"],\"present\":true}},\"scanned_commits\":[{\"candidate_files\":19,\"commit\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"read_files\":19,\"refs\":[\"refs/heads/main\"],\"tree_files\":125},{\"candidate_files\":10,\"commit\":\"16e84298035f5e4ec7e2b7d39967ad5e40ea3d4b\",\"read_files\":10,\"refs\":[\"refs/heads/cr-2026-0006-cluster-cloud-quorum\"],\"tree_files\":66},{\"candidate_files\":32,\"commit\":\"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17\",\"read_files\":32,\"refs\":[\"refs/heads/cr-2026-0017-inventory-foundation\"],\"tree_files\":160},{\"candidate_files\":13,\"commit\":\"1f7abe5acf856ad2a2abe10ef2a9452485edb073\",\"read_files\":13,\"refs\":[\"refs/heads/cr-2026-0008-skladchik-snapshot-integrity\"],\"tree_files\":94},{\"candidate_files\":17,\"commit\":\"25b275f96b54551e26f07516c72651d85f235ad0\",\"read_files\":17,\"refs\":[\"refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition\"],\"tree_files\":110},{\"candidate_files\":18,\"commit\":\"60f53ea6fe6724196802a46de3de19c7889a51cc\",\"read_files\":18,\"refs\":[\"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary\"],\"tree_files\":127},{\"candidate_files\":2270,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"read_files\":2267,\"refs\":[\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"tree_files\":4438},{\"candidate_files\":14,\"commit\":\"7bd1b050f8d64c7b55dfd51ead63f0adda87f2df\",\"read_files\":14,\"refs\":[\"refs/heads/cr-2026-0009-skladchik-concurrency-guard\"],\"tree_files\":99},{\"candidate_files\":7,\"commit\":\"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\",\"read_files\":7,\"refs\":[\"refs/heads/cr-2026-0005-codex-bootstrap-activation\"],\"tree_files\":47},{\"candidate_files\":15,\"commit\":\"bb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9\",\"read_files\":15,\"refs\":[\"refs/heads/cr-2026-0011-skladchik-cookie-jar-reset\"],\"tree_files\":102},{\"candidate_files\":12,\"commit\":\"d399d24440f948b518761ecfd516521993861b43\",\"read_files\":12,\"refs\":[\"refs/heads/cr-2026-0007-skladchik-controlled-reauth\"],\"tree_files\":91},{\"candidate_files\":16,\"commit\":\"f5b22d867ea467987008408e3fb1fb0e17fa7b2e\",\"read_files\":16,\"refs\":[\"refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook\"],\"tree_files\":107},{\"candidate_files\":2270,\"commit\":\"f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49\",\"read_files\":2267,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\"],\"tree_files\":4434}],\"scanned_unique_heads\":13},\"validation\":{\"unittest\":{\"duration_seconds\":0.121,\"rc\":1,\"stderr\":\"test_apply_exact_scope (test_cr_2026_0005.CR20260005Tests.test_apply_exact_scope) ... ok\\ntest_declared_phase_outputs (test_cr_2026_0005.CR20260005Tests.test_declared_phase_outputs) ... ok\\ntest_journal_pipeline_safety (test_cr_2026_0005.CR20260005Tests.test_journal_pipeline_safety) ... ok\\ntest_no_pmxcfs_or_remote_mutation (test_cr_2026_0005.CR20260005Tests.test_no_pmxcfs_or_remote_mutation) ... ok\\ntest_phase_guardrails (test_cr_2026_0005.CR20260005Tests.test_phase_guardrails) ... ok\\ntest_policy_markers (test_cr_2026_0005.CR20260005Tests.test_policy_markers) ... ok\\ntest_regression_cases (test_cr_2026_0005.CR20260005Tests.test_regression_cases) ... ok\\ntest_standard_seal (test_cr_2026_0005.CR20260005Tests.test_standard_seal) ... ok\\ntest_systemctl_failed_first_field (test_cr_2026_0005.CR20260005Tests.test_systemctl_failed_first_field) ... ok\\ntest_task_semantic_coherence (test_cr_2026_0005.CR20260005Tests.test_task_semantic_coherence) ... ok\\ntest_change_is_local_only (test_cr_2026_0006.CR20260006Tests.test_change_is_local_only) ... ok\\ntest_command_delivery_locks (test_cr_2026_0006.CR20260006Tests.test_command_delivery_locks) ... ok\\ntest_distinct_accounts (test_cr_2026_0006.CR20260006Tests.test_distinct_accounts) ... ok\\ntest_local_delete_fail_closed (test_cr_2026_0006.CR20260006Tests.test_local_delete_fail_closed) ... ok\\ntest_policy_contract (test_cr_2026_0006.CR20260006Tests.test_policy_contract) ... ok\\ntest_regression_cases (test_cr_2026_0006.CR20260006Tests.test_regression_cases) ... ok\\ntest_restore_contract (test_cr_2026_0006.CR20260006Tests.test_restore_contract) ... ok\\ntest_contract (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_contract) ... ok\\ntest_distinct_accounts_and_exact_mapping (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_distinct_accounts_and_exact_mapping) ... ok\\ntest_exact_path_and_symlink_guards (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_exact_path_and_symlink_guards) ... ok\\ntest_health_root_cause_evidence (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_health_root_cause_evidence) ... ok\\ntest_no_forbidden_delivery_or_hostkey_patterns (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_no_forbidden_delivery_or_hostkey_patterns) ... ok\\ntest_no_inline_remote_shell_program (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_no_inline_remote_shell_program) ... ok\\ntest_per_part_and_full_roundtrip_single_remote_pass (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_per_part_and_full_roundtrip_single_remote_pass) ... ok\\ntest_preflight_checks_all_execution_nodes_with_versioned_scripts (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_preflight_checks_all_execution_nodes_with_versioned_scripts) ... ok\\ntest_prepare_verifies_prepared_not_sealed (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_prepare_verifies_prepared_not_sealed) ... ok\\ntest_rollback_restores_remote_generation_health_and_symlink (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_rollback_restores_remote_generation_health_and_symlink) ... ok\\ntest_shell_syntax (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_shell_syntax) ... ok\\ntest_two_stage_seal_has_truthful_delete_order (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_two_stage_seal_has_truthful_delete_order) ... ok\\ntest_verify_queries_pve03_not_pve01_staging (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_verify_queries_pve03_not_pve01_staging) ... ok\\ntest_contract (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_contract) ... ok\\ntest_edge_script_sha_is_exact_sha256 (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_edge_script_sha_is_exact_sha256) ... ok\\ntest_inline_python_policy_matches_linter_scope (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_inline_python_policy_matches_linter_scope) ... ok\\ntest_no_inline_remote_shell (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_no_inline_remote_shell) ... ok\\ntest_regression_lock (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_regression_lock) ... ok\\ntest_rollback_before_apply (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_rollback_before_apply) ... ok\\ntest_shell_syntax (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_shell_syntax) ... ok\\ntest_strict_hostkey_and_no_secret_material (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_strict_hostkey_and_no_secret_material) ... ok\\ntest_verify_requires_real_counts (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_verify_requires_real_counts) ... ok\\ntest_all_active_callers_are_versioned_and_strict (test_cr_2026_0007_skladchik_semantic_repair.SkladchikSemanticRepairTests.test_all_active_callers_are_versioned_and_strict) ... ok\\ntest_apply_installs_live_and_desired_assets (test_cr_2026_0007_skladchik_semantic_repair.SkladchikSemanticRepairTests.test_apply_installs_live_and_desired_assets) ... ok\\nte\",\"stderr_sha256\":\"301889d5996ed9723faa0f3f808c32efd9bb4247ffc81d261743a16876e5ea73\",\"stderr_truncated\":false,\"stdout\":\"\",\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"validate_repo\":{\"duration_seconds\":0.031,\"rc\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_sha256\":\"8d9b6d16bd0883193db77e5e0d348f4f97fa99cfc3e1107e09f47a0af945d7ec\",\"stdout_truncated\":false}}},\"gitea_changed\":false,\"handbook_assessment\":{\"canonical_ambiguous\":true,\"canonical_commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"canonical_found\":true,\"canonical_path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"canonical_score\":105,\"canonical_sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"coverage_missing\":[],\"coverage_present\":[\"access_and_admin\",\"backup_and_restore\",\"change_safety\",\"error_learning\",\"external_services\",\"guests_and_workloads\",\"identity_and_topology\",\"internal_services\",\"monitoring_and_logs\",\"network_and_dns\",\"repair_and_troubleshooting\",\"storage\"],\"live_inventory_evidence\":{\"backup_job_count\":0,\"guest_count\":0,\"node_count\":0,\"running_service_units_total\":47,\"storage_rows\":0},\"requires_update\":true},\"live_cluster\":{\"backup_jobs\":[],\"cluster_status\":null,\"commands\":{\"hostname\":{\"rc\":0,\"value\":\"pve01.gram1.ru\"},\"pvecm_status\":{\"excerpt\":\"\",\"rc\":255,\"sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\"},\"pveversion\":{\"excerpt\":\"proxmox-ve: 9.2.0 (running kernel: 7.0.12-1-pve)\\npve-manager: 9.2.3 (running version: 9.2.3/d0fde103346cf89a)\\nproxmox-kernel-helper: 9.2.0\\nproxmox-kernel-7.0: 7.0.12-1\\nproxmox-kernel-7.0.12-1-pve-signed: 7.0.12-1\\nproxmox-kernel-7.0.6-2-pve-signed: 7.0.6-2\\nproxmox-kernel-7.0.2-6-pve-signed: 7.0.2-6\\nceph-fuse: 19.2.3-pve4\\ncorosync: 3.1.10-pve2\\ncriu: 4.1.1-1\\nfrr-pythontools: 10.6.1-1+pve2\\nifupdown2: 3.3.0-1+pmx12\\nintel-microcode: 3.20251111.1~deb13u1\\nksm-control-daemon: 1.5-1\\nlibjs-extjs: 7.0.0-5\\nlibproxmox-acme-perl: 1.7.1\\nlibproxmox-backup-qemu0: 2.0.2\\nlibproxmox-rs-perl: 0.4.1\\nlibpve-access-control: 9.1.1\\nlibpve-apiclient-perl: 3.4.2\\nlibpve-cluster-api-perl: 9.1.6\\nlibpve-cluster-perl: 9.1.6\\nlibpve-common-perl: 9.1.16\\nlibpve-guest-common-perl: 6.0.4\\nlibpve-http-server-perl: 6.0.5\\nlibpve-network-perl: 1.6.6\\nlibpve-notify-perl: 9.1.6\\nlibpve-rs-perl: 0.15.3\\nlibpve-storage-perl: 9.1.6\\nlibspice-server1: 0.15.2-1+b1\\nlvm2: 2.03.31-2+pmx1\\nlxc-pve: 7.0.0-2\\nlxcfs: 7.0.0-pve1\\nnovnc-pve: 1.7.0-1\\nproxmox-backup-client: 4.2.2-1\\nproxmox-backup-file-restore: 4.2.2-1\\nproxmox-backup-restore-image: 1.0.0\\nproxmox-firewall: 1.2.3\\nproxmox-kernel-helper: 9.2.0\\nproxmox-mail-forward: 1.0.3\\nproxmox-mini-journalreader: 1.6\\nproxmox-offline-mirror-helper: 0.7.4\\nproxmox-widget-toolkit: 5.2.5\\npve-cluster: 9.1.6\\npve-container: 6.1.10\\npve-docs: 9.2.2\\npve-edk2-firmware: 4.2025.05-2\\npve-esxi-import-tools: 1.0.1\\npve-firewall: 6.0.4\\npve-firmware: 3.18-4\\npve-ha-manager: 5.2.4\\npve-i18n: 3.8.0\\npve-qemu-kvm: 11.0.0-4\\npve-xtermjs: 6.0.0-1\\nqemu-server: 9.1.17\\nsmartmontools: 7.5-pve2\\nspiceterm: 3.4.2\\nswtpm: 0.8.0+pve3\\nvncterm: 1.9.2\\nzfsutils-linux: 2.4.2-pve1\\n\",\"rc\":0,\"sha256\":\"19ba1ac5d9e5ee6299326b5ad7d5b334a03b23b84a97f3cbdf0f1cf7748d1c0a\"}},\"endpoint_meta\":{\"backup_jobs\":{\"duration_seconds\":0.46,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"cluster_status\":{\"duration_seconds\":0.462,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"ha_current\":{\"duration_seconds\":0.471,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"ha_groups\":{\"duration_seconds\":0.466,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"ha_resources\":{\"duration_seconds\":0.461,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"nodes\":{\"duration_seconds\":0.459,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"replication\":{\"duration_seconds\":0.467,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"resources_storage\":{\"duration_seconds\":0.461,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"resources_vm\":{\"duration_seconds\":0.478,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"storage_config\":{\"duration_seconds\":0.46,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false}},\"guests\":[],\"ha_current\":null,\"ha_groups\":null,\"ha_resources\":null,\"nodes\":[],\"replication\":null,\"running_service_units\":[{\"description\":\"chrony, an NTP client/server\",\"unit\":\"chrony.service\"},{\"description\":\"Corosync Cluster Engine\",\"unit\":\"corosync.service\"},{\"description\":\"Regular background program processing daemon\",\"unit\":\"cron.service\"},{\"description\":\"D-Bus System Message Bus\",\"unit\":\"dbus.service\"},{\"description\":\"Device-mapper event daemon\",\"unit\":\"dm-event.service\"},{\"description\":\"Getty on tty1\",\"unit\":\"getty@tty1.service\"},{\"description\":\"Homelab command adapter\",\"unit\":\"homelab-command-adapter.service\"},{\"description\":\"Homelab command portal\",\"unit\":\"homelab-command-portal.service\"},{\"description\":\"Homelab health HTTP endpoint 9101\",\"unit\":\"homelab-health-http-9101.service\"},{\"description\":\"Homelab health HTTP endpoint\",\"unit\":\"homelab-health-http.service\"},{\"description\":\"Homelab immutable capability reader v3\",\"unit\":\"homelab-reader-v3.service\"},{\"description\":\"Homelab automatic fixed result anchor\",\"unit\":\"homelab-result-lookup.service\"},{\"description\":\"Homelab Scrutiny SMART dashboard\",\"unit\":\"homelab-scrutiny.service\"},{\"description\":\"Kernel Samepage Merging (KSM) Tuning Daemon\",\"unit\":\"ksmtuned.service\"},{\"description\":\"LXC Container Monitoring Daemon\",\"unit\":\"lxc-monitord.service\"},{\"description\":\"FUSE filesystem for LXC\",\"unit\":\"lxcfs.service\"},{\"description\":\"NetBird mesh network client\",\"unit\":\"netbird.service\"},{\"description\":\"pNFS block layout mapping daemon\",\"unit\":\"nfs-blkmap.service\"},{\"description\":\"Network UPS Tools - device driver for NUT device 'cyberpower'\",\"unit\":\"nut-driver@cyberpower.service\"},{\"description\":\"Network UPS Tools - power device monitor and shutdown controller\",\"unit\":\"nut-monitor.service\"},{\"description\":\"Network UPS Tools - power devices information server\",\"unit\":\"nut-server.service\"},{\"description\":\"Postfix Mail Transport Agent (main/default instance)\",\"unit\":\"postfix.service\"},{\"description\":\"Prometheus exporter for machine metrics\",\"unit\":\"prometheus-node-exporter.service\"},{\"description\":\"Proxmox nftables firewall\",\"unit\":\"proxmox-firewall.service\"},{\"description\":\"The Proxmox VE cluster filesystem\",\"unit\":\"pve-cluster.service\"},{\"description\":\"PVE LXC Container: 110\",\"unit\":\"pve-container@110.service\"},{\"description\":\"PVE LXC Container: 112\",\"unit\":\"pve-container@112.service\"},{\"description\":\"Proxmox VE firewall\",\"unit\":\"pve-firewall.service\"},{\"description\":\"PVE Cluster HA Resource Manager Daemon\",\"unit\":\"pve-ha-crm.service\"},{\"description\":\"PVE Local HA Resource Manager Daemon\",\"unit\":\"pve-ha-lrm.service\"},{\"description\":\"Proxmox VE LXC Syscall Daemon\",\"unit\":\"pve-lxc-syscalld.service\"},{\"description\":\"PVE API Daemon\",\"unit\":\"pvedaemon.service\"},{\"description\":\"Proxmox VE firewall logger\",\"unit\":\"pvefw-logger.service\"},{\"description\":\"PVE API Proxy Server\",\"unit\":\"pveproxy.service\"},{\"description\":\"Proxmox VE scheduler\",\"unit\":\"pvescheduler.service\"},{\"description\":\"PVE Status Daemon\",\"unit\":\"pvestatd.service\"},{\"description\":\"PVE Qemu Event Daemon\",\"unit\":\"qmeventd.service\"},{\"description\":\"RPC bind portmap service\",\"unit\":\"rpcbind.service\"},{\"description\":\"Data caching daemon for rrdtool\",\"unit\":\"rrdcached.service\"},{\"description\":\"Self Monitoring and Reporting Technology (SMART) Daemon\",\"unit\":\"smartmontools.service\"},{\"description\":\"PVE SPICE Proxy Server\",\"unit\":\"spiceproxy.service\"},{\"description\":\"OpenBSD Secure Shell server\",\"unit\":\"ssh.service\"},{\"description\":\"Journal Service\",\"unit\":\"systemd-journald.service\"},{\"description\":\"User Login Management\",\"unit\":\"systemd-logind.service\"},{\"description\":\"Rule-based Manager for Device Events and Files\",\"unit\":\"systemd-udevd.service\"},{\"description\":\"Proxmox VE watchdog multiplexer\",\"unit\":\"watchdog-mux.service\"},{\"description\":\"ZFS Event Daemon (zed)\",\"unit\":\"zfs-zed.service\"}],\"running_service_units_total\":47,\"storage_config\":[],\"storages\":[]},\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RESOLVE_ONLY_PROVEN_BLOCKING_FINDINGS_BEFORE_MUTATION\",\"output_truncated_in_json\":false,\"prior_exact_failure\":{\"capsule_sha256\":\"e1b501473c532362e379e21e3ffb86a8c86c0c5b993c51ed32ed98ddc1eda157\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-20260805T062500Z\",\"correction\":\"candidate scan now uses the already-enforced complete tree limit instead of the disproven 600-file sublimit\",\"error\":\"repository complete scan limits were hit: candidate_file_limit:76da439c1f69f405b434e20b2a3da1c11dc92e38:2270; candidate_file_limit:f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49:2270\",\"error_type\":\"RuntimeError\",\"rc\":1,\"rollback_restored\":null,\"rollback_started\":false,\"runner_json_sha256\":\"0ec0065f247a5731fb21cf43eb73e871779f40941e235a3108513b4cb5d860fe\",\"status\":\"FAIL\"},\"production_changed\":false,\"rc\":0,\"read_only\":true,\"result_json_sha256_before_hash_field\":\"bd5de9eb6188e90f9ac67327bf77ef5b78699292a46c3308333ed7c6fdf730ae\",\"result_projection\":{\"bounded\":true,\"bytes_before_hash\":294474,\"compaction_applied\":true},\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"status\":\"OK\"}\n" + "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z\",\"command_rc\":1,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":1,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"FAIL\",\"version\":1}\n{\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z\",\"command_rc\":1,\"error\":\"exact homelab-ops bare repository not found in proven local or running-container locations\",\"error_type\":\"RuntimeError\",\"exact_result_basis\":{\"blocking_findings\":[\"HANDBOOK_CANDIDATE_AMBIGUOUS\",\"REPOSITORY_TESTS_FAILED\",\"CLUSTER_STATUS_UNREADABLE\"],\"capsule_sha256\":\"2d2886a07bf68d97acf144a4d94855d6558cdd0c1277e2c633a5a244f9aebb0f\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z\",\"command_rc\":0,\"control_plane_error\":{\"message\":\"existing runner returned a different rc after writing its public artifact; runtime publication or wrapper completion failed\",\"type\":\"RunnerWrapperMismatch\"},\"mutation_outcome\":\"NO_MUTATION\",\"output_complete\":true,\"output_truncated_in_json\":false,\"prevention_in_this_probe\":\"bounded structured output; no complete success logs; no adapter or result-access repair\",\"rollback_restored\":null,\"rollback_started\":false,\"runner_document_rc\":0,\"runner_json_sha256\":\"f219bbfbfd996e659820b7275a52a14258000d0a27eea3c09793c0eea8cb10c3\",\"runner_rc\":75,\"runner_status\":\"OK\",\"runner_text_sha256\":\"bb714fe8c1973f37e190c01d8582c15f2b92ea0b44adb5a358d5f3d03ba1848a\",\"runner_wrapper_matches_document\":false,\"state_status\":\"FAIL\"},\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":1,\"read_only\":true,\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"status\":\"FAIL\"}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 350f47a..4d3f449 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,7 +1,7 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z -STATUS=OK -RC=0 +COMMAND_ID=HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z +STATUS=FAIL +RC=1 HOST=pve01 MODE=verify COMPONENT=cluster-knowledge-base-error-system @@ -9,14 +9,14 @@ REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83 -COMMAND_SHA256=829077ae842686fb1f36e274117ae6385fb6020f21e25b3af48ae632cde78bcc +COMMAND_SHA256=c2efc9b349daf87cf20c1977db12a588a59f40b8db5a80d176e791b898d76253 DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false RESULT_CONTRACT_VALID=true RESULT_CONTRACT_STATUS=NOT_APPLICABLE RESULT_CONTRACT_ERROR=NONE -COMMAND_RC=0 +COMMAND_RC=1 CHANGES_MADE=false ROLLBACK_STARTED=false ROLLBACK_RESTORED=null @@ -24,11 +24,11 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=10eeba794a85e13eb9ddc29f821f0e0cf430c57b93acf878eb539e048389d8f6 -SANITIZED_OUTPUT_SHA256=11a658e5cc7243e6916e1903b779b9538dded188f7d8c27c775d3f68147adde9 +RAW_EVIDENCE_SHA256=0b8e29a53c59c5c34cb36c8db9939fc5315a7679d9636937c1e515984f835f85 +SANITIZED_OUTPUT_SHA256=0b8e29a53c59c5c34cb36c8db9939fc5315a7679d9636937c1e515984f835f85 OUTPUT_BEGIN -HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1} -{"blocking_findings":["HANDBOOK_CANDIDATE_AMBIGUOUS","REPOSITORY_TESTS_FAILED","CLUSTER_STATUS_UNREADABLE"],"changes_made":false,"cluster_changed":false,"command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z","command_rc":0,"error_system_assessment":{"deterministic_fingerprint_observed":true,"immutable_error_ledger_observed":false,"mandatory_components":{"linter":{"paths":[],"present":false},"regression_registry":{"paths":["errors/regression-cases.json"],"present":true},"repository_validator":{"paths":["tools/validate_repo.py"],"present":true},"superseded_policy":{"paths":[],"present":false},"tests":{"paths":["tests/fixtures/gitea-legacy-auth-permission.json","tests/test_access_contexts.py","tests/test_cr_2026_0005.py","tests/test_cr_2026_0006.py","tests/test_cr_2026_0006_vm160_task.py","tests/test_cr_2026_0007_skladchik_reauth.py","tests/test_cr_2026_0007_skladchik_semantic_repair.py","tests/test_cr_2026_0008_skladchik_snapshot_integrity.py","tests/test_cr_2026_0009_skladchik_concurrency_guard.py","tests/test_cr_2026_0011_skladchik_cookie_jar_reset.py","tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py","tests/test_cr_2026_0013_vm160_worker_bootstrap_transition.py","tests/test_cr_2026_0015_pve03_r8152_rx_ring_canary.py","tests/test_cr_2026_0018_execution_boundary_preparation.py","tests/test_inventory_foundation.py","tests/test_live_verification.py","tests/test_no_repeat_policy.py","tests/test_reg_014_015.py","tests/test_repository.py"],"present":true}},"missing_mandatory_components":["linter","superseded_policy"],"observed_error_artifact_count":160,"pre_command_gate_observed":false,"proposed_v2":{"command_evidence_basis":"Каждая задача закрепляется на точном Gitea commit и SHA исходных файлов. Команда без evidence_basis или с устаревшим commit блокируется до нового READ_ONLY probe.","deterministic_fingerprint":"SHA256 нормализованного набора component + operation + phase + rc + error_type + stable evidence; секреты и переменные значения исключаются до хеширования.","error_ledger":"Одна неизменяемая JSON-запись на каждый доказанный отказ: error_id, command_id, capsule_sha256, component, operation, target, exact evidence, root cause, fixed_by, prevention_test, supersedes, first_seen, last_seen.","exact_result_ingestion":"После exact-result автоматически формируется candidate incident; запись принимается только после сверки command_id, capsule_sha256, runner_json_sha256, wrapper/document RC и отсутствия truncation.","pre_command_gate":"Перед выпуском любой капсулы обязательный поиск fingerprint/component/operation в реестре. Повтор известной ошибки блокируется, пока капсула не содержит подтверждённое prevention_test или документированное исключение.","quality_metrics":"Счётчики: first-pass success rate, repeated-error rate, rollback rate, unknown-state commands, commands without exact-result verification. Цель — repeated-error rate = 0.","regression_tests":"Каждая исправленная ошибка обязана иметь воспроизводимый тест в tests/errors; лinter запрещает закрывать ошибку без теста и ссылки fixed_by.","supersession":"Старые задачи и обходные пути не удаляются молча: они получают статус superseded с заменой, причиной и запретом повторного запуска."