{
  "schema_version": 1,
  "channel": "homelab-runtime",
  "command_id": "HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z",
  "status": "OK",
  "rc": 0,
  "host": "pve01",
  "mode": "verify",
  "component": "cluster-knowledge-base-error-system",
  "started_at_utc": "2026-08-05T06:48:00Z",
  "finished_at_utc": "2026-08-05T06:48:24Z",
  "reference_register_checked": true,
  "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
  "error_register_checked": true,
  "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83",
  "command_sha256": "829077ae842686fb1f36e274117ae6385fb6020f21e25b3af48ae632cde78bcc",
  "duplicate_failed_command_blocked": false,
  "block_reason": null,
  "execution_started": true,
  "change_declared": false,
  "result_contract_valid": true,
  "result_contract_status": null,
  "result_contract_error": null,
  "command_rc": 0,
  "changes_made": false,
  "rollback_started": false,
  "rollback_restored": null,
  "mutation_outcome": "NO_MUTATION",
  "sanitized": true,
  "secrets_included": false,
  "private_addresses_included": false,
  "raw_evidence_retained_locally": true,
  "raw_evidence_sha256": "10eeba794a85e13eb9ddc29f821f0e0cf430c57b93acf878eb539e048389d8f6",
  "sanitized_output_sha256": "11a658e5cc7243e6916e1903b779b9538dded188f7d8c27c775d3f68147adde9",
  "output_truncated_in_json": false,
  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
  "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z\",\"command_rc\":0,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"blocking_findings\":[\"HANDBOOK_CANDIDATE_AMBIGUOUS\",\"REPOSITORY_TESTS_FAILED\",\"CLUSTER_STATUS_UNREADABLE\"],\"changes_made\":false,\"cluster_changed\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-RETRY-20260805T064700Z\",\"command_rc\":0,\"error_system_assessment\":{\"deterministic_fingerprint_observed\":true,\"immutable_error_ledger_observed\":false,\"mandatory_components\":{\"linter\":{\"paths\":[],\"present\":false},\"regression_registry\":{\"paths\":[\"errors/regression-cases.json\"],\"present\":true},\"repository_validator\":{\"paths\":[\"tools/validate_repo.py\"],\"present\":true},\"superseded_policy\":{\"paths\":[],\"present\":false},\"tests\":{\"paths\":[\"tests/fixtures/gitea-legacy-auth-permission.json\",\"tests/test_access_contexts.py\",\"tests/test_cr_2026_0005.py\",\"tests/test_cr_2026_0006.py\",\"tests/test_cr_2026_0006_vm160_task.py\",\"tests/test_cr_2026_0007_skladchik_reauth.py\",\"tests/test_cr_2026_0007_skladchik_semantic_repair.py\",\"tests/test_cr_2026_0008_skladchik_snapshot_integrity.py\",\"tests/test_cr_2026_0009_skladchik_concurrency_guard.py\",\"tests/test_cr_2026_0011_skladchik_cookie_jar_reset.py\",\"tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py\",\"tests/test_cr_2026_0013_vm160_worker_bootstrap_transition.py\",\"tests/test_cr_2026_0015_pve03_r8152_rx_ring_canary.py\",\"tests/test_cr_2026_0018_execution_boundary_preparation.py\",\"tests/test_inventory_foundation.py\",\"tests/test_live_verification.py\",\"tests/test_no_repeat_policy.py\",\"tests/test_reg_014_015.py\",\"tests/test_repository.py\"],\"present\":true}},\"missing_mandatory_components\":[\"linter\",\"superseded_policy\"],\"observed_error_artifact_count\":160,\"pre_command_gate_observed\":false,\"proposed_v2\":{\"command_evidence_basis\":\"Каждая задача закрепляется на точном Gitea commit и SHA исходных файлов. Команда без evidence_basis или с устаревшим commit блокируется до нового READ_ONLY probe.\",\"deterministic_fingerprint\":\"SHA256 нормализованного набора component + operation + phase + rc + error_type + stable evidence; секреты и переменные значения исключаются до хеширования.\",\"error_ledger\":\"Одна неизменяемая JSON-запись на каждый доказанный отказ: error_id, command_id, capsule_sha256, component, operation, target, exact evidence, root cause, fixed_by, prevention_test, supersedes, first_seen, last_seen.\",\"exact_result_ingestion\":\"После exact-result автоматически формируется candidate incident; запись принимается только после сверки command_id, capsule_sha256, runner_json_sha256, wrapper/document RC и отсутствия truncation.\",\"pre_command_gate\":\"Перед выпуском любой капсулы обязательный поиск fingerprint/component/operation в реестре. Повтор известной ошибки блокируется, пока капсула не содержит подтверждённое prevention_test или документированное исключение.\",\"quality_metrics\":\"Счётчики: first-pass success rate, repeated-error rate, rollback rate, unknown-state commands, commands without exact-result verification. Цель — repeated-error rate = 0.\",\"regression_tests\":\"Каждая исправленная ошибка обязана иметь воспроизводимый тест в tests/errors; лinter запрещает закрывать ошибку без теста и ссылки fixed_by.\",\"supersession\":\"Старые задачи и обходные пути не удаляются молча: они получают статус superseded с заменой, причиной и запретом повторного запуска.\"},\"requires_v2\":true},\"gitea\":{\"default_head_archive\":{\"archive_sha256\":\"8f595e76a5baa7b2d8d2148f1a694e9acd22a90accb6e55f962fc47ff1432a5a\",\"branch\":\"main\",\"bytes\":376932,\"commit\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"files\":125},\"discovery_evidence\":[{\"id\":\"aa350cac62aa\",\"kind\":\"podman-probe\",\"paths_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"rc\":126,\"stderr\":\"Error: crun: capset: Operation not permitted: OCI permission denied\\n\"},{\"kind\":\"network-ls-remote\",\"rc\":0,\"stderr\":\"\",\"stdout_sha256\":\"b6697044d593fdddb9d66bc35bd58267cc6d07a31b756330aac2f147bc98bc6c\"},{\"kind\":\"network-mirror\",\"rc\":0,\"stderr\":\"Cloning into bare repository '/tmp/homelab-kb-network-fallback-k4x0gd1r/homelab-ops.git'...\\n\",\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}],\"identity\":{\"access_method\":\"authenticated-network-mirror\",\"default_branch\":\"main\",\"head\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"ref_count\":13,\"refs\":[{\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"committer_date\":\"2026-07-31T10:40:00Z\",\"ref\":\"refs/heads/site-gram1-ru-baseline-canonical-20260731\",\"subject\":\"gram1.ru: publish verified baseline pointer\"},{\"commit\":\"f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49\",\"committer_date\":\"2026-07-31T10:37:56+03:00\",\"ref\":\"refs/heads/site-gram1-ru-baseline-20260731\",\"subject\":\"GRAM1: capture initial site baseline 20260731T071400Z\"},{\"commit\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"committer_date\":\"2026-07-29T09:33:11Z\",\"ref\":\"refs/heads/main\",\"subject\":\"docs: mark Skladchik moderator assistant as planned\"},{\"commit\":\"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17\",\"committer_date\":\"2026-07-20T00:37:03+03:00\",\"ref\":\"refs/heads/cr-2026-0017-inventory-foundation\",\"subject\":\"CR-2026-0017: model access contexts and discover guest management\"},{\"commit\":\"60f53ea6fe6724196802a46de3de19c7889a51cc\",\"committer_date\":\"2026-07-19T17:57:23+03:00\",\"ref\":\"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary\",\"subject\":\"CR-2026-0015: add pve03 r8152 RX ring canary\"},{\"commit\":\"25b275f96b54551e26f07516c72651d85f235ad0\",\"committer_date\":\"2026-07-18T16:27:33+03:00\",\"ref\":\"refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition\",\"subject\":\"CR-2026-0013: allow VM160 worker bootstrap transition\"},{\"commit\":\"f5b22d867ea467987008408e3fb1fb0e17fa7b2e\",\"committer_date\":\"2026-07-18T14:17:33+03:00\",\"ref\":\"refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook\",\"subject\":\"CR-2026-0012: add one-command Skladchik Cookie refresh runbook\"},{\"commit\":\"bb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9\",\"committer_date\":\"2026-07-18T13:11:46+03:00\",\"ref\":\"refs/heads/cr-2026-0011-skladchik-cookie-jar-reset\",\"subject\":\"CR-2026-0011: force fresh Skladchik Cookie before jar persistence\"},{\"commit\":\"7bd1b050f8d64c7b55dfd51ead63f0adda87f2df\",\"committer_date\":\"2026-07-18T10:34:25+03:00\",\"ref\":\"refs/heads/cr-2026-0009-skladchik-concurrency-guard\",\"subject\":\"CR-2026-0010: separate current and target Skladchik edge SHAs\"},{\"commit\":\"1f7abe5acf856ad2a2abe10ef2a9452485edb073\",\"committer_date\":\"2026-07-18T09:26:07+03:00\",\"ref\":\"refs/heads/cr-2026-0008-skladchik-snapshot-integrity\",\"subject\":\"CR-2026-0008: repair Skladchik rollback snapshot integrity\"},{\"commit\":\"d399d24440f948b518761ecfd516521993861b43\",\"committer_date\":\"2026-07-18T08:57:02+03:00\",\"ref\":\"refs/heads/cr-2026-0007-skladchik-controlled-reauth\",\"subject\":\"CR-2026-0007: add controlled Skladchik reauthentication task\"},{\"commit\":\"16e84298035f5e4ec7e2b7d39967ad5e40ea3d4b\",\"committer_date\":\"2026-07-18T07:43:14+03:00\",\"ref\":\"refs/heads/cr-2026-0006-cluster-cloud-quorum\",\"subject\":\"CR-2026-0006: add VM160 cloud quorum canary task\"},{\"commit\":\"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\",\"committer_date\":\"2026-07-18T03:57:33+03:00\",\"ref\":\"refs/heads/cr-2026-0005-codex-bootstrap-activation\",\"subject\":\"CR-2026-0005 prepare reviewed logrotate bootstrap clearance\"}],\"refs_sha256\":\"1349b9021de5d4f1bb0406fd4895b3e0d1fd5c674f3686bad730a3e7a0695fb3\",\"repo_url\":\"https://git.gram1.ru/homelab-admin/homelab-ops\",\"source\":{\"kind\":\"direct\",\"path\":\"/tmp/homelab-kb-network-fallback-k4x0gd1r/homelab-ops.git\"}},\"scan\":{\"canonical_candidate\":{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},\"canonical_candidate_ambiguous\":true,\"error_artifacts\":[{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":1079183,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":102,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"бэкап\",\"restore\",\"восстанов\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"error_learning\":[\"regression\",\"incident\",\"superseded\"],\"external_services\":[\"внешн\",\"public\",\"reverse proxy\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"внутренн\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"repair\",\"troubleshoot\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"excerpt\":\"<OMITTED_SENSITIVE_CONTENT><BOUNDED_PROJECTION><BOUNDED_PROJECTION><BOUNDED_PROJECTION>\",\"headings\":[],\"json_top_level_size\":1000,\"json_top_level_type\":\"list\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"url-userinfo\"],\"sha256\":\"aeb92358514ec5cd67d557f15ea295b3ae4f25df5f17a14556dae750b8496d1b\",\"total_score\":102},{\"bytes\":9499,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":88,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"internet\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"internal service\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"excerpt\":\"# DR from zero runbook, 2026-06-22\\n\\nChecked at UTC: `2026-06-22T09:00:38Z`.\\n\\nMarker: **DR from zero runbook, 2026-06-22**\\n\\n## Purpose\\n\\nThis runbook describes how to rebuild a minimum viable homelab from zero after a serious failure.\\n\\nIt is not a restore execution log. It is a step-by-step operator procedure.\\n\\n## Scope\\n\\nThe goal is to recover enough infrastructure to regain access, documentation, identity, routing, secrets, Git, backup visibility, and then stateful applications.\\n\\nMinimum viable homelab means:\\n\\n- SSH access works;\\n- VPN/Tailscale/NetBird access works or has a known temporary replacement;\\n- Git repository is available;\\n- SOPS/age secrets can be decrypted;\\n- MkDocs documentation is published;\\n- NPMplus routes can be restored;\\n- Authentik, Gitea, Vaultwarden, NetBox, and Uptime Kuma can be restored;\\n- backup/offhost locations are visible;\\n- health checks prove the restored state.\\n\\n## Current known source-of-truth commits\\n\\n- Backup coverage closure: completed before this runbook.\\n- MkDocs publish hardening: completed.\\n- Backup tiering table: completed.\\n- Current repo head when starting this runbook: `adb8c55`.\\n\\n## P0 restore order\\n\\n| Order | Component | Why first | Expec<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"DR from zero runbook, 2026-06-22\"},{\"level\":2,\"line\":7,\"title\":\"Purpose\"},{\"level\":2,\"line\":13,\"title\":\"Scope\"},{\"level\":2,\"line\":29,\"title\":\"Current known source-of-truth commits\"},{\"level\":2,\"line\":36,\"title\":\"P0 restore order\"},{\"level\":2,\"line\":55,\"title\":\"Critical backup sources\"},{\"level\":2,\"line\":71,\"title\":\"Phase 0 — stop and preserve evidence\"},{\"level\":2,\"line\":86,\"title\":\"Phase 1 — base host recovery\"},{\"level\":2,\"line\":104,\"title\":\"Phase 2 — network access\"},{\"level\":2,\"line\":119,\"title\":\"Phase 3 — clone repository\"},{\"level\":2,\"line\":136,\"title\":\"Phase 4 — restore secrets/SOPS\"},{\"level\":2,\"line\":155,\"title\":\"Phase 5 — restore documentation first\"},{\"level\":2,\"line\":173,\"title\":\"Phase 6 — recover NPMplus and Uptime Kuma\"},{\"level\":2,\"line\":197,\"title\":\"Phase 7 — recover Authentik\"},{\"level\":2,\"line\":215,\"title\":\"Phase 8 — recover Gitea\"},{\"level\":2,\"line\":230,\"title\":\"Phase 9 — recover Vaultwarden\"},{\"level\":2,\"line\":244,\"title\":\"Phase 10 — recover NetBox\"},{\"level\":2,\"line\":270,\"title\":\"Phase 11 — recover Edge VM\"},{\"level\":2,\"line\":291,\"title\":\"Phase 12 — recover user data services\"},{\"level\":2,\"line\":306,\"title\":\"Phase 13 — restore monitoring and alerting\"},{\"level\":2,\"line\":325,\"title\":\"Do not do\"},{\"level\":2,\"line\":334,\"title\":\"Final DR closure checklist\"},{\"level\":2,\"line\":353,\"title\":\"Next improvement after this runbook\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f8312cd7cd0a296c60950a60c7866a67b19a70016b93f68b3a76b78d5440cb63\",\"total_score\":102},{\"bytes\":9386,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Disaster Recovery Runbook\"},{\"level\":2,\"line\":6,\"title\":\"Current verified recovery anchors\"},{\"level\":2,\"line\":25,\"title\":\"Things that must exist outside the repo\"},{\"level\":2,\"line\":39,\"title\":\"Recovery priority\"},{\"level\":2,\"line\":51,\"title\":\"Phase 0: establish a control host\"},{\"level\":2,\"line\":65,\"title\":\"Phase 1: restore rclone access\"},{\"level\":2,\"line\":90,\"title\":\"Phase 2: restore the critical/small cloud bundle\"},{\"level\":1,\"line\":107,\"title\":\"Expected:\"},{\"level\":1,\"line\":108,\"title\":\"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c\"},{\"level\":2,\"line\":130,\"title\":\"Phase 3: recover small app/config backups\"},{\"level\":2,\"line\":163,\"title\":\"Phase 4: recover edge-vm large backup\"},{\"level\":1,\"line\":194,\"title\":\"Expected size:\"},{\"level\":1,\"line\":195,\"title\":\"16936767590\"},{\"level\":1,\"line\":196,\"title\":\"Expected SHA256:\"},{\"level\":1,\"line\":197,\"title\":\"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001\"},{\"level\":2,\"line\":202,\"title\":\"Phase 5: restore validation checklist\"},{\"level\":2,\"line\":218,\"title\":\"Phase 6: re-enable backup and offsite automation\"},{\"level\":2,\"line\":231,\"title\":\"Known failure lessons\"},{\"level\":2,\"line\":243,\"title\":\"Vaultwarden isolated restore drill result — 2026-06-18\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e\",\"total_score\":100},{\"bytes\":9386,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Disaster Recovery Runbook\"},{\"level\":2,\"line\":6,\"title\":\"Current verified recovery anchors\"},{\"level\":2,\"line\":25,\"title\":\"Things that must exist outside the repo\"},{\"level\":2,\"line\":39,\"title\":\"Recovery priority\"},{\"level\":2,\"line\":51,\"title\":\"Phase 0: establish a control host\"},{\"level\":2,\"line\":65,\"title\":\"Phase 1: restore rclone access\"},{\"level\":2,\"line\":90,\"title\":\"Phase 2: restore the critical/small cloud bundle\"},{\"level\":1,\"line\":107,\"title\":\"Expected:\"},{\"level\":1,\"line\":108,\"title\":\"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c\"},{\"level\":2,\"line\":130,\"title\":\"Phase 3: recover small app/config backups\"},{\"level\":2,\"line\":163,\"title\":\"Phase 4: recover edge-vm large backup\"},{\"level\":1,\"line\":194,\"title\":\"Expected size:\"},{\"level\":1,\"line\":195,\"title\":\"16936767590\"},{\"level\":1,\"line\":196,\"title\":\"Expected SHA256:\"},{\"level\":1,\"line\":197,\"title\":\"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001\"},{\"level\":2,\"line\":202,\"title\":\"Phase 5: restore validation checklist\"},{\"level\":2,\"line\":218,\"title\":\"Phase 6: re-enable backup and offsite automation\"},{\"level\":2,\"line\":231,\"title\":\"Known failure lessons\"},{\"level\":2,\"line\":243,\"title\":\"Vaultwarden isolated restore drill result — 2026-06-18\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e\",\"total_score\":100},{\"bytes\":16031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"internal service\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"05. Service Catalog\"},{\"level\":2,\"line\":5,\"title\":\"Edge VM\"},{\"level\":2,\"line\":12,\"title\":\"NPMplus\"},{\"level\":2,\"line\":22,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":30,\"title\":\"Gotify\"},{\"level\":2,\"line\":38,\"title\":\"Vaultwarden\"},{\"level\":2,\"line\":49,\"title\":\"Dockge\"},{\"level\":2,\"line\":61,\"title\":\"Homepage\"},{\"level\":2,\"line\":71,\"title\":\"Gitea\"},{\"level\":2,\"line\":84,\"title\":\"Nextcloud AIO\"},{\"level\":2,\"line\":95,\"title\":\"DNS stack\"},{\"level\":2,\"line\":102,\"title\":\"Backup\"},{\"level\":2,\"line\":109,\"title\":\"Edge applications added 2026-06-15/16\"},{\"level\":2,\"line\":132,\"title\":\"Backup health proxy\"},{\"level\":2,\"line\":155,\"title\":\"Edge VM capacity note\"},{\"level\":2,\"line\":366,\"title\":\"Homepage grouped dashboard update, 2026-06-22\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a\",\"total_score\":95},{\"bytes\":106031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":92,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"web ui\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"lxc\",\"qemu\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"локальн\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"99. Current state summary\"},{\"level\":2,\"line\":5,\"title\":\"Git repository\"},{\"level\":2,\"line\":12,\"title\":\"Operating rules\"},{\"level\":2,\"line\":21,\"title\":\"Current verified backup health\"},{\"level\":2,\"line\":32,\"title\":\"Backup scripts and services\"},{\"level\":2,\"line\":41,\"title\":\"Proxmox and network layout\"},{\"level\":2,\"line\":58,\"title\":\"NPMplus state\"},{\"level\":2,\"line\":81,\"title\":\"DNS rewrites\"},{\"level\":2,\"line\":101,\"title\":\"Edge applications\"},{\"level\":2,\"line\":118,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":131,\"title\":\"Cloudflare token rotation\"},{\"level\":2,\"line\":139,\"title\":\"Known working URLs\"},{\"level\":2,\"line\":166,\"title\":\"Pending after this documentation update\"},{\"level\":2,\"line\":181,\"title\":\"Edge application setup checkpoint — 2026-06-16T10:26:57Z\"},{\"level\":2,\"line\":194,\"title\":\"Immich media storage checkpoint — 2026-06-16T11:01:32Z\"},{\"level\":2,\"line\":204,\"title\":\"Immich media backup checkpoint — 