{ "schema_version": 1, "channel": "homelab-runtime", "command_id": "HOMELAB-CLUSTER-KB-V1-EXTERNAL-DNS-TLS-GITEA-ROUTE-PROBE-READ-ONLY-20260805T120500Z", "status": "OK", "rc": 0, "host": "pve01", "mode": "verify", "component": "cluster-knowledge-base-error-system", "started_at_utc": "2026-08-05T12:15:56Z", "finished_at_utc": "2026-08-05T12:15:56Z", "reference_register_checked": true, "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", "error_register_checked": true, "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83", "command_sha256": "906ae82c320561f5adc8e6cad76be836c23d57ccd4fede88f5be6c7374feffd2", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, "change_declared": false, "result_contract_valid": true, "result_contract_status": null, "result_contract_error": null, "command_rc": 0, "changes_made": false, "rollback_started": false, "rollback_restored": null, "mutation_outcome": "NO_MUTATION", "sanitized": true, "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, "raw_evidence_sha256": "de264857bc353abb684c0721414f153afb1ca52fc770dff2beaeaa2c2708ec21", "sanitized_output_sha256": "de264857bc353abb684c0721414f153afb1ca52fc770dff2beaeaa2c2708ec21", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-EXTERNAL-DNS-TLS-GITEA-ROUTE-PROBE-READ-ONLY-20260805T120500Z\",\"command_rc\":0,\"mutation_outcome\":\"NO_MUTATION\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"status\":\"OK\",\"version\":1}\n{\"authorization_header_sent\":false,\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-EXTERNAL-DNS-TLS-GITEA-ROUTE-PROBE-READ-ONLY-20260805T120500Z\",\"command_rc\":0,\"cookies_sent\":false,\"correction_of_previous_logic_gap\":{\"exact_fix\":\"resolve the external hostname, validate TLS with SNI, fingerprint bounded HTTP responses, query only unauthenticated read-only Gitea API routes after endpoint proof, and correlate raw addresses only in memory with current host and Proxmox guest addresses\",\"proven_gap\":\"no reverse-proxy runtime for git.gram1.ru was visible in the authoritative host process tree\",\"regression_test\":\"owner is accepted only from an exact repository API match; header values, response bodies and addresses are never emitted\"},\"credentials_sent\":false,\"dns\":{\"address_count\":1,\"addresses\":[{\"family\":4,\"scope\":\"private\",\"sha256\":\"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834\"}],\"available\":true,\"invalid_line_count\":0,\"probe\":{\"duration_seconds\":0.002,\"rc\":0,\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_bytes\":84,\"stdout_sha256\":\"d50c5f28e19b1bed5be2d0644d817c7363c5adabdaba2ca13ccd4be3c0a72402\",\"stdout_truncated\":false},\"raw_addresses_emitted\":false},\"error_fingerprint\":\"4386418883fecf6bcd72b7578656cc2670252b1407aee4cf799f68a2c4c81b18\",\"gitea_endpoint_verified\":true,\"host_route_match\":{\"available\":true,\"match_count\":0,\"matches\":[],\"parse_ok\":true,\"