},"requires_v2":true},"gitea":{"default_head_archive":{"archive_sha256":"8f595e76a5baa7b2d8d2148f1a694e9acd22a90accb6e55f962fc47ff1432a5a","branch":"main","bytes":376932,"commit":"fe1221b06643db3b00a621b0230f92a46a4edc2b","files":125},"discovery_evidence":[{"id":"aa350cac62aa","kind":"podman-probe","paths_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","rc":126,"stderr":"Error: crun: capset: Operation not permitted: OCI permission denied\n"},{"kind":"network-ls-remote","rc":0,"stderr":"","stdout_sha256":"b6697044d593fdddb9d66bc35bd58267cc6d07a31b756330aac2f147bc98bc6c"},{"kind":"network-mirror","rc":0,"stderr":"Cloning into bare repository '/tmp/homelab-kb-network-fallback-k4x0gd1r/homelab-ops.git'...\n","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}],"identity":{"access_method":"authenticated-network-mirror","default_branch":"main","head":"fe1221b06643db3b00a621b0230f92a46a4edc2b","ref_count":13,"refs":[{"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","committer_date":"2026-07-31T10:40:00Z","ref":"refs/heads/site-gram1-ru-baseline-canonical-20260731","subject":"gram1.ru: publish verified baseline pointer"},{"commit":"f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49","committer_date":"2026-07-31T10:37:56+03:00","ref":"refs/heads/site-gram1-ru-baseline-20260731","subject":"GRAM1: capture initial site baseline 20260731T071400Z"},{"commit":"fe1221b06643db3b00a621b0230f92a46a4edc2b","committer_date":"2026-07-29T09:33:11Z","ref":"refs/heads/main","subject":"docs: mark Skladchik moderator assistant as planned"},{"commit":"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17","committer_date":"2026-07-20T00:37:03+03:00","ref":"refs/heads/cr-2026-0017-inventory-foundation","subject":"CR-2026-0017: model access contexts and discover guest management"},{"commit":"60f53ea6fe6724196802a46de3de19c7889a51cc","committer_date":"2026-07-19T17:57:23+03:00","ref":"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary","subject":"CR-2026-0015: add pve03 r8152 RX ring canary"},{"commit":"25b275f96b54551e26f07516c72651d85f235ad0","committer_date":"2026-07-18T16:27:33+03:00","ref":"refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition","subject":"CR-2026-0013: allow VM160 worker bootstrap transition"},{"commit":"f5b22d867ea467987008408e3fb1fb0e17fa7b2e","committer_date":"2026-07-18T14:17:33+03:00","ref":"refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook","subject":"CR-2026-0012: add one-command Skladchik Cookie refresh runbook"},{"commit":"bb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9","committer_date":"2026-07-18T13:11:46+03:00","ref":"refs/heads/cr-2026-0011-skladchik-cookie-jar-reset","subject":"CR-2026-0011: force fresh Skladchik Cookie before jar persistence"},{"commit":"7bd1b050f8d64c7b55dfd51ead63f0adda87f2df","committer_date":"2026-07-18T10:34:25+03:00","ref":"refs/heads/cr-2026-0009-skladchik-concurrency-guard","subject":"CR-2026-0010: separate current and target Skladchik edge SHAs"},{"commit":"1f7abe5acf856ad2a2abe10ef2a9452485edb073","committer_date":"2026-07-18T09:26:07+03:00","ref":"refs/heads/cr-2026-0008-skladchik-snapshot-integrity","subject":"CR-2026-0008: repair Skladchik rollback snapshot integrity"},{"commit":"d399d24440f948b518761ecfd516521993861b43","committer_date":"2026-07-18T08:57:02+03:00","ref":"refs/heads/cr-2026-0007-skladchik-controlled-reauth","subject":"CR-2026-0007: add controlled Skladchik reauthentication task"},{"commit":"16e84298035f5e4ec7e2b7d39967ad5e40ea3d4b","committer_date":"2026-07-18T07:43:14+03:00","ref":"refs/heads/cr-2026-0006-cluster-cloud-quorum","subject":"CR-2026-0006: add VM160 cloud quorum canary task"},{"commit":"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc","committer_date":"2026-07-18T03:57:33+03:00","ref":"refs/heads/cr-2026-0005-codex-bootstrap-activation","subject":"CR-2026-0005 prepare reviewed logrotate bootstrap clearance"}],"refs_sha256":"1349b9021de5d4f1bb0406fd4895b3e0d1fd5c674f3686bad730a3e7a0695fb3","repo_url":"https://git.gram1.ru/homelab-admin/homelab-ops","source":{"kind":"direct","path":"/tmp/homelab-kb-network-fallback-k4x0gd1r/homelab-ops.git"}},"scan":{"canonical_candidate":{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n - UPnP/IGD discovery","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},"canonical_candidate_ambiguous":true,"error_artifacts":[{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n - UPnP/IGD discovery","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n - UPnP/IGD discovery","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n - UPnP/IGD discovery","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":1079183,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":102,"coverage":{"access_and_admin":["access","login","admin","ssh","console","url"],"backup_and_restore":["backup","бэкап","restore","восстанов","recovery","retention"],"change_safety":["rollback","sha256","atomic"],"error_learning":["regression","incident","superseded"],"external_services":["внешн","public","reverse proxy","nginx"],"guests_and_workloads":["vmid","container","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["внутренн","lan"],"monitoring_and_logs":["monitor","alert","log","journal","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","tls","certificate"],"repair_and_troubleshooting":["repair","troubleshoot","diagnostic","failure"],"storage":["storage","thin","disk"]},"excerpt":"","headings":[],"json_top_level_size":1000,"json_top_level_type":"list","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["url-userinfo"],"sha256":"aeb92358514ec5cd67d557f15ea295b3ae4f25df5f17a14556dae750b8496d1b","total_score":102},{"bytes":9499,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":88,"coverage":{"access_and_admin":["access","login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","internet"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["internal service","lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","grafana","prometheus"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"excerpt":"# DR from zero runbook, 2026-06-22\n\nChecked at UTC: `2026-06-22T09:00:38Z`.\n\nMarker: **DR from zero runbook, 2026-06-22**\n\n## Purpose\n\nThis runbook describes how to rebuild a minimum viable homelab from zero after a serious failure.\n\nIt is not a restore execution log. It is a step-by-step operator procedure.\n\n## Scope\n\nThe goal is to recover enough infrastructure to regain access, documentation, identity, routing, secrets, Git, backup visibility, and then stateful applications.\n\nMinimum viable homelab means:\n\n- SSH access works;\n- VPN/Tailscale/NetBird access works or has a known temporary replacement;\n- Git repository is available;\n- SOPS/age secrets can be decrypted;\n- MkDocs documentation is published;\n- NPMplus routes can be restored;\n- Authentik, Gitea, Vaultwarden, NetBox, and Uptime Kuma can be restored;\n- backup/offhost locations are visible;\n- health checks prove the restored state.\n\n## Current known source-of-truth commits\n\n- Backup coverage closure: completed before this runbook.\n- MkDocs publish hardening: completed.\n- Backup tiering table: completed.\n- Current repo head when starting this runbook: `adb8c55`.\n\n## P0 restore order\n\n| Order | Component | Why first | Expec","headings":[{"level":1,"line":1,"title":"DR from zero runbook, 2026-06-22"},{"level":2,"line":7,"title":"Purpose"},{"level":2,"line":13,"title":"Scope"},{"level":2,"line":29,"title":"Current known source-of-truth commits"},{"level":2,"line":36,"title":"P0 restore order"},{"level":2,"line":55,"title":"Critical backup sources"},{"level":2,"line":71,"title":"Phase 0 — stop and preserve evidence"},{"level":2,"line":86,"title":"Phase 1 — base host recovery"},{"level":2,"line":104,"title":"Phase 2 — network access"},{"level":2,"line":119,"title":"Phase 3 — clone repository"},{"level":2,"line":136,"title":"Phase 4 — restore secrets/SOPS"},{"level":2,"line":155,"title":"Phase 5 — restore documentation first"},{"level":2,"line":173,"title":"Phase 6 — recover NPMplus and Uptime Kuma"},{"level":2,"line":197,"title":"Phase 7 — recover Authentik"},{"level":2,"line":215,"title":"Phase 8 — recover Gitea"},{"level":2,"line":230,"title":"Phase 9 — recover Vaultwarden"},{"level":2,"line":244,"title":"Phase 10 — recover NetBox"},{"level":2,"line":270,"title":"Phase 11 — recover Edge VM"},{"level":2,"line":291,"title":"Phase 12 — recover user data services"},{"level":2,"line":306,"title":"Phase 13 — restore monitoring and alerting"},{"level":2,"line":325,"title":"Do not do"},{"level":2,"line":334,"title":"Final DR closure checklist"},{"level":2,"line":353,"title":"Next improvement after this runbook"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f8312cd7cd0a296c60950a60c7866a67b19a70016b93f68b3a76b78d5440cb63","total_score":102},{"bytes":9386,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["qemu"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns"],"repair_and_troubleshooting":["failure"],"storage":["thin","disk"]},"headings":[{"level":1,"line":1,"title":"Disaster Recovery Runbook"},{"level":2,"line":6,"title":"Current verified recovery anchors"},{"level":2,"line":25,"title":"Things that must exist outside the repo"},{"level":2,"line":39,"title":"Recovery priority"},{"level":2,"line":51,"title":"Phase 0: establish a control host"},{"level":2,"line":65,"title":"Phase 1: restore rclone access"},{"level":2,"line":90,"title":"Phase 2: restore the critical/small cloud bundle"},{"level":1,"line":107,"title":"Expected:"},{"level":1,"line":108,"title":"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c"},{"level":2,"line":130,"title":"Phase 3: recover small app/config backups"},{"level":2,"line":163,"title":"Phase 4: recover edge-vm large backup"},{"level":1,"line":194,"title":"Expected size:"},{"level":1,"line":195,"title":"16936767590"},{"level":1,"line":196,"title":"Expected SHA256:"},{"level":1,"line":197,"title":"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001"},{"level":2,"line":202,"title":"Phase 5: restore validation checklist"},{"level":2,"line":218,"title":"Phase 6: re-enable backup and offsite automation"},{"level":2,"line":231,"title":"Known failure lessons"},{"level":2,"line":243,"title":"Vaultwarden isolated restore drill result — 2026-06-18"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e","total_score":100},{"bytes":9386,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["qemu"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns"],"repair_and_troubleshooting":["failure"],"storage":["thin","disk"]},"headings":[{"level":1,"line":1,"title":"Disaster Recovery Runbook"},{"level":2,"line":6,"title":"Current verified recovery anchors"},{"level":2,"line":25,"title":"Things that must exist outside the repo"},{"level":2,"line":39,"title":"Recovery priority"},{"level":2,"line":51,"title":"Phase 0: establish a control host"},{"level":2,"line":65,"title":"Phase 1: restore rclone access"},{"level":2,"line":90,"title":"Phase 2: restore the critical/small cloud bundle"},{"level":1,"line":107,"title":"Expected:"},{"level":1,"line":108,"title":"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c"},{"level":2,"line":130,"title":"Phase 3: recover small app/config backups"},{"level":2,"line":163,"title":"Phase 4: recover edge-vm large backup"},{"level":1,"line":194,"title":"Expected size:"},{"level":1,"line":195,"title":"16936767590"},{"level":1,"line":196,"title":"Expected SHA256:"},{"level":1,"line":197,"title":"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001"},{"level":2,"line":202,"title":"Phase 5: restore validation checklist"},{"level":2,"line":218,"title":"Phase 6: re-enable backup and offsite automation"},{"level":2,"line":231,"title":"Known failure lessons"},{"level":2,"line":243,"title":"Vaultwarden isolated restore drill result — 2026-06-18"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e","total_score":100},{"bytes":16031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["internal service","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"05. Service Catalog"},{"level":2,"line":5,"title":"Edge VM"},{"level":2,"line":12,"title":"NPMplus"},{"level":2,"line":22,"title":"Uptime Kuma"},{"level":2,"line":30,"title":"Gotify"},{"level":2,"line":38,"title":"Vaultwarden"},{"level":2,"line":49,"title":"Dockge"},{"level":2,"line":61,"title":"Homepage"},{"level":2,"line":71,"title":"Gitea"},{"level":2,"line":84,"title":"Nextcloud AIO"},{"level":2,"line":95,"title":"DNS stack"},{"level":2,"line":102,"title":"Backup"},{"level":2,"line":109,"title":"Edge applications added 2026-06-15/16"},{"level":2,"line":132,"title":"Backup health proxy"},{"level":2,"line":155,"title":"Edge VM capacity note"},{"level":2,"line":366,"title":"Homepage grouped dashboard update, 2026-06-22"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a","total_score":95},{"bytes":106031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":92,"coverage":{"access_and_admin":["access","login","admin","web ui","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","lxc","qemu","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["локальн","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"99. Current state summary"},{"level":2,"line":5,"title":"Git repository"},{"level":2,"line":12,"title":"Operating rules"},{"level":2,"line":21,"title":"Current verified backup health"},{"level":2,"line":32,"title":"Backup scripts and services"},{"level":2,"line":41,"title":"Proxmox and network layout"},{"level":2,"line":58,"title":"NPMplus state"},{"level":2,"line":81,"title":"DNS rewrites"},{"level":2,"line":101,"title":"Edge applications"},{"level":2,"line":118,"title":"Uptime Kuma"},{"level":2,"line":131,"title":"Cloudflare token rotation"},{"level":2,"line":139,"title":"Known working URLs"},{"level":2,"line":166,"title":"Pending after this documentation update"},{"level":2,"line":181,"title":"Edge application setup checkpoint — 2026-06-16T10:26:57Z"},{"level":2,"line":194,"title":"Immich media storage checkpoint — 2026-06-16T11:01:32Z"},{"level":2,"line":204,"title":"Immich media backup checkpoint — 2026-06-16T11:24:22Z"},{"level":2,"line":219,"title":"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z"},{"level":2,"line":231,"title":"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z"},{"level":2,"line":245,"title":"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z"},{"level":2,"line":257,"title":"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z"},{"level":2,"line":266,"title":"Closed validation checkpoint — 2026-06-16T16:51:40Z"},{"level":2,"line":278,"title":"Disk Space Health checkpoint — 2026-06-16T17:06:06Z"},{"level":2,"line":298,"title":"Memos backup checkpoint — 2026-06-16T17:33:39Z"},{"level":2,"line":319,"title":"Paperless backup checkpoint — 2026-06-16T17:50:49Z"},{"level":2,"line":350,"title":"Application restore validation checkpoint — 2026-06-16T18:01:17Z"},{"level":2,"line":364,"title":"Final full baseline checkpoint — 2026-06-16T18:10:15Z"},{"level":2,"line":407,"title":"Daily cluster status report"},{"level":2,"line":420,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":447,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":482,"title":"Контейнерная волна обновлений, 2026-06-19"},{"level":2,"line":498,"title":"CVE root-cause analysis, 2026-06-19"},{"level":2,"line":514,"title":"Browser / Chromium risk analysis, 2026-06-19"},{"level":2,"line":527,"title":"Base OS package CVE analysis, 2026-06-19"},{"level":2,"line":541,"title":"Go runtime/dependency CVE analysis, 2026-06-19"},{"level":2,"line":555,"title":"Node/NPM dependency CVE analysis, 2026-06-19"},{"level":2,"line":569,"title":"Dockge / Karakeep candidate tag scan, 2026-06-19"},{"level":2,"line":583,"title":"Karakeep production update, 2026-06-19"},{"level":2,"line":605,"title":"Uptime Kuma candidate tag scan, 2026-06-19"},{"level":2,"line":622,"title":"Uptime Kuma production update, 2026-06-19"},{"level":2,"line":644,"title":"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19"},{"level":2,"line":663,"title":"Linkding candidate tag scan, 2026-06-19"},{"level":2,"line":678,"title":"Linkding production update, 2026-06-19"},{"level":2,"line":698,"title":"Current Trivy leaderboard after Linkding, 2026-06-19"},{"level":2,"line":717,"title":"Batch candidate scan, 2026-06-19"},{"level":2,"line":744,"title":"Disk cleanup and Git push recovery, 2026-06-19"},{"level":2,"line":758,"title":"Next update candidates from batch scan, 2026-06-19"},{"level":2,"line":770,"title":"IT-Tools production update, 2026-06-19"},{"level":2,"line":789,"title":"NPMplus production update, 2026-06-19"},{"level":2,"line":812,"title":"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19"},{"level":2,"line":827,"title":"Paperless stable candidate scan, 2026-06-19"},{"level":2,"line":852,"title":"Immich app stable pair candidate scan, 2026-06-19"},{"level":2,"line":878,"title":"Immich app pair candidate scan result, 2026-06-19"},{"level":2,"line":896,"title":"Home Assistant stable candidate scan, 2026-06-19"},{"level":2,"line":919,"title":"MinIO release candidate scan, 2026-06-19"},{"level":2,"line":942,"title":"Mealie stable candidate scan, 2026-06-19"},{"level":2,"line":965,"title":"Authentik server image candidate scan, 2026-06-19"},{"level":2,"line":988,"title":"Karakeep Meilisearch candidate scan, 2026-06-19"},{"level":2,"line":1011,"title":"Karakeep Chrome candidate scan, 2026-06-19"},{"level":2,"line":1034,"title":"Vaultwarden stable candidate scan, 2026-06-19"},{"level":2,"line":1057,"title":"Vaultwarden production update, 2026-06-20"},{"level":2,"line":1083,"title":"Current Trivy leaderboard after Vaultwarden, 2026-06-20"},{"level":2,"line":1098,"title":"n8n stable candidate scan, 