2026-06-16T11:24:22Z\"},{\"level\":2,\"line\":219,\"title\":\"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z\"},{\"level\":2,\"line\":231,\"title\":\"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z\"},{\"level\":2,\"line\":245,\"title\":\"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z\"},{\"level\":2,\"line\":257,\"title\":\"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z\"},{\"level\":2,\"line\":266,\"title\":\"Closed validation checkpoint — 2026-06-16T16:51:40Z\"},{\"level\":2,\"line\":278,\"title\":\"Disk Space Health checkpoint — 2026-06-16T17:06:06Z\"},{\"level\":2,\"line\":298,\"title\":\"Memos backup checkpoint — 2026-06-16T17:33:39Z\"},{\"level\":2,\"line\":319,\"title\":\"Paperless backup checkpoint — 2026-06-16T17:50:49Z\"},{\"level\":2,\"line\":350,\"title\":\"Application restore validation checkpoint — 2026-06-16T18:01:17Z\"},{\"level\":2,\"line\":364,\"title\":\"Final full baseline checkpoint — 2026-06-16T18:10:15Z\"},{\"level\":2,\"line\":407,\"title\":\"Daily cluster status report\"},{\"level\":2,\"line\":420,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":447,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":482,\"title\":\"Контейнерная волна обновлений, 2026-06-19\"},{\"level\":2,\"line\":498,\"title\":\"CVE root-cause analysis, 2026-06-19\"},{\"level\":2,\"line\":514,\"title\":\"Browser / Chromium risk analysis, 2026-06-19\"},{\"level\":2,\"line\":527,\"title\":\"Base OS package CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":541,\"title\":\"Go runtime/dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":555,\"title\":\"Node/NPM dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":569,\"title\":\"Dockge / Karakeep candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":583,\"title\":\"Karakeep production update, 2026-06-19\"},{\"level\":2,\"line\":605,\"title\":\"Uptime Kuma candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":622,\"title\":\"Uptime Kuma production update, 2026-06-19\"},{\"level\":2,\"line\":644,\"title\":\"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19\"},{\"level\":2,\"line\":663,\"title\":\"Linkding candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":678,\"title\":\"Linkding production update, 2026-06-19\"},{\"level\":2,\"line\":698,\"title\":\"Current Trivy leaderboard after Linkding, 2026-06-19\"},{\"level\":2,\"line\":717,\"title\":\"Batch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":744,\"title\":\"Disk cleanup and Git push recovery, 2026-06-19\"},{\"level\":2,\"line\":758,\"title\":\"Next update candidates from batch scan, 2026-06-19\"},{\"level\":2,\"line\":770,\"title\":\"IT-Tools production update, 2026-06-19\"},{\"level\":2,\"line\":789,\"title\":\"NPMplus production update, 2026-06-19\"},{\"level\":2,\"line\":812,\"title\":\"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19\"},{\"level\":2,\"line\":827,\"title\":\"Paperless stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":852,\"title\":\"Immich app stable pair candidate scan, 2026-06-19\"},{\"level\":2,\"line\":878,\"title\":\"Immich app pair candidate scan result, 2026-06-19\"},{\"level\":2,\"line\":896,\"title\":\"Home Assistant stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":919,\"title\":\"MinIO release candidate scan, 2026-06-19\"},{\"level\":2,\"line\":942,\"title\":\"Mealie stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":965,\"title\":\"Authentik server image candidate scan, 2026-06-19\"},{\"level\":2,\"line\":988,\"title\":\"Karakeep Meilisearch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1011,\"title\":\"Karakeep Chrome candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1034,\"title\":\"Vaultwarden stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1057,\"title\":\"Vaultwarden production update, 2026-06-20\"},{\"level\":2,\"line\":1083,\"title\":\"Current Trivy leaderboard after Vaultwarden, 2026-06-20\"},{\"level\":2,\"line\":1098,\"title\":\"n8n stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1121,\"title\":\"n8n latest tag restore, 2026-06-20\"},{\"level\":2,\"line\":1137,\"title\":\"n8n 2.27.3 smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1163,\"title\":\"n8n production update, 2026-06-20\"},{\"level\":2,\"line\":1193,\"title\":\"Gotify stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1213,\"title\":\"Batch remaining open candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1234,\"title\":\"CrowdSec production update, 2026-06-20\"},{\"level\":2,\"line\":1262,\"title\":\"Final CVE pass summary, 2026-06-20\"},{\"level\":2,\"line\":1286,\"title\":\"n8n encryption key rotation, 2026-06-20\"},{\"level\":2,\"line\":1311,\"title\":\"Audit and backup inventory, 2026-06-20\"},{\"level\":2,\"line\":1326,\"title\":\"Immich Postgres restore smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1342,\"title\":\"Immich Postgres candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1352,\"title\":\"Dockge candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1362,\"title\":\"Paperless candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1372,\"title\":\"Karakeep and Immich Server real-tag scan, 2026-06-20\"},{\"level\":2,\"line\":1382,\"title\":\"Closing high-CVE ledger, 2026-06-20\"},{\"level\":2,\"line\":1392,\"title\":\"Candidate test directories cleanup, 2026-06-20\"},{\"level\":2,\"line\":1402,\"title\":\"Old n8n key backup removal preflight, 2026-06-20\"},{\"level\":2,\"line\":1412,\"title\":\"NetBird peers health hardening, 2026-06-20\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\",\"path_score\":3,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c\",\"total_score\":95},{\"bytes\":16031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"internal service\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"05. Service Catalog\"},{\"level\":2,\"line\":5,\"title\":\"Edge VM\"},{\"level\":2,\"line\":12,\"title\":\"NPMplus\"},{\"level\":2,\"line\":22,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":30,\"title\":\"Gotify\"},{\"level\":2,\"line\":38,\"title\":\"Vaultwarden\"},{\"level\":2,\"line\":49,\"title\":\"Dockge\"},{\"level\":2,\"line\":61,\"title\":\"Homepage\"},{\"level\":2,\"line\":71,\"title\":\"Gitea\"},{\"level\":2,\"line\":84,\"title\":\"Nextcloud AIO\"},{\"level\":2,\"line\":95,\"title\":\"DNS stack\"},{\"level\":2,\"line\":102,\"title\":\"Backup\"},{\"level\":2,\"line\":109,\"title\":\"Edge applications added 2026-06-15/16\"},{\"level\":2,\"line\":132,\"title\":\"Backup health proxy\"},{\"level\":2,\"line\":155,\"title\":\"Edge VM capacity note\"},{\"level\":2,\"line\":366,\"title\":\"Homepage grouped dashboard update, 2026-06-22\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a\",\"total_score\":95},{\"bytes\":106031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":92,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"web ui\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"lxc\",\"qemu\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"локальн\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"99. Current state summary\"},{\"level\":2,\"line\":5,\"title\":\"Git repository\"},{\"level\":2,\"line\":12,\"title\":\"Operating rules\"},{\"level\":2,\"line\":21,\"title\":\"Current verified backup health\"},{\"level\":2,\"line\":32,\"title\":\"Backup scripts and services\"},{\"level\":2,\"line\":41,\"title\":\"Proxmox and network layout\"},{\"level\":2,\"line\":58,\"title\":\"NPMplus state\"},{\"level\":2,\"line\":81,\"title\":\"DNS rewrites\"},{\"level\":2,\"line\":101,\"title\":\"Edge applications\"},{\"level\":2,\"line\":118,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":131,\"title\":\"Cloudflare token rotation\"},{\"level\":2,\"line\":139,\"title\":\"Known working URLs\"},{\"level\":2,\"line\":166,\"title\":\"Pending after this documentation update\"},{\"level\":2,\"line\":181,\"title\":\"Edge application setup checkpoint — 2026-06-16T10:26:57Z\"},{\"level\":2,\"line\":194,\"title\":\"Immich media storage checkpoint — 2026-06-16T11:01:32Z\"},{\"level\":2,\"line\":204,\"title\":\"Immich media backup checkpoint — 2026-06-16T11:24:22Z\"},{\"level\":2,\"line\":219,\"title\":\"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z\"},{\"level\":2,\"line\":231,\"title\":\"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z\"},{\"level\":2,\"line\":245,\"title\":\"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z\"},{\"level\":2,\"line\":257,\"title\":\"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z\"},{\"level\":2,\"line\":266,\"title\":\"Closed validation checkpoint — 2026-06-16T16:51:40Z\"},{\"level\":2,\"line\":278,\"title\":\"Disk Space Health checkpoint — 2026-06-16T17:06:06Z\"},{\"level\":2,\"line\":298,\"title\":\"Memos backup checkpoint — 2026-06-16T17:33:39Z\"},{\"level\":2,\"line\":319,\"title\":\"Paperless backup checkpoint — 2026-06-16T17:50:49Z\"},{\"level\":2,\"line\":350,\"title\":\"Application restore validation checkpoint — 2026-06-16T18:01:17Z\"},{\"level\":2,\"line\":364,\"title\":\"Final full baseline checkpoint — 2026-06-16T18:10:15Z\"},{\"level\":2,\"line\":407,\"title\":\"Daily cluster status report\"},{\"level\":2,\"line\":420,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":447,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":482,\"title\":\"Контейнерная волна обновлений, 2026-06-19\"},{\"level\":2,\"line\":498,\"title\":\"CVE root-cause analysis, 2026-06-19\"},{\"level\":2,\"line\":514,\"title\":\"Browser / Chromium risk analysis, 2026-06-19\"},{\"level\":2,\"line\":527,\"title\":\"Base OS package CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":541,\"title\":\"Go runtime/dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":555,\"title\":\"Node/NPM dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":569,\"title\":\"Dockge / Karakeep candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":583,\"title\":\"Karakeep production update, 2026-06-19\"},{\"level\":2,\"line\":605,\"title\":\"Uptime Kuma candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":622,\"title\":\"Uptime Kuma production update, 2026-06-19\"},{\"level\":2,\"line\":644,\"title\":\"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19\"},{\"level\":2,\"line\":663,\"title\":\"Linkding candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":678,\"title\":\"Linkding production update, 2026-06-19\"},{\"level\":2,\"line\":698,\"title\":\"Current Trivy leaderboard after Linkding, 2026-06-19\"},{\"level\":2,\"line\":717,\"title\":\"Batch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":744,\"title\":\"Disk cleanup and Git push recovery, 2026-06-19\"},{\"level\":2,\"line\":758,\"title\":\"Next update candidates from batch scan, 2026-06-19\"},{\"level\":2,\"line\":770,\"title\":\"IT-Tools production update, 2026-06-19\"},{\"level\":2,\"line\":789,\"title\":\"NPMplus production update, 2026-06-19\"},{\"level\":2,\"line\":812,\"title\":\"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19\"},{\"level\":2,\"line\":827,\"title\":\"Paperless stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":852,\"title\":\"Immich app stable pair candidate scan, 2026-06-19\"},{\"level\":2,\"line\":878,\"title\":\"Immich app pair candidate scan result, 2026-06-19\"},{\"level\":2,\"line\":896,\"title\":\"Home Assistant stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":919,\"title\":\"MinIO release candidate scan, 2026-06-19\"},{\"level\":2,\"line\":942,\"title\":\"Mealie stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":965,\"title\":\"Authentik server image candidate scan, 2026-06-19\"},{\"level\":2,\"line\":988,\"title\":\"Karakeep Meilisearch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1011,\"title\":\"Karakeep Chrome candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1034,\"title\":\"Vaultwarden stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1057,\"title\":\"Vaultwarden production update, 2026-06-20\"},{\"level\":2,\"line\":1083,\"title\":\"Current Trivy leaderboard after Vaultwarden, 2026-06-20\"},{\"level\":2,\"line\":1098,\"title\":\"n8n stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1121,\"title\":\"n8n latest tag restore, 2026-06-20\"},{\"level\":2,\"line\":1137,\"title\":\"n8n 2.27.3 smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1163,\"title\":\"n8n production update, 2026-06-20\"},{\"level\":2,\"line\":1193,\"title\":\"Gotify stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1213,\"title\":\"Batch remaining open candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1234,\"title\":\"CrowdSec production update, 2026-06-20\"},{\"level\":2,\"line\":1262,\"title\":\"Final CVE pass summary, 2026-06-20\"},{\"level\":2,\"line\":1286,\"title\":\"n8n encryption key rotation, 2026-06-20\"},{\"level\":2,\"line\":1311,\"title\":\"Audit and backup inventory, 2026-06-20\"},{\"level\":2,\"line\":1326,\"title\":\"Immich Postgres restore smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1342,\"title\":\"Immich Postgres candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1352,\"title\":\"Dockge candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1362,\"title\":\"Paperless candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1372,\"title\":\"Karakeep and Immich Server real-tag scan, 2026-06-20\"},{\"level\":2,\"line\":1382,\"title\":\"Closing high-CVE ledger, 2026-06-20\"},{\"level\":2,\"line\":1392,\"title\":\"Candidate test directories cleanup, 2026-06-20\"},{\"level\":2,\"line\":1402,\"title\":\"Old n8n key backup removal preflight, 2026-06-20\"},{\"level\":2,\"line\":1412,\"title\":\"NetBird peers health hardening, 2026-06-20\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\",\"path_score\":3,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c\",\"total_score\":95},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":38408,\"commit\":\"60f53ea6fe6724196802a46de3de19c7889a51cc\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\",\"quorum\",\"corosync\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"network\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary\"],\"sensitive_findings\":[],\"sha256\":\"07c9854ab0232d1f2766cdab114d0d398a4dcc1a5b41ea7fde77646e5f42804e\",\"total_score\":86},{\"bytes\":61327,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Services bootstrap snapshot — 2026-06-17\"},{\"level\":2,\"line\":3,\"title\":\"Scope\"},{\"level\":2,\"line\":9,\"title\":\"Edge VM\"},{\"level\":2,\"line\":19,\"title\":\"NetBird VPS\"},{\"level\":2,\"line\":34,\"title\":\"NetBird backup status\"},{\"level\":3,\"line\":37,\"title\":\"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb<BOUNDED_PROJECTION>\"},{\"level\":2,\"line\":40,\"title\":\"NetBird backup timers\"},{\"level\":2,\"line\":46,\"title\":\"Important follow-ups\"},{\"level\":2,\"line\":54,\"title\":\"NetBird Uptime Kuma monitors\"},{\"level\":2,\"line\":64,\"title\":\"NetBird homelab peers\"},{\"level\":3,\"line\":69,\"title\":\"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0              UNKNOWN        100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 <BOUNDED_PROJECTION>\"},{\"level\":2,\"line\":72,\"title\":\"NetBird peers health monitor\"},{\"level\":2,\"line\":88,\"title\":\"File Browser credential remediation\"},{\"level\":2,\"line\":98,\"title\":\"Proxmox private SSL via NetBird FQDN\"},{\"level\":2,\"line\":116,\"title\":\"File Browser backup, offhost sync, and restore validation\"},{\"level\":2,\"line\":150,\"title\":\"App stacks batch backup chain\"},{\"level\":2,\"line\":194,\"title\":\"Final backup and health baseline\"},{\"level\":2,\"line\":202,\"title\":\"Private NPMplus hosts via NetBird\"},{\"level\":2,\"line\":231,\"title\":\"Homepage VPN Authentik forward-auth\"},{\"level\":2,\"line\":244,\"title\":\"Homepage Authentik forward-auth rollback\"},{\"level\":2,\"line\":257,\"title\":\"Private VPN hosts safe baseline after Authentik rollback\"},{\"level\":2,\"line\":271,\"title\":\"Private VPN Hosts Kuma monitor\"},{\"level\":2,\"line\":289,\"title\":\"Private VPN Hosts health timer\"},{\"level\":2,\"line\":304,\"title\":\"Private VPN Hosts timer auto-cycle verified\"},{\"level\":2,\"line\":314,\"title\":\"Final ops snapshot — private VPN hosts\"},{\"level\":2,\"line\":326,\"title\":\"NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":348,\"title\":\"Corrected NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":367,\"title\":\"NPMplus + Kuma backup chain Kuma monitors\"},{\"level\":2,\"line\":382,\"title\":\"NPMplus + Kuma config backup timer\"},{\"level\":2,\"line\":398,\"title\":\"Authentik backup chain\"},{\"level\":2,\"line\":408,\"title\":\"Authentik backup chain Kuma monitors\"},{\"level\":2,\"line\":417,\"title\":\"Authentik backup timer\"},{\"level\":2,\"line\":431,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":441,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":445,\"title\":\"Gitea backup chain Kuma monitors\"},{\"level\":2,\"line\":454,\"title\":\"Gitea backup timer\"},{\"level\":2,\"line\":465,\"title\":\"Vaultwarden backup chain\"},{\"level\":2,\"line\":475,\"title\":\"Vaultwarden backup chain Kuma monitors\"},{\"level\":2,\"line\":484,\"title\":\"Vaultwarden backup timer\"},{\"level\":2,\"line\":495,\"title\":\"Edge VM manual vzdump backup\"},{\"level\":2,\"line\":502,\"title\":\"Edge VM vzdump offhost copy\"},{\"level\":2,\"line\":508,\"title\":\"Edge VM vzdump restore verification\"},{\"level\":2,\"line\":515,\"title\":\"Edge VM vzdump Kuma monitors\"},{\"level\":2,\"line\":528,\"title\":\"Edge VM vzdump weekly timer\"},{\"level\":2,\"line\":543,\"title\":\"Immich media backup existing automation inventory\"},{\"level\":2,\"line\":553,\"title\":\"Immich media restore verification\"},{\"level\":2,\"line\":560,\"title\":\"Immich media restore Kuma monitor\"},{\"level\":2,\"line\":570,\"title\":\"Immich media restore Kuma monitor correction\"},{\"level\":2,\"line\":577,\"title\":\"P0 backup baseline closure\"},{\"level\":2,\"line\":589,\"title\":\"P1 Mail.ru Cloud offsite inventory\"},{\"level\":2,\"line\":651,\"title\":\"P1 Mail.ru Cloud rclone config drift resolved\"},{\"level\":2,\"line\":667,\"title\":\"P1 Mail.ru Cloud canary\"},{\"level\":2,\"line\":675,\"title\":\"P1 Mail.ru Cloud production payload inventory\"},{\"level\":2,\"line\":710,\"title\":\"P1 Mail.ru Cloud critical baseline upload\"},{\"level\":2,\"line\":720,\"title\":\"P1 Mail.ru Cloud Kuma monitors\"},{\"level\":2,\"line\":732,\"title\":\"P1 Mail.ru Cloud edge-vm chunked large upload\"},{\"level\":2,\"line\":742,\"title\":\"P1 Mail.ru Cloud Edge VM Kuma monitor\"},{\"level\":2,\"line\":753,\"title\":\"P1 Mail.ru Cloud offsite seed closure\"},{\"level\":2,\"line\":776,\"title\":\"P1 Mail.ru Cloud critical upload automation\"},{\"level\":2,\"line\":791,\"title\":\"P1 Mail.ru Cloud edge-vm upload automation\"},{\"level\":2,\"line\":807,\"title\":\"P1 Mail.ru Cloud automation and retention closure\"},{\"level\":2,\"line\":829,\"title\":\"P1 Mail.ru Cloud restore drill automation\"},{\"level\":2,\"line\":843,\"title\":\"P2 Disaster Recovery runbook\"},{\"level\":2,\"line\":853,\"title\":\"P2 Critical bundle bootstrap drill\"},{\"level\":2,\"line\":870,\"title\":\"P2 Disaster Recovery bootstrap closure\"},{\"level\":2,\"line\":892,\"title\":\"Vaultwarden isolated restore drill — 2026-06-18\"},{\"level\":2,\"line\":929,\"title\":\"Daily cluster status report — 