2026-06-20"},{"level":2,"line":1121,"title":"n8n latest tag restore, 2026-06-20"},{"level":2,"line":1137,"title":"n8n 2.27.3 smoke-test, 2026-06-20"},{"level":2,"line":1163,"title":"n8n production update, 2026-06-20"},{"level":2,"line":1193,"title":"Gotify stable candidate scan, 2026-06-20"},{"level":2,"line":1213,"title":"Batch remaining open candidate scan, 2026-06-20"},{"level":2,"line":1234,"title":"CrowdSec production update, 2026-06-20"},{"level":2,"line":1262,"title":"Final CVE pass summary, 2026-06-20"},{"level":2,"line":1286,"title":"n8n encryption key rotation, 2026-06-20"},{"level":2,"line":1311,"title":"Audit and backup inventory, 2026-06-20"},{"level":2,"line":1326,"title":"Immich Postgres restore smoke-test, 2026-06-20"},{"level":2,"line":1342,"title":"Immich Postgres candidate scan, 2026-06-20"},{"level":2,"line":1352,"title":"Dockge candidate scan, 2026-06-20"},{"level":2,"line":1362,"title":"Paperless candidate scan, 2026-06-20"},{"level":2,"line":1372,"title":"Karakeep and Immich Server real-tag scan, 2026-06-20"},{"level":2,"line":1382,"title":"Closing high-CVE ledger, 2026-06-20"},{"level":2,"line":1392,"title":"Candidate test directories cleanup, 2026-06-20"},{"level":2,"line":1402,"title":"Old n8n key backup removal preflight, 2026-06-20"},{"level":2,"line":1412,"title":"NetBird peers health hardening, 2026-06-20"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md","path_score":3,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c","total_score":95},{"bytes":16031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["internal service","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"05. Service Catalog"},{"level":2,"line":5,"title":"Edge VM"},{"level":2,"line":12,"title":"NPMplus"},{"level":2,"line":22,"title":"Uptime Kuma"},{"level":2,"line":30,"title":"Gotify"},{"level":2,"line":38,"title":"Vaultwarden"},{"level":2,"line":49,"title":"Dockge"},{"level":2,"line":61,"title":"Homepage"},{"level":2,"line":71,"title":"Gitea"},{"level":2,"line":84,"title":"Nextcloud AIO"},{"level":2,"line":95,"title":"DNS stack"},{"level":2,"line":102,"title":"Backup"},{"level":2,"line":109,"title":"Edge applications added 2026-06-15/16"},{"level":2,"line":132,"title":"Backup health proxy"},{"level":2,"line":155,"title":"Edge VM capacity note"},{"level":2,"line":366,"title":"Homepage grouped dashboard update, 2026-06-22"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a","total_score":95},{"bytes":106031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":92,"coverage":{"access_and_admin":["access","login","admin","web ui","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","lxc","qemu","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["локальн","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"99. Current state summary"},{"level":2,"line":5,"title":"Git repository"},{"level":2,"line":12,"title":"Operating rules"},{"level":2,"line":21,"title":"Current verified backup health"},{"level":2,"line":32,"title":"Backup scripts and services"},{"level":2,"line":41,"title":"Proxmox and network layout"},{"level":2,"line":58,"title":"NPMplus state"},{"level":2,"line":81,"title":"DNS rewrites"},{"level":2,"line":101,"title":"Edge applications"},{"level":2,"line":118,"title":"Uptime Kuma"},{"level":2,"line":131,"title":"Cloudflare token rotation"},{"level":2,"line":139,"title":"Known working URLs"},{"level":2,"line":166,"title":"Pending after this documentation update"},{"level":2,"line":181,"title":"Edge application setup checkpoint — 2026-06-16T10:26:57Z"},{"level":2,"line":194,"title":"Immich media storage checkpoint — 2026-06-16T11:01:32Z"},{"level":2,"line":204,"title":"Immich media backup checkpoint — 2026-06-16T11:24:22Z"},{"level":2,"line":219,"title":"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z"},{"level":2,"line":231,"title":"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z"},{"level":2,"line":245,"title":"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z"},{"level":2,"line":257,"title":"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z"},{"level":2,"line":266,"title":"Closed validation checkpoint — 2026-06-16T16:51:40Z"},{"level":2,"line":278,"title":"Disk Space Health checkpoint — 2026-06-16T17:06:06Z"},{"level":2,"line":298,"title":"Memos backup checkpoint — 2026-06-16T17:33:39Z"},{"level":2,"line":319,"title":"Paperless backup checkpoint — 2026-06-16T17:50:49Z"},{"level":2,"line":350,"title":"Application restore validation checkpoint — 2026-06-16T18:01:17Z"},{"level":2,"line":364,"title":"Final full baseline checkpoint — 2026-06-16T18:10:15Z"},{"level":2,"line":407,"title":"Daily cluster status report"},{"level":2,"line":420,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":447,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":482,"title":"Контейнерная волна обновлений, 2026-06-19"},{"level":2,"line":498,"title":"CVE root-cause analysis, 2026-06-19"},{"level":2,"line":514,"title":"Browser / Chromium risk analysis, 2026-06-19"},{"level":2,"line":527,"title":"Base OS package CVE analysis, 2026-06-19"},{"level":2,"line":541,"title":"Go runtime/dependency CVE analysis, 2026-06-19"},{"level":2,"line":555,"title":"Node/NPM dependency CVE analysis, 2026-06-19"},{"level":2,"line":569,"title":"Dockge / Karakeep candidate tag scan, 2026-06-19"},{"level":2,"line":583,"title":"Karakeep production update, 2026-06-19"},{"level":2,"line":605,"title":"Uptime Kuma candidate tag scan, 2026-06-19"},{"level":2,"line":622,"title":"Uptime Kuma production update, 2026-06-19"},{"level":2,"line":644,"title":"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19"},{"level":2,"line":663,"title":"Linkding candidate tag scan, 2026-06-19"},{"level":2,"line":678,"title":"Linkding production update, 2026-06-19"},{"level":2,"line":698,"title":"Current Trivy leaderboard after Linkding, 2026-06-19"},{"level":2,"line":717,"title":"Batch candidate scan, 2026-06-19"},{"level":2,"line":744,"title":"Disk cleanup and Git push recovery, 2026-06-19"},{"level":2,"line":758,"title":"Next update candidates from batch scan, 2026-06-19"},{"level":2,"line":770,"title":"IT-Tools production update, 2026-06-19"},{"level":2,"line":789,"title":"NPMplus production update, 2026-06-19"},{"level":2,"line":812,"title":"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19"},{"level":2,"line":827,"title":"Paperless stable candidate scan, 2026-06-19"},{"level":2,"line":852,"title":"Immich app stable pair candidate scan, 2026-06-19"},{"level":2,"line":878,"title":"Immich app pair candidate scan result, 2026-06-19"},{"level":2,"line":896,"title":"Home Assistant stable candidate scan, 2026-06-19"},{"level":2,"line":919,"title":"MinIO release candidate scan, 2026-06-19"},{"level":2,"line":942,"title":"Mealie stable candidate scan, 2026-06-19"},{"level":2,"line":965,"title":"Authentik server image candidate scan, 2026-06-19"},{"level":2,"line":988,"title":"Karakeep Meilisearch candidate scan, 2026-06-19"},{"level":2,"line":1011,"title":"Karakeep Chrome candidate scan, 2026-06-19"},{"level":2,"line":1034,"title":"Vaultwarden stable candidate scan, 2026-06-19"},{"level":2,"line":1057,"title":"Vaultwarden production update, 2026-06-20"},{"level":2,"line":1083,"title":"Current Trivy leaderboard after Vaultwarden, 2026-06-20"},{"level":2,"line":1098,"title":"n8n stable candidate scan, 2026-06-20"},{"level":2,"line":1121,"title":"n8n latest tag restore, 2026-06-20"},{"level":2,"line":1137,"title":"n8n 2.27.3 smoke-test, 2026-06-20"},{"level":2,"line":1163,"title":"n8n production update, 2026-06-20"},{"level":2,"line":1193,"title":"Gotify stable candidate scan, 2026-06-20"},{"level":2,"line":1213,"title":"Batch remaining open candidate scan, 2026-06-20"},{"level":2,"line":1234,"title":"CrowdSec production update, 2026-06-20"},{"level":2,"line":1262,"title":"Final CVE pass summary, 2026-06-20"},{"level":2,"line":1286,"title":"n8n encryption key rotation, 2026-06-20"},{"level":2,"line":1311,"title":"Audit and backup inventory, 2026-06-20"},{"level":2,"line":1326,"title":"Immich Postgres restore smoke-test, 2026-06-20"},{"level":2,"line":1342,"title":"Immich Postgres candidate scan, 2026-06-20"},{"level":2,"line":1352,"title":"Dockge candidate scan, 2026-06-20"},{"level":2,"line":1362,"title":"Paperless candidate scan, 2026-06-20"},{"level":2,"line":1372,"title":"Karakeep and Immich Server real-tag scan, 2026-06-20"},{"level":2,"line":1382,"title":"Closing high-CVE ledger, 2026-06-20"},{"level":2,"line":1392,"title":"Candidate test directories cleanup, 2026-06-20"},{"level":2,"line":1402,"title":"Old n8n key backup removal preflight, 2026-06-20"},{"level":2,"line":1412,"title":"NetBird peers health hardening, 2026-06-20"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md","path_score":3,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c","total_score":95},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":38408,"commit":"60f53ea6fe6724196802a46de3de19c7889a51cc","content_score":86,"coverage":{"access_and_admin":["login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256","atomic"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["pve01","cluster","node","quorum","corosync"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["network","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary"],"sensitive_findings":[],"sha256":"07c9854ab0232d1f2766cdab114d0d398a4dcc1a5b41ea7fde77646e5f42804e","total_score":86},{"bytes":61327,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["access","login","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","qemu"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","grafana","prometheus"],"network_and_dns":["network","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"Services bootstrap snapshot — 2026-06-17"},{"level":2,"line":3,"title":"Scope"},{"level":2,"line":9,"title":"Edge VM"},{"level":2,"line":19,"title":"NetBird VPS"},{"level":2,"line":34,"title":"NetBird backup status"},{"level":3,"line":37,"title":"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb"},{"level":2,"line":40,"title":"NetBird backup timers"},{"level":2,"line":46,"title":"Important follow-ups"},{"level":2,"line":54,"title":"NetBird Uptime Kuma monitors"},{"level":2,"line":64,"title":"NetBird homelab peers"},{"level":3,"line":69,"title":"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0 UNKNOWN 100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 "},{"level":2,"line":72,"title":"NetBird peers health monitor"},{"level":2,"line":88,"title":"File Browser credential remediation"},{"level":2,"line":98,"title":"Proxmox private SSL via NetBird FQDN"},{"level":2,"line":116,"title":"File Browser backup, offhost sync, and restore validation"},{"level":2,"line":150,"title":"App stacks batch backup chain"},{"level":2,"line":194,"title":"Final backup and health baseline"},{"level":2,"line":202,"title":"Private NPMplus hosts via NetBird"},{"level":2,"line":231,"title":"Homepage VPN Authentik forward-auth"},{"level":2,"line":244,"title":"Homepage Authentik forward-auth rollback"},{"level":2,"line":257,"title":"Private VPN hosts safe baseline after Authentik rollback"},{"level":2,"line":271,"title":"Private VPN Hosts Kuma monitor"},{"level":2,"line":289,"title":"Private VPN Hosts health timer"},{"level":2,"line":304,"title":"Private VPN Hosts timer auto-cycle verified"},{"level":2,"line":314,"title":"Final ops snapshot — private VPN hosts"},{"level":2,"line":326,"title":"NPMplus + Kuma config backup chain"},{"level":2,"line":348,"title":"Corrected NPMplus + Kuma config backup chain"},{"level":2,"line":367,"title":"NPMplus + Kuma backup chain Kuma monitors"},{"level":2,"line":382,"title":"NPMplus + Kuma config backup timer"},{"level":2,"line":398,"title":"Authentik backup chain"},{"level":2,"line":408,"title":"Authentik backup chain Kuma monitors"},{"level":2,"line":417,"title":"Authentik backup timer"},{"level":2,"line":431,"title":"Gitea backup chain"},{"level":2,"line":441,"title":"Gitea backup chain"},{"level":2,"line":445,"title":"Gitea backup chain Kuma monitors"},{"level":2,"line":454,"title":"Gitea backup timer"},{"level":2,"line":465,"title":"Vaultwarden backup chain"},{"level":2,"line":475,"title":"Vaultwarden backup chain Kuma monitors"},{"level":2,"line":484,"title":"Vaultwarden backup timer"},{"level":2,"line":495,"title":"Edge VM manual vzdump backup"},{"level":2,"line":502,"title":"Edge VM vzdump offhost copy"},{"level":2,"line":508,"title":"Edge VM vzdump restore verification"},{"level":2,"line":515,"title":"Edge VM vzdump Kuma monitors"},{"level":2,"line":528,"title":"Edge VM vzdump weekly timer"},{"level":2,"line":543,"title":"Immich media backup existing automation inventory"},{"level":2,"line":553,"title":"Immich media restore verification"},{"level":2,"line":560,"title":"Immich media restore Kuma monitor"},{"level":2,"line":570,"title":"Immich media restore Kuma monitor correction"},{"level":2,"line":577,"title":"P0 backup baseline closure"},{"level":2,"line":589,"title":"P1 Mail.ru Cloud offsite inventory"},{"level":2,"line":651,"title":"P1 Mail.ru Cloud rclone config drift resolved"},{"level":2,"line":667,"title":"P1 Mail.ru Cloud canary"},{"level":2,"line":675,"title":"P1 Mail.ru Cloud production payload inventory"},{"level":2,"line":710,"title":"P1 Mail.ru Cloud critical baseline upload"},{"level":2,"line":720,"title":"P1 Mail.ru Cloud Kuma monitors"},{"level":2,"line":732,"title":"P1 Mail.ru Cloud edge-vm chunked large upload"},{"level":2,"line":742,"title":"P1 Mail.ru Cloud Edge VM Kuma monitor"},{"level":2,"line":753,"title":"P1 Mail.ru Cloud offsite seed closure"},{"level":2,"line":776,"title":"P1 Mail.ru Cloud critical upload automation"},{"level":2,"line":791,"title":"P1 Mail.ru Cloud edge-vm upload automation"},{"level":2,"line":807,"title":"P1 Mail.ru Cloud automation and retention closure"},{"level":2,"line":829,"title":"P1 Mail.ru Cloud restore drill automation"},{"level":2,"line":843,"title":"P2 Disaster Recovery runbook"},{"level":2,"line":853,"title":"P2 Critical bundle bootstrap drill"},{"level":2,"line":870,"title":"P2 Disaster Recovery bootstrap closure"},{"level":2,"line":892,"title":"Vaultwarden isolated restore drill — 2026-06-18"},{"level":2,"line":929,"title":"Daily cluster status report — 2026-06-18"},{"level":2,"line":985,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":1012,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":1047,"title":"Trivy scan mode after 2026-06-19 update wave"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["sensitive-assignment"],"sha256":"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6","total_score":86},{"bytes":89904,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["admin","console","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","grafana","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["troubleshoot"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"P0 alert routing preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab","total_score":86},{"bytes":61327,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["access","login","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","qemu"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","grafana","prometheus"],"network_and_dns":["network","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"Services bootstrap snapshot — 2026-06-17"},{"level":2,"line":3,"title":"Scope"},{"level":2,"line":9,"title":"Edge VM"},{"level":2,"line":19,"title":"NetBird VPS"},{"level":2,"line":34,"title":"NetBird backup status"},{"level":3,"line":37,"title":"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb"},{"level":2,"line":40,"title":"NetBird backup timers"},{"level":2,"line":46,"title":"Important follow-ups"},{"level":2,"line":54,"title":"NetBird Uptime Kuma monitors"},{"level":2,"line":64,"title":"NetBird homelab peers"},{"level":3,"line":69,"title":"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0 UNKNOWN 100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 "},{"level":2,"line":72,"title":"NetBird peers health monitor"},{"level":2,"line":88,"title":"File Browser credential remediation"},{"level":2,"line":98,"title":"Proxmox private SSL via NetBird FQDN"},{"level":2,"line":116,"title":"File Browser backup, offhost sync, and restore validation"},{"level":2,"line":150,"title":"App stacks batch backup chain"},{"level":2,"line":194,"title":"Final backup and health baseline"},{"level":2,"line":202,"title":"Private NPMplus hosts via NetBird"},{"level":2,"line":231,"title":"Homepage VPN Authentik forward-auth"},{"level":2,"line":244,"title":"Homepage Authentik forward-auth rollback"},{"level":2,"line":257,"title":"Private VPN hosts safe baseline after Authentik rollback"},{"level":2,"line":271,"title":"Private VPN Hosts Kuma monitor"},{"level":2,"line":289,"title":"Private VPN Hosts health timer"},{"level":2,"line":304,"title":"Private VPN Hosts timer auto-cycle verified"},{"level":2,"line":314,"title":"Final ops snapshot — private VPN hosts"},{"level":2,"line":326,"title":"NPMplus + Kuma config backup chain"},{"level":2,"line":348,"title":"Corrected NPMplus + Kuma config backup chain"},{"level":2,"line":367,"title":"NPMplus + Kuma backup chain Kuma monitors"},{"level":2,"line":382,"title":"NPMplus + Kuma config backup timer"},{"level":2,"line":398,"title":"Authentik backup chain"},{"level":2,"line":408,"title":"Authentik backup chain Kuma monitors"},{"level":2,"line":417,"title":"Authentik backup timer"},{"level":2,"line":431,"title":"Gitea backup chain"},{"level":2,"line":441,"title":"Gitea backup chain"},{"level":2,"line":445,"title":"Gitea backup chain Kuma monitors"},{"level":2,"line":454,"title":"Gitea backup timer"},{"level":2,"line":465,"title":"Vaultwarden backup chain"},{"level":2,"line":475,"title":"Vaultwarden backup chain Kuma monitors"},{"level":2,"line":484,"title":"Vaultwarden backup timer"},{"level":2,"line":495,"title":"Edge VM manual vzdump backup"},{"level":2,"line":502,"title":"Edge VM vzdump offhost copy"},{"level":2,"line":508,"title":"Edge VM vzdump restore verification"},{"level":2,"line":515,"title":"Edge VM vzdump Kuma monitors"},{"level":2,"line":528,"title":"Edge VM vzdump weekly timer"},{"level":2,"line":543,"title":"Immich media backup existing automation inventory"},{"level":2,"line":553,"title":"Immich media restore verification"},{"level":2,"line":560,"title":"Immich media restore Kuma monitor"},{"level":2,"line":570,"title":"Immich media restore Kuma monitor correction"},{"level":2,"line":577,"title":"P0 backup baseline closure"},{"level":2,"line":589,"title":"P1 Mail.ru Cloud offsite inventory"},{"level":2,"line":651,"title":"P1 Mail.ru Cloud rclone config drift resolved"},{"level":2,"line":667,"title":"P1 Mail.ru Cloud canary"},{"level":2,"line":675,"title":"P1 Mail.ru Cloud production payload inventory"},{"level":2,"line":710,"title":"P1 Mail.ru Cloud critical baseline upload"},{"level":2,"line":720,"title":"P1 Mail.ru Cloud Kuma monitors"},{"level":2,"line":732,"title":"P1 Mail.ru Cloud edge-vm chunked large upload"},{"level":2,"line":742,"title":"P1 Mail.ru Cloud Edge VM Kuma monitor"},{"level":2,"line":753,"title":"P1 Mail.ru Cloud offsite seed closure"},{"level":2,"line":776,"title":"P1 Mail.ru Cloud critical upload automation"},{"level":2,"line":791,"title":"P1 Mail.ru Cloud edge-vm upload automation"},{"level":2,"line":807,"title":"P1 Mail.ru Cloud automation and retention closure"},{"level":2,"line":829,"title":"P1 Mail.ru Cloud restore drill automation"},{"level":2,"line":843,"title":"P2 Disaster Recovery runbook"},{"level":2,"line":853,"title":"P2 Critical bundle bootstrap drill"},{"level":2,"line":870,"title":"P2 Disaster Recovery bootstrap closure"},{"level":2,"line":892,"title":"Vaultwarden isolated restore drill — 2026-06-18"},{"level":2,"line":929,"title":"Daily cluster status report — 2026-06-18"},{"level":2,"line":985,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":1012,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":1047,"title":"Trivy scan mode after 2026-06-19 update wave"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["sensitive-assignment"],"sha256":"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6","total_score":86},{"bytes":89904,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["admin","console","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","grafana","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["troubleshoot"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"P0 alert routing preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab","total_score":86},{"bytes":89904,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["admin","console","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","grafana","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["troubleshoot"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"P0 alert routing preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab","total_score":86},{"bytes":8415,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":74,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","prometheus"],"network_and_dns":["firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-05 CrowdSec LAPI monitoring coverage inventory"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Coverage summary"},{"level":2,"line":31,"title":"Runtime monitoring containers"},{"level":2,"line":41,"title":"Repo evidence sample"},{"level":2,"line":69,"title":"Kuma match sample"},{"level":2,"line":76,"title":"Prometheus related files"},{"level":2,"line":80,"title":"Edge health-file sample"},{"level":2,"line":107,"title":"pve01 health-file sample"},{"level":2,"line":113,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25","total_score":83},{"bytes":4739,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["rollback"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"monitoring_and_logs":["log"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["repair","failure"]},"headings":[{"level":1,"line":1,"title":"NPMplus route-change safety runbook"},{"level":2,"line":3,"title":"Purpose"},{"level":2,"line":9,"title":"Scope"},{"level":2,"line":23,"title":"Forbidden actions unless explicitly approved"},{"level":2,"line":36,"title":"Required read-only preflight"},{"level":2,"line":57,"title":"Generated config discovery"},{"level":2,"line":65,"title":"Target and protocol decision tree"},{"level":2,"line":74,"title":"Required patch sequence"},{"level":2,"line":93,"title":"Rollback requirements"},{"level":2,"line":99,"title":"Redirect-loop checks"},{"level":2,"line":111,"title":"Adjacent component awareness"},{"level":2,"line":125,"title":"Adjacent smoke checks"},{"level":2,"line":135,"title":"Terminal command requirements"},{"level":2,"line":148,"title":"Closeout requirements"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"364e3146093a497342a308b35afcd38821564da0f72cfa3bc1b24e4b3b0d81a1","total_score":83},{"bytes":8415,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":74,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","prometheus"],"network_and_dns":["firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-05 CrowdSec LAPI monitoring coverage inventory"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Coverage summary"},{"level":2,"line":31,"title":"Runtime monitoring containers"},{"level":2,"line":41,"title":"Repo evidence sample"},{"level":2,"line":69,"title":"Kuma match sample"},{"level":2,"line":76,"title":"Prometheus related files"},{"level":2,"line":80,"title":"Edge health-file sample"},{"level":2,"line":107,"title":"pve01 health-file sample"},{"level":2,"line":113,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25","total_score":83},{"bytes":4739,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["rollback"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"monitoring_and_logs":["log"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["repair","failure"]},"headings":[{"level":1,"line":1,"title":"NPMplus route-change safety runbook"},{"level":2,"line":3,"title":"Purpose"},{"level":2,"line":9,"title":"Scope"},{"level":2,"line":23,"title":"Forbidden actions unless explicitly approved"},{"level":2,"line":36,"title":"Required read-only preflight"},{"level":2,"line":57,"title":"Generated config discovery"},{"level":2,"line":65,"title":"Target and protocol decision tree"},{"level":2,"line":74,"title":"Required patch sequence"},{"level":2,"line":93,"title":"Rollback requirements"},{"level":2,"line":99,"title":"Redirect-loop checks"},{"level":2,"line":111,"title":"Adjacent component awareness"},{"level":2,"line":125,"title":"Adjacent smoke checks"},{"level":2,"line":135,"title":"Terminal command requirements"},{"level":2,"line":148,"title":"Closeout requirements"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"364e3146093a497342a308b35afcd38821564da0f72cfa3bc1b24e4b3b0d81a1","total_score":83},{"bytes":8415,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":74,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","prometheus"],"network_and_dns":["firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-05 CrowdSec LAPI monitoring coverage inventory"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Coverage summary"},{"level":2,"line":31,"title":"Runtime monitoring containers"},{"level":2,"line":41,"title":"Repo evidence sample"},{"level":2,"line":69,"title":"Kuma match sample"},{"level":2,"line":76,"title":"Prometheus related files"},{"level":2,"line":80,"title":"Edge health-file sample"},{"level":2,"line":107,"title":"pve01 health-file sample"},{"level":2,"line":113,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25","total_score":83},{"bytes":2463,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","admin","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[{"level":1,"line":1,"title":"P2 Ideal Cluster program init"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Starting counters"},{"level":2,"line":15,"title":"Baseline"},{"level":2,"line":21,"title":"Safety model"},{"level":2,"line":30,"title":"Workstreams"},{"level":3,"line":32,"title":"P2-A DR and restore maturity"},{"level":3,"line":40,"title":"P2-B Network and ingress source of truth"},{"level":3,"line":47,"title":"P2-C Access control and service policy"},{"level":3,"line":54,"title":"P2-D Observability closure"},{"level":3,"line":62,"title":"P2-E Backup coverage for services"},{"level":3,"line":70,"title":"P2-F Security hardening"},{"level":3,"line":78,"title":"P2-G NetBox and documentation source of truth"},{"level":2,"line":86,"title":"First selected task"},{"level":2,"line":90,"title":"Safety boundary"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1","total_score":81},{"bytes":2463,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","admin","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[{"level":1,"line":1,"title":"P2 Ideal Cluster program init"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Starting counters"},{"level":2,"line":15,"title":"Baseline"},{"level":2,"line":21,"title":"Safety model"},{"level":2,"line":30,"title":"Workstreams"},{"level":3,"line":32,"title":"P2-A DR and restore maturity"},{"level":3,"line":40,"title":"P2-B Network and ingress source of truth"},{"level":3,"line":47,"title":"P2-C Access control and service policy"},{"level":3,"line":54,"title":"P2-D Observability closure"},{"level":3,"line":62,"title":"P2-E Backup coverage for services"},{"level":3,"line":70,"title":"P2-F Security hardening"},{"level":3,"line":78,"title":"P2-G NetBox and documentation source of truth"},{"level":2,"line":86,"title":"First selected task"},{"level":2,"line":90,"title":"Safety boundary"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1","total_score":81},{"bytes":2463,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":72,"coverage":{"access_and_admin":["access","admin","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[{"level":1,"line":1,"title":"P2 Ideal Cluster program init"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Starting counters"},{"level":2,"line":15,"title":"Baseline"},{"level":2,"line":21,"title":"Safety model"},{"level":2,"line":30,"title":"Workstreams"},{"level":3,"line":32,"title":"P2-A DR and restore maturity"},{"level":3,"line":40,"title":"P2-B Network and ingress source of truth"},{"level":3,"line":47,"title":"P2-C Access control and service policy"},{"level":3,"line":54,"title":"P2-D Observability closure"},{"level":3,"line":62,"title":"P2-E Backup coverage for services"},{"level":3,"line":70,"title":"P2-F Security hardening"},{"level":3,"line":78,"title":"P2-G NetBox and documentation source of truth"},{"level":2,"line":86,"title":"First selected task"},{"level":2,"line":90,"title":"Safety boundary"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1","total_score":81},{"bytes":504281,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["access","login","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["sha256","atomic"],"external_services":["public","internet","nginx"],"guests_and_workloads":["container","lxc","workload"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","firewall","dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure","ошиб"],"storage":["storage","thin","disk","volume"]},"headings":[{"level":1,"line":1,"title":"MkDocs refresh discovery"},{"level":2,"line":7,"title":"Raw output"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md","path_score":0,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["sensitive-assignment"],"sha256":"1ac8fe15ebd06db8ef3a9c6127fe5efe7ecbb76d395abbe551c249b249492d21","total_score":80},{"bytes":3398,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore"],"change_safety":["sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","dns","domain","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"00. Restore from zero for beginners"},{"level":2,"line":7,"title":"0. What must be available before restore"},{"level":2,"line":17,"title":"1. Restore physical and network layer"},{"level":2,"line":25,"title":"2. Restore Proxmox nodes"},{"level":2,"line":35,"title":"3. Restore DNS first"},{"level":2,"line":48,"title":"4. Restore edge-vm"},{"level":2,"line":66,"title":"5. Restore Nextcloud VM"},{"level":2,"line":78,"title":"6. Validate router NAT"},{"level":2,"line":88,"title":"7. Validate main URLs"},{"level":2,"line":100,"title":"8. Validate backup health"},{"level":2,"line":110,"title":"9. Validate monitoring"},{"level":2,"line":125,"title":"10. After restore"},{"level":2,"line":134,"title":"11. Known mistakes to avoid"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"5e430e17e36b23faa90caa38b019485cf09640c94011828e18841b0e361e4470","total_score":78},{"bytes":3785,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["access","admin","url"],"backup_and_restore":["backup"],"change_safety":["rollback","sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"internal_services":["internal service","lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns","domain","tls","certificate"],"storage":["storage","thin"]},"headings":[{"level":1,"line":1,"title":"01. Add new service runbook"},{"level":2,"line":5,"title":"Rule zero"},{"level":2,"line":9,"title":"1. Precheck"},{"level":2,"line":22,"title":"2. DNS"},{"level":2,"line":32,"title":"3. Install container"},{"level":2,"line":46,"title":"4. Local validation"},{"level":2,"line":56,"title":"5. NPMplus"},{"level":2,"line":68,"title":"6. Certificate"},{"level":2,"line":88,"title":"7. Monitoring"},{"level":2,"line":103,"title":"8. Homepage"},{"level":2,"line":109,"title":"9. Service note"},{"level":2,"line":127,"title":"10. Backup"},{"level":2,"line":135,"title":"11. Baseline"},{"level":2,"line":141,"title":"12. MASTER_STATUS"},{"level":2,"line":147,"title":"13. Git documentation"},{"level":2,"line":155,"title":"Known mistakes to avoid"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c8634bd21ce16651970e1a6bdfba6fba9fd84fac030cd53a41798dc92b3ca81c","total_score":77},{"bytes":15818,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28","total_score":76},{"bytes":31410,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","journal","metric"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk","volume"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","path_score":12,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da","total_score":76},{"bytes":15818,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28","total_score":76},{"bytes":31410,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","journal","metric"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk","volume"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","path_score":12,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da","total_score":76},{"bytes":15818,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28","total_score":76},{"bytes":31410,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","journal","metric"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk","volume"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","path_score":12,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da","total_score":76},{"bytes":4960,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["container"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-12 final ideal cluster closeout"},{"level":2,"line":7,"title":"Plain explanation"},{"level":2,"line":17,"title":"Final state"},{"level":2,"line":32,"title":"P3 task summary"},{"level":2,"line":48,"title":"Residual gaps to true 100"},{"level":2,"line":60,"title":"Checks"},{"level":2,"line":73,"title":"Next task"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b","total_score":75},{"bytes":4960,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["container"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-12 final ideal cluster closeout"},{"level":2,"line":7,"title":"Plain explanation"},{"level":2,"line":17,"title":"Final state"},{"level":2,"line":32,"title":"P3 task summary"},{"level":2,"line":48,"title":"Residual gaps to true 100"},{"level":2,"line":60,"title":"Checks"},{"level":2,"line":73,"title":"Next task"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b","total_score":75},{"bytes":4960,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["container"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-12 final ideal cluster closeout"},{"level":2,"line":7,"title":"Plain explanation"},{"level":2,"line":17,"title":"Final state"},{"level":2,"line":32,"title":"P3 task summary"},{"level":2,"line":48,"title":"Residual gaps to true 100"},{"level":2,"line":60,"title":"Checks"},{"level":2,"line":73,"title":"Next task"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b","total_score":75},{"bytes":1585,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","recovery"],"error_learning":["incident"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["alert","grafana"],"storage":["thin"]},"headings":[{"level":1,"line":1,"title":"Homelab recovery runbooks"},{"level":2,"line":5,"title":"Global first command"},{"level":2,"line":12,"title":"Runbooks"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/04_homelab-desired-state/runbooks/INDEX.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"fbaa19446121d3bdb225c82e33e274a91bc414e3786e2f0df49145db1f95f851","total_score":75},{"bytes":56894,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":18,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92","total_score":74},{"bytes":20108,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-09 health surface WARN/OTHER status register"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":13,"title":"Counters"},{"level":2,"line":22,"title":"Summary"},{"level":2,"line":31,"title":"Proposed class counts"},{"level":2,"line":39,"title":"Service hint counts"},{"level":2,"line":47,"title":"Register rows"},{"level":2,"line":136,"title":"Category meanings"},{"level":2,"line":146,"title":"Rules"},{"level":2,"line":154,"title":"Operational conclusion"},{"level":2,"line":158,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2","total_score":74},{"bytes":56894,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":18,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92","total_score":74},{"bytes":20108,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-09 health surface WARN/OTHER status register"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":13,"title":"Counters"},{"level":2,"line":22,"title":"Summary"},{"level":2,"line":31,"title":"Proposed class counts"},{"level":2,"line":39,"title":"Service hint counts"},{"level":2,"line":47,"title":"Register rows"},{"level":2,"line":136,"title":"Category meanings"},{"level":2,"line":146,"title":"Rules"},{"level":2,"line":154,"title":"Operational conclusion"},{"level":2,"line":158,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2","total_score":74},{"bytes":56894,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":18,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92","total_score":74},{"bytes":20108,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":68,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-09 health surface WARN/OTHER status register"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":13,"title":"Counters"},{"level":2,"line":22,"title":"Summary"},{"level":2,"line":31,"title":"Proposed class counts"},{"level":2,"line":39,"title":"Service hint counts"},{"level":2,"line":47,"title":"Register rows"},{"level":2,"line":136,"title":"Category meanings"},{"level":2,"line":146,"title":"Rules"},{"level":2,"line":154,"title":"Operational conclusion"},{"level":2,"line":158,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2","total_score":74},{"bytes":171784,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f","total_score":73},{"bytes":1555,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":62,"coverage":{"access_and_admin":["ssh","url"],"backup_and_restore":["backup","restore"],"change_safety":["rollback"],"identity_and_topology":["proxmox","pve01","cluster","node"],"monitoring_and_logs":["prometheus"]},"headings":[{"level":1,"line":1,"title":"Proxmox exporter runbook"},{"level":2,"line":3,"title":"Location"},{"level":2,"line":11,"title":"Secret handling"},{"level":2,"line":19,"title":"Exporter health"},{"level":2,"line":31,"title":"Prometheus checks"},{"level":2,"line":50,"title":"PVE permissions"},{"level":2,"line":57,"title":"Rollback"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/proxmox-exporter.