2026-06-18\"},{\"level\":2,\"line\":985,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":1012,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":1047,\"title\":\"Trivy scan mode after 2026-06-19 update wave\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"sensitive-assignment\"],\"sha256\":\"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6\",\"total_score\":86},{\"bytes\":89904,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 alert routing preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab\",\"total_score\":86},{\"bytes\":61327,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Services bootstrap snapshot — 2026-06-17\"},{\"level\":2,\"line\":3,\"title\":\"Scope\"},{\"level\":2,\"line\":9,\"title\":\"Edge VM\"},{\"level\":2,\"line\":19,\"title\":\"NetBird VPS\"},{\"level\":2,\"line\":34,\"title\":\"NetBird backup status\"},{\"level\":3,\"line\":37,\"title\":\"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb<BOUNDED_PROJECTION>\"},{\"level\":2,\"line\":40,\"title\":\"NetBird backup timers\"},{\"level\":2,\"line\":46,\"title\":\"Important follow-ups\"},{\"level\":2,\"line\":54,\"title\":\"NetBird Uptime Kuma monitors\"},{\"level\":2,\"line\":64,\"title\":\"NetBird homelab peers\"},{\"level\":3,\"line\":69,\"title\":\"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0              UNKNOWN        100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 <BOUNDED_PROJECTION>\"},{\"level\":2,\"line\":72,\"title\":\"NetBird peers health monitor\"},{\"level\":2,\"line\":88,\"title\":\"File Browser credential remediation\"},{\"level\":2,\"line\":98,\"title\":\"Proxmox private SSL via NetBird FQDN\"},{\"level\":2,\"line\":116,\"title\":\"File Browser backup, offhost sync, and restore validation\"},{\"level\":2,\"line\":150,\"title\":\"App stacks batch backup chain\"},{\"level\":2,\"line\":194,\"title\":\"Final backup and health baseline\"},{\"level\":2,\"line\":202,\"title\":\"Private NPMplus hosts via NetBird\"},{\"level\":2,\"line\":231,\"title\":\"Homepage VPN Authentik forward-auth\"},{\"level\":2,\"line\":244,\"title\":\"Homepage Authentik forward-auth rollback\"},{\"level\":2,\"line\":257,\"title\":\"Private VPN hosts safe baseline after Authentik rollback\"},{\"level\":2,\"line\":271,\"title\":\"Private VPN Hosts Kuma monitor\"},{\"level\":2,\"line\":289,\"title\":\"Private VPN Hosts health timer\"},{\"level\":2,\"line\":304,\"title\":\"Private VPN Hosts timer auto-cycle verified\"},{\"level\":2,\"line\":314,\"title\":\"Final ops snapshot — private VPN hosts\"},{\"level\":2,\"line\":326,\"title\":\"NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":348,\"title\":\"Corrected NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":367,\"title\":\"NPMplus + Kuma backup chain Kuma monitors\"},{\"level\":2,\"line\":382,\"title\":\"NPMplus + Kuma config backup timer\"},{\"level\":2,\"line\":398,\"title\":\"Authentik backup chain\"},{\"level\":2,\"line\":408,\"title\":\"Authentik backup chain Kuma monitors\"},{\"level\":2,\"line\":417,\"title\":\"Authentik backup timer\"},{\"level\":2,\"line\":431,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":441,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":445,\"title\":\"Gitea backup chain Kuma monitors\"},{\"level\":2,\"line\":454,\"title\":\"Gitea backup timer\"},{\"level\":2,\"line\":465,\"title\":\"Vaultwarden backup chain\"},{\"level\":2,\"line\":475,\"title\":\"Vaultwarden backup chain Kuma monitors\"},{\"level\":2,\"line\":484,\"title\":\"Vaultwarden backup timer\"},{\"level\":2,\"line\":495,\"title\":\"Edge VM manual vzdump backup\"},{\"level\":2,\"line\":502,\"title\":\"Edge VM vzdump offhost copy\"},{\"level\":2,\"line\":508,\"title\":\"Edge VM vzdump restore verification\"},{\"level\":2,\"line\":515,\"title\":\"Edge VM vzdump Kuma monitors\"},{\"level\":2,\"line\":528,\"title\":\"Edge VM vzdump weekly timer\"},{\"level\":2,\"line\":543,\"title\":\"Immich media backup existing automation inventory\"},{\"level\":2,\"line\":553,\"title\":\"Immich media restore verification\"},{\"level\":2,\"line\":560,\"title\":\"Immich media restore Kuma monitor\"},{\"level\":2,\"line\":570,\"title\":\"Immich media restore Kuma monitor correction\"},{\"level\":2,\"line\":577,\"title\":\"P0 backup baseline closure\"},{\"level\":2,\"line\":589,\"title\":\"P1 Mail.ru Cloud offsite inventory\"},{\"level\":2,\"line\":651,\"title\":\"P1 Mail.ru Cloud rclone config drift resolved\"},{\"level\":2,\"line\":667,\"title\":\"P1 Mail.ru Cloud canary\"},{\"level\":2,\"line\":675,\"title\":\"P1 Mail.ru Cloud production payload inventory\"},{\"level\":2,\"line\":710,\"title\":\"P1 Mail.ru Cloud critical baseline upload\"},{\"level\":2,\"line\":720,\"title\":\"P1 Mail.ru Cloud Kuma monitors\"},{\"level\":2,\"line\":732,\"title\":\"P1 Mail.ru Cloud edge-vm chunked large upload\"},{\"level\":2,\"line\":742,\"title\":\"P1 Mail.ru Cloud Edge VM Kuma monitor\"},{\"level\":2,\"line\":753,\"title\":\"P1 Mail.ru Cloud offsite seed closure\"},{\"level\":2,\"line\":776,\"title\":\"P1 Mail.ru Cloud critical upload automation\"},{\"level\":2,\"line\":791,\"title\":\"P1 Mail.ru Cloud edge-vm upload automation\"},{\"level\":2,\"line\":807,\"title\":\"P1 Mail.ru Cloud automation and retention closure\"},{\"level\":2,\"line\":829,\"title\":\"P1 Mail.ru Cloud restore drill automation\"},{\"level\":2,\"line\":843,\"title\":\"P2 Disaster Recovery runbook\"},{\"level\":2,\"line\":853,\"title\":\"P2 Critical bundle bootstrap drill\"},{\"level\":2,\"line\":870,\"title\":\"P2 Disaster Recovery bootstrap closure\"},{\"level\":2,\"line\":892,\"title\":\"Vaultwarden isolated restore drill — 2026-06-18\"},{\"level\":2,\"line\":929,\"title\":\"Daily cluster status report — 2026-06-18\"},{\"level\":2,\"line\":985,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":1012,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":1047,\"title\":\"Trivy scan mode after 2026-06-19 update wave\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"sensitive-assignment\"],\"sha256\":\"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6\",\"total_score\":86},{\"bytes\":89904,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 alert routing preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab\",\"total_score\":86},{\"bytes\":89904,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 alert routing preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab\",\"total_score\":86},{\"bytes\":8415,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":74,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"prometheus\"],\"network_and_dns\":[\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-05 CrowdSec LAPI monitoring coverage inventory\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Coverage summary\"},{\"level\":2,\"line\":31,\"title\":\"Runtime monitoring containers\"},{\"level\":2,\"line\":41,\"title\":\"Repo evidence sample\"},{\"level\":2,\"line\":69,\"title\":\"Kuma match sample\"},{\"level\":2,\"line\":76,\"title\":\"Prometheus related files\"},{\"level\":2,\"line\":80,\"title\":\"Edge health-file sample\"},{\"level\":2,\"line\":107,\"title\":\"pve01 health-file sample\"},{\"level\":2,\"line\":113,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25\",\"total_score\":83},{\"bytes\":4739,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"repair\",\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"NPMplus route-change safety runbook\"},{\"level\":2,\"line\":3,\"title\":\"Purpose\"},{\"level\":2,\"line\":9,\"title\":\"Scope\"},{\"level\":2,\"line\":23,\"title\":\"Forbidden actions unless explicitly approved\"},{\"level\":2,\"line\":36,\"title\":\"Required read-only preflight\"},{\"level\":2,\"line\":57,\"title\":\"Generated config discovery\"},{\"level\":2,\"line\":65,\"title\":\"Target and protocol decision tree\"},{\"level\":2,\"line\":74,\"title\":\"Required patch sequence\"},{\"level\":2,\"line\":93,\"title\":\"Rollback requirements\"},{\"level\":2,\"line\":99,\"title\":\"Redirect-loop checks\"},{\"level\":2,\"line\":111,\"title\":\"Adjacent component awareness\"},{\"level\":2,\"line\":125,\"title\":\"Adjacent smoke checks\"},{\"level\":2,\"line\":135,\"title\":\"Terminal command requirements\"},{\"level\":2,\"line\":148,\"title\":\"Closeout requirements\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"364e3146093a497342a308b35afcd38821564da0f72cfa3bc1b24e4b3b0d81a1\",\"total_score\":83},{\"bytes\":8415,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":74,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"prometheus\"],\"network_and_dns\":[\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-05 CrowdSec LAPI monitoring coverage inventory\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Coverage summary\"},{\"level\":2,\"line\":31,\"title\":\"Runtime monitoring containers\"},{\"level\":2,\"line\":41,\"title\":\"Repo evidence sample\"},{\"level\":2,\"line\":69,\"title\":\"Kuma match sample\"},{\"level\":2,\"line\":76,\"title\":\"Prometheus related files\"},{\"level\":2,\"line\":80,\"title\":\"Edge health-file sample\"},{\"level\":2,\"line\":107,\"title\":\"pve01 health-file sample\"},{\"level\":2,\"line\":113,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25\",\"total_score\":83},{\"bytes\":4739,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"repair\",\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"NPMplus route-change safety runbook\"},{\"level\":2,\"line\":3,\"title\":\"Purpose\"},{\"level\":2,\"line\":9,\"title\":\"Scope\"},{\"level\":2,\"line\":23,\"title\":\"Forbidden actions unless explicitly approved\"},{\"level\":2,\"line\":36,\"title\":\"Required read-only preflight\"},{\"level\":2,\"line\":57,\"title\":\"Generated config discovery\"},{\"level\":2,\"line\":65,\"title\":\"Target and protocol decision tree\"},{\"level\":2,\"line\":74,\"title\":\"Required patch sequence\"},{\"level\":2,\"line\":93,\"title\":\"Rollback requirements\"},{\"level\":2,\"line\":99,\"title\":\"Redirect-loop checks\"},{\"level\":2,\"line\":111,\"title\":\"Adjacent component awareness\"},{\"level\":2,\"line\":125,\"title\":\"Adjacent smoke checks\"},{\"level\":2,\"line\":135,\"title\":\"Terminal command requirements\"},{\"level\":2,\"line\":148,\"title\":\"Closeout requirements\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"364e3146093a497342a308b35afcd38821564da0f72cfa3bc1b24e4b3b0d81a1\",\"total_score\":83},{\"bytes\":8415,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":74,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"prometheus\"],\"network_and_dns\":[\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-05 CrowdSec LAPI monitoring coverage inventory\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Coverage summary\"},{\"level\":2,\"line\":31,\"title\":\"Runtime monitoring containers\"},{\"level\":2,\"line\":41,\"title\":\"Repo evidence sample\"},{\"level\":2,\"line\":69,\"title\":\"Kuma match sample\"},{\"level\":2,\"line\":76,\"title\":\"Prometheus related files\"},{\"level\":2,\"line\":80,\"title\":\"Edge health-file sample\"},{\"level\":2,\"line\":107,\"title\":\"pve01 health-file sample\"},{\"level\":2,\"line\":113,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"88eb831aadf3efe74186e4d21c29e2f7b2acdd4413ec5fa2cbc0d0365e968a25\",\"total_score\":83},{\"bytes\":2463,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2 Ideal Cluster program init\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Starting counters\"},{\"level\":2,\"line\":15,\"title\":\"Baseline\"},{\"level\":2,\"line\":21,\"title\":\"Safety model\"},{\"level\":2,\"line\":30,\"title\":\"Workstreams\"},{\"level\":3,\"line\":32,\"title\":\"P2-A DR and restore maturity\"},{\"level\":3,\"line\":40,\"title\":\"P2-B Network and ingress source of truth\"},{\"level\":3,\"line\":47,\"title\":\"P2-C Access control and service policy\"},{\"level\":3,\"line\":54,\"title\":\"P2-D Observability closure\"},{\"level\":3,\"line\":62,\"title\":\"P2-E Backup coverage for services\"},{\"level\":3,\"line\":70,\"title\":\"P2-F Security hardening\"},{\"level\":3,\"line\":78,\"title\":\"P2-G NetBox and documentation source of truth\"},{\"level\":2,\"line\":86,\"title\":\"First selected task\"},{\"level\":2,\"line\":90,\"title\":\"Safety boundary\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1\",\"total_score\":81},{\"bytes\":2463,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2 Ideal Cluster program init\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Starting counters\"},{\"level\":2,\"line\":15,\"title\":\"Baseline\"},{\"level\":2,\"line\":21,\"title\":\"Safety model\"},{\"level\":2,\"line\":30,\"title\":\"Workstreams\"},{\"level\":3,\"line\":32,\"title\":\"P2-A DR and restore maturity\"},{\"level\":3,\"line\":40,\"title\":\"P2-B Network and ingress source of truth\"},{\"level\":3,\"line\":47,\"title\":\"P2-C Access control and service policy\"},{\"level\":3,\"line\":54,\"title\":\"P2-D Observability closure\"},{\"level\":3,\"line\":62,\"title\":\"P2-E Backup coverage for services\"},{\"level\":3,\"line\":70,\"title\":\"P2-F Security hardening\"},{\"level\":3,\"line\":78,\"title\":\"P2-G NetBox and documentation source of truth\"},{\"level\":2,\"line\":86,\"title\":\"First selected task\"},{\"level\":2,\"line\":90,\"title\":\"Safety boundary\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1\",\"total_score\":81},{\"bytes\":2463,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":72,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2 Ideal Cluster program init\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Starting counters\"},{\"level\":2,\"line\":15,\"title\":\"Baseline\"},{\"level\":2,\"line\":21,\"title\":\"Safety model\"},{\"level\":2,\"line\":30,\"title\":\"Workstreams\"},{\"level\":3,\"line\":32,\"title\":\"P2-A DR and restore maturity\"},{\"level\":3,\"line\":40,\"title\":\"P2-B Network and ingress source of truth\"},{\"level\":3,\"line\":47,\"title\":\"P2-C Access control and service policy\"},{\"level\":3,\"line\":54,\"title\":\"P2-D Observability closure\"},{\"level\":3,\"line\":62,\"title\":\"P2-E Backup coverage for services\"},{\"level\":3,\"line\":70,\"title\":\"P2-F Security hardening\"},{\"level\":3,\"line\":78,\"title\":\"P2-G NetBox and documentation source of truth\"},{\"level\":2,\"line\":86,\"title\":\"First selected task\"},{\"level\":2,\"line\":90,\"title\":\"Safety boundary\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"17c116947cbf1f3c814cba5e0baf4fb749e04cf5d4d19a5bcc89280599e20ce1\",\"total_score\":81},{\"bytes\":504281,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"internet\",\"nginx\"],\"guests_and_workloads\":[\"container\",\"lxc\",\"workload\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\",\"ошиб\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"MkDocs refresh discovery\"},{\"level\":2,\"line\":7,\"title\":\"Raw output\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"sensitive-assignment\"],\"sha256\":\"1ac8fe15ebd06db8ef3a9c6127fe5efe7ecbb76d395abbe551c249b249492d21\",\"total_score\":80},{\"bytes\":3398,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"dns\",\"domain\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"00. Restore from zero for beginners\"},{\"level\":2,\"line\":7,\"title\":\"0. What must be available before restore\"},{\"level\":2,\"line\":17,\"title\":\"1. Restore physical and network layer\"},{\"level\":2,\"line\":25,\"title\":\"2. Restore Proxmox nodes\"},{\"level\":2,\"line\":35,\"title\":\"3. Restore DNS first\"},{\"level\":2,\"line\":48,\"title\":\"4. Restore edge-vm\"},{\"level\":2,\"line\":66,\"title\":\"5. Restore Nextcloud VM\"},{\"level\":2,\"line\":78,\"title\":\"6. Validate router NAT\"},{\"level\":2,\"line\":88,\"title\":\"7. Validate main URLs\"},{\"level\":2,\"line\":100,\"title\":\"8. Validate backup health\"},{\"level\":2,\"line\":110,\"title\":\"9. Validate monitoring\"},{\"level\":2,\"line\":125,\"title\":\"10. After restore\"},{\"level\":2,\"line\":134,\"title\":\"11. Known mistakes to avoid\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"5e430e17e36b23faa90caa38b019485cf09640c94011828e18841b0e361e4470\",\"total_score\":78},{\"bytes\":3785,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"internal service\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"01. Add new service runbook\"},{\"level\":2,\"line\":5,\"title\":\"Rule zero\"},{\"level\":2,\"line\":9,\"title\":\"1. Precheck\"},{\"level\":2,\"line\":22,\"title\":\"2. DNS\"},{\"level\":2,\"line\":32,\"title\":\"3. Install container\"},{\"level\":2,\"line\":46,\"title\":\"4. Local validation\"},{\"level\":2,\"line\":56,\"title\":\"5. NPMplus\"},{\"level\":2,\"line\":68,\"title\":\"6. Certificate\"},{\"level\":2,\"line\":88,\"title\":\"7. Monitoring\"},{\"level\":2,\"line\":103,\"title\":\"8. Homepage\"},{\"level\":2,\"line\":109,\"title\":\"9. Service note\"},{\"level\":2,\"line\":127,\"title\":\"10. Backup\"},{\"level\":2,\"line\":135,\"title\":\"11. Baseline\"},{\"level\":2,\"line\":141,\"title\":\"12. MASTER_STATUS\"},{\"level\":2,\"line\":147,\"title\":\"13. Git documentation\"},{\"level\":2,\"line\":155,\"title\":\"Known mistakes to avoid\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c8634bd21ce16651970e1a6bdfba6fba9fd84fac030cd53a41798dc92b3ca81c\",\"total_score\":77},{\"bytes\":15818,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28\",\"total_score\":76},{\"bytes\":31410,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"journal\",\"metric\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\",\"volume\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"path_score\":12,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da\",\"total_score\":76},{\"bytes\":15818,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28\",\"total_score\":76},{\"bytes\":31410,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"journal\",\"metric\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\",\"volume\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"path_score\":12,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da\",\"total_score\":76},{\"bytes\":15818,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"85edb7ef527d25b5f970fe125a7759580ea96e64e847b432a2bfa9875d4c4a28\",\"total_score\":76},{\"bytes\":31410,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"journal\",\"metric\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\",\"volume\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"path_score\":12,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"66f3f3bfe1d2b8179b14b81b5a5d3541b48a5c7c80d51b96438d5a81413215da\",\"total_score\":76},{\"bytes\":4960,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-12 final ideal cluster closeout\"},{\"level\":2,\"line\":7,\"title\":\"Plain explanation\"},{\"level\":2,\"line\":17,\"title\":\"Final state\"},{\"level\":2,\"line\":32,\"title\":\"P3 task summary\"},{\"level\":2,\"line\":48,\"title\":\"Residual gaps to true 100\"},{\"level\":2,\"line\":60,\"title\":\"Checks\"},{\"level\":2,\"line\":73,\"title\":\"Next task\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b\",\"total_score\":75},{\"bytes\":4960,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-12 final ideal cluster closeout\"},{\"level\":2,\"line\":7,\"title\":\"Plain explanation\"},{\"level\":2,\"line\":17,\"title\":\"Final state\"},{\"level\":2,\"line\":32,\"title\":\"P3 task summary\"},{\"level\":2,\"line\":48,\"title\":\"Residual gaps to true 100\"},{\"level\":2,\"line\":60,\"title\":\"Checks\"},{\"level\":2,\"line\":73,\"title\":\"Next task\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b\",\"total_score\":75},{\"bytes\":4960,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-12 final ideal cluster closeout\"},{\"level\":2,\"line\":7,\"title\":\"Plain explanation\"},{\"level\":2,\"line\":17,\"title\":\"Final state\"},{\"level\":2,\"line\":32,\"title\":\"P3 task summary\"},{\"level\":2,\"line\":48,\"title\":\"Residual gaps to true 100\"},{\"level\":2,\"line\":60,\"title\":\"Checks\"},{\"level\":2,\"line\":73,\"title\":\"Next task\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-12-final-ideal-cluster-closeout-20260626T044127Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c7fd4fe4d2bcc3deec184c9571d6b60ebf5fefd9ae098d58030498fe8ae5576b\",\"total_score\":75},{\"bytes\":1585,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"error_learning\":[\"incident\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"grafana\"],\"storage\":[\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab recovery runbooks\"},{\"level\":2,\"line\":5,\"title\":\"Global first command\"},{\"level\":2,\"line\":12,\"title\":\"Runbooks\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/04_homelab-desired-state/runbooks/INDEX.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"fbaa19446121d3bdb225c82e33e274a91bc414e3786e2f0df49145db1f95f851\",\"total_score\":75},{\"bytes\":56894,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":18,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92\",\"total_score\":74},{\"bytes\":20108,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-09 health surface WARN/OTHER status register\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":13,\"title\":\"Counters\"},{\"level\":2,\"line\":22,\"title\":\"Summary\"},{\"level\":2,\"line\":31,\"title\":\"Proposed class counts\"},{\"level\":2,\"line\":39,\"title\":\"Service hint counts\"},{\"level\":2,\"line\":47,\"title\":\"Register rows\"},{\"level\":2,\"line\":136,\"title\":\"Category meanings\"},{\"level\":2,\"line\":146,\"title\":\"Rules\"},{\"level\":2,\"line\":154,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":158,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2\",\"total_score\":74},{\"bytes\":56894,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":18,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92\",\"total_score\":74},{\"bytes\":20108,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-09 health surface WARN/OTHER status register\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":13,\"title\":\"Counters\"},{\"level\":2,\"line\":22,\"title\":\"Summary\"},{\"level\":2,\"line\":31,\"title\":\"Proposed class counts\"},{\"level\":2,\"line\":39,\"title\":\"Service hint counts\"},{\"level\":2,\"line\":47,\"title\":\"Register rows\"},{\"level\":2,\"line\":136,\"title\":\"Category meanings\"},{\"level\":2,\"line\":146,\"title\":\"Rules\"},{\"level\":2,\"line\":154,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":158,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2\",\"total_score\":74},{\"bytes\":56894,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":18,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"cf02c253fc825949b1569bd1e9ecf460ccd7ef3ef2a967838c1c6dd2c707ed92\",\"total_score\":74},{\"bytes\":20108,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":68,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-09 health surface WARN/OTHER status register\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":13,\"title\":\"Counters\"},{\"level\":2,\"line\":22,\"title\":\"Summary\"},{\"level\":2,\"line\":31,\"title\":\"Proposed class counts\"},{\"level\":2,\"line\":39,\"title\":\"Service hint counts\"},{\"level\":2,\"line\":47,\"title\":\"Register rows\"},{\"level\":2,\"line\":136,\"title\":\"Category meanings\"},{\"level\":2,\"line\":146,\"title\":\"Rules\"},{\"level\":2,\"line\":154,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":158,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-09-health-surface-warn-other-status-register-20260625T233553Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3faf5640d57909e355f3e0b119802278895195329eddac6cc7c24823e87c6cf2\",\"total_score\":74},{\"bytes\":171784,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f\",\"total_score\":73},{\"bytes\":1555,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":62,\"coverage\":{\"access_and_admin\":[\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"monitoring_and_logs\":[\"prometheus\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Proxmox exporter runbook\"},{\"level\":2,\"line\":3,\"title\":\"Location\"},{\"level\":2,\"line\":11,\"title\":\"Secret handling\"},{\"level\":2,\"line\":19,\"title\":\"Exporter health\"},{\"level\":2,\"line\":31,\"title\":\"Prometheus checks\"},{\"level\":2,\"line\":50,\"title\":\"PVE permissions\"},{\"level\":2,\"line\":57,\"title\":\"Rollback\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/proxmox-exporter.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"ebcd3f4d48f72038a99d5d8f795c224942723be4ab4db46803664895ff975bad\",\"total_score\":73},{\"bytes\":171784,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f\",\"total_score\":73},{\"bytes\":171784,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":16,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-inventory-20260625T231646Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"862adaea3888fa3b28959a5747606a14056dfef874f5e9934c7749da3067019f\",\"total_score\":73},{\"bytes\":84145,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"guests_and_workloads\":[\"container\",\"qemu\",\"workload\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"tls\"],\"storage\":[\"lvm\",\"thin\",\"disk\",\"volume\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 edge cleanup preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-edge-cleanup-preflight-20260624T192250Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620\",\"total_score\":72},{\"bytes\":19149,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"url\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"corosync\"],\"monitoring_and_logs\":[\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"dns\"],\"storage\":[\"storage\",\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1 AdGuardHome sync image policy preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4\",\"total_score\":72},{\"bytes\":2268,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":58,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\",\"nginx\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-23 Next safe backlog after NPMplus runbook close\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Next task\"},{\"level\":2,\"line\":13,\"title\":\"Reason\"},{\"level\":2,\"line\":19,\"title\":\"Input facts\"},{\"level\":2,\"line\":29,\"title\":\"P1-24 expected output\"},{\"level\":2,\"line\":41,\"title\":\"P1-24 safety boundary\"},{\"level\":2,\"line\":58,\"title\":\"Required carry-forward guardrails\"},{\"level\":2,\"line\":75,\"title\":\"Command protocol\"},{\"level\":2,\"line\":82,\"title\":\"DOCX policy\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf\",\"total_score\":72},{\"bytes\":84145,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"guests_and_workloads\":[\"container\",\"qemu\",\"workload\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"tls\"],\"storage\":[\"lvm\",\"thin\",\"disk\",\"volume\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 edge cleanup preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-edge-cleanup-preflight-20260624T192250Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620\",\"total_score\":72},{\"bytes\":19149,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"url\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"corosync\"],\"monitoring_and_logs\":[\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"dns\"],\"storage\":[\"storage\",\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1 AdGuardHome sync image policy preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4\",\"total_score\":72},{\"bytes\":2268,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":58,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\",\"nginx\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-23 Next safe backlog after NPMplus runbook close\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Next task\"},{\"level\":2,\"line\":13,\"title\":\"Reason\"},{\"level\":2,\"line\":19,\"title\":\"Input facts\"},{\"level\":2,\"line\":29,\"title\":\"P1-24 expected output\"},{\"level\":2,\"line\":41,\"title\":\"P1-24 safety boundary\"},{\"level\":2,\"line\":58,\"title\":\"Required carry-forward guardrails\"},{\"level\":2,\"line\":75,\"title\":\"Command protocol\"},{\"level\":2,\"line\":82,\"title\":\"DOCX policy\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf\",\"total_score\":72},{\"bytes\":84145,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"guests_and_workloads\":[\"container\",\"qemu\",\"workload\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"tls\"],\"storage\":[\"lvm\",\"thin\",\"disk\",\"volume\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 edge cleanup preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-edge-cleanup-preflight-20260624T192250Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"ccd8c5c618bca9911b31a04ac792d74dcff67497188c6aa4bd423a85bbdcb620\",\"total_score\":72},{\"bytes\":19149,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":66,\"coverage\":{\"access_and_admin\":[\"url\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"corosync\"],\"monitoring_and_logs\":[\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"dns\"],\"storage\":[\"storage\",\"thin\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1 AdGuardHome sync image policy preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-adguardhome-sync-image-policy-preflight-20260624T211517Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1313ddcfa39f3d11366510c7973b9c6c32f6aff8c5bd495f5fa5903f2a46fcb4\",\"total_score\":72},{\"bytes\":2268,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":58,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"recovery\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\",\"nginx\"],\"monitoring_and_logs\":[\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-23 Next safe backlog after NPMplus runbook close\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":9,\"title\":\"Next task\"},{\"level\":2,\"line\":13,\"title\":\"Reason\"},{\"level\":2,\"line\":19,\"title\":\"Input facts\"},{\"level\":2,\"line\":29,\"title\":\"P1-24 expected output\"},{\"level\":2,\"line\":41,\"title\":\"P1-24 safety boundary\"},{\"level\":2,\"line\":58,\"title\":\"Required carry-forward guardrails\"},{\"level\":2,\"line\":75,\"title\":\"Command protocol\"},{\"level\":2,\"line\":82,\"title\":\"DOCX policy\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-backlog-after-npmplus-runbook-close-20260625T213614Z.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"6ac8eba3d11d99d30f2a0e07d96b578b8ab7b2df79fbc38b7df39bde0ac130bf\",\"total_score\":72},{\"bytes\":43565,\"commit\":\"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17\",\"content_score\":62,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\"],\"change_safety\":[\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\"],\"storage\":[\"thin\"]},\"headings\":[],\"json_top_level_size\":5,\"json_top_level_type\":\"dict\",\"path\":\"inventory/services.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0017-inventory-foundation\"],\"sensitive_findings\":[],\"sha256\":\"189ab606f9de7b379b03510aef024def88ab91a1e2782d0c7d74fe93fa61509b\",\"total_score\":71},{\"bytes\":2281,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"access_and_admin\":[\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"monitoring_and_logs\":[\"metric\",\"prometheus\"],\"storage\":[\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"smartmontools + node_exporter textfile runbook\"},{\"level\":2,\"line\":3,\"title\":\"Scope\"},{\"level\":2,\"line\":18,\"title\":\"Local checks on a PVE node\"},{\"level\":2,\"line\":40,\"title\":\"Prometheus checks from edge-vm\"},{\"level\":2,\"line\":54,\"title\":\"Expected metrics\"},{\"level\":2,\"line\":63,\"title\":\"Rollback\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/smartmontools-node-exporter.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"8bbdc976a24aadb0943ef386486d11f58f4e8b16b6589f519d2b5d99b2bdcaca\",\"total_score\":71},{\"bytes\":32948,\"commit\":\"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"cluster\",\"node\",\"quorum\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0017-inventory-foundation\"],\"sensitive_findings\":[],\"sha256\":\"3e79648b565bad680dbafbda376155ce48e74bd9deaeda58b3425906ac025ab0\",\"total_score\":70},{\"bytes\":26500,\"commit\":\"f5b22d867ea467987008408e3fb1fb0e17fa7b2e\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"cluster\",\"node\",\"quorum\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook\"],\"sensitive_findings\":[],\"sha256\":\"5dab56a2e73e4a3582d4792b91a0c803d485e68b40791bc456315748b15490a0\",\"total_score\":70},{\"bytes\":29485,\"commit\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"cluster\",\"node\",\"quorum\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition\",\"refs/heads/main\",\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"8051e3e761493a1b7088a0f3ed7e0aa9218673f453ca88171178364d26701f64\",\"total_score\":70},{\"bytes\":5868,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-20 Exposure matrix repo preflight\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":12,\"title\":\"Safety boundary\"},{\"level\":2,\"line\":22,\"title\":\"Matching file paths\"},{\"level\":2,\"line\":105,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30\",\"total_score\":70},{\"bytes\":8774,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e\",\"total_score\":70},{\"bytes\":7063,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-02 privilege risk classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Classification summary\"},{\"level\":2,\"line\":27,\"title\":\"Review table\"},{\"level\":2,\"line\":40,\"title\":\"Detailed classification\"},{\"level\":3,\"line\":42,\"title\":\"authentik-worker-1\"},{\"level\":3,\"line\":68,\"title\":\"cadvisor\"},{\"level\":3,\"line\":93,\"title\":\"dockge\"},{\"level\":3,\"line\":119,\"title\":\"npmplus\"},{\"level\":3,\"line\":146,\"title\":\"homeassistant\"},{\"level\":3,\"line\":173,\"title\":\"homelab-registry-cache\"},{\"level\":3,\"line\":199,\"title\":\"kopia\"},{\"level\":3,\"line\":225,\"title\":\"socket-proxy\"},{\"level\":2,\"line\":253,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2\",\"total_score\":70},{\"bytes\":16075,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a\",\"total_score\":70},{\"bytes\":61338,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":19,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0\",\"total_score\":70},{\"bytes\":15688,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface findings classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Overall classification\"},{\"level\":2,\"line\":28,\"title\":\"Source summary\"},{\"level\":2,\"line\":40,\"title\":\"Category counts\"},{\"level\":2,\"line\":47,\"title\":\"Classified findings\"},{\"level\":2,\"line\":132,\"title\":\"Interpretation\"},{\"level\":2,\"line\":138,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b\",\"total_score\":70},{\"bytes\":18777,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":23,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca\",\"total_score\":70},{\"bytes\":9282,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface normalization plan\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Starting classification\"},{\"level\":2,\"line\":33,\"title\":\"Normalization tracks\"},{\"level\":2,\"line\":42,\"title\":\"Implementation sequence\"},{\"level\":2,\"line\":51,\"title\":\"Sample findings carried forward\"},{\"level\":2,\"line\":98,\"title\":\"Guardrails\"},{\"level\":2,\"line\":107,\"title\":\"Future close criteria\"},{\"level\":2,\"line\":115,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":121,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507\",\"total_score\":70},{\"bytes\":5868,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-20 Exposure matrix repo preflight\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":12,\"title\":\"Safety boundary\"},{\"level\":2,\"line\":22,\"title\":\"Matching file paths\"},{\"level\":2,\"line\":105,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30\",\"total_score\":70},{\"bytes\":8774,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e\",\"total_score\":70},{\"bytes\":7063,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-02 privilege risk classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Classification summary\"},{\"level\":2,\"line\":27,\"title\":\"Review table\"},{\"level\":2,\"line\":40,\"title\":\"Detailed classification\"},{\"level\":3,\"line\":42,\"title\":\"authentik-worker-1\"},{\"level\":3,\"line\":68,\"title\":\"cadvisor\"},{\"level\":3,\"line\":93,\"title\":\"dockge\"},{\"level\":3,\"line\":119,\"title\":\"npmplus\"},{\"level\":3,\"line\":146,\"title\":\"homeassistant\"},{\"level\":3,\"line\":173,\"title\":\"homelab-registry-cache\"},{\"level\":3,\"line\":199,\"title\":\"kopia\"},{\"level\":3,\"line\":225,\"title\":\"socket-proxy\"},{\"level\":2,\"line\":253,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2\",\"total_score\":70},{\"bytes\":16075,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a\",\"total_score\":70},{\"bytes\":61338,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":19,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0\",\"total_score\":70},{\"bytes\":15688,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface findings classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Overall classification\"},{\"level\":2,\"line\":28,\"title\":\"Source summary\"},{\"level\":2,\"line\":40,\"title\":\"Category counts\"},{\"level\":2,\"line\":47,\"title\":\"Classified findings\"},{\"level\":2,\"line\":132,\"title\":\"Interpretation\"},{\"level\":2,\"line\":138,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b\",\"total_score\":70},{\"bytes\":18777,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":23,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca\",\"total_score\":70},{\"bytes\":9282,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface normalization plan\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Starting classification\"},{\"level\":2,\"line\":33,\"title\":\"Normalization tracks\"},{\"level\":2,\"line\":42,\"title\":\"Implementation sequence\"},{\"level\":2,\"line\":51,\"title\":\"Sample findings carried forward\"},{\"level\":2,\"line\":98,\"title\":\"Guardrails\"},{\"level\":2,\"line\":107,\"title\":\"Future close