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"ebcd3f4d48f72038a99d5d8f795c224942723be4ab4db46803664895ff975bad","total_score":73},{"bytes":171784,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f","total_score":73},{"bytes":171784,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":16,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f","total_score":73},{"bytes":84145,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["access","login","admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"guests_and_workloads":["container","qemu","workload","guest"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","journal","grafana","prometheus"],"network_and_dns":["tls"],"storage":["lvm","thin","disk","volume"]},"headings":[{"level":1,"line":1,"title":"P0 edge cleanup preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-edge-cleanup-preflight-20260624T192250Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620","total_score":72},{"bytes":19149,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["url"],"backup_and_restore":["backup","recovery"],"change_safety":["sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","corosync"],"monitoring_and_logs":["log","journal"],"network_and_dns":["network","dns"],"storage":["storage","thin"]},"headings":[{"level":1,"line":1,"title":"P1 AdGuardHome sync image policy preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4","total_score":72},{"bytes":2268,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":58,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","recovery"],"change_safety":["rollback"],"external_services":["public","nginx"],"monitoring_and_logs":["log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"]},"headings":[{"level":1,"line":1,"title":"P1-23 Next safe backlog after NPMplus runbook close"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Next task"},{"level":2,"line":13,"title":"Reason"},{"level":2,"line":19,"title":"Input facts"},{"level":2,"line":29,"title":"P1-24 expected output"},{"level":2,"line":41,"title":"P1-24 safety boundary"},{"level":2,"line":58,"title":"Required carry-forward guardrails"},{"level":2,"line":75,"title":"Command protocol"},{"level":2,"line":82,"title":"DOCX policy"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf","total_score":72},{"bytes":84145,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["access","login","admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"guests_and_workloads":["container","qemu","workload","guest"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","journal","grafana","prometheus"],"network_and_dns":["tls"],"storage":["lvm","thin","disk","volume"]},"headings":[{"level":1,"line":1,"title":"P0 edge cleanup preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-edge-cleanup-preflight-20260624T192250Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620","total_score":72},{"bytes":19149,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["url"],"backup_and_restore":["backup","recovery"],"change_safety":["sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","corosync"],"monitoring_and_logs":["log","journal"],"network_and_dns":["network","dns"],"storage":["storage","thin"]},"headings":[{"level":1,"line":1,"title":"P1 AdGuardHome sync image policy preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4","total_score":72},{"bytes":2268,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":58,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","recovery"],"change_safety":["rollback"],"external_services":["public","nginx"],"monitoring_and_logs":["log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"]},"headings":[{"level":1,"line":1,"title":"P1-23 Next safe backlog after NPMplus runbook close"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Next task"},{"level":2,"line":13,"title":"Reason"},{"level":2,"line":19,"title":"Input facts"},{"level":2,"line":29,"title":"P1-24 expected output"},{"level":2,"line":41,"title":"P1-24 safety boundary"},{"level":2,"line":58,"title":"Required carry-forward guardrails"},{"level":2,"line":75,"title":"Command protocol"},{"level":2,"line":82,"title":"DOCX policy"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf","total_score":72},{"bytes":84145,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["access","login","admin","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"guests_and_workloads":["container","qemu","workload","guest"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","journal","grafana","prometheus"],"network_and_dns":["tls"],"storage":["lvm","thin","disk","volume"]},"headings":[{"level":1,"line":1,"title":"P0 edge cleanup preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-edge-cleanup-preflight-20260624T192250Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620","total_score":72},{"bytes":19149,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":66,"coverage":{"access_and_admin":["url"],"backup_and_restore":["backup","recovery"],"change_safety":["sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","corosync"],"monitoring_and_logs":["log","journal"],"network_and_dns":["network","dns"],"storage":["storage","thin"]},"headings":[{"level":1,"line":1,"title":"P1 AdGuardHome sync image policy preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4","total_score":72},{"bytes":2268,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":58,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","recovery"],"change_safety":["rollback"],"external_services":["public","nginx"],"monitoring_and_logs":["log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["failure"]},"headings":[{"level":1,"line":1,"title":"P1-23 Next safe backlog after NPMplus runbook close"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":9,"title":"Next task"},{"level":2,"line":13,"title":"Reason"},{"level":2,"line":19,"title":"Input facts"},{"level":2,"line":29,"title":"P1-24 expected output"},{"level":2,"line":41,"title":"P1-24 safety boundary"},{"level":2,"line":58,"title":"Required carry-forward guardrails"},{"level":2,"line":75,"title":"Command protocol"},{"level":2,"line":82,"title":"DOCX policy"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf","total_score":72},{"bytes":43565,"commit":"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17","content_score":62,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup"],"change_safety":["sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","grafana","prometheus"],"network_and_dns":["dns"],"storage":["thin"]},"headings":[],"json_top_level_size":5,"json_top_level_type":"dict","path":"inventory/services.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/cr-2026-0017-inventory-foundation"],"sensitive_findings":[],"sha256":"189ab606f9de7b379b03510aef024def88ab91a1e2782d0c7d74fe93fa61509b","total_score":71},{"bytes":2281,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"access_and_admin":["ssh","url"],"backup_and_restore":["backup","restore"],"change_safety":["rollback"],"identity_and_topology":["pve01","node"],"monitoring_and_logs":["metric","prometheus"],"storage":["disk"]},"headings":[{"level":1,"line":1,"title":"smartmontools + node_exporter textfile runbook"},{"level":2,"line":3,"title":"Scope"},{"level":2,"line":18,"title":"Local checks on a PVE node"},{"level":2,"line":40,"title":"Prometheus checks from edge-vm"},{"level":2,"line":54,"title":"Expected metrics"},{"level":2,"line":63,"title":"Rollback"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/smartmontools-node-exporter.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"8bbdc976a24aadb0943ef386486d11f58f4e8b16b6589f519d2b5d99b2bdcaca","total_score":71},{"bytes":32948,"commit":"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17","content_score":70,"coverage":{"access_and_admin":["access","login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["cluster","node","quorum"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0017-inventory-foundation"],"sensitive_findings":[],"sha256":"3e79648b565bad680dbafbda376155ce48e74bd9deaeda58b3425906ac025ab0","total_score":70},{"bytes":26500,"commit":"f5b22d867ea467987008408e3fb1fb0e17fa7b2e","content_score":70,"coverage":{"access_and_admin":["login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["cluster","node","quorum"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook"],"sensitive_findings":[],"sha256":"5dab56a2e73e4a3582d4792b91a0c803d485e68b40791bc456315748b15490a0","total_score":70},{"bytes":29485,"commit":"fe1221b06643db3b00a621b0230f92a46a4edc2b","content_score":70,"coverage":{"access_and_admin":["login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["cluster","node","quorum"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition","refs/heads/main","refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"8051e3e761493a1b7088a0f3ed7e0aa9218673f453ca88171178364d26701f64","total_score":70},{"bytes":5868,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","metric"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["troubleshoot"]},"headings":[{"level":1,"line":1,"title":"P1-20 Exposure matrix repo preflight"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":12,"title":"Safety boundary"},{"level":2,"line":22,"title":"Matching file paths"},{"level":2,"line":105,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30","total_score":70},{"bytes":8774,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall"],"storage":["storage"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e","total_score":70},{"bytes":7063,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-02 privilege risk classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Classification summary"},{"level":2,"line":27,"title":"Review table"},{"level":2,"line":40,"title":"Detailed classification"},{"level":3,"line":42,"title":"authentik-worker-1"},{"level":3,"line":68,"title":"cadvisor"},{"level":3,"line":93,"title":"dockge"},{"level":3,"line":119,"title":"npmplus"},{"level":3,"line":146,"title":"homeassistant"},{"level":3,"line":173,"title":"homelab-registry-cache"},{"level":3,"line":199,"title":"kopia"},{"level":3,"line":225,"title":"socket-proxy"},{"level":2,"line":253,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2","total_score":70},{"bytes":16075,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access","login","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","metric","prometheus"],"network_and_dns":["network","firewall","dns","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a","total_score":70},{"bytes":61338,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":19,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0","total_score":70},{"bytes":15688,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface findings classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Overall classification"},{"level":2,"line":28,"title":"Source summary"},{"level":2,"line":40,"title":"Category counts"},{"level":2,"line":47,"title":"Classified findings"},{"level":2,"line":132,"title":"Interpretation"},{"level":2,"line":138,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b","total_score":70},{"bytes":18777,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":23,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca","total_score":70},{"bytes":9282,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface normalization plan"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Starting classification"},{"level":2,"line":33,"title":"Normalization tracks"},{"level":2,"line":42,"title":"Implementation sequence"},{"level":2,"line":51,"title":"Sample findings carried forward"},{"level":2,"line":98,"title":"Guardrails"},{"level":2,"line":107,"title":"Future close criteria"},{"level":2,"line":115,"title":"Operational conclusion"},{"level":2,"line":121,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507","total_score":70},{"bytes":5868,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","metric"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["troubleshoot"]},"headings":[{"level":1,"line":1,"title":"P1-20 Exposure matrix repo preflight"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":12,"title":"Safety boundary"},{"level":2,"line":22,"title":"Matching file paths"},{"level":2,"line":105,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30","total_score":70},{"bytes":8774,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall"],"storage":["storage"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e","total_score":70},{"bytes":7063,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-02 privilege risk classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Classification summary"},{"level":2,"line":27,"title":"Review table"},{"level":2,"line":40,"title":"Detailed classification"},{"level":3,"line":42,"title":"authentik-worker-1"},{"level":3,"line":68,"title":"cadvisor"},{"level":3,"line":93,"title":"dockge"},{"level":3,"line":119,"title":"npmplus"},{"level":3,"line":146,"title":"homeassistant"},{"level":3,"line":173,"title":"homelab-registry-cache"},{"level":3,"line":199,"title":"kopia"},{"level":3,"line":225,"title":"socket-proxy"},{"level":2,"line":253,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2","total_score":70},{"bytes":16075,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access","login","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","metric","prometheus"],"network_and_dns":["network","firewall","dns","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a","total_score":70},{"bytes":61338,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":19,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0","total_score":70},{"bytes":15688,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface findings classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Overall classification"},{"level":2,"line":28,"title":"Source summary"},{"level":2,"line":40,"title":"Category counts"},{"level":2,"line":47,"title":"Classified findings"},{"level":2,"line":132,"title":"Interpretation"},{"level":2,"line":138,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b","total_score":70},{"bytes":18777,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":23,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca","total_score":70},{"bytes":9282,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface normalization plan"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Starting classification"},{"level":2,"line":33,"title":"Normalization tracks"},{"level":2,"line":42,"title":"Implementation sequence"},{"level":2,"line":51,"title":"Sample findings carried forward"},{"level":2,"line":98,"title":"Guardrails"},{"level":2,"line":107,"title":"Future close criteria"},{"level":2,"line":115,"title":"Operational conclusion"},{"level":2,"line":121,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507","total_score":70},{"bytes":5868,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"identity_and_topology":["proxmox","cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","metric"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["troubleshoot"]},"headings":[{"level":1,"line":1,"title":"P1-20 Exposure matrix repo preflight"},{"level":2,"line":5,"title":"Result"},{"level":2,"line":12,"title":"Safety boundary"},{"level":2,"line":22,"title":"Matching file paths"},{"level":2,"line":105,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30","total_score":70},{"bytes":8774,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall"],"storage":["storage"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e","total_score":70},{"bytes":7063,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["network","firewall","dns","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P2-02 privilege risk classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Classification summary"},{"level":2,"line":27,"title":"Review table"},{"level":2,"line":40,"title":"Detailed classification"},{"level":3,"line":42,"title":"authentik-worker-1"},{"level":3,"line":68,"title":"cadvisor"},{"level":3,"line":93,"title":"dockge"},{"level":3,"line":119,"title":"npmplus"},{"level":3,"line":146,"title":"homeassistant"},{"level":3,"line":173,"title":"homelab-registry-cache"},{"level":3,"line":199,"title":"kopia"},{"level":3,"line":225,"title":"socket-proxy"},{"level":2,"line":253,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2","total_score":70},{"bytes":16075,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["access","login","admin"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","metric","prometheus"],"network_and_dns":["network","firewall","dns","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":15,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a","total_score":70},{"bytes":61338,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":19,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0","total_score":70},{"bytes":15688,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"access_and_admin":["admin"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["vmid","container"],"identity_and_topology":["pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface findings classification"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Overall classification"},{"level":2,"line":28,"title":"Source summary"},{"level":2,"line":40,"title":"Category counts"},{"level":2,"line":47,"title":"Classified findings"},{"level":2,"line":132,"title":"Interpretation"},{"level":2,"line":138,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b","total_score":70},{"bytes":18777,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":23,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca","total_score":70},{"bytes":9282,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":64,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log"],"network_and_dns":["dns","certificate"],"repair_and_troubleshooting":["diagnostic","failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"P2-07 health surface normalization plan"},{"level":2,"line":5,"title":"Scope"},{"level":2,"line":11,"title":"Counters"},{"level":2,"line":20,"title":"Starting classification"},{"level":2,"line":33,"title":"Normalization tracks"},{"level":2,"line":42,"title":"Implementation sequence"},{"level":2,"line":51,"title":"Sample findings carried forward"},{"level":2,"line":98,"title":"Guardrails"},{"level":2,"line":107,"title":"Future close criteria"},{"level":2,"line":115,"title":"Operational conclusion"},{"level":2,"line":121,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507","total_score":70},{"bytes":946,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":56,"coverage":{"access_and_admin":["admin","url"],"backup_and_restore":["backup","restore","recovery"],"error_learning":["incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"]},"headings":[{"level":1,"line":1,"title":"Runbook: cluster-admin-incident-engine"},{"level":2,"line":3,"title":"Current verified backup state"},{"level":2,"line":12,"title":"First checks"},{"level":2,"line":19,"title":"Safe recovery rule"},{"level":2,"line":22,"title":"Evidence commands"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/04_homelab-desired-state/runbooks/cluster-admin-incident-engine.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"304ca47a962dbc921b18f465bbc433580e71e2fdecf6b868ff4cfc30daebac34","total_score":70},{"bytes":26140,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["superseded"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-11-health-surface-p1-file-operator-decision-package-20260625T234808Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3d85ce8de8cc17b76fde6fa144b918000f052c847780529b9caa98ccc0f10c80","total_score":69},{"bytes":3023,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[],"json_top_level_size":9,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"4983daf23fd88331c0985a6a794cebfb06731768766e277f10ac847174eba312","total_score":69},{"bytes":2982,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"backup_and_restore":["backup","restore","retention"],"error_learning":["regression"],"external_services":["reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","domain","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-01 evidence-based cluster score model"},{"level":2,"line":5,"title":"Final score for this baseline"},{"level":2,"line":11,"title":"Key findings"},{"level":2,"line":21,"title":"Score domains"},{"level":2,"line":33,"title":"Actions required to reach 100/100"},{"level":2,"line":49,"title":"Safety state"},{"level":2,"line":56,"title":"Next task"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-01-cluster-ideal-state-evidence-based-score-model-20260626T040011Z.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"17ea887feea2f371871c0e3155bcc3f3dd979dca0627d32e4f01da6ba8241e42","total_score":69},{"bytes":2502,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":52,"coverage":{"backup_and_restore":["backup","restore"],"error_learning":["regression"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage"]},"headings":[{"level":1,"line":1,"title":"P3-11 final CI/no-regression/runbooks inventory"},{"level":2,"line":5,"title":"Plain explanation"},{"level":2,"line":11,"title":"Summary"},{"level":2,"line":25,"title":"Close artifacts"},{"level":2,"line":38,"title":"Redaction"},{"level":2,"line":42,"title":"Next step"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.md","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c610e8118037cdf7239ce61bac44dda4dfc8af4ca4c9d7166829e0ef56241bcb","total_score":69},{"bytes":1375,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":58,"coverage":{"access_and_admin":["access","ssh","url"],"backup_and_restore":["backup"],"change_safety":["rollback"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","node"],"monitoring_and_logs":["monitor","log","journal","metric","prometheus"],"repair_and_troubleshooting":["diagnostic"]},"headings":[{"level":1,"line":1,"title":"Scrutiny pve01 runbook"},{"level":2,"line":3,"title":"Location"},{"level":2,"line":10,"title":"Health check"},{"level":2,"line":26,"title":"Logs"},{"level":2,"line":32,"title":"Data"},{"level":2,"line":41,"title":"Access"},{"level":2,"line":51,"title":"Relationship with Prometheus SMART monitoring"},{"level":2,"line":59,"title":"Rollback"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/scrutiny-pve01.md","path_score":11,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"e8e03dc156536ae569e4f42bb7baf715495c91ad24d3e16924bd329ce74dc12c","total_score":69},{"bytes":26140,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback"],"error_learning":["superseded"],"identity_and_topology":["pve01"],"internal_services":["lan"],"monitoring_and_logs":["monitor"],"network_and_dns":["certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-11-health-surface-p1-file-operator-decision-package-20260625T234808Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3d85ce8de8cc17b76fde6fa144b918000f052c847780529b9caa98ccc0f10c80","total_score":69},{"bytes":3023,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":60,"coverage":{"access_and_admin":["access","admin"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["rollback"],"error_learning":["regression"],"guests_and_workloads":["lxc"],"identity_and_topology":["cluster"],"internal_services":["lan"],"monitoring_and_logs":["alert","log","grafana"],"network_and_dns":["network","firewall","dns"]},"headings":[],"json_top_level_size":9,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"4983daf23fd88331c0985a6a794cebfb06731768766e277f10ac847174eba312","total_score":69}],"error_artifacts_omitted":60,"handbook_candidates":[{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n - UPnP/IGD discovery","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n - UPnP/IGD discovery","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":85189,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":96,"coverage":{"access_and_admin":["access","admin","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","journal","prometheus"],"network_and_dns":["network","vlan","dns","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage","thin","disk","volume"]},"excerpt":"# Homelab cluster live context\n\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\n\n## 2026-06-24 P1 live context update — 20260624T144403Z\n\n### Recently closed\n\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\n- Gotify fix required extra repairs:\n - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\n - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\n - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\n- TURN 3478 validated:\n - `turn.gram1.ru:3478` TCP/UDP STUN works.\n - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\n- Router ingress audit:\n - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\n - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\n - UPnP/IGD discovery","headings":[{"level":1,"line":1,"title":"Homelab cluster live context"},{"level":2,"line":5,"title":"2026-06-24 P1 live context update — 20260624T144403Z"},{"level":3,"line":7,"title":"Recently closed"},{"level":3,"line":23,"title":"Security notes / follow-up"},{"level":2,"line":29,"title":"2026-06-24 SecretRotation recovery note — 20260624T150118Z"},{"level":2,"line":44,"title":"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z"},{"level":2,"line":52,"title":"2026-06-24 TURN discovery cleanup — 20260624T150759Z"},{"level":2,"line":61,"title":"2026-06-24 TURN persistence verification — 20260624T151320Z"},{"level":2,"line":71,"title":"2026-06-24 TURN persistence issue — 20260624T151547Z"},{"level":2,"line":78,"title":"2026-06-24 TURN manual Talk recreate — 20260624T151817Z"},{"level":2,"line":86,"title":"2026-06-24 TURN manual recreate retry — 20260624T152140Z"},{"level":2,"line":93,"title":"2026-06-24 SecretRotation final closure — 20260624T180202Z"},{"level":2,"line":109,"title":"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z"},{"level":3,"line":118,"title":"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z"},{"level":3,"line":126,"title":"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z"},{"level":3,"line":133,"title":"PostP1HealthSweep closed - 20260624T183006Z"},{"level":3,"line":140,"title":"PostP1HealthSweep closed - 20260624T183258Z"},{"level":3,"line":147,"title":"PostP1 source-of-truth correction - 20260624T183424Z"},{"level":3,"line":153,"title":"P0RestoreDrillMatrix audit started - 20260624T183542Z"},{"level":3,"line":161,"title":"P0RestoreDrillMatrix edge index collected - 20260624T183747Z"},{"level":3,"line":167,"title":"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z"},{"level":3,"line":174,"title":"P0RestoreDrillMatrix closed - 20260624T184202Z"},{"level":3,"line":185,"title":"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z"},{"level":3,"line":193,"title":"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z"},{"level":3,"line":201,"title":"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z"},{"level":3,"line":209,"title":"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z"},{"level":3,"line":217,"title":"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z"},{"level":3,"line":225,"title":"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z"},{"level":3,"line":232,"title":"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z"},{"level":3,"line":241,"title":"P0RestoreProofOffhostCoverage closed - 20260624T190444Z"},{"level":3,"line":252,"title":"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z"},{"level":3,"line":259,"title":"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z"},{"level":3,"line":267,"title":"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z"},{"level":3,"line":275,"title":"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z"},{"level":3,"line":283,"title":"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z"},{"level":3,"line":290,"title":"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z"},{"level":3,"line":297,"title":"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z"},{"level":3,"line":305,"title":"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z"},{"level":3,"line":313,"title":"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z"},{"level":3,"line":320,"title":"P0EdgeCleanup preflight - 20260624T192250Z"},{"level":3,"line":328,"title":"P0EdgeCleanup plan classified - 20260624T192904Z"},{"level":3,"line":336,"title":"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z"},{"level":3,"line":345,"title":"P0EdgeCleanup post-verify - 20260624T193303Z"},{"level":3,"line":352,"title":"P0EdgeCleanup closed - 20260624T193441Z"},{"level":3,"line":363,"title":"P0 run-level checkpoint audit - 20260624T193717Z"},{"level":3,"line":370,"title":"P0 run-level checkpoint committed - 20260624T193947Z"},{"level":3,"line":377,"title":"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z"},{"level":3,"line":385,"title":"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z"},{"level":3,"line":395,"title":"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z"},{"level":3,"line":404,"title":"P0RollbackImageRetentionPolicy closed - 20260624T194750Z"},{"level":3,"line":415,"title":"Manual VPS SSH host-key verification closed - 20260624T200554Z"},{"level":3,"line":423,"title":"Final all-clear checkpoint - 20260624T200838Z"},{"level":3,"line":431,"title":"P1TmpCleanupPolicy preflight - 20260624T201119Z"},{"level":3,"line":439,"title":"P1TmpCleanupPolicy cleanup - 20260624T201559Z"},{"level":3,"line":447,"title":"P1TmpCleanupPolicy validate + commit - 20260624T205442Z"},{"level":3,"line":454,"title":"P1TmpCleanupPolicy closed - 20260624T205620Z"},{"level":3,"line":462,"title":"P1JournalRetentionPolicy preflight - 20260624T205759Z"},{"level":3,"line":470,"title":"P1JournalRetentionPolicy noise decision - 20260624T210034Z"},{"level":3,"line":478,"title":"P1JournalRetentionPolicy commit decision - 20260624T210220Z"},{"level":3,"line":485,"title":"P1JournalRetentionPolicy closed - 20260624T210359Z"},{"level":3,"line":492,"title":"P1DockerImageInventoryPolicy preflight - 20260624T210548Z"},{"level":3,"line":500,"title":"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z"},{"level":3,"line":508,"title":"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z"},{"level":3,"line":517,"title":"P1DockerImageInventoryPolicy closed - 20260624T211315Z"},{"level":3,"line":525,"title":"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z"},{"level":3,"line":533,"title":"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z"},{"level":3,"line":540,"title":"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z"},{"level":3,"line":547,"title":"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z"},{"level":3,"line":554,"title":"P1 housekeeping checkpoint - 20260624T212215Z"},{"level":3,"line":560,"title":"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z"},{"level":3,"line":568,"title":"P1EdgeJournalNoiseTriage decision - 20260624T212527Z"},{"level":3,"line":576,"title":"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z"},{"level":3,"line":583,"title":"P1EdgeJournalNoiseTriage closed - 20260624T212748Z"},{"level":3,"line":590,"title":"P1 post-noise checkpoint - 20260624T212856Z"},{"level":3,"line":597,"title":"P1ToolScannerImagePolicy preflight - 20260624T213038Z"},{"level":3,"line":605,"title":"P1ToolScannerImagePolicy decision - 20260624T214349Z"},{"level":3,"line":613,"title":"P1ToolScannerImagePolicy cleanup - 20260624T214547Z"},{"level":3,"line":622,"title":"P1ToolScannerImagePolicy closed - 20260624T214728Z"},{"level":3,"line":630,"title":"P1 post tool/scanner checkpoint - 20260624T214903Z"},{"level":3,"line":637,"title":"P1 final all-clear checkpoint - 20260624T215112Z"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","total_score":105},{"bytes":1079183,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":102,"coverage":{"access_and_admin":["access","login","admin","ssh","console","url"],"backup_and_restore":["backup","бэкап","restore","восстанов","recovery","retention"],"change_safety":["rollback","sha256","atomic"],"error_learning":["regression","incident","superseded"],"external_services":["внешн","public","reverse proxy","nginx"],"guests_and_workloads":["vmid","container","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["внутренн","lan"],"monitoring_and_logs":["monitor","alert","log","journal","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","tls","certificate"],"repair_and_troubleshooting":["repair","troubleshoot","diagnostic","failure"],"storage":["storage","thin","disk"]},"excerpt":"","headings":[],"json_top_level_size":1000,"json_top_level_type":"list","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["url-userinfo"],"sha256":"aeb92358514ec5cd67d557f15ea295b3ae4f25df5f17a14556dae750b8496d1b","total_score":102},{"bytes":9499,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":88,"coverage":{"access_and_admin":["access","login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","internet"],"identity_and_topology":["proxmox","pve01","cluster"],"internal_services":["internal service","lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","grafana","prometheus"],"network_and_dns":["network","dns","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"excerpt":"# DR from zero runbook, 2026-06-22\n\nChecked at UTC: `2026-06-22T09:00:38Z`.\n\nMarker: **DR from zero runbook, 2026-06-22**\n\n## Purpose\n\nThis runbook describes how to rebuild a minimum viable homelab from zero after a serious failure.\n\nIt is not a restore execution log. It is a step-by-step operator procedure.\n\n## Scope\n\nThe goal is to recover enough infrastructure to regain access, documentation, identity, routing, secrets, Git, backup visibility, and then stateful applications.\n\nMinimum viable homelab means:\n\n- SSH access works;\n- VPN/Tailscale/NetBird access works or has a known temporary replacement;\n- Git repository is available;\n- SOPS/age secrets can be decrypted;\n- MkDocs documentation is published;\n- NPMplus routes can be restored;\n- Authentik, Gitea, Vaultwarden, NetBox, and Uptime Kuma can be restored;\n- backup/offhost locations are visible;\n- health checks prove the restored state.\n\n## Current known source-of-truth commits\n\n- Backup coverage closure: completed before this runbook.\n- MkDocs publish hardening: completed.\n- Backup tiering table: completed.\n- Current repo head when starting this runbook: `adb8c55`.\n\n## P0 restore order\n\n| Order | Component | Why first | Expec","headings":[{"level":1,"line":1,"title":"DR from zero runbook, 2026-06-22"},{"level":2,"line":7,"title":"Purpose"},{"level":2,"line":13,"title":"Scope"},{"level":2,"line":29,"title":"Current known source-of-truth commits"},{"level":2,"line":36,"title":"P0 restore order"},{"level":2,"line":55,"title":"Critical backup sources"},{"level":2,"line":71,"title":"Phase 0 — stop and preserve evidence"},{"level":2,"line":86,"title":"Phase 1 — base host recovery"},{"level":2,"line":104,"title":"Phase 2 — network access"},{"level":2,"line":119,"title":"Phase 3 — clone repository"},{"level":2,"line":136,"title":"Phase 4 — restore secrets/SOPS"},{"level":2,"line":155,"title":"Phase 5 — restore documentation first"},{"level":2,"line":173,"title":"Phase 6 — recover NPMplus and Uptime Kuma"},{"level":2,"line":197,"title":"Phase 7 — recover Authentik"},{"level":2,"line":215,"title":"Phase 8 — recover Gitea"},{"level":2,"line":230,"title":"Phase 9 — recover Vaultwarden"},{"level":2,"line":244,"title":"Phase 10 — recover NetBox"},{"level":2,"line":270,"title":"Phase 11 — recover Edge VM"},{"level":2,"line":291,"title":"Phase 12 — recover user data services"},{"level":2,"line":306,"title":"Phase 13 — restore monitoring and alerting"},{"level":2,"line":325,"title":"Do not do"},{"level":2,"line":334,"title":"Final DR closure checklist"},{"level":2,"line":353,"title":"Next improvement after this runbook"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"f8312cd7cd0a296c60950a60c7866a67b19a70016b93f68b3a76b78d5440cb63","total_score":102},{"bytes":9386,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["qemu"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns"],"repair_and_troubleshooting":["failure"],"storage":["thin","disk"]},"headings":[{"level":1,"line":1,"title":"Disaster Recovery Runbook"},{"level":2,"line":6,"title":"Current verified recovery anchors"},{"level":2,"line":25,"title":"Things that must exist outside the repo"},{"level":2,"line":39,"title":"Recovery priority"},{"level":2,"line":51,"title":"Phase 0: establish a control host"},{"level":2,"line":65,"title":"Phase 1: restore rclone access"},{"level":2,"line":90,"title":"Phase 2: restore the critical/small cloud bundle"},{"level":1,"line":107,"title":"Expected:"},{"level":1,"line":108,"title":"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c"},{"level":2,"line":130,"title":"Phase 3: recover small app/config backups"},{"level":2,"line":163,"title":"Phase 4: recover edge-vm large backup"},{"level":1,"line":194,"title":"Expected size:"},{"level":1,"line":195,"title":"16936767590"},{"level":1,"line":196,"title":"Expected SHA256:"},{"level":1,"line":197,"title":"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001"},{"level":2,"line":202,"title":"Phase 5: restore validation checklist"},{"level":2,"line":218,"title":"Phase 6: re-enable backup and offsite automation"},{"level":2,"line":231,"title":"Known failure lessons"},{"level":2,"line":243,"title":"Vaultwarden isolated restore drill result — 2026-06-18"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e","total_score":100},{"bytes":9386,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["qemu"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["dns"],"repair_and_troubleshooting":["failure"],"storage":["thin","disk"]},"headings":[{"level":1,"line":1,"title":"Disaster Recovery Runbook"},{"level":2,"line":6,"title":"Current verified recovery anchors"},{"level":2,"line":25,"title":"Things that must exist outside the repo"},{"level":2,"line":39,"title":"Recovery priority"},{"level":2,"line":51,"title":"Phase 0: establish a control host"},{"level":2,"line":65,"title":"Phase 1: restore rclone access"},{"level":2,"line":90,"title":"Phase 2: restore the critical/small cloud bundle"},{"level":1,"line":107,"title":"Expected:"},{"level":1,"line":108,"title":"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c"},{"level":2,"line":130,"title":"Phase 3: recover small app/config backups"},{"level":2,"line":163,"title":"Phase 4: recover edge-vm large backup"},{"level":1,"line":194,"title":"Expected size:"},{"level":1,"line":195,"title":"16936767590"},{"level":1,"line":196,"title":"Expected SHA256:"},{"level":1,"line":197,"title":"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001"},{"level":2,"line":202,"title":"Phase 5: restore validation checklist"},{"level":2,"line":218,"title":"Phase 6: re-enable backup and offsite automation"},{"level":2,"line":231,"title":"Known failure lessons"},{"level":2,"line":243,"title":"Vaultwarden isolated restore drill result — 2026-06-18"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","path_score":14,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e","total_score":100},{"bytes":16031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["internal service","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"05. Service Catalog"},{"level":2,"line":5,"title":"Edge VM"},{"level":2,"line":12,"title":"NPMplus"},{"level":2,"line":22,"title":"Uptime Kuma"},{"level":2,"line":30,"title":"Gotify"},{"level":2,"line":38,"title":"Vaultwarden"},{"level":2,"line":49,"title":"Dockge"},{"level":2,"line":61,"title":"Homepage"},{"level":2,"line":71,"title":"Gitea"},{"level":2,"line":84,"title":"Nextcloud AIO"},{"level":2,"line":95,"title":"DNS stack"},{"level":2,"line":102,"title":"Backup"},{"level":2,"line":109,"title":"Edge applications added 2026-06-15/16"},{"level":2,"line":132,"title":"Backup health proxy"},{"level":2,"line":155,"title":"Edge VM capacity note"},{"level":2,"line":366,"title":"Homepage grouped dashboard update, 2026-06-22"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a","total_score":95},{"bytes":106031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":92,"coverage":{"access_and_admin":["access","login","admin","web ui","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","lxc","qemu","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["локальн","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"99. Current state summary"},{"level":2,"line":5,"title":"Git repository"},{"level":2,"line":12,"title":"Operating rules"},{"level":2,"line":21,"title":"Current verified backup health"},{"level":2,"line":32,"title":"Backup scripts and services"},{"level":2,"line":41,"title":"Proxmox and network layout"},{"level":2,"line":58,"title":"NPMplus state"},{"level":2,"line":81,"title":"DNS rewrites"},{"level":2,"line":101,"title":"Edge applications"},{"level":2,"line":118,"title":"Uptime Kuma"},{"level":2,"line":131,"title":"Cloudflare token rotation"},{"level":2,"line":139,"title":"Known working URLs"},{"level":2,"line":166,"title":"Pending after this documentation update"},{"level":2,"line":181,"title":"Edge application setup checkpoint — 2026-06-16T10:26:57Z"},{"level":2,"line":194,"title":"Immich media storage checkpoint — 2026-06-16T11:01:32Z"},{"level":2,"line":204,"title":"Immich media backup checkpoint — 2026-06-16T11:24:22Z"},{"level":2,"line":219,"title":"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z"},{"level":2,"line":231,"title":"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z"},{"level":2,"line":245,"title":"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z"},{"level":2,"line":257,"title":"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z"},{"level":2,"line":266,"title":"Closed validation checkpoint — 2026-06-16T16:51:40Z"},{"level":2,"line":278,"title":"Disk Space Health checkpoint — 2026-06-16T17:06:06Z"},{"level":2,"line":298,"title":"Memos backup checkpoint — 2026-06-16T17:33:39Z"},{"level":2,"line":319,"title":"Paperless backup checkpoint — 2026-06-16T17:50:49Z"},{"level":2,"line":350,"title":"Application restore validation checkpoint — 2026-06-16T18:01:17Z"},{"level":2,"line":364,"title":"Final full baseline checkpoint — 2026-06-16T18:10:15Z"},{"level":2,"line":407,"title":"Daily cluster status report"},{"level":2,"line":420,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":447,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":482,"title":"Контейнерная волна обновлений, 2026-06-19"},{"level":2,"line":498,"title":"CVE root-cause analysis, 2026-06-19"},{"level":2,"line":514,"title":"Browser / Chromium risk analysis, 2026-06-19"},{"level":2,"line":527,"title":"Base OS package CVE analysis, 2026-06-19"},{"level":2,"line":541,"title":"Go runtime/dependency CVE analysis, 2026-06-19"},{"level":2,"line":555,"title":"Node/NPM dependency CVE analysis, 2026-06-19"},{"level":2,"line":569,"title":"Dockge / Karakeep candidate tag scan, 2026-06-19"},{"level":2,"line":583,"title":"Karakeep production update, 2026-06-19"},{"level":2,"line":605,"title":"Uptime Kuma candidate tag scan, 2026-06-19"},{"level":2,"line":622,"title":"Uptime Kuma production update, 2026-06-19"},{"level":2,"line":644,"title":"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19"},{"level":2,"line":663,"title":"Linkding candidate tag scan, 2026-06-19"},{"level":2,"line":678,"title":"Linkding production update, 2026-06-19"},{"level":2,"line":698,"title":"Current Trivy leaderboard after Linkding, 2026-06-19"},{"level":2,"line":717,"title":"Batch candidate scan, 2026-06-19"},{"level":2,"line":744,"title":"Disk cleanup and Git push recovery, 2026-06-19"},{"level":2,"line":758,"title":"Next update candidates from batch scan, 2026-06-19"},{"level":2,"line":770,"title":"IT-Tools production update, 2026-06-19"},{"level":2,"line":789,"title":"NPMplus production update, 2026-06-19"},{"level":2,"line":812,"title":"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19"},{"level":2,"line":827,"title":"Paperless stable candidate scan, 2026-06-19"},{"level":2,"line":852,"title":"Immich app stable pair candidate scan, 2026-06-19"},{"level":2,"line":878,"title":"Immich app pair candidate scan result, 