criteria\"},{\"level\":2,\"line\":115,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":121,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507\",\"total_score\":70},{\"bytes\":5868,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"identity_and_topology\":[\"proxmox\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P1-20 Exposure matrix repo preflight\"},{\"level\":2,\"line\":5,\"title\":\"Result\"},{\"level\":2,\"line\":12,\"title\":\"Safety boundary\"},{\"level\":2,\"line\":22,\"title\":\"Matching file paths\"},{\"level\":2,\"line\":105,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p1-exposure-matrix-repo-preflight-20260625T205521Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"db77f9791f8d89cc4563d194331d9932fb86cc71cce6f118dc350dc57d186a30\",\"total_score\":70},{\"bytes\":8774,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"79f4b5e068d8736372f46b84fcf67309d8dbc0f16bbcb57523593808e0f1298e\",\"total_score\":70},{\"bytes\":7063,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-02 privilege risk classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Classification summary\"},{\"level\":2,\"line\":27,\"title\":\"Review table\"},{\"level\":2,\"line\":40,\"title\":\"Detailed classification\"},{\"level\":3,\"line\":42,\"title\":\"authentik-worker-1\"},{\"level\":3,\"line\":68,\"title\":\"cadvisor\"},{\"level\":3,\"line\":93,\"title\":\"dockge\"},{\"level\":3,\"line\":119,\"title\":\"npmplus\"},{\"level\":3,\"line\":146,\"title\":\"homeassistant\"},{\"level\":3,\"line\":173,\"title\":\"homelab-registry-cache\"},{\"level\":3,\"line\":199,\"title\":\"kopia\"},{\"level\":3,\"line\":225,\"title\":\"socket-proxy\"},{\"level\":2,\"line\":253,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"45049333e69ddab0e481c07098f1826cd2c0e3dfdfdaea6a2994a3db9bf8aed2\",\"total_score\":70},{\"bytes\":16075,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":15,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"1a8b6aba8ec377a9ed89ac6ed24a90db73561deaa85cca6a858e7bc444744b2a\",\"total_score\":70},{\"bytes\":61338,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":19,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f9875b5c4776f804bd8006ff824e0860ea003934e259accc6e7790c0b0f419b0\",\"total_score\":70},{\"bytes\":15688,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"access_and_admin\":[\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"vmid\",\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface findings classification\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Overall classification\"},{\"level\":2,\"line\":28,\"title\":\"Source summary\"},{\"level\":2,\"line\":40,\"title\":\"Category counts\"},{\"level\":2,\"line\":47,\"title\":\"Classified findings\"},{\"level\":2,\"line\":132,\"title\":\"Interpretation\"},{\"level\":2,\"line\":138,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-classification-20260625T232327Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"9026d064d83b124c479105905c41a915e39db0472389f72699e9318d83fc5b2b\",\"total_score\":70},{\"bytes\":18777,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":23,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.json\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"a0b65628d2bd1139933135485de7f3f632ebb198dd909fc46dff92df9b9afeca\",\"total_score\":70},{\"bytes\":9282,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":64,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\"],\"network_and_dns\":[\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P2-07 health surface normalization plan\"},{\"level\":2,\"line\":5,\"title\":\"Scope\"},{\"level\":2,\"line\":11,\"title\":\"Counters\"},{\"level\":2,\"line\":20,\"title\":\"Starting classification\"},{\"level\":2,\"line\":33,\"title\":\"Normalization tracks\"},{\"level\":2,\"line\":42,\"title\":\"Implementation sequence\"},{\"level\":2,\"line\":51,\"title\":\"Sample findings carried forward\"},{\"level\":2,\"line\":98,\"title\":\"Guardrails\"},{\"level\":2,\"line\":107,\"title\":\"Future close criteria\"},{\"level\":2,\"line\":115,\"title\":\"Operational conclusion\"},{\"level\":2,\"line\":121,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-07-health-surface-readability-status-normalization-plan-20260625T232454Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"e563b9c64d614c7cb6049d5e461aae2dc4ebb7d42416d0c6b17a50da6adb9507\",\"total_score\":70},{\"bytes\":946,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":56,\"coverage\":{\"access_and_admin\":[\"admin\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"error_learning\":[\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Runbook: cluster-admin-incident-engine\"},{\"level\":2,\"line\":3,\"title\":\"Current verified backup state\"},{\"level\":2,\"line\":12,\"title\":\"First checks\"},{\"level\":2,\"line\":19,\"title\":\"Safe recovery rule\"},{\"level\":2,\"line\":22,\"title\":\"Evidence commands\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/04_homelab-desired-state/runbooks/cluster-admin-incident-engine.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"304ca47a962dbc921b18f465bbc433580e71e2fdecf6b868ff4cfc30daebac34\",\"total_score\":70},{\"bytes\":26140,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"superseded\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-11-health-surface-p1-file-operator-decision-package-20260625T234808Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3d85ce8de8cc17b76fde6fa144b918000f052c847780529b9caa98ccc0f10c80\",\"total_score\":69},{\"bytes\":3023,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[],\"json_top_level_size\":9,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"4983daf23fd88331c0985a6a794cebfb06731768766e277f10ac847174eba312\",\"total_score\":69},{\"bytes\":2982,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"error_learning\":[\"regression\"],\"external_services\":[\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"domain\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-01 evidence-based cluster score model\"},{\"level\":2,\"line\":5,\"title\":\"Final score for this baseline\"},{\"level\":2,\"line\":11,\"title\":\"Key findings\"},{\"level\":2,\"line\":21,\"title\":\"Score domains\"},{\"level\":2,\"line\":33,\"title\":\"Actions required to reach 100/100\"},{\"level\":2,\"line\":49,\"title\":\"Safety state\"},{\"level\":2,\"line\":56,\"title\":\"Next task\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-01-cluster-ideal-state-evidence-based-score-model-20260626T040011Z.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"17ea887feea2f371871c0e3155bcc3f3dd979dca0627d32e4f01da6ba8241e42\",\"total_score\":69},{\"bytes\":2502,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":52,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\"],\"error_learning\":[\"regression\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P3-11 final CI/no-regression/runbooks inventory\"},{\"level\":2,\"line\":5,\"title\":\"Plain explanation\"},{\"level\":2,\"line\":11,\"title\":\"Summary\"},{\"level\":2,\"line\":25,\"title\":\"Close artifacts\"},{\"level\":2,\"line\":38,\"title\":\"Redaction\"},{\"level\":2,\"line\":42,\"title\":\"Next step\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.md\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c610e8118037cdf7239ce61bac44dda4dfc8af4ca4c9d7166829e0ef56241bcb\",\"total_score\":69},{\"bytes\":1375,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":58,\"coverage\":{\"access_and_admin\":[\"access\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\"],\"change_safety\":[\"rollback\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"node\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"repair_and_troubleshooting\":[\"diagnostic\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Scrutiny pve01 runbook\"},{\"level\":2,\"line\":3,\"title\":\"Location\"},{\"level\":2,\"line\":10,\"title\":\"Health check\"},{\"level\":2,\"line\":26,\"title\":\"Logs\"},{\"level\":2,\"line\":32,\"title\":\"Data\"},{\"level\":2,\"line\":41,\"title\":\"Access\"},{\"level\":2,\"line\":51,\"title\":\"Relationship with Prometheus SMART monitoring\"},{\"level\":2,\"line\":59,\"title\":\"Rollback\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/scrutiny-pve01.md\",\"path_score\":11,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"e8e03dc156536ae569e4f42bb7baf715495c91ad24d3e16924bd329ce74dc12c\",\"total_score\":69},{\"bytes\":26140,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"superseded\"],\"identity_and_topology\":[\"pve01\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\"],\"network_and_dns\":[\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-11-health-surface-p1-file-operator-decision-package-20260625T234808Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3d85ce8de8cc17b76fde6fa144b918000f052c847780529b9caa98ccc0f10c80\",\"total_score\":69},{\"bytes\":3023,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":60,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\"],\"guests_and_workloads\":[\"lxc\"],\"identity_and_topology\":[\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"alert\",\"log\",\"grafana\"],\"network_and_dns\":[\"network\",\"firewall\",\"dns\"]},\"headings\":[],\"json_top_level_size\":9,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"4983daf23fd88331c0985a6a794cebfb06731768766e277f10ac847174eba312\",\"total_score\":69}],\"error_artifacts_omitted\":60,\"handbook_candidates\":[{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":85189,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":96,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"prometheus\"],\"network_and_dns\":[\"network\",\"vlan\",\"dns\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\",\"volume\"]},\"excerpt\":\"# Homelab cluster live context\\n\\nThis file is append-only operational context for recent cluster changes, errors, and follow-ups.\\n\\n## 2026-06-24 P1 live context update — 20260624T144403Z\\n\\n### Recently closed\\n\\n- NPMplus admin listener is restricted to `127.0.0.1:81`; LAN `:81` is blocked/closed.\\n- Gotify direct publish was changed from `[PRIVATE_IP]:8082` to `127.0.0.1:8082`; public `gotify.gram1.ru` is OK through NPMplus; LAN direct `8082` is closed.\\n- Gotify fix required extra repairs:\\n  - NPMplus generated proxy config had stale upstream `[PRIVATE_IP]:8082`, causing HTTP 502.\\n  - `homelab-cluster-daily-status` and `.core` had stale Gotify endpoint references.\\n  - Uptime Kuma monitor id=11 had a stale 502 heartbeat and was refreshed after live verification.\\n- TURN 3478 validated:\\n  - `turn.gram1.ru:3478` TCP/UDP STUN works.\\n  - `nc.gram1.ru:3478` did not respond and was removed from the Nextcloud Talk TURN list.\\n- Router ingress audit:\\n  - Expected TCP 80/443 and TCP/UDP 3478 are reachable via hairpin.\\n  - Tagged UDP test showed expected `3478` to Nextcloud and no tagged stale forwards to edge for `51820`, `53`, `5000`, `8082`, `8123`, `81`, `80`, or `443`.\\n  - UPnP/IGD discovery<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Homelab cluster live context\"},{\"level\":2,\"line\":5,\"title\":\"2026-06-24 P1 live context update — 20260624T144403Z\"},{\"level\":3,\"line\":7,\"title\":\"Recently closed\"},{\"level\":3,\"line\":23,\"title\":\"Security notes / follow-up\"},{\"level\":2,\"line\":29,\"title\":\"2026-06-24 SecretRotation recovery note — 20260624T150118Z\"},{\"level\":2,\"line\":44,\"title\":\"2026-06-24 TURN secret source/auth discovery — 20260624T150523Z\"},{\"level\":2,\"line\":52,\"title\":\"2026-06-24 TURN discovery cleanup — 20260624T150759Z\"},{\"level\":2,\"line\":61,\"title\":\"2026-06-24 TURN persistence verification — 20260624T151320Z\"},{\"level\":2,\"line\":71,\"title\":\"2026-06-24 TURN persistence issue — 20260624T151547Z\"},{\"level\":2,\"line\":78,\"title\":\"2026-06-24 TURN manual Talk recreate — 20260624T151817Z\"},{\"level\":2,\"line\":86,\"title\":\"2026-06-24 TURN manual recreate retry — 20260624T152140Z\"},{\"level\":2,\"line\":93,\"title\":\"2026-06-24 SecretRotation final closure — 20260624T180202Z\"},{\"level\":2,\"line\":109,\"title\":\"2026-06-24 P1 post-health sweep pve01 failed units — 20260624T180727Z\"},{\"level\":3,\"line\":118,\"title\":\"PostP1HealthSweep 3/4 live rerun and drift classification - 20260624T181926Z\"},{\"level\":3,\"line\":126,\"title\":\"PostP1HealthSweep 4/5 fix inputs inspected - 20260624T182227Z\"},{\"level\":3,\"line\":133,\"title\":\"PostP1HealthSweep closed - 20260624T183006Z\"},{\"level\":3,\"line\":140,\"title\":\"PostP1HealthSweep closed - 20260624T183258Z\"},{\"level\":3,\"line\":147,\"title\":\"PostP1 source-of-truth correction - 20260624T183424Z\"},{\"level\":3,\"line\":153,\"title\":\"P0RestoreDrillMatrix audit started - 20260624T183542Z\"},{\"level\":3,\"line\":161,\"title\":\"P0RestoreDrillMatrix edge index collected - 20260624T183747Z\"},{\"level\":3,\"line\":167,\"title\":\"P0RestoreDrillMatrix quality/offhost audit - 20260624T183931Z\"},{\"level\":3,\"line\":174,\"title\":\"P0RestoreDrillMatrix closed - 20260624T184202Z\"},{\"level\":3,\"line\":185,\"title\":\"P0RestoreProofOffhostCoverage audit retry - 20260624T185223Z\"},{\"level\":3,\"line\":193,\"title\":\"P0RestoreProofOffhostCoverage pve02 lookup fixed - 20260624T185442Z\"},{\"level\":3,\"line\":201,\"title\":\"P0RestoreProofOffhostCoverage copy preflight - 20260624T185740Z\"},{\"level\":3,\"line\":209,\"title\":\"P0RestoreProofOffhostCoverage copy completed - 20260624T185921Z\"},{\"level\":3,\"line\":217,\"title\":\"P0RestoreProofOffhostCoverage copy recovery completed - 20260624T190040Z\"},{\"level\":3,\"line\":225,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof-location audit - 20260624T190222Z\"},{\"level\":3,\"line\":232,\"title\":\"P0RestoreProofOffhostCoverage Nextcloud proof offhost copy - 20260624T190330Z\"},{\"level\":3,\"line\":241,\"title\":\"P0RestoreProofOffhostCoverage closed - 20260624T190444Z\"},{\"level\":3,\"line\":252,\"title\":\"P0RestoreProofOffhostCoverage source-truth correction - 20260624T190605Z\"},{\"level\":3,\"line\":259,\"title\":\"P0RestoreProofStrengthenHealthchecks preflight - 20260624T190801Z\"},{\"level\":3,\"line\":267,\"title\":\"P0RestoreProofStrengthenHealthchecks temp restore verify - 20260624T190936Z\"},{\"level\":3,\"line\":275,\"title\":\"P0RestoreProofStrengthenHealthchecks closed - 20260624T191045Z\"},{\"level\":3,\"line\":283,\"title\":\"P0RestoreProofStrengthenHealthchecks committed - 20260624T191154Z\"},{\"level\":3,\"line\":290,\"title\":\"P0RestoreProofStrengthenVikunja preflight - 20260624T191408Z\"},{\"level\":3,\"line\":297,\"title\":\"P0RestoreProofStrengthenVikunja temp restore verify - 20260624T191818Z\"},{\"level\":3,\"line\":305,\"title\":\"P0RestoreProofStrengthenVikunja closed - 20260624T191953Z\"},{\"level\":3,\"line\":313,\"title\":\"P0RestoreProofStrengthenVikunja committed - 20260624T192126Z\"},{\"level\":3,\"line\":320,\"title\":\"P0EdgeCleanup preflight - 20260624T192250Z\"},{\"level\":3,\"line\":328,\"title\":\"P0EdgeCleanup plan classified - 20260624T192904Z\"},{\"level\":3,\"line\":336,\"title\":\"P0EdgeCleanup low-risk cleanup executed - 20260624T193118Z\"},{\"level\":3,\"line\":345,\"title\":\"P0EdgeCleanup post-verify - 20260624T193303Z\"},{\"level\":3,\"line\":352,\"title\":\"P0EdgeCleanup closed - 20260624T193441Z\"},{\"level\":3,\"line\":363,\"title\":\"P0 run-level checkpoint audit - 20260624T193717Z\"},{\"level\":3,\"line\":370,\"title\":\"P0 run-level checkpoint committed - 20260624T193947Z\"},{\"level\":3,\"line\":377,\"title\":\"P0RollbackImageRetentionPolicy preflight - 20260624T194126Z\"},{\"level\":3,\"line\":385,\"title\":\"P0RollbackImageRetentionPolicy policy review - 20260624T194418Z\"},{\"level\":3,\"line\":395,\"title\":\"P0RollbackImageRetentionPolicy explicit remove - 20260624T194607Z\"},{\"level\":3,\"line\":404,\"title\":\"P0RollbackImageRetentionPolicy closed - 20260624T194750Z\"},{\"level\":3,\"line\":415,\"title\":\"Manual VPS SSH host-key verification closed - 20260624T200554Z\"},{\"level\":3,\"line\":423,\"title\":\"Final all-clear checkpoint - 20260624T200838Z\"},{\"level\":3,\"line\":431,\"title\":\"P1TmpCleanupPolicy preflight - 20260624T201119Z\"},{\"level\":3,\"line\":439,\"title\":\"P1TmpCleanupPolicy cleanup - 20260624T201559Z\"},{\"level\":3,\"line\":447,\"title\":\"P1TmpCleanupPolicy validate + commit - 20260624T205442Z\"},{\"level\":3,\"line\":454,\"title\":\"P1TmpCleanupPolicy closed - 20260624T205620Z\"},{\"level\":3,\"line\":462,\"title\":\"P1JournalRetentionPolicy preflight - 20260624T205759Z\"},{\"level\":3,\"line\":470,\"title\":\"P1JournalRetentionPolicy noise decision - 20260624T210034Z\"},{\"level\":3,\"line\":478,\"title\":\"P1JournalRetentionPolicy commit decision - 20260624T210220Z\"},{\"level\":3,\"line\":485,\"title\":\"P1JournalRetentionPolicy closed - 20260624T210359Z\"},{\"level\":3,\"line\":492,\"title\":\"P1DockerImageInventoryPolicy preflight - 20260624T210548Z\"},{\"level\":3,\"line\":500,\"title\":\"P1DockerImageInventoryPolicy candidate decision - 20260624T210906Z\"},{\"level\":3,\"line\":508,\"title\":\"P1DockerImageInventoryPolicy cleanup - 20260624T211059Z\"},{\"level\":3,\"line\":517,\"title\":\"P1DockerImageInventoryPolicy closed - 20260624T211315Z\"},{\"level\":3,\"line\":525,\"title\":\"P1AdguardHomeSyncImagePolicy preflight - 20260624T211517Z\"},{\"level\":3,\"line\":533,\"title\":\"P1AdguardHomeSyncImagePolicy semantics - 20260624T211805Z\"},{\"level\":3,\"line\":540,\"title\":\"P1AdguardHomeSyncImagePolicy commit decision - 20260624T211930Z\"},{\"level\":3,\"line\":547,\"title\":\"P1AdguardHomeSyncImagePolicy closed - 20260624T212109Z\"},{\"level\":3,\"line\":554,\"title\":\"P1 housekeeping checkpoint - 20260624T212215Z\"},{\"level\":3,\"line\":560,\"title\":\"P1EdgeJournalNoiseTriage preflight - 20260624T212340Z\"},{\"level\":3,\"line\":568,\"title\":\"P1EdgeJournalNoiseTriage decision - 20260624T212527Z\"},{\"level\":3,\"line\":576,\"title\":\"P1EdgeJournalNoiseTriage commit decision - 20260624T212645Z\"},{\"level\":3,\"line\":583,\"title\":\"P1EdgeJournalNoiseTriage closed - 20260624T212748Z\"},{\"level\":3,\"line\":590,\"title\":\"P1 post-noise checkpoint - 20260624T212856Z\"},{\"level\":3,\"line\":597,\"title\":\"P1ToolScannerImagePolicy preflight - 20260624T213038Z\"},{\"level\":3,\"line\":605,\"title\":\"P1ToolScannerImagePolicy decision - 20260624T214349Z\"},{\"level\":3,\"line\":613,\"title\":\"P1ToolScannerImagePolicy cleanup - 20260624T214547Z\"},{\"level\":3,\"line\":622,\"title\":\"P1ToolScannerImagePolicy closed - 20260624T214728Z\"},{\"level\":3,\"line\":630,\"title\":\"P1 post tool/scanner checkpoint - 20260624T214903Z\"},{\"level\":3,\"line\":637,\"title\":\"P1 final all-clear checkpoint - 20260624T215112Z\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"total_score\":105},{\"bytes\":1079183,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":102,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"бэкап\",\"restore\",\"восстанов\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"error_learning\":[\"regression\",\"incident\",\"superseded\"],\"external_services\":[\"внешн\",\"public\",\"reverse proxy\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"внутренн\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"repair\",\"troubleshoot\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"excerpt\":\"<OMITTED_SENSITIVE_CONTENT><BOUNDED_PROJECTION><BOUNDED_PROJECTION><BOUNDED_PROJECTION>\",\"headings\":[],\"json_top_level_size\":1000,\"json_top_level_type\":\"list\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"url-userinfo\"],\"sha256\":\"aeb92358514ec5cd67d557f15ea295b3ae4f25df5f17a14556dae750b8496d1b\",\"total_score\":102},{\"bytes\":9499,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":88,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"internet\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\"],\"internal_services\":[\"internal service\",\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"excerpt\":\"# DR from zero runbook, 2026-06-22\\n\\nChecked at UTC: `2026-06-22T09:00:38Z`.