2026-06-19"},{"level":2,"line":896,"title":"Home Assistant stable candidate scan, 2026-06-19"},{"level":2,"line":919,"title":"MinIO release candidate scan, 2026-06-19"},{"level":2,"line":942,"title":"Mealie stable candidate scan, 2026-06-19"},{"level":2,"line":965,"title":"Authentik server image candidate scan, 2026-06-19"},{"level":2,"line":988,"title":"Karakeep Meilisearch candidate scan, 2026-06-19"},{"level":2,"line":1011,"title":"Karakeep Chrome candidate scan, 2026-06-19"},{"level":2,"line":1034,"title":"Vaultwarden stable candidate scan, 2026-06-19"},{"level":2,"line":1057,"title":"Vaultwarden production update, 2026-06-20"},{"level":2,"line":1083,"title":"Current Trivy leaderboard after Vaultwarden, 2026-06-20"},{"level":2,"line":1098,"title":"n8n stable candidate scan, 2026-06-20"},{"level":2,"line":1121,"title":"n8n latest tag restore, 2026-06-20"},{"level":2,"line":1137,"title":"n8n 2.27.3 smoke-test, 2026-06-20"},{"level":2,"line":1163,"title":"n8n production update, 2026-06-20"},{"level":2,"line":1193,"title":"Gotify stable candidate scan, 2026-06-20"},{"level":2,"line":1213,"title":"Batch remaining open candidate scan, 2026-06-20"},{"level":2,"line":1234,"title":"CrowdSec production update, 2026-06-20"},{"level":2,"line":1262,"title":"Final CVE pass summary, 2026-06-20"},{"level":2,"line":1286,"title":"n8n encryption key rotation, 2026-06-20"},{"level":2,"line":1311,"title":"Audit and backup inventory, 2026-06-20"},{"level":2,"line":1326,"title":"Immich Postgres restore smoke-test, 2026-06-20"},{"level":2,"line":1342,"title":"Immich Postgres candidate scan, 2026-06-20"},{"level":2,"line":1352,"title":"Dockge candidate scan, 2026-06-20"},{"level":2,"line":1362,"title":"Paperless candidate scan, 2026-06-20"},{"level":2,"line":1372,"title":"Karakeep and Immich Server real-tag scan, 2026-06-20"},{"level":2,"line":1382,"title":"Closing high-CVE ledger, 2026-06-20"},{"level":2,"line":1392,"title":"Candidate test directories cleanup, 2026-06-20"},{"level":2,"line":1402,"title":"Old n8n key backup removal preflight, 2026-06-20"},{"level":2,"line":1412,"title":"NetBird peers health hardening, 2026-06-20"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md","path_score":3,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c","total_score":95},{"bytes":16031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":86,"coverage":{"access_and_admin":["access","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo"],"change_safety":["sha256"],"external_services":["public","reverse proxy"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","node"],"internal_services":["internal service","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","disk"]},"headings":[{"level":1,"line":1,"title":"05. Service Catalog"},{"level":2,"line":5,"title":"Edge VM"},{"level":2,"line":12,"title":"NPMplus"},{"level":2,"line":22,"title":"Uptime Kuma"},{"level":2,"line":30,"title":"Gotify"},{"level":2,"line":38,"title":"Vaultwarden"},{"level":2,"line":49,"title":"Dockge"},{"level":2,"line":61,"title":"Homepage"},{"level":2,"line":71,"title":"Gitea"},{"level":2,"line":84,"title":"Nextcloud AIO"},{"level":2,"line":95,"title":"DNS stack"},{"level":2,"line":102,"title":"Backup"},{"level":2,"line":109,"title":"Edge applications added 2026-06-15/16"},{"level":2,"line":132,"title":"Backup health proxy"},{"level":2,"line":155,"title":"Edge VM capacity note"},{"level":2,"line":366,"title":"Homepage grouped dashboard update, 2026-06-22"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a","total_score":95},{"bytes":106031,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":92,"coverage":{"access_and_admin":["access","login","admin","web ui","ssh","console","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","lxc","qemu","guest"],"identity_and_topology":["proxmox","pve01","cluster","node","quorum"],"internal_services":["локальн","lan","service catalog"],"monitoring_and_logs":["monitor","alert","log","metric","grafana","prometheus"],"network_and_dns":["network","bridge","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"99. Current state summary"},{"level":2,"line":5,"title":"Git repository"},{"level":2,"line":12,"title":"Operating rules"},{"level":2,"line":21,"title":"Current verified backup health"},{"level":2,"line":32,"title":"Backup scripts and services"},{"level":2,"line":41,"title":"Proxmox and network layout"},{"level":2,"line":58,"title":"NPMplus state"},{"level":2,"line":81,"title":"DNS rewrites"},{"level":2,"line":101,"title":"Edge applications"},{"level":2,"line":118,"title":"Uptime Kuma"},{"level":2,"line":131,"title":"Cloudflare token rotation"},{"level":2,"line":139,"title":"Known working URLs"},{"level":2,"line":166,"title":"Pending after this documentation update"},{"level":2,"line":181,"title":"Edge application setup checkpoint — 2026-06-16T10:26:57Z"},{"level":2,"line":194,"title":"Immich media storage checkpoint — 2026-06-16T11:01:32Z"},{"level":2,"line":204,"title":"Immich media backup checkpoint — 2026-06-16T11:24:22Z"},{"level":2,"line":219,"title":"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z"},{"level":2,"line":231,"title":"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z"},{"level":2,"line":245,"title":"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z"},{"level":2,"line":257,"title":"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z"},{"level":2,"line":266,"title":"Closed validation checkpoint — 2026-06-16T16:51:40Z"},{"level":2,"line":278,"title":"Disk Space Health checkpoint — 2026-06-16T17:06:06Z"},{"level":2,"line":298,"title":"Memos backup checkpoint — 2026-06-16T17:33:39Z"},{"level":2,"line":319,"title":"Paperless backup checkpoint — 2026-06-16T17:50:49Z"},{"level":2,"line":350,"title":"Application restore validation checkpoint — 2026-06-16T18:01:17Z"},{"level":2,"line":364,"title":"Final full baseline checkpoint — 2026-06-16T18:10:15Z"},{"level":2,"line":407,"title":"Daily cluster status report"},{"level":2,"line":420,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":447,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":482,"title":"Контейнерная волна обновлений, 2026-06-19"},{"level":2,"line":498,"title":"CVE root-cause analysis, 2026-06-19"},{"level":2,"line":514,"title":"Browser / Chromium risk analysis, 2026-06-19"},{"level":2,"line":527,"title":"Base OS package CVE analysis, 2026-06-19"},{"level":2,"line":541,"title":"Go runtime/dependency CVE analysis, 2026-06-19"},{"level":2,"line":555,"title":"Node/NPM dependency CVE analysis, 2026-06-19"},{"level":2,"line":569,"title":"Dockge / Karakeep candidate tag scan, 2026-06-19"},{"level":2,"line":583,"title":"Karakeep production update, 2026-06-19"},{"level":2,"line":605,"title":"Uptime Kuma candidate tag scan, 2026-06-19"},{"level":2,"line":622,"title":"Uptime Kuma production update, 2026-06-19"},{"level":2,"line":644,"title":"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19"},{"level":2,"line":663,"title":"Linkding candidate tag scan, 2026-06-19"},{"level":2,"line":678,"title":"Linkding production update, 2026-06-19"},{"level":2,"line":698,"title":"Current Trivy leaderboard after Linkding, 2026-06-19"},{"level":2,"line":717,"title":"Batch candidate scan, 2026-06-19"},{"level":2,"line":744,"title":"Disk cleanup and Git push recovery, 2026-06-19"},{"level":2,"line":758,"title":"Next update candidates from batch scan, 2026-06-19"},{"level":2,"line":770,"title":"IT-Tools production update, 2026-06-19"},{"level":2,"line":789,"title":"NPMplus production update, 2026-06-19"},{"level":2,"line":812,"title":"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19"},{"level":2,"line":827,"title":"Paperless stable candidate scan, 2026-06-19"},{"level":2,"line":852,"title":"Immich app stable pair candidate scan, 2026-06-19"},{"level":2,"line":878,"title":"Immich app pair candidate scan result, 2026-06-19"},{"level":2,"line":896,"title":"Home Assistant stable candidate scan, 2026-06-19"},{"level":2,"line":919,"title":"MinIO release candidate scan, 2026-06-19"},{"level":2,"line":942,"title":"Mealie stable candidate scan, 2026-06-19"},{"level":2,"line":965,"title":"Authentik server image candidate scan, 2026-06-19"},{"level":2,"line":988,"title":"Karakeep Meilisearch candidate scan, 2026-06-19"},{"level":2,"line":1011,"title":"Karakeep Chrome candidate scan, 2026-06-19"},{"level":2,"line":1034,"title":"Vaultwarden stable candidate scan, 2026-06-19"},{"level":2,"line":1057,"title":"Vaultwarden production update, 2026-06-20"},{"level":2,"line":1083,"title":"Current Trivy leaderboard after Vaultwarden, 2026-06-20"},{"level":2,"line":1098,"title":"n8n stable candidate scan, 2026-06-20"},{"level":2,"line":1121,"title":"n8n latest tag restore, 2026-06-20"},{"level":2,"line":1137,"title":"n8n 2.27.3 smoke-test, 2026-06-20"},{"level":2,"line":1163,"title":"n8n production update, 2026-06-20"},{"level":2,"line":1193,"title":"Gotify stable candidate scan, 2026-06-20"},{"level":2,"line":1213,"title":"Batch remaining open candidate scan, 2026-06-20"},{"level":2,"line":1234,"title":"CrowdSec production update, 2026-06-20"},{"level":2,"line":1262,"title":"Final CVE pass summary, 2026-06-20"},{"level":2,"line":1286,"title":"n8n encryption key rotation, 2026-06-20"},{"level":2,"line":1311,"title":"Audit and backup inventory, 2026-06-20"},{"level":2,"line":1326,"title":"Immich Postgres restore smoke-test, 2026-06-20"},{"level":2,"line":1342,"title":"Immich Postgres candidate scan, 2026-06-20"},{"level":2,"line":1352,"title":"Dockge candidate scan, 2026-06-20"},{"level":2,"line":1362,"title":"Paperless candidate scan, 2026-06-20"},{"level":2,"line":1372,"title":"Karakeep and Immich Server real-tag scan, 2026-06-20"},{"level":2,"line":1382,"title":"Closing high-CVE ledger, 2026-06-20"},{"level":2,"line":1392,"title":"Candidate test directories cleanup, 2026-06-20"},{"level":2,"line":1402,"title":"Old n8n key backup removal preflight, 2026-06-20"},{"level":2,"line":1412,"title":"NetBird peers health hardening, 2026-06-20"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md","path_score":3,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c","total_score":95},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":75334,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":78,"coverage":{"access_and_admin":["access","admin","console","url"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256"],"error_learning":["incident"],"external_services":["public","nginx"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal","metric","prometheus"],"network_and_dns":["network","bridge","firewall","dns","certificate"],"repair_and_troubleshooting":["diagnostic"],"storage":["storage"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","path_score":9,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db","total_score":87},{"bytes":22484,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":70,"coverage":{"access_and_admin":["admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback"],"error_learning":["regression","incident"],"guests_and_workloads":["container"],"identity_and_topology":["pve01","cluster"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","log","journal"],"network_and_dns":["network","firewall","tls","certificate"],"storage":["storage","disk"]},"headings":[],"json_top_level_size":17,"json_top_level_type":"dict","path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","path_score":17,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4","total_score":87},{"bytes":38408,"commit":"60f53ea6fe6724196802a46de3de19c7889a51cc","content_score":86,"coverage":{"access_and_admin":["login","admin","ssh"],"backup_and_restore":["backup","restore","recovery","retention"],"change_safety":["rollback","sha256","atomic"],"error_learning":["regression","incident"],"external_services":["public"],"identity_and_topology":["pve01","cluster","node","quorum","corosync"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log"],"network_and_dns":["network","domain"],"repair_and_troubleshooting":["repair","diagnostic","failure"],"storage":["storage"]},"headings":[],"json_top_level_size":2,"json_top_level_type":"dict","path":"errors/regression-cases.json","path_score":0,"path_sensitive":false,"refs":["refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary"],"sensitive_findings":[],"sha256":"07c9854ab0232d1f2766cdab114d0d398a4dcc1a5b41ea7fde77646e5f42804e","total_score":86},{"bytes":61327,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["access","login","admin","ssh","url"],"backup_and_restore":["backup","restore","recovery","rpo","retention"],"change_safety":["rollback","sha256","atomic"],"external_services":["public","nginx"],"guests_and_workloads":["vmid","container","qemu"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","log","grafana","prometheus"],"network_and_dns":["network","dns","domain","certificate"],"repair_and_troubleshooting":["failure"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"Services bootstrap snapshot — 2026-06-17"},{"level":2,"line":3,"title":"Scope"},{"level":2,"line":9,"title":"Edge VM"},{"level":2,"line":19,"title":"NetBird VPS"},{"level":2,"line":34,"title":"NetBird backup status"},{"level":3,"line":37,"title":"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb"},{"level":2,"line":40,"title":"NetBird backup timers"},{"level":2,"line":46,"title":"Important follow-ups"},{"level":2,"line":54,"title":"NetBird Uptime Kuma monitors"},{"level":2,"line":64,"title":"NetBird homelab peers"},{"level":3,"line":69,"title":"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0 UNKNOWN 100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 "},{"level":2,"line":72,"title":"NetBird peers health monitor"},{"level":2,"line":88,"title":"File Browser credential remediation"},{"level":2,"line":98,"title":"Proxmox private SSL via NetBird FQDN"},{"level":2,"line":116,"title":"File Browser backup, offhost sync, and restore validation"},{"level":2,"line":150,"title":"App stacks batch backup chain"},{"level":2,"line":194,"title":"Final backup and health baseline"},{"level":2,"line":202,"title":"Private NPMplus hosts via NetBird"},{"level":2,"line":231,"title":"Homepage VPN Authentik forward-auth"},{"level":2,"line":244,"title":"Homepage Authentik forward-auth rollback"},{"level":2,"line":257,"title":"Private VPN hosts safe baseline after Authentik rollback"},{"level":2,"line":271,"title":"Private VPN Hosts Kuma monitor"},{"level":2,"line":289,"title":"Private VPN Hosts health timer"},{"level":2,"line":304,"title":"Private VPN Hosts timer auto-cycle verified"},{"level":2,"line":314,"title":"Final ops snapshot — private VPN hosts"},{"level":2,"line":326,"title":"NPMplus + Kuma config backup chain"},{"level":2,"line":348,"title":"Corrected NPMplus + Kuma config backup chain"},{"level":2,"line":367,"title":"NPMplus + Kuma backup chain Kuma monitors"},{"level":2,"line":382,"title":"NPMplus + Kuma config backup timer"},{"level":2,"line":398,"title":"Authentik backup chain"},{"level":2,"line":408,"title":"Authentik backup chain Kuma monitors"},{"level":2,"line":417,"title":"Authentik backup timer"},{"level":2,"line":431,"title":"Gitea backup chain"},{"level":2,"line":441,"title":"Gitea backup chain"},{"level":2,"line":445,"title":"Gitea backup chain Kuma monitors"},{"level":2,"line":454,"title":"Gitea backup timer"},{"level":2,"line":465,"title":"Vaultwarden backup chain"},{"level":2,"line":475,"title":"Vaultwarden backup chain Kuma monitors"},{"level":2,"line":484,"title":"Vaultwarden backup timer"},{"level":2,"line":495,"title":"Edge VM manual vzdump backup"},{"level":2,"line":502,"title":"Edge VM vzdump offhost copy"},{"level":2,"line":508,"title":"Edge VM vzdump restore verification"},{"level":2,"line":515,"title":"Edge VM vzdump Kuma monitors"},{"level":2,"line":528,"title":"Edge VM vzdump weekly timer"},{"level":2,"line":543,"title":"Immich media backup existing automation inventory"},{"level":2,"line":553,"title":"Immich media restore verification"},{"level":2,"line":560,"title":"Immich media restore Kuma monitor"},{"level":2,"line":570,"title":"Immich media restore Kuma monitor correction"},{"level":2,"line":577,"title":"P0 backup baseline closure"},{"level":2,"line":589,"title":"P1 Mail.ru Cloud offsite inventory"},{"level":2,"line":651,"title":"P1 Mail.ru Cloud rclone config drift resolved"},{"level":2,"line":667,"title":"P1 Mail.ru Cloud canary"},{"level":2,"line":675,"title":"P1 Mail.ru Cloud production payload inventory"},{"level":2,"line":710,"title":"P1 Mail.ru Cloud critical baseline upload"},{"level":2,"line":720,"title":"P1 Mail.ru Cloud Kuma monitors"},{"level":2,"line":732,"title":"P1 Mail.ru Cloud edge-vm chunked large upload"},{"level":2,"line":742,"title":"P1 Mail.ru Cloud Edge VM Kuma monitor"},{"level":2,"line":753,"title":"P1 Mail.ru Cloud offsite seed closure"},{"level":2,"line":776,"title":"P1 Mail.ru Cloud critical upload automation"},{"level":2,"line":791,"title":"P1 Mail.ru Cloud edge-vm upload automation"},{"level":2,"line":807,"title":"P1 Mail.ru Cloud automation and retention closure"},{"level":2,"line":829,"title":"P1 Mail.ru Cloud restore drill automation"},{"level":2,"line":843,"title":"P2 Disaster Recovery runbook"},{"level":2,"line":853,"title":"P2 Critical bundle bootstrap drill"},{"level":2,"line":870,"title":"P2 Disaster Recovery bootstrap closure"},{"level":2,"line":892,"title":"Vaultwarden isolated restore drill — 2026-06-18"},{"level":2,"line":929,"title":"Daily cluster status report — 2026-06-18"},{"level":2,"line":985,"title":"Edge VM timezone standardization — 2026-06-19"},{"level":2,"line":1012,"title":"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19"},{"level":2,"line":1047,"title":"Trivy scan mode after 2026-06-19 update wave"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":["sensitive-assignment"],"sha256":"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6","total_score":86},{"bytes":89904,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","content_score":80,"coverage":{"access_and_admin":["admin","console","url"],"backup_and_restore":["backup","restore","retention"],"change_safety":["rollback","sha256"],"external_services":["public"],"guests_and_workloads":["container"],"identity_and_topology":["proxmox","pve01","cluster","node"],"internal_services":["lan"],"monitoring_and_logs":["monitor","alert","metric","grafana","prometheus"],"network_and_dns":["dns","domain","tls","certificate"],"repair_and_troubleshooting":["troubleshoot"],"storage":["storage","thin","disk"]},"headings":[{"level":1,"line":1,"title":"P0 alert routing preflight"}],"path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","path_score":6,"path_sensitive":false,"refs":["refs/heads/site-gram1-ru-baseline-20260731","refs/heads/site-gram1-ru-baseline-canonical-20260731"],"sensitive_findings":[],"sha256":"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab","total_score":86}],"handbook_candidates_omitted":20,"history":{"log":"COMMIT\tf9d3ba8caf65005605aa8aee2ede7e4e7e94ee49\t2026-07-31T10:37:56+03:00\thomelab-site-baseline\tGRAM1: capture initial site baseline 20260731T071400Z\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\nA\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\n\nCOMMIT\tf12d914540d40b3c221786c81be0ec17f42c91a5\t2026-07-20T00:16:16+03:00\tHOMELAB Ops Reviewer\tCR-2026-0017: record one-pass live inventory verification\nM\terrors/regression-cases.json\n\nCOMMIT\td831f34685a9305412f949c1e845842af78661a1\t2026-07-20T00:05:34+03:00\tHOMELAB Ops Reviewer\tCR-2026-0017: add unified homelab inventory foundation\nM\terrors/regression-cases.json\n\nCOMMIT\t60f53ea6fe6724196802a46de3de19c7889a51cc\t2026-07-19T13:49:08+03:00\tHOMELAB Bootstrap Reviewer\tCR-2026-0015: add pve03 r8152 RX ring canary\nM\terrors/regression-cases.json\n\nCOMMIT\t25b275f96b54551e26f07516c72651d85f235ad0\t2026-07-18T16:27:33+03:00\thomelab-ops-bootstrap\tCR-2026-0013: allow VM160 worker bootstrap transition\nM\terrors/regression-cases.json\n\nCOMMIT\tf5b22d867ea467987008408e3fb1fb0e17fa7b2e\t2026-07-18T14:17:33+03:00\thomelab-ops-bootstrap\tCR-2026-0012: add one-command Skladchik Cookie refresh runbook\nM\terrors/regression-cases.json\n\nCOMMIT\tbb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9\t2026-07-18T13:11:46+03:00\thomelab-ops-bootstrap\tCR-2026-0011: force fresh Skladchik Cookie before jar persistence\nM\terrors/regression-cases.json\n\nCOMMIT\t7bd1b050f8d64c7b55dfd51ead63f0adda87f2df\t2026-07-18T10:34:25+03:00\thomelab-ops-bootstrap\tCR-2026-0010: separate current and target Skladchik edge SHAs\nM\terrors/regression-cases.json\n\nCOMMIT\t10a747b86ef498aabd3a71b1e32dfb6c80547ddb\t2026-07-18T09:59:55+03:00\thomelab-ops-bootstrap\tCR-2026-0009: guard Skladchik monitor concurrency\nM\terrors/regression-cases.json\n\nCOMMIT\t1f7abe5acf856ad2a2abe10ef2a9452485edb073\t2026-07-18T09:26:07+03:00\thomelab-ops-bootstrap\tCR-2026-0008: repair Skladchik rollback snapshot integrity\nM\terrors/regression-cases.json\n\nCOMMIT\td399d24440f948b518761ecfd516521993861b43\t2026-07-18T08:10:58+03:00\thomelab-ops-bootstrap\tCR-2026-0007: add controlled Skladchik reauthentication task\nM\terrors/regression-cases.json\n\nCOMMIT\t65855c4108dd0dd961803ad8233e5a805c00993b\t2026-07-18T06:15:45+03:00\thomelab-ops-bootstrap\tCR-2026-0006: lock cluster cloud quorum failures\nM\terrors/regression-cases.json\n\nCOMMIT\tb8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\t2026-07-18T03:57:33+03:00\tHOMELAB Bootstrap Reviewer\tCR-2026-0005 prepare reviewed logrotate bootstrap clearance\nM\terrors/regression-cases.json\n\nCOMMIT\t14d8bb0467e5890a7166444afda90a0185552eba\t2026-07-16T01:29:16+03:00\thomelab-ops-bootstrap\tbootstrap homelab-ops v2\nA\terrors/regression-cases.json\n","log_bytes":7893,"log_sha256":"6952e258f02107d8b918fe6d37d51146ba54c5a3fa27110434001f2046127c7e","log_truncated":false,"paths":["sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json","errors/regression-cases.