\\n\\nMarker: **DR from zero runbook, 2026-06-22**\\n\\n## Purpose\\n\\nThis runbook describes how to rebuild a minimum viable homelab from zero after a serious failure.\\n\\nIt is not a restore execution log. It is a step-by-step operator procedure.\\n\\n## Scope\\n\\nThe goal is to recover enough infrastructure to regain access, documentation, identity, routing, secrets, Git, backup visibility, and then stateful applications.\\n\\nMinimum viable homelab means:\\n\\n- SSH access works;\\n- VPN/Tailscale/NetBird access works or has a known temporary replacement;\\n- Git repository is available;\\n- SOPS/age secrets can be decrypted;\\n- MkDocs documentation is published;\\n- NPMplus routes can be restored;\\n- Authentik, Gitea, Vaultwarden, NetBox, and Uptime Kuma can be restored;\\n- backup/offhost locations are visible;\\n- health checks prove the restored state.\\n\\n## Current known source-of-truth commits\\n\\n- Backup coverage closure: completed before this runbook.\\n- MkDocs publish hardening: completed.\\n- Backup tiering table: completed.\\n- Current repo head when starting this runbook: `adb8c55`.\\n\\n## P0 restore order\\n\\n| Order | Component | Why first | Expec<BOUNDED_PROJECTION>\",\"headings\":[{\"level\":1,\"line\":1,\"title\":\"DR from zero runbook, 2026-06-22\"},{\"level\":2,\"line\":7,\"title\":\"Purpose\"},{\"level\":2,\"line\":13,\"title\":\"Scope\"},{\"level\":2,\"line\":29,\"title\":\"Current known source-of-truth commits\"},{\"level\":2,\"line\":36,\"title\":\"P0 restore order\"},{\"level\":2,\"line\":55,\"title\":\"Critical backup sources\"},{\"level\":2,\"line\":71,\"title\":\"Phase 0 — stop and preserve evidence\"},{\"level\":2,\"line\":86,\"title\":\"Phase 1 — base host recovery\"},{\"level\":2,\"line\":104,\"title\":\"Phase 2 — network access\"},{\"level\":2,\"line\":119,\"title\":\"Phase 3 — clone repository\"},{\"level\":2,\"line\":136,\"title\":\"Phase 4 — restore secrets/SOPS\"},{\"level\":2,\"line\":155,\"title\":\"Phase 5 — restore documentation first\"},{\"level\":2,\"line\":173,\"title\":\"Phase 6 — recover NPMplus and Uptime Kuma\"},{\"level\":2,\"line\":197,\"title\":\"Phase 7 — recover Authentik\"},{\"level\":2,\"line\":215,\"title\":\"Phase 8 — recover Gitea\"},{\"level\":2,\"line\":230,\"title\":\"Phase 9 — recover Vaultwarden\"},{\"level\":2,\"line\":244,\"title\":\"Phase 10 — recover NetBox\"},{\"level\":2,\"line\":270,\"title\":\"Phase 11 — recover Edge VM\"},{\"level\":2,\"line\":291,\"title\":\"Phase 12 — recover user data services\"},{\"level\":2,\"line\":306,\"title\":\"Phase 13 — restore monitoring and alerting\"},{\"level\":2,\"line\":325,\"title\":\"Do not do\"},{\"level\":2,\"line\":334,\"title\":\"Final DR closure checklist\"},{\"level\":2,\"line\":353,\"title\":\"Next improvement after this runbook\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"f8312cd7cd0a296c60950a60c7866a67b19a70016b93f68b3a76b78d5440cb63\",\"total_score\":102},{\"bytes\":9386,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Disaster Recovery Runbook\"},{\"level\":2,\"line\":6,\"title\":\"Current verified recovery anchors\"},{\"level\":2,\"line\":25,\"title\":\"Things that must exist outside the repo\"},{\"level\":2,\"line\":39,\"title\":\"Recovery priority\"},{\"level\":2,\"line\":51,\"title\":\"Phase 0: establish a control host\"},{\"level\":2,\"line\":65,\"title\":\"Phase 1: restore rclone access\"},{\"level\":2,\"line\":90,\"title\":\"Phase 2: restore the critical/small cloud bundle\"},{\"level\":1,\"line\":107,\"title\":\"Expected:\"},{\"level\":1,\"line\":108,\"title\":\"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c\"},{\"level\":2,\"line\":130,\"title\":\"Phase 3: recover small app/config backups\"},{\"level\":2,\"line\":163,\"title\":\"Phase 4: recover edge-vm large backup\"},{\"level\":1,\"line\":194,\"title\":\"Expected size:\"},{\"level\":1,\"line\":195,\"title\":\"16936767590\"},{\"level\":1,\"line\":196,\"title\":\"Expected SHA256:\"},{\"level\":1,\"line\":197,\"title\":\"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001\"},{\"level\":2,\"line\":202,\"title\":\"Phase 5: restore validation checklist\"},{\"level\":2,\"line\":218,\"title\":\"Phase 6: re-enable backup and offsite automation\"},{\"level\":2,\"line\":231,\"title\":\"Known failure lessons\"},{\"level\":2,\"line\":243,\"title\":\"Vaultwarden isolated restore drill result — 2026-06-18\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e\",\"total_score\":100},{\"bytes\":9386,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"dns\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Disaster Recovery Runbook\"},{\"level\":2,\"line\":6,\"title\":\"Current verified recovery anchors\"},{\"level\":2,\"line\":25,\"title\":\"Things that must exist outside the repo\"},{\"level\":2,\"line\":39,\"title\":\"Recovery priority\"},{\"level\":2,\"line\":51,\"title\":\"Phase 0: establish a control host\"},{\"level\":2,\"line\":65,\"title\":\"Phase 1: restore rclone access\"},{\"level\":2,\"line\":90,\"title\":\"Phase 2: restore the critical/small cloud bundle\"},{\"level\":1,\"line\":107,\"title\":\"Expected:\"},{\"level\":1,\"line\":108,\"title\":\"f413fcbd5641ac14b146c7d2d997b9ccfbb302467a5f22fdf0bebb8e3e9aba6c\"},{\"level\":2,\"line\":130,\"title\":\"Phase 3: recover small app/config backups\"},{\"level\":2,\"line\":163,\"title\":\"Phase 4: recover edge-vm large backup\"},{\"level\":1,\"line\":194,\"title\":\"Expected size:\"},{\"level\":1,\"line\":195,\"title\":\"16936767590\"},{\"level\":1,\"line\":196,\"title\":\"Expected SHA256:\"},{\"level\":1,\"line\":197,\"title\":\"489ba4eb59d182ee0deeff54804d055d4f9a3ba3d0e8618a5de848cf0a168001\"},{\"level\":2,\"line\":202,\"title\":\"Phase 5: restore validation checklist\"},{\"level\":2,\"line\":218,\"title\":\"Phase 6: re-enable backup and offsite automation\"},{\"level\":2,\"line\":231,\"title\":\"Known failure lessons\"},{\"level\":2,\"line\":243,\"title\":\"Vaultwarden isolated restore drill result — 2026-06-18\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"path_score\":14,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c80e78642336f5ad15a23299e1061854a200fcc51866f68f27d40127b3e27b8e\",\"total_score\":100},{\"bytes\":16031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"internal service\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"05. Service Catalog\"},{\"level\":2,\"line\":5,\"title\":\"Edge VM\"},{\"level\":2,\"line\":12,\"title\":\"NPMplus\"},{\"level\":2,\"line\":22,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":30,\"title\":\"Gotify\"},{\"level\":2,\"line\":38,\"title\":\"Vaultwarden\"},{\"level\":2,\"line\":49,\"title\":\"Dockge\"},{\"level\":2,\"line\":61,\"title\":\"Homepage\"},{\"level\":2,\"line\":71,\"title\":\"Gitea\"},{\"level\":2,\"line\":84,\"title\":\"Nextcloud AIO\"},{\"level\":2,\"line\":95,\"title\":\"DNS stack\"},{\"level\":2,\"line\":102,\"title\":\"Backup\"},{\"level\":2,\"line\":109,\"title\":\"Edge applications added 2026-06-15/16\"},{\"level\":2,\"line\":132,\"title\":\"Backup health proxy\"},{\"level\":2,\"line\":155,\"title\":\"Edge VM capacity note\"},{\"level\":2,\"line\":366,\"title\":\"Homepage grouped dashboard update, 2026-06-22\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a\",\"total_score\":95},{\"bytes\":106031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":92,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"web ui\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"lxc\",\"qemu\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"локальн\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"99. Current state summary\"},{\"level\":2,\"line\":5,\"title\":\"Git repository\"},{\"level\":2,\"line\":12,\"title\":\"Operating rules\"},{\"level\":2,\"line\":21,\"title\":\"Current verified backup health\"},{\"level\":2,\"line\":32,\"title\":\"Backup scripts and services\"},{\"level\":2,\"line\":41,\"title\":\"Proxmox and network layout\"},{\"level\":2,\"line\":58,\"title\":\"NPMplus state\"},{\"level\":2,\"line\":81,\"title\":\"DNS rewrites\"},{\"level\":2,\"line\":101,\"title\":\"Edge applications\"},{\"level\":2,\"line\":118,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":131,\"title\":\"Cloudflare token rotation\"},{\"level\":2,\"line\":139,\"title\":\"Known working URLs\"},{\"level\":2,\"line\":166,\"title\":\"Pending after this documentation update\"},{\"level\":2,\"line\":181,\"title\":\"Edge application setup checkpoint — 2026-06-16T10:26:57Z\"},{\"level\":2,\"line\":194,\"title\":\"Immich media storage checkpoint — 2026-06-16T11:01:32Z\"},{\"level\":2,\"line\":204,\"title\":\"Immich media backup checkpoint — 2026-06-16T11:24:22Z\"},{\"level\":2,\"line\":219,\"title\":\"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z\"},{\"level\":2,\"line\":231,\"title\":\"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z\"},{\"level\":2,\"line\":245,\"title\":\"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z\"},{\"level\":2,\"line\":257,\"title\":\"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z\"},{\"level\":2,\"line\":266,\"title\":\"Closed validation checkpoint — 2026-06-16T16:51:40Z\"},{\"level\":2,\"line\":278,\"title\":\"Disk Space Health checkpoint — 2026-06-16T17:06:06Z\"},{\"level\":2,\"line\":298,\"title\":\"Memos backup checkpoint — 2026-06-16T17:33:39Z\"},{\"level\":2,\"line\":319,\"title\":\"Paperless backup checkpoint — 2026-06-16T17:50:49Z\"},{\"level\":2,\"line\":350,\"title\":\"Application restore validation checkpoint — 2026-06-16T18:01:17Z\"},{\"level\":2,\"line\":364,\"title\":\"Final full baseline checkpoint — 2026-06-16T18:10:15Z\"},{\"level\":2,\"line\":407,\"title\":\"Daily cluster status report\"},{\"level\":2,\"line\":420,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":447,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":482,\"title\":\"Контейнерная волна обновлений, 2026-06-19\"},{\"level\":2,\"line\":498,\"title\":\"CVE root-cause analysis, 2026-06-19\"},{\"level\":2,\"line\":514,\"title\":\"Browser / Chromium risk analysis, 2026-06-19\"},{\"level\":2,\"line\":527,\"title\":\"Base OS package CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":541,\"title\":\"Go runtime/dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":555,\"title\":\"Node/NPM dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":569,\"title\":\"Dockge / Karakeep candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":583,\"title\":\"Karakeep production update, 2026-06-19\"},{\"level\":2,\"line\":605,\"title\":\"Uptime Kuma candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":622,\"title\":\"Uptime Kuma production update, 2026-06-19\"},{\"level\":2,\"line\":644,\"title\":\"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19\"},{\"level\":2,\"line\":663,\"title\":\"Linkding candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":678,\"title\":\"Linkding production update, 2026-06-19\"},{\"level\":2,\"line\":698,\"title\":\"Current Trivy leaderboard after Linkding, 2026-06-19\"},{\"level\":2,\"line\":717,\"title\":\"Batch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":744,\"title\":\"Disk cleanup and Git push recovery, 2026-06-19\"},{\"level\":2,\"line\":758,\"title\":\"Next update candidates from batch scan, 2026-06-19\"},{\"level\":2,\"line\":770,\"title\":\"IT-Tools production update, 2026-06-19\"},{\"level\":2,\"line\":789,\"title\":\"NPMplus production update, 2026-06-19\"},{\"level\":2,\"line\":812,\"title\":\"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19\"},{\"level\":2,\"line\":827,\"title\":\"Paperless stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":852,\"title\":\"Immich app stable pair candidate scan, 2026-06-19\"},{\"level\":2,\"line\":878,\"title\":\"Immich app pair candidate scan result, 2026-06-19\"},{\"level\":2,\"line\":896,\"title\":\"Home Assistant stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":919,\"title\":\"MinIO release candidate scan, 2026-06-19\"},{\"level\":2,\"line\":942,\"title\":\"Mealie stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":965,\"title\":\"Authentik server image candidate scan, 2026-06-19\"},{\"level\":2,\"line\":988,\"title\":\"Karakeep Meilisearch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1011,\"title\":\"Karakeep Chrome candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1034,\"title\":\"Vaultwarden stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1057,\"title\":\"Vaultwarden production update, 2026-06-20\"},{\"level\":2,\"line\":1083,\"title\":\"Current Trivy leaderboard after Vaultwarden, 2026-06-20\"},{\"level\":2,\"line\":1098,\"title\":\"n8n stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1121,\"title\":\"n8n latest tag restore, 2026-06-20\"},{\"level\":2,\"line\":1137,\"title\":\"n8n 2.27.3 smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1163,\"title\":\"n8n production update, 2026-06-20\"},{\"level\":2,\"line\":1193,\"title\":\"Gotify stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1213,\"title\":\"Batch remaining open candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1234,\"title\":\"CrowdSec production update, 2026-06-20\"},{\"level\":2,\"line\":1262,\"title\":\"Final CVE pass summary, 2026-06-20\"},{\"level\":2,\"line\":1286,\"title\":\"n8n encryption key rotation, 2026-06-20\"},{\"level\":2,\"line\":1311,\"title\":\"Audit and backup inventory, 2026-06-20\"},{\"level\":2,\"line\":1326,\"title\":\"Immich Postgres restore smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1342,\"title\":\"Immich Postgres candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1352,\"title\":\"Dockge candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1362,\"title\":\"Paperless candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1372,\"title\":\"Karakeep and Immich Server real-tag scan, 2026-06-20\"},{\"level\":2,\"line\":1382,\"title\":\"Closing high-CVE ledger, 2026-06-20\"},{\"level\":2,\"line\":1392,\"title\":\"Candidate test directories cleanup, 2026-06-20\"},{\"level\":2,\"line\":1402,\"title\":\"Old n8n key backup removal preflight, 2026-06-20\"},{\"level\":2,\"line\":1412,\"title\":\"NetBird peers health hardening, 2026-06-20\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\",\"path_score\":3,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c\",\"total_score\":95},{\"bytes\":16031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\"],\"change_safety\":[\"sha256\"],\"external_services\":[\"public\",\"reverse proxy\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"node\"],\"internal_services\":[\"internal service\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"05. Service Catalog\"},{\"level\":2,\"line\":5,\"title\":\"Edge VM\"},{\"level\":2,\"line\":12,\"title\":\"NPMplus\"},{\"level\":2,\"line\":22,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":30,\"title\":\"Gotify\"},{\"level\":2,\"line\":38,\"title\":\"Vaultwarden\"},{\"level\":2,\"line\":49,\"title\":\"Dockge\"},{\"level\":2,\"line\":61,\"title\":\"Homepage\"},{\"level\":2,\"line\":71,\"title\":\"Gitea\"},{\"level\":2,\"line\":84,\"title\":\"Nextcloud AIO\"},{\"level\":2,\"line\":95,\"title\":\"DNS stack\"},{\"level\":2,\"line\":102,\"title\":\"Backup\"},{\"level\":2,\"line\":109,\"title\":\"Edge applications added 2026-06-15/16\"},{\"level\":2,\"line\":132,\"title\":\"Backup health proxy\"},{\"level\":2,\"line\":155,\"title\":\"Edge VM capacity note\"},{\"level\":2,\"line\":366,\"title\":\"Homepage grouped dashboard update, 2026-06-22\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c85813dad244b61b86521f8c384a6c0f2d7e8a69d5f0ea44f60776f638958d5a\",\"total_score\":95},{\"bytes\":106031,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":92,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"web ui\",\"ssh\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"lxc\",\"qemu\",\"guest\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\",\"quorum\"],\"internal_services\":[\"локальн\",\"lan\",\"service catalog\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"99. Current state summary\"},{\"level\":2,\"line\":5,\"title\":\"Git repository\"},{\"level\":2,\"line\":12,\"title\":\"Operating rules\"},{\"level\":2,\"line\":21,\"title\":\"Current verified backup health\"},{\"level\":2,\"line\":32,\"title\":\"Backup scripts and services\"},{\"level\":2,\"line\":41,\"title\":\"Proxmox and network layout\"},{\"level\":2,\"line\":58,\"title\":\"NPMplus state\"},{\"level\":2,\"line\":81,\"title\":\"DNS rewrites\"},{\"level\":2,\"line\":101,\"title\":\"Edge applications\"},{\"level\":2,\"line\":118,\"title\":\"Uptime Kuma\"},{\"level\":2,\"line\":131,\"title\":\"Cloudflare token rotation\"},{\"level\":2,\"line\":139,\"title\":\"Known working URLs\"},{\"level\":2,\"line\":166,\"title\":\"Pending after this documentation update\"},{\"level\":2,\"line\":181,\"title\":\"Edge application setup checkpoint — 2026-06-16T10:26:57Z\"},{\"level\":2,\"line\":194,\"title\":\"Immich media storage checkpoint — 2026-06-16T11:01:32Z\"},{\"level\":2,\"line\":204,\"title\":\"Immich media backup checkpoint — 2026-06-16T11:24:22Z\"},{\"level\":2,\"line\":219,\"title\":\"Immich media backup monitoring checkpoint — 2026-06-16T11:33:03Z\"},{\"level\":2,\"line\":231,\"title\":\"Immich media off-host backup checkpoint — 2026-06-16T11:52:03Z\"},{\"level\":2,\"line\":245,\"title\":\"Immich media VM backup exclusion checkpoint — 2026-06-16T11:55:56Z\"},{\"level\":2,\"line\":257,\"title\":\"Immich media backup symlink checkpoint — 2026-06-16T12:10:24Z\"},{\"level\":2,\"line\":266,\"title\":\"Closed validation checkpoint — 2026-06-16T16:51:40Z\"},{\"level\":2,\"line\":278,\"title\":\"Disk Space Health checkpoint — 2026-06-16T17:06:06Z\"},{\"level\":2,\"line\":298,\"title\":\"Memos backup checkpoint — 2026-06-16T17:33:39Z\"},{\"level\":2,\"line\":319,\"title\":\"Paperless backup checkpoint — 2026-06-16T17:50:49Z\"},{\"level\":2,\"line\":350,\"title\":\"Application restore validation checkpoint — 2026-06-16T18:01:17Z\"},{\"level\":2,\"line\":364,\"title\":\"Final full baseline checkpoint — 2026-06-16T18:10:15Z\"},{\"level\":2,\"line\":407,\"title\":\"Daily cluster status report\"},{\"level\":2,\"line\":420,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":447,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":482,\"title\":\"Контейнерная волна обновлений, 2026-06-19\"},{\"level\":2,\"line\":498,\"title\":\"CVE root-cause analysis, 2026-06-19\"},{\"level\":2,\"line\":514,\"title\":\"Browser / Chromium risk analysis, 2026-06-19\"},{\"level\":2,\"line\":527,\"title\":\"Base