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json","sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json"]},"mandatory_error_artifacts":{"linter":{"paths":[],"present":false},"regression_registry":{"paths":["errors/regression-cases.json"],"present":true},"repository_validator":{"paths":["tools/validate_repo.py"],"present":true},"superseded_policy":{"paths":[],"present":false},"tests":{"paths":["tests/fixtures/gitea-legacy-auth-permission.json","tests/test_access_contexts.py","tests/test_cr_2026_0005.py","tests/test_cr_2026_0006.py","tests/test_cr_2026_0006_vm160_task.py","tests/test_cr_2026_0007_skladchik_reauth.py","tests/test_cr_2026_0007_skladchik_semantic_repair.py","tests/test_cr_2026_0008_skladchik_snapshot_integrity.py","tests/test_cr_2026_0009_skladchik_concurrency_guard.py","tests/test_cr_2026_0011_skladchik_cookie_jar_reset.py","tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py","tests/test_cr_2026_0013_vm160_worker_bootstrap_transition.py","tests/test_cr_2026_0015_pve03_r8152_rx_ring_canary.py","tests/test_cr_2026_0018_execution_boundary_preparation.py","tests/test_inventory_foundation.py","tests/test_live_verification.py","tests/test_no_repeat_policy.py","tests/test_reg_014_015.py","tests/test_repository.py"],"present":true}},"scanned_commits":[{"candidate_files":19,"commit":"fe1221b06643db3b00a621b0230f92a46a4edc2b","read_files":19,"refs":["refs/heads/main"],"tree_files":125},{"candidate_files":10,"commit":"16e84298035f5e4ec7e2b7d39967ad5e40ea3d4b","read_files":10,"refs":["refs/heads/cr-2026-0006-cluster-cloud-quorum"],"tree_files":66},{"candidate_files":32,"commit":"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17","read_files":32,"refs":["refs/heads/cr-2026-0017-inventory-foundation"],"tree_files":160},{"candidate_files":13,"commit":"1f7abe5acf856ad2a2abe10ef2a9452485edb073","read_files":13,"refs":["refs/heads/cr-2026-0008-skladchik-snapshot-integrity"],"tree_files":94},{"candidate_files":17,"commit":"25b275f96b54551e26f07516c72651d85f235ad0","read_files":17,"refs":["refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition"],"tree_files":110},{"candidate_files":18,"commit":"60f53ea6fe6724196802a46de3de19c7889a51cc","read_files":18,"refs":["refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary"],"tree_files":127},{"candidate_files":2270,"commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","read_files":2267,"refs":["refs/heads/site-gram1-ru-baseline-canonical-20260731"],"tree_files":4438},{"candidate_files":14,"commit":"7bd1b050f8d64c7b55dfd51ead63f0adda87f2df","read_files":14,"refs":["refs/heads/cr-2026-0009-skladchik-concurrency-guard"],"tree_files":99},{"candidate_files":7,"commit":"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc","read_files":7,"refs":["refs/heads/cr-2026-0005-codex-bootstrap-activation"],"tree_files":47},{"candidate_files":15,"commit":"bb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9","read_files":15,"refs":["refs/heads/cr-2026-0011-skladchik-cookie-jar-reset"],"tree_files":102},{"candidate_files":12,"commit":"d399d24440f948b518761ecfd516521993861b43","read_files":12,"refs":["refs/heads/cr-2026-0007-skladchik-controlled-reauth"],"tree_files":91},{"candidate_files":16,"commit":"f5b22d867ea467987008408e3fb1fb0e17fa7b2e","read_files":16,"refs":["refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook"],"tree_files":107},{"candidate_files":2270,"commit":"f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49","read_files":2267,"refs":["refs/heads/site-gram1-ru-baseline-20260731"],"tree_files":4434}],"scanned_unique_heads":13},"validation":{"unittest":{"duration_seconds":0.121,"rc":1,"stderr":"test_apply_exact_scope (test_cr_2026_0005.CR20260005Tests.test_apply_exact_scope) ... ok\ntest_declared_phase_outputs (test_cr_2026_0005.CR20260005Tests.test_declared_phase_outputs) ... ok\ntest_journal_pipeline_safety (test_cr_2026_0005.CR20260005Tests.test_journal_pipeline_safety) ... ok\ntest_no_pmxcfs_or_remote_mutation (test_cr_2026_0005.CR20260005Tests.test_no_pmxcfs_or_remote_mutation) ... ok\ntest_phase_guardrails (test_cr_2026_0005.CR20260005Tests.test_phase_guardrails) ... ok\ntest_policy_markers (test_cr_2026_0005.CR20260005Tests.test_policy_markers) ... ok\ntest_regression_cases (test_cr_2026_0005.CR20260005Tests.test_regression_cases) ... ok\ntest_standard_seal (test_cr_2026_0005.CR20260005Tests.test_standard_seal) ... ok\ntest_systemctl_failed_first_field (test_cr_2026_0005.CR20260005Tests.test_systemctl_failed_first_field) ... ok\ntest_task_semantic_coherence (test_cr_2026_0005.CR20260005Tests.test_task_semantic_coherence) ... ok\ntest_change_is_local_only (test_cr_2026_0006.CR20260006Tests.test_change_is_local_only) ... ok\ntest_command_delivery_locks (test_cr_2026_0006.CR20260006Tests.test_command_delivery_locks) ... ok\ntest_distinct_accounts (test_cr_2026_0006.CR20260006Tests.test_distinct_accounts) ... ok\ntest_local_delete_fail_closed (test_cr_2026_0006.CR20260006Tests.test_local_delete_fail_closed) ... ok\ntest_policy_contract (test_cr_2026_0006.CR20260006Tests.test_policy_contract) ... ok\ntest_regression_cases (test_cr_2026_0006.CR20260006Tests.test_regression_cases) ... ok\ntest_restore_contract (test_cr_2026_0006.CR20260006Tests.test_restore_contract) ... ok\ntest_contract (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_contract) ... ok\ntest_distinct_accounts_and_exact_mapping (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_distinct_accounts_and_exact_mapping) ... ok\ntest_exact_path_and_symlink_guards (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_exact_path_and_symlink_guards) ... ok\ntest_health_root_cause_evidence (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_health_root_cause_evidence) ... ok\ntest_no_forbidden_delivery_or_hostkey_patterns (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_no_forbidden_delivery_or_hostkey_patterns) ... ok\ntest_no_inline_remote_shell_program (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_no_inline_remote_shell_program) ... ok\ntest_per_part_and_full_roundtrip_single_remote_pass (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_per_part_and_full_roundtrip_single_remote_pass) ... ok\ntest_preflight_checks_all_execution_nodes_with_versioned_scripts (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_preflight_checks_all_execution_nodes_with_versioned_scripts) ... ok\ntest_prepare_verifies_prepared_not_sealed (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_prepare_verifies_prepared_not_sealed) ... ok\ntest_rollback_restores_remote_generation_health_and_symlink (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_rollback_restores_remote_generation_health_and_symlink) ... ok\ntest_shell_syntax (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_shell_syntax) ... ok\ntest_two_stage_seal_has_truthful_delete_order (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_two_stage_seal_has_truthful_delete_order) ... ok\ntest_verify_queries_pve03_not_pve01_staging (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_verify_queries_pve03_not_pve01_staging) ... ok\ntest_contract (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_contract) ... ok\ntest_edge_script_sha_is_exact_sha256 (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_edge_script_sha_is_exact_sha256) ... ok\ntest_inline_python_policy_matches_linter_scope (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_inline_python_policy_matches_linter_scope) ... ok\ntest_no_inline_remote_shell (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_no_inline_remote_shell) ... ok\ntest_regression_lock (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_regression_lock) ... ok\ntest_rollback_before_apply (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_rollback_before_apply) ... ok\ntest_shell_syntax (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_shell_syntax) ... ok\ntest_strict_hostkey_and_no_secret_material (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_strict_hostkey_and_no_secret_material) ... ok\ntest_verify_requires_real_counts (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_verify_requires_real_counts) ... ok\ntest_all_active_callers_are_versioned_and_strict (test_cr_2026_0007_skladchik_semantic_repair.SkladchikSemanticRepairTests.test_all_active_callers_are_versioned_and_strict) ... ok\ntest_apply_installs_live_and_desired_assets (test_cr_2026_0007_skladchik_semantic_repair.SkladchikSemanticRepairTests.test_apply_installs_live_and_desired_assets) ... ok\nte","stderr_sha256":"301889d5996ed9723faa0f3f808c32efd9bb4247ffc81d261743a16876e5ea73","stderr_truncated":false,"stdout":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"validate_repo":{"duration_seconds":0.031,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"8d9b6d16bd0883193db77e5e0d348f4f97fa99cfc3e1107e09f47a0af945d7ec","stdout_truncated":false}}},"gitea_changed":false,"handbook_assessment":{"canonical_ambiguous":true,"canonical_commit":"76da439c1f69f405b434e20b2a3da1c11dc92e38","canonical_found":true,"canonical_path":"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md","canonical_score":105,"canonical_sha256":"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab","coverage_missing":[],"coverage_present":["access_and_admin","backup_and_restore","change_safety","error_learning","external_services","guests_and_workloads","identity_and_topology","internal_services","monitoring_and_logs","network_and_dns","repair_and_troubleshooting","storage"],"live_inventory_evidence":{"backup_job_count":0,"guest_count":0,"node_count":0,"running_service_units_total":47,"storage_rows":0},"requires_update":true},"live_cluster":{"backup_jobs":[],"cluster_status":null,"commands":{"hostname":{"rc":0,"value":"pve01.gram1.ru"},"pvecm_status":{"excerpt":"","rc":255,"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n"},"pveversion":{"excerpt":"proxmox-ve: 9.2.0 (running kernel: 7.0.12-1-pve)\npve-manager: 9.2.3 (running version: 9.2.3/d0fde103346cf89a)\nproxmox-kernel-helper: 9.2.0\nproxmox-kernel-7.0: 7.0.12-1\nproxmox-kernel-7.0.12-1-pve-signed: 7.0.12-1\nproxmox-kernel-7.0.6-2-pve-signed: 7.0.6-2\nproxmox-kernel-7.0.2-6-pve-signed: 7.0.2-6\nceph-fuse: 19.2.3-pve4\ncorosync: 3.1.10-pve2\ncriu: 4.1.1-1\nfrr-pythontools: 10.6.1-1+pve2\nifupdown2: 3.3.0-1+pmx12\nintel-microcode: 3.20251111.1~deb13u1\nksm-control-daemon: 1.5-1\nlibjs-extjs: 7.0.0-5\nlibproxmox-acme-perl: 1.7.1\nlibproxmox-backup-qemu0: 2.0.2\nlibproxmox-rs-perl: 0.4.1\nlibpve-access-control: 9.1.1\nlibpve-apiclient-perl: 3.4.2\nlibpve-cluster-api-perl: 9.1.6\nlibpve-cluster-perl: 9.1.6\nlibpve-common-perl: 9.1.16\nlibpve-guest-common-perl: 6.0.4\nlibpve-http-server-perl: 6.0.5\nlibpve-network-perl: 1.6.6\nlibpve-notify-perl: 9.1.6\nlibpve-rs-perl: 0.15.3\nlibpve-storage-perl: 9.1.6\nlibspice-server1: 0.15.2-1+b1\nlvm2: 2.03.31-2+pmx1\nlxc-pve: 7.0.0-2\nlxcfs: 7.0.0-pve1\nnovnc-pve: 1.7.0-1\nproxmox-backup-client: 4.2.2-1\nproxmox-backup-file-restore: 4.2.2-1\nproxmox-backup-restore-image: 1.0.0\nproxmox-firewall: 1.2.3\nproxmox-kernel-helper: 9.2.0\nproxmox-mail-forward: 1.0.3\nproxmox-mini-journalreader: 1.6\nproxmox-offline-mirror-helper: 0.7.4\nproxmox-widget-toolkit: 5.2.5\npve-cluster: 9.1.6\npve-container: 6.1.10\npve-docs: 9.2.2\npve-edk2-firmware: 4.2025.05-2\npve-esxi-import-tools: 1.0.1\npve-firewall: 6.0.4\npve-firmware: 3.18-4\npve-ha-manager: 5.2.4\npve-i18n: 3.8.0\npve-qemu-kvm: 11.0.0-4\npve-xtermjs: 6.0.0-1\nqemu-server: 9.1.17\nsmartmontools: 7.5-pve2\nspiceterm: 3.4.2\nswtpm: 0.8.0+pve3\nvncterm: 1.9.2\nzfsutils-linux: 2.4.2-pve1\n","rc":0,"sha256":"19ba1ac5d9e5ee6299326b5ad7d5b334a03b23b84a97f3cbdf0f1cf7748d1c0a"}},"endpoint_meta":{"backup_jobs":{"duration_seconds":0.46,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"cluster_status":{"duration_seconds":0.462,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"ha_current":{"duration_seconds":0.471,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"ha_groups":{"duration_seconds":0.466,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"ha_resources":{"duration_seconds":0.461,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"nodes":{"duration_seconds":0.459,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"replication":{"duration_seconds":0.467,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"resources_storage":{"duration_seconds":0.461,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"resources_vm":{"duration_seconds":0.478,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"storage_config":{"duration_seconds":0.46,"rc":255,"stderr":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false}},"guests":[],"ha_current":null,"ha_groups":null,"ha_resources":null,"nodes":[],"replication":null,"running_service_units":[{"description":"chrony, an NTP client/server","unit":"chrony.service"},{"description":"Corosync Cluster Engine","unit":"corosync.service"},{"description":"Regular background program processing daemon","unit":"cron.service"},{"description":"D-Bus System Message Bus","unit":"dbus.service"},{"description":"Device-mapper event daemon","unit":"dm-event.service"},{"description":"Getty on tty1","unit":"getty@tty1.service"},{"description":"Homelab command adapter","unit":"homelab-command-adapter.service"},{"description":"Homelab command portal","unit":"homelab-command-portal.service"},{"description":"Homelab health HTTP endpoint 9101","unit":"homelab-health-http-9101.service"},{"description":"Homelab health HTTP endpoint","unit":"homelab-health-http.service"},{"description":"Homelab immutable capability reader v3","unit":"homelab-reader-v3.service"},{"description":"Homelab automatic fixed result anchor","unit":"homelab-result-lookup.service"},{"description":"Homelab Scrutiny SMART dashboard","unit":"homelab-scrutiny.service"},{"description":"Kernel Samepage Merging (KSM) Tuning Daemon","unit":"ksmtuned.service"},{"description":"LXC Container Monitoring Daemon","unit":"lxc-monitord.service"},{"description":"FUSE filesystem for LXC","unit":"lxcfs.service"},{"description":"NetBird mesh network client","unit":"netbird.service"},{"description":"pNFS block layout mapping daemon","unit":"nfs-blkmap.service"},{"description":"Network UPS Tools - device driver for NUT device 'cyberpower'","unit":"nut-driver@cyberpower.service"},{"description":"Network UPS Tools - power device monitor and shutdown controller","unit":"nut-monitor.service"},{"description":"Network UPS Tools - power devices information server","unit":"nut-server.service"},{"description":"Postfix Mail Transport Agent (main/default instance)","unit":"postfix.service"},{"description":"Prometheus exporter for machine metrics","unit":"prometheus-node-exporter.service"},{"description":"Proxmox nftables firewall","unit":"proxmox-firewall.service"},{"description":"The Proxmox VE cluster filesystem","unit":"pve-cluster.service"},{"description":"PVE LXC Container: 110","unit":"pve-container@110.service"},{"description":"PVE LXC Container: 112","unit":"pve-container@112.service"},{"description":"Proxmox VE firewall","unit":"pve-firewall.service"},{"description":"PVE Cluster HA Resource Manager Daemon","unit":"pve-ha-crm.service"},{"description":"PVE Local HA Resource Manager Daemon","unit":"pve-ha-lrm.service"},{"description":"Proxmox VE LXC Syscall Daemon","unit":"pve-lxc-syscalld.service"},{"description":"PVE API Daemon","unit":"pvedaemon.service"},{"description":"Proxmox VE firewall logger","unit":"pvefw-logger.service"},{"description":"PVE API Proxy Server","unit":"pveproxy.service"},{"description":"Proxmox VE scheduler","unit":"pvescheduler.service"},{"description":"PVE Status Daemon","unit":"pvestatd.service"},{"description":"PVE Qemu Event Daemon","unit":"qmeventd.service"},{"description":"RPC bind portmap service","unit":"rpcbind.service"},{"description":"Data caching daemon for rrdtool","unit":"rrdcached.service"},{"description":"Self Monitoring and Reporting Technology (SMART) Daemon","unit":"smartmontools.service"},{"description":"PVE SPICE Proxy Server","unit":"spiceproxy.service"},{"description":"OpenBSD Secure Shell server","unit":"ssh.service"},{"description":"Journal Service","unit":"systemd-journald.service"},{"description":"User Login Management","unit":"systemd-logind.service"},{"description":"Rule-based Manager for Device Events and Files","unit":"systemd-udevd.service"},{"description":"Proxmox VE watchdog multiplexer","unit":"watchdog-mux.service"},{"description":"ZFS Event Daemon (zed)","unit":"zfs-zed.service"}],"running_service_units_total":47,"storage_config":[],"storages":[]},"mutation_outcome":"NO_MUTATION","next_action":"RESOLVE_ONLY_PROVEN_BLOCKING_FINDINGS_BEFORE_MUTATION","output_truncated_in_json":false,"prior_exact_failure":{"capsule_sha256":"e1b501473c532362e379e21e3ffb86a8c86c0c5b993c51ed32ed98ddc1eda157","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-20260805T062500Z","correction":"candidate scan now uses the already-enforced complete tree limit instead of the disproven 600-file sublimit","error":"repository complete scan limits were hit: candidate_file_limit:76da439c1f69f405b434e20b2a3da1c11dc92e38:2270; candidate_file_limit:f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49:2270","error_type":"RuntimeError","rc":1,"rollback_restored":null,"rollback_started":false,"runner_json_sha256":"0ec0065f247a5731fb21cf43eb73e871779f40941e235a3108513b4cb5d860fe","status":"FAIL"},"production_changed":false,"rc":0,"read_only":true,"result_json_sha256_before_hash_field":"bd5de9eb6188e90f9ac67327bf77ef5b78699292a46c3308333ed7c6fdf730ae","result_projection":{"bounded":true,"bytes_before_hash":294474,"compaction_applied":true},"rollback_restored":null,"rollback_started":false,"schema":1,"status":"OK"} +HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z","command_rc":1,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":1,"rollback_restored":null,"rollback_started":false,"status":"FAIL","version":1} +{"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-BLOCKER-RESOLUTION-READ-ONLY-20260805T070400Z","command_rc":1,"error":"exact homelab-ops bare repository not found in proven local or running-container locations","error_type":"RuntimeError","exact_result_basis":{"blocking_findings":["HANDBOOK_CANDIDATE_AMBIGUOUS","REPOSITORY_TESTS_FAILED","CLUSTER_STATUS_UNREADABLE"],"capsule_sha256":"2d2886a07bf68d97acf144a4d94855d6558cdd0c1277e2c633a5a244f9aebb0f","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z","command_rc":0,"control_plane_error":{"message":"existing runner returned a different rc after writing its public artifact; runtime publication or wrapper completion failed","type":"RunnerWrapperMismatch"},"mutation_outcome":"NO_MUTATION","output_complete":true,"output_truncated_in_json":false,"prevention_in_this_probe":"bounded structured output; no complete success logs; no adapter or result-access repair","rollback_restored":null,"rollback_started":false,"runner_document_rc":0,"runner_json_sha256":"f219bbfbfd996e659820b7275a52a14258000d0a27eea3c09793c0eea8cb10c3","runner_rc":75,"runner_status":"OK","runner_text_sha256":"bb714fe8c1973f37e190c01d8582c15f2b92ea0b44adb5a358d5f3d03ba1848a","runner_wrapper_matches_document":false,"state_status":"FAIL"},"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":1,"read_only":true,"rollback_restored":null,"rollback_started":false,"schema":1,"status":"FAIL"} OUTPUT_END CHAT_OUTPUT_END