OS package CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":541,\"title\":\"Go runtime/dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":555,\"title\":\"Node/NPM dependency CVE analysis, 2026-06-19\"},{\"level\":2,\"line\":569,\"title\":\"Dockge / Karakeep candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":583,\"title\":\"Karakeep production update, 2026-06-19\"},{\"level\":2,\"line\":605,\"title\":\"Uptime Kuma candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":622,\"title\":\"Uptime Kuma production update, 2026-06-19\"},{\"level\":2,\"line\":644,\"title\":\"Current Trivy leaderboard after Karakeep and Uptime Kuma, 2026-06-19\"},{\"level\":2,\"line\":663,\"title\":\"Linkding candidate tag scan, 2026-06-19\"},{\"level\":2,\"line\":678,\"title\":\"Linkding production update, 2026-06-19\"},{\"level\":2,\"line\":698,\"title\":\"Current Trivy leaderboard after Linkding, 2026-06-19\"},{\"level\":2,\"line\":717,\"title\":\"Batch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":744,\"title\":\"Disk cleanup and Git push recovery, 2026-06-19\"},{\"level\":2,\"line\":758,\"title\":\"Next update candidates from batch scan, 2026-06-19\"},{\"level\":2,\"line\":770,\"title\":\"IT-Tools production update, 2026-06-19\"},{\"level\":2,\"line\":789,\"title\":\"NPMplus production update, 2026-06-19\"},{\"level\":2,\"line\":812,\"title\":\"Current Trivy leaderboard after IT-Tools and NPMplus, 2026-06-19\"},{\"level\":2,\"line\":827,\"title\":\"Paperless stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":852,\"title\":\"Immich app stable pair candidate scan, 2026-06-19\"},{\"level\":2,\"line\":878,\"title\":\"Immich app pair candidate scan result, 2026-06-19\"},{\"level\":2,\"line\":896,\"title\":\"Home Assistant stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":919,\"title\":\"MinIO release candidate scan, 2026-06-19\"},{\"level\":2,\"line\":942,\"title\":\"Mealie stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":965,\"title\":\"Authentik server image candidate scan, 2026-06-19\"},{\"level\":2,\"line\":988,\"title\":\"Karakeep Meilisearch candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1011,\"title\":\"Karakeep Chrome candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1034,\"title\":\"Vaultwarden stable candidate scan, 2026-06-19\"},{\"level\":2,\"line\":1057,\"title\":\"Vaultwarden production update, 2026-06-20\"},{\"level\":2,\"line\":1083,\"title\":\"Current Trivy leaderboard after Vaultwarden, 2026-06-20\"},{\"level\":2,\"line\":1098,\"title\":\"n8n stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1121,\"title\":\"n8n latest tag restore, 2026-06-20\"},{\"level\":2,\"line\":1137,\"title\":\"n8n 2.27.3 smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1163,\"title\":\"n8n production update, 2026-06-20\"},{\"level\":2,\"line\":1193,\"title\":\"Gotify stable candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1213,\"title\":\"Batch remaining open candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1234,\"title\":\"CrowdSec production update, 2026-06-20\"},{\"level\":2,\"line\":1262,\"title\":\"Final CVE pass summary, 2026-06-20\"},{\"level\":2,\"line\":1286,\"title\":\"n8n encryption key rotation, 2026-06-20\"},{\"level\":2,\"line\":1311,\"title\":\"Audit and backup inventory, 2026-06-20\"},{\"level\":2,\"line\":1326,\"title\":\"Immich Postgres restore smoke-test, 2026-06-20\"},{\"level\":2,\"line\":1342,\"title\":\"Immich Postgres candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1352,\"title\":\"Dockge candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1362,\"title\":\"Paperless candidate scan, 2026-06-20\"},{\"level\":2,\"line\":1372,\"title\":\"Karakeep and Immich Server real-tag scan, 2026-06-20\"},{\"level\":2,\"line\":1382,\"title\":\"Closing high-CVE ledger, 2026-06-20\"},{\"level\":2,\"line\":1392,\"title\":\"Candidate test directories cleanup, 2026-06-20\"},{\"level\":2,\"line\":1402,\"title\":\"Old n8n key backup removal preflight, 2026-06-20\"},{\"level\":2,\"line\":1412,\"title\":\"NetBird peers health hardening, 2026-06-20\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\",\"path_score\":3,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"371246f79ab37dfefabd25028e9457cb77d91d03e7bf52d1790eb1de943f1f5c\",\"total_score\":95},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":75334,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":78,\"coverage\":{\"access_and_admin\":[\"access\",\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"error_learning\":[\"incident\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\",\"metric\",\"prometheus\"],\"network_and_dns\":[\"network\",\"bridge\",\"firewall\",\"dns\",\"certificate\"],\"repair_and_troubleshooting\":[\"diagnostic\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"path_score\":9,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"c49a388e872124af113a0bef8b52c19924d5b2302513053f16bff2fd500f42db\",\"total_score\":87},{\"bytes\":22484,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":70,\"coverage\":{\"access_and_admin\":[\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\"],\"error_learning\":[\"regression\",\"incident\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"pve01\",\"cluster\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"log\",\"journal\"],\"network_and_dns\":[\"network\",\"firewall\",\"tls\",\"certificate\"],\"storage\":[\"storage\",\"disk\"]},\"headings\":[],\"json_top_level_size\":17,\"json_top_level_type\":\"dict\",\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"path_score\":17,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"3778749ada56ab473aced25dec1ead241db039602a932e9017e943604478e6a4\",\"total_score\":87},{\"bytes\":38408,\"commit\":\"60f53ea6fe6724196802a46de3de19c7889a51cc\",\"content_score\":86,\"coverage\":{\"access_and_admin\":[\"login\",\"admin\",\"ssh\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"error_learning\":[\"regression\",\"incident\"],\"external_services\":[\"public\"],\"identity_and_topology\":[\"pve01\",\"cluster\",\"node\",\"quorum\",\"corosync\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\"],\"network_and_dns\":[\"network\",\"domain\"],\"repair_and_troubleshooting\":[\"repair\",\"diagnostic\",\"failure\"],\"storage\":[\"storage\"]},\"headings\":[],\"json_top_level_size\":2,\"json_top_level_type\":\"dict\",\"path\":\"errors/regression-cases.json\",\"path_score\":0,\"path_sensitive\":false,\"refs\":[\"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary\"],\"sensitive_findings\":[],\"sha256\":\"07c9854ab0232d1f2766cdab114d0d398a4dcc1a5b41ea7fde77646e5f42804e\",\"total_score\":86},{\"bytes\":61327,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"access\",\"login\",\"admin\",\"ssh\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"recovery\",\"rpo\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\",\"atomic\"],\"external_services\":[\"public\",\"nginx\"],\"guests_and_workloads\":[\"vmid\",\"container\",\"qemu\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"log\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"network\",\"dns\",\"domain\",\"certificate\"],\"repair_and_troubleshooting\":[\"failure\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"Services bootstrap snapshot — 2026-06-17\"},{\"level\":2,\"line\":3,\"title\":\"Scope\"},{\"level\":2,\"line\":9,\"title\":\"Edge VM\"},{\"level\":2,\"line\":19,\"title\":\"NetBird VPS\"},{\"level\":2,\"line\":34,\"title\":\"NetBird backup status\"},{\"level\":3,\"line\":37,\"title\":\"netbird-vps-backup.txt;STATUS=OK;SERVICE=netbird-vps-backup;TIMESTAMP_UTC=20260617T074922Z;VPS_IP=188.127.235.6;SNAPSHOT=/mnt/staging/netbird-vps-backups/snapshots/20260617T074922Z;LATEST_SYMLINK=/mnt/staging/netbird-vps-backups/snapshots/latest;FILES=2;SIZE=32M;SHA256=8e0c6538268b4e5dc463e008e59acb<BOUNDED_PROJECTION>\"},{\"level\":2,\"line\":40,\"title\":\"NetBird backup timers\"},{\"level\":2,\"line\":46,\"title\":\"Important follow-ups\"},{\"level\":2,\"line\":54,\"title\":\"NetBird Uptime Kuma monitors\"},{\"level\":2,\"line\":64,\"title\":\"NetBird homelab peers\"},{\"level\":3,\"line\":69,\"title\":\"pve01;HOST=pve01;SERVICE=active/enabled;WT0=wt0              UNKNOWN        100.100.131.41/16 [PRIVATE_IPV6]/64 ;STATUS=OS: linux/amd64;Daemon version: 0.72.4;CLI version: 0.72.4;Profile: default;Management: Connected;Signal: Connected;Relays: 2/2 Available;Nameservers: 0/0 <BOUNDED_PROJECTION>\"},{\"level\":2,\"line\":72,\"title\":\"NetBird peers health monitor\"},{\"level\":2,\"line\":88,\"title\":\"File Browser credential remediation\"},{\"level\":2,\"line\":98,\"title\":\"Proxmox private SSL via NetBird FQDN\"},{\"level\":2,\"line\":116,\"title\":\"File Browser backup, offhost sync, and restore validation\"},{\"level\":2,\"line\":150,\"title\":\"App stacks batch backup chain\"},{\"level\":2,\"line\":194,\"title\":\"Final backup and health baseline\"},{\"level\":2,\"line\":202,\"title\":\"Private NPMplus hosts via NetBird\"},{\"level\":2,\"line\":231,\"title\":\"Homepage VPN Authentik forward-auth\"},{\"level\":2,\"line\":244,\"title\":\"Homepage Authentik forward-auth rollback\"},{\"level\":2,\"line\":257,\"title\":\"Private VPN hosts safe baseline after Authentik rollback\"},{\"level\":2,\"line\":271,\"title\":\"Private VPN Hosts Kuma monitor\"},{\"level\":2,\"line\":289,\"title\":\"Private VPN Hosts health timer\"},{\"level\":2,\"line\":304,\"title\":\"Private VPN Hosts timer auto-cycle verified\"},{\"level\":2,\"line\":314,\"title\":\"Final ops snapshot — private VPN hosts\"},{\"level\":2,\"line\":326,\"title\":\"NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":348,\"title\":\"Corrected NPMplus + Kuma config backup chain\"},{\"level\":2,\"line\":367,\"title\":\"NPMplus + Kuma backup chain Kuma monitors\"},{\"level\":2,\"line\":382,\"title\":\"NPMplus + Kuma config backup timer\"},{\"level\":2,\"line\":398,\"title\":\"Authentik backup chain\"},{\"level\":2,\"line\":408,\"title\":\"Authentik backup chain Kuma monitors\"},{\"level\":2,\"line\":417,\"title\":\"Authentik backup timer\"},{\"level\":2,\"line\":431,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":441,\"title\":\"Gitea backup chain\"},{\"level\":2,\"line\":445,\"title\":\"Gitea backup chain Kuma monitors\"},{\"level\":2,\"line\":454,\"title\":\"Gitea backup timer\"},{\"level\":2,\"line\":465,\"title\":\"Vaultwarden backup chain\"},{\"level\":2,\"line\":475,\"title\":\"Vaultwarden backup chain Kuma monitors\"},{\"level\":2,\"line\":484,\"title\":\"Vaultwarden backup timer\"},{\"level\":2,\"line\":495,\"title\":\"Edge VM manual vzdump backup\"},{\"level\":2,\"line\":502,\"title\":\"Edge VM vzdump offhost copy\"},{\"level\":2,\"line\":508,\"title\":\"Edge VM vzdump restore verification\"},{\"level\":2,\"line\":515,\"title\":\"Edge VM vzdump Kuma monitors\"},{\"level\":2,\"line\":528,\"title\":\"Edge VM vzdump weekly timer\"},{\"level\":2,\"line\":543,\"title\":\"Immich media backup existing automation inventory\"},{\"level\":2,\"line\":553,\"title\":\"Immich media restore verification\"},{\"level\":2,\"line\":560,\"title\":\"Immich media restore Kuma monitor\"},{\"level\":2,\"line\":570,\"title\":\"Immich media restore Kuma monitor correction\"},{\"level\":2,\"line\":577,\"title\":\"P0 backup baseline closure\"},{\"level\":2,\"line\":589,\"title\":\"P1 Mail.ru Cloud offsite inventory\"},{\"level\":2,\"line\":651,\"title\":\"P1 Mail.ru Cloud rclone config drift resolved\"},{\"level\":2,\"line\":667,\"title\":\"P1 Mail.ru Cloud canary\"},{\"level\":2,\"line\":675,\"title\":\"P1 Mail.ru Cloud production payload inventory\"},{\"level\":2,\"line\":710,\"title\":\"P1 Mail.ru Cloud critical baseline upload\"},{\"level\":2,\"line\":720,\"title\":\"P1 Mail.ru Cloud Kuma monitors\"},{\"level\":2,\"line\":732,\"title\":\"P1 Mail.ru Cloud edge-vm chunked large upload\"},{\"level\":2,\"line\":742,\"title\":\"P1 Mail.ru Cloud Edge VM Kuma monitor\"},{\"level\":2,\"line\":753,\"title\":\"P1 Mail.ru Cloud offsite seed closure\"},{\"level\":2,\"line\":776,\"title\":\"P1 Mail.ru Cloud critical upload automation\"},{\"level\":2,\"line\":791,\"title\":\"P1 Mail.ru Cloud edge-vm upload automation\"},{\"level\":2,\"line\":807,\"title\":\"P1 Mail.ru Cloud automation and retention closure\"},{\"level\":2,\"line\":829,\"title\":\"P1 Mail.ru Cloud restore drill automation\"},{\"level\":2,\"line\":843,\"title\":\"P2 Disaster Recovery runbook\"},{\"level\":2,\"line\":853,\"title\":\"P2 Critical bundle bootstrap drill\"},{\"level\":2,\"line\":870,\"title\":\"P2 Disaster Recovery bootstrap closure\"},{\"level\":2,\"line\":892,\"title\":\"Vaultwarden isolated restore drill — 2026-06-18\"},{\"level\":2,\"line\":929,\"title\":\"Daily cluster status report — 2026-06-18\"},{\"level\":2,\"line\":985,\"title\":\"Edge VM timezone standardization — 2026-06-19\"},{\"level\":2,\"line\":1012,\"title\":\"Daily status extra checks for DIUN, Trivy and Loki/Alloy — 2026-06-19\"},{\"level\":2,\"line\":1047,\"title\":\"Trivy scan mode after 2026-06-19 update wave\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[\"sensitive-assignment\"],\"sha256\":\"c6bf25f6df69404a0305fc66f743f34b23dd49f53c434428d7e0ec1b86f71ed6\",\"total_score\":86},{\"bytes\":89904,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"content_score\":80,\"coverage\":{\"access_and_admin\":[\"admin\",\"console\",\"url\"],\"backup_and_restore\":[\"backup\",\"restore\",\"retention\"],\"change_safety\":[\"rollback\",\"sha256\"],\"external_services\":[\"public\"],\"guests_and_workloads\":[\"container\"],\"identity_and_topology\":[\"proxmox\",\"pve01\",\"cluster\",\"node\"],\"internal_services\":[\"lan\"],\"monitoring_and_logs\":[\"monitor\",\"alert\",\"metric\",\"grafana\",\"prometheus\"],\"network_and_dns\":[\"dns\",\"domain\",\"tls\",\"certificate\"],\"repair_and_troubleshooting\":[\"troubleshoot\"],\"storage\":[\"storage\",\"thin\",\"disk\"]},\"headings\":[{\"level\":1,\"line\":1,\"title\":\"P0 alert routing preflight\"}],\"path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"path_score\":6,\"path_sensitive\":false,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\",\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"sensitive_findings\":[],\"sha256\":\"26d58a53f500f685f7bf28a6074dbdda6b9d24c684b776e39c53add737cb4dab\",\"total_score\":86}],\"handbook_candidates_omitted\":20,\"history\":{\"log\":\"COMMIT\\tf9d3ba8caf65005605aa8aee2ede7e4e7e94ee49\\t2026-07-31T10:37:56+03:00\\thomelab-site-baseline\\tGRAM1: capture initial site baseline 20260731T071400Z\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\\nA\\tsites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\\n\\nCOMMIT\\tf12d914540d40b3c221786c81be0ec17f42c91a5\\t2026-07-20T00:16:16+03:00\\tHOMELAB Ops Reviewer\\tCR-2026-0017: record one-pass live inventory verification\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\td831f34685a9305412f949c1e845842af78661a1\\t2026-07-20T00:05:34+03:00\\tHOMELAB Ops Reviewer\\tCR-2026-0017: add unified homelab inventory foundation\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t60f53ea6fe6724196802a46de3de19c7889a51cc\\t2026-07-19T13:49:08+03:00\\tHOMELAB Bootstrap Reviewer\\tCR-2026-0015: add pve03 r8152 RX ring canary\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t25b275f96b54551e26f07516c72651d85f235ad0\\t2026-07-18T16:27:33+03:00\\thomelab-ops-bootstrap\\tCR-2026-0013: allow VM160 worker bootstrap transition\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\tf5b22d867ea467987008408e3fb1fb0e17fa7b2e\\t2026-07-18T14:17:33+03:00\\thomelab-ops-bootstrap\\tCR-2026-0012: add one-command Skladchik Cookie refresh runbook\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\tbb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9\\t2026-07-18T13:11:46+03:00\\thomelab-ops-bootstrap\\tCR-2026-0011: force fresh Skladchik Cookie before jar persistence\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t7bd1b050f8d64c7b55dfd51ead63f0adda87f2df\\t2026-07-18T10:34:25+03:00\\thomelab-ops-bootstrap\\tCR-2026-0010: separate current and target Skladchik edge SHAs\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t10a747b86ef498aabd3a71b1e32dfb6c80547ddb\\t2026-07-18T09:59:55+03:00\\thomelab-ops-bootstrap\\tCR-2026-0009: guard Skladchik monitor concurrency\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t1f7abe5acf856ad2a2abe10ef2a9452485edb073\\t2026-07-18T09:26:07+03:00\\thomelab-ops-bootstrap\\tCR-2026-0008: repair Skladchik rollback snapshot integrity\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\td399d24440f948b518761ecfd516521993861b43\\t2026-07-18T08:10:58+03:00\\thomelab-ops-bootstrap\\tCR-2026-0007: add controlled Skladchik reauthentication task\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t65855c4108dd0dd961803ad8233e5a805c00993b\\t2026-07-18T06:15:45+03:00\\thomelab-ops-bootstrap\\tCR-2026-0006: lock cluster cloud quorum failures\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\tb8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\\t2026-07-18T03:57:33+03:00\\tHOMELAB Bootstrap Reviewer\\tCR-2026-0005 prepare reviewed logrotate bootstrap clearance\\nM\\terrors/regression-cases.json\\n\\nCOMMIT\\t14d8bb0467e5890a7166444afda90a0185552eba\\t2026-07-16T01:29:16+03:00\\thomelab-ops-bootstrap\\tbootstrap homelab-ops v2\\nA\\terrors/regression-cases.json\\n<BOUNDED_PROJECTION><BOUNDED_PROJECTION>\",\"log_bytes\":7893,\"log_sha256\":\"6952e258f02107d8b918fe6d37d51146ba54c5a3fa27110434001f2046127c7e\",\"log_truncated\":false,\"paths\":[\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/homelab-cluster-context-live.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/homelab-cluster-context-live.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/discovery/domain_matches.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-current.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/RUNBOOK-DISASTER-RECOVERY-20260618.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/05-service-catalog.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/99-current-state-summary.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/05-service-catalog.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/99-current-state-summary.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-11-final-ci-no-regression-runbooks-inventory-20260626T043846Z.json\",\"errors/regression-cases.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/SERVICES-BOOTSTRAP-20260617.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/SERVICES-BOOTSTRAP-20260617.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p0-alert-routing-preflight-20260625T050439Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/runbooks/npmplus-route-change-safety-runbook-20260625T213126Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-05-crowdsec-lapi-monitoring-coverage-inventory-20260625T225709Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-ideal-cluster-program-init-20260625T221242Z.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/reports/mkdocs-refresh-discovery-20260621.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/00-restore-from-zero-for-beginners.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/runbooks/01-add-new-service.md\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/02_docs/operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p2-06-crowdsec-lapi-monitoring-implementation-preflight-20260625T230443Z.json\",\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/03_operations/p3-03-backup-coverage-audit-source-inventory-20260626T040630Z.json\"]},\"mandatory_error_artifacts\":{\"linter\":{\"paths\":[],\"present\":false},\"regression_registry\":{\"paths\":[\"errors/regression-cases.json\"],\"present\":true},\"repository_validator\":{\"paths\":[\"tools/validate_repo.py\"],\"present\":true},\"superseded_policy\":{\"paths\":[],\"present\":false},\"tests\":{\"paths\":[\"tests/fixtures/gitea-legacy-auth-permission.json\",\"tests/test_access_contexts.py\",\"tests/test_cr_2026_0005.py\",\"tests/test_cr_2026_0006.py\",\"tests/test_cr_2026_0006_vm160_task.py\",\"tests/test_cr_2026_0007_skladchik_reauth.py\",\"tests/test_cr_2026_0007_skladchik_semantic_repair.py\",\"tests/test_cr_2026_0008_skladchik_snapshot_integrity.py\",\"tests/test_cr_2026_0009_skladchik_concurrency_guard.py\",\"tests/test_cr_2026_0011_skladchik_cookie_jar_reset.py\",\"tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py\",\"tests/test_cr_2026_0013_vm160_worker_bootstrap_transition.py\",\"tests/test_cr_2026_0015_pve03_r8152_rx_ring_canary.py\",\"tests/test_cr_2026_0018_execution_boundary_preparation.py\",\"tests/test_inventory_foundation.py\",\"tests/test_live_verification.py\",\"tests/test_no_repeat_policy.py\",\"tests/test_reg_014_015.py\",\"tests/test_repository.py\"],\"present\":true}},\"scanned_commits\":[{\"candidate_files\":19,\"commit\":\"fe1221b06643db3b00a621b0230f92a46a4edc2b\",\"read_files\":19,\"refs\":[\"refs/heads/main\"],\"tree_files\":125},{\"candidate_files\":10,\"commit\":\"16e84298035f5e4ec7e2b7d39967ad5e40ea3d4b\",\"read_files\":10,\"refs\":[\"refs/heads/cr-2026-0006-cluster-cloud-quorum\"],\"tree_files\":66},{\"candidate_files\":32,\"commit\":\"1c20ac860cbdd2ca7a05ef63d7011ac5937a7e17\",\"read_files\":32,\"refs\":[\"refs/heads/cr-2026-0017-inventory-foundation\"],\"tree_files\":160},{\"candidate_files\":13,\"commit\":\"1f7abe5acf856ad2a2abe10ef2a9452485edb073\",\"read_files\":13,\"refs\":[\"refs/heads/cr-2026-0008-skladchik-snapshot-integrity\"],\"tree_files\":94},{\"candidate_files\":17,\"commit\":\"25b275f96b54551e26f07516c72651d85f235ad0\",\"read_files\":17,\"refs\":[\"refs/heads/cr-2026-0013-vm160-worker-bootstrap-transition\"],\"tree_files\":110},{\"candidate_files\":18,\"commit\":\"60f53ea6fe6724196802a46de3de19c7889a51cc\",\"read_files\":18,\"refs\":[\"refs/heads/cr-2026-0015-pve03-r8152-rx-ring-canary\"],\"tree_files\":127},{\"candidate_files\":2270,\"commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"read_files\":2267,\"refs\":[\"refs/heads/site-gram1-ru-baseline-canonical-20260731\"],\"tree_files\":4438},{\"candidate_files\":14,\"commit\":\"7bd1b050f8d64c7b55dfd51ead63f0adda87f2df\",\"read_files\":14,\"refs\":[\"refs/heads/cr-2026-0009-skladchik-concurrency-guard\"],\"tree_files\":99},{\"candidate_files\":7,\"commit\":\"b8a5cdb7f027c7738e1b3c5443e4bb97fad747dc\",\"read_files\":7,\"refs\":[\"refs/heads/cr-2026-0005-codex-bootstrap-activation\"],\"tree_files\":47},{\"candidate_files\":15,\"commit\":\"bb25a4acfdfa827345963d65e5e2c1fe2a3f8ba9\",\"read_files\":15,\"refs\":[\"refs/heads/cr-2026-0011-skladchik-cookie-jar-reset\"],\"tree_files\":102},{\"candidate_files\":12,\"commit\":\"d399d24440f948b518761ecfd516521993861b43\",\"read_files\":12,\"refs\":[\"refs/heads/cr-2026-0007-skladchik-controlled-reauth\"],\"tree_files\":91},{\"candidate_files\":16,\"commit\":\"f5b22d867ea467987008408e3fb1fb0e17fa7b2e\",\"read_files\":16,\"refs\":[\"refs/heads/cr-2026-0012-skladchik-cookie-refresh-runbook\"],\"tree_files\":107},{\"candidate_files\":2270,\"commit\":\"f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49\",\"read_files\":2267,\"refs\":[\"refs/heads/site-gram1-ru-baseline-20260731\"],\"tree_files\":4434}],\"scanned_unique_heads\":13},\"validation\":{\"unittest\":{\"duration_seconds\":0.121,\"rc\":1,\"stderr\":\"test_apply_exact_scope (test_cr_2026_0005.CR20260005Tests.test_apply_exact_scope) ... ok\\ntest_declared_phase_outputs (test_cr_2026_0005.CR20260005Tests.test_declared_phase_outputs) ... ok\\ntest_journal_pipeline_safety (test_cr_2026_0005.CR20260005Tests.test_journal_pipeline_safety) ... ok\\ntest_no_pmxcfs_or_remote_mutation (test_cr_2026_0005.CR20260005Tests.test_no_pmxcfs_or_remote_mutation) ... ok\\ntest_phase_guardrails (test_cr_2026_0005.CR20260005Tests.test_phase_guardrails) ... ok\\ntest_policy_markers (test_cr_2026_0005.CR20260005Tests.test_policy_markers) ... ok\\ntest_regression_cases (test_cr_2026_0005.CR20260005Tests.test_regression_cases) ... ok\\ntest_standard_seal (test_cr_2026_0005.CR20260005Tests.test_standard_seal) ... ok\\ntest_systemctl_failed_first_field (test_cr_2026_0005.CR20260005Tests.test_systemctl_failed_first_field) ... ok\\ntest_task_semantic_coherence (test_cr_2026_0005.CR20260005Tests.test_task_semantic_coherence) ... ok\\ntest_change_is_local_only (test_cr_2026_0006.CR20260006Tests.test_change_is_local_only) ... ok\\ntest_command_delivery_locks (test_cr_2026_0006.CR20260006Tests.test_command_delivery_locks) ... ok\\ntest_distinct_accounts (test_cr_2026_0006.CR20260006Tests.test_distinct_accounts) ... ok\\ntest_local_delete_fail_closed (test_cr_2026_0006.CR20260006Tests.test_local_delete_fail_closed) ... ok\\ntest_policy_contract (test_cr_2026_0006.CR20260006Tests.test_policy_contract) ... ok\\ntest_regression_cases (test_cr_2026_0006.CR20260006Tests.test_regression_cases) ... ok\\ntest_restore_contract (test_cr_2026_0006.CR20260006Tests.test_restore_contract) ... ok\\ntest_contract (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_contract) ... ok\\ntest_distinct_accounts_and_exact_mapping (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_distinct_accounts_and_exact_mapping) ... ok\\ntest_exact_path_and_symlink_guards (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_exact_path_and_symlink_guards) ... ok\\ntest_health_root_cause_evidence (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_health_root_cause_evidence) ... ok\\ntest_no_forbidden_delivery_or_hostkey_patterns (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_no_forbidden_delivery_or_hostkey_patterns) ... ok\\ntest_no_inline_remote_shell_program (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_no_inline_remote_shell_program) ... ok\\ntest_per_part_and_full_roundtrip_single_remote_pass (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_per_part_and_full_roundtrip_single_remote_pass) ... ok\\ntest_preflight_checks_all_execution_nodes_with_versioned_scripts (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_preflight_checks_all_execution_nodes_with_versioned_scripts) ... ok\\ntest_prepare_verifies_prepared_not_sealed (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_prepare_verifies_prepared_not_sealed) ... ok\\ntest_rollback_restores_remote_generation_health_and_symlink (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_rollback_restores_remote_generation_health_and_symlink) ... ok\\ntest_shell_syntax (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_shell_syntax) ... ok\\ntest_two_stage_seal_has_truthful_delete_order (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_two_stage_seal_has_truthful_delete_order) ... ok\\ntest_verify_queries_pve03_not_pve01_staging (test_cr_2026_0006_vm160_task.VM160CloudQuorumTaskTests.test_verify_queries_pve03_not_pve01_staging) ... ok\\ntest_contract (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_contract) ... ok\\ntest_edge_script_sha_is_exact_sha256 (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_edge_script_sha_is_exact_sha256) ... ok\\ntest_inline_python_policy_matches_linter_scope (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_inline_python_policy_matches_linter_scope) ... ok\\ntest_no_inline_remote_shell (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_no_inline_remote_shell) ... ok\\ntest_regression_lock (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_regression_lock) ... ok\\ntest_rollback_before_apply (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_rollback_before_apply) ... ok\\ntest_shell_syntax (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_shell_syntax) ... ok\\ntest_strict_hostkey_and_no_secret_material (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_strict_hostkey_and_no_secret_material) ... ok\\ntest_verify_requires_real_counts (test_cr_2026_0007_skladchik_reauth.SkladchikReauthTaskTests.test_verify_requires_real_counts) ... ok\\ntest_all_active_callers_are_versioned_and_strict (test_cr_2026_0007_skladchik_semantic_repair.SkladchikSemanticRepairTests.test_all_active_callers_are_versioned_and_strict) ... ok\\ntest_apply_installs_live_and_desired_assets (test_cr_2026_0007_skladchik_semantic_repair.SkladchikSemanticRepairTests.test_apply_installs_live_and_desired_assets) ... ok\\nte\",\"stderr_sha256\":\"301889d5996ed9723faa0f3f808c32efd9bb4247ffc81d261743a16876e5ea73\",\"stderr_truncated\":false,\"stdout\":\"\",\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"validate_repo\":{\"duration_seconds\":0.031,\"rc\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_sha256\":\"8d9b6d16bd0883193db77e5e0d348f4f97fa99cfc3e1107e09f47a0af945d7ec\",\"stdout_truncated\":false}}},\"gitea_changed\":false,\"handbook_assessment\":{\"canonical_ambiguous\":true,\"canonical_commit\":\"76da439c1f69f405b434e20b2a3da1c11dc92e38\",\"canonical_found\":true,\"canonical_path\":\"sites/gram1.ru/baseline/20260731T071400Z/hosts/local/source/01_homelab-configs-worktree/docs/operations/homelab-cluster-context-live.md\",\"canonical_score\":105,\"canonical_sha256\":\"d6f2711673479b28d945553565b8aed9cbb77eb6f46b78028b0397d972f34fab\",\"coverage_missing\":[],\"coverage_present\":[\"access_and_admin\",\"backup_and_restore\",\"change_safety\",\"error_learning\",\"external_services\",\"guests_and_workloads\",\"identity_and_topology\",\"internal_services\",\"monitoring_and_logs\",\"network_and_dns\",\"repair_and_troubleshooting\",\"storage\"],\"live_inventory_evidence\":{\"backup_job_count\":0,\"guest_count\":0,\"node_count\":0,\"running_service_units_total\":47,\"storage_rows\":0},\"requires_update\":true},\"live_cluster\":{\"backup_jobs\":[],\"cluster_status\":null,\"commands\":{\"hostname\":{\"rc\":0,\"value\":\"pve01.gram1.ru\"},\"pvecm_status\":{\"excerpt\":\"\",\"rc\":255,\"sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\"},\"pveversion\":{\"excerpt\":\"proxmox-ve: 9.2.0 (running kernel: 7.0.12-1-pve)\\npve-manager: 9.2.3 (running version: 9.2.3/d0fde103346cf89a)\\nproxmox-kernel-helper: 9.2.0\\nproxmox-kernel-7.0: 7.0.12-1\\nproxmox-kernel-7.0.12-1-pve-signed: 7.0.12-1\\nproxmox-kernel-7.0.6-2-pve-signed: 7.0.6-2\\nproxmox-kernel-7.0.2-6-pve-signed: 7.0.2-6\\nceph-fuse: 19.2.3-pve4\\ncorosync: 3.1.10-pve2\\ncriu: 4.1.1-1\\nfrr-pythontools: 10.6.1-1+pve2\\nifupdown2: 3.3.0-1+pmx12\\nintel-microcode: 3.20251111.1~deb13u1\\nksm-control-daemon: 1.5-1\\nlibjs-extjs: 7.0.0-5\\nlibproxmox-acme-perl: 1.7.1\\nlibproxmox-backup-qemu0: 2.0.2\\nlibproxmox-rs-perl: 0.4.1\\nlibpve-access-control: 9.1.1\\nlibpve-apiclient-perl: 3.4.2\\nlibpve-cluster-api-perl: 9.1.6\\nlibpve-cluster-perl: 9.1.6\\nlibpve-common-perl: 9.1.16\\nlibpve-guest-common-perl: 6.0.4\\nlibpve-http-server-perl: 6.0.5\\nlibpve-network-perl: 1.6.6\\nlibpve-notify-perl: 9.1.6\\nlibpve-rs-perl: 0.15.3\\nlibpve-storage-perl: 9.1.6\\nlibspice-server1: 0.15.2-1+b1\\nlvm2: 2.03.31-2+pmx1\\nlxc-pve: 7.0.0-2\\nlxcfs: 7.0.0-pve1\\nnovnc-pve: 1.7.0-1\\nproxmox-backup-client: 4.2.2-1\\nproxmox-backup-file-restore: 4.2.2-1\\nproxmox-backup-restore-image: 1.0.0\\nproxmox-firewall: 1.2.3\\nproxmox-kernel-helper: 9.2.0\\nproxmox-mail-forward: 1.0.3\\nproxmox-mini-journalreader: 1.6\\nproxmox-offline-mirror-helper: 0.7.4\\nproxmox-widget-toolkit: 5.2.5\\npve-cluster: 9.1.6\\npve-container: 6.1.10\\npve-docs: 9.2.2\\npve-edk2-firmware: 4.2025.05-2\\npve-esxi-import-tools: 1.0.1\\npve-firewall: 6.0.4\\npve-firmware: 3.18-4\\npve-ha-manager: 5.2.4\\npve-i18n: 3.8.0\\npve-qemu-kvm: 11.0.0-4\\npve-xtermjs: 6.0.0-1\\nqemu-server: 9.1.17\\nsmartmontools: 7.5-pve2\\nspiceterm: 3.4.2\\nswtpm: 0.8.0+pve3\\nvncterm: 1.9.2\\nzfsutils-linux: 2.4.2-pve1\\n\",\"rc\":0,\"sha256\":\"19ba1ac5d9e5ee6299326b5ad7d5b334a03b23b84a97f3cbdf0f1cf7748d1c0a\"}},\"endpoint_meta\":{\"backup_jobs\":{\"duration_seconds\":0.46,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"cluster_status\":{\"duration_seconds\":0.462,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"ha_current\":{\"duration_seconds\":0.471,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"ha_groups\":{\"duration_seconds\":0.466,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"ha_resources\":{\"duration_seconds\":0.461,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"nodes\":{\"duration_seconds\":0.459,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"replication\":{\"duration_seconds\":0.467,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"resources_storage\":{\"duration_seconds\":0.461,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"resources_vm\":{\"duration_seconds\":0.478,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false},\"storage_config\":{\"duration_seconds\":0.46,\"rc\":255,\"stderr\":\"ipcc_send_rec[1] failed: Unknown error -1\\nipcc_send_rec[2] failed: Unknown error -1\\nipcc_send_rec[3] failed: Unknown error -1\\nUnable to load access control list: Unknown error -1\\n\",\"stderr_sha256\":\"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228\",\"stderr_truncated\":false,\"stdout_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_truncated\":false}},\"guests\":[],\"ha_current\":null,\"ha_groups\":null,\"ha_resources\":null,\"nodes\":[],\"replication\":null,\"running_service_units\":[{\"description\":\"chrony, an NTP client/server\",\"unit\":\"chrony.service\"},{\"description\":\"Corosync Cluster Engine\",\"unit\":\"corosync.service\"},{\"description\":\"Regular background program processing daemon\",\"unit\":\"cron.service\"},{\"description\":\"D-Bus System Message Bus\",\"unit\":\"dbus.service\"},{\"description\":\"Device-mapper event daemon\",\"unit\":\"dm-event.service\"},{\"description\":\"Getty on tty1\",\"unit\":\"getty@tty1.service\"},{\"description\":\"Homelab command adapter\",\"unit\":\"homelab-command-adapter.service\"},{\"description\":\"Homelab command portal\",\"unit\":\"homelab-command-portal.service\"},{\"description\":\"Homelab health HTTP endpoint 9101\",\"unit\":\"homelab-health-http-9101.service\"},{\"description\":\"Homelab health HTTP endpoint\",\"unit\":\"homelab-health-http.service\"},{\"description\":\"Homelab immutable capability reader v3\",\"unit\":\"homelab-reader-v3.service\"},{\"description\":\"Homelab automatic fixed result anchor\",\"unit\":\"homelab-result-lookup.service\"},{\"description\":\"Homelab Scrutiny SMART dashboard\",\"unit\":\"homelab-scrutiny.service\"},{\"description\":\"Kernel Samepage Merging (KSM) Tuning Daemon\",\"unit\":\"ksmtuned.service\"},{\"description\":\"LXC Container Monitoring Daemon\",\"unit\":\"lxc-monitord.service\"},{\"description\":\"FUSE filesystem for LXC\",\"unit\":\"lxcfs.service\"},{\"description\":\"NetBird mesh network client\",\"unit\":\"netbird.service\"},{\"description\":\"pNFS block layout mapping daemon\",\"unit\":\"nfs-blkmap.service\"},{\"description\":\"Network UPS Tools - device driver for NUT device 'cyberpower'\",\"unit\":\"nut-driver@cyberpower.service\"},{\"description\":\"Network UPS Tools - power device monitor and shutdown controller\",\"unit\":\"nut-monitor.service\"},{\"description\":\"Network UPS Tools - power devices information server\",\"unit\":\"nut-server.service\"},{\"description\":\"Postfix Mail Transport Agent (main/default instance)\",\"unit\":\"postfix.service\"},{\"description\":\"Prometheus exporter for machine metrics\",\"unit\":\"prometheus-node-exporter.service\"},{\"description\":\"Proxmox nftables firewall\",\"unit\":\"proxmox-firewall.service\"},{\"description\":\"The Proxmox VE cluster filesystem\",\"unit\":\"pve-cluster.service\"},{\"description\":\"PVE LXC Container: 110\",\"unit\":\"pve-container@110.service\"},{\"description\":\"PVE LXC Container: 112\",\"unit\":\"pve-container@112.service\"},{\"description\":\"Proxmox VE firewall\",\"unit\":\"pve-firewall.service\"},{\"description\":\"PVE Cluster HA Resource Manager Daemon\",\"unit\":\"pve-ha-crm.service\"},{\"description\":\"PVE Local HA Resource Manager Daemon\",\"unit\":\"pve-ha-lrm.service\"},{\"description\":\"Proxmox VE LXC Syscall Daemon\",\"unit\":\"pve-lxc-syscalld.service\"},{\"description\":\"PVE API Daemon\",\"unit\":\"pvedaemon.service\"},{\"description\":\"Proxmox VE firewall logger\",\"unit\":\"pvefw-logger.service\"},{\"description\":\"PVE API Proxy Server\",\"unit\":\"pveproxy.service\"},{\"description\":\"Proxmox VE scheduler\",\"unit\":\"pvescheduler.service\"},{\"description\":\"PVE Status Daemon\",\"unit\":\"pvestatd.service\"},{\"description\":\"PVE Qemu Event Daemon\",\"unit\":\"qmeventd.service\"},{\"description\":\"RPC bind portmap service\",\"unit\":\"rpcbind.service\"},{\"description\":\"Data caching daemon for rrdtool\",\"unit\":\"rrdcached.service\"},{\"description\":\"Self Monitoring and Reporting Technology (SMART) Daemon\",\"unit\":\"smartmontools.service\"},{\"description\":\"PVE SPICE Proxy Server\",\"unit\":\"spiceproxy.service\"},{\"description\":\"OpenBSD Secure Shell server\",\"unit\":\"ssh.service\"},{\"description\":\"Journal Service\",\"unit\":\"systemd-journald.service\"},{\"description\":\"User Login Management\",\"unit\":\"systemd-logind.service\"},{\"description\":\"Rule-based Manager for Device Events and Files\",\"unit\":\"systemd-udevd.service\"},{\"description\":\"Proxmox VE watchdog multiplexer\",\"unit\":\"watchdog-mux.service\"},{\"description\":\"ZFS Event Daemon (zed)\",\"unit\":\"zfs-zed.service\"}],\"running_service_units_total\":47,\"storage_config\":[],\"storages\":[]},\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RESOLVE_ONLY_PROVEN_BLOCKING_FINDINGS_BEFORE_MUTATION\",\"output_truncated_in_json\":false,\"prior_exact_failure\":{\"capsule_sha256\":\"e1b501473c532362e379e21e3ffb86a8c86c0c5b993c51ed32ed98ddc1eda157\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-GITEA-ERROR-READ-ONLY-20260805T062500Z\",\"correction\":\"candidate scan now uses the already-enforced complete tree limit instead of the disproven 600-file sublimit\",\"error\":\"repository complete scan limits were hit: candidate_file_limit:76da439c1f69f405b434e20b2a3da1c11dc92e38:2270; candidate_file_limit:f9d3ba8caf65005605aa8aee2ede7e4e7e94ee49:2270\",\"error_type\":\"RuntimeError\",\"rc\":1,\"rollback_restored\":null,\"rollback_started\":false,\"runner_json_sha256\":\"0ec0065f247a5731fb21cf43eb73e871779f40941e235a3108513b4cb5d860fe\",\"status\":\"FAIL\"},\"production_changed\":false,\"rc\":0,\"read_only\":true,\"result_json_sha256_before_hash_field\":\"bd5de9eb6188e90f9ac67327bf77ef5b78699292a46c3308333ed7c6fdf730ae\",\"result_projection\":{\"bounded\":true,\"bytes_before_hash\":294474,\"compaction_applied\":true},\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"status\":\"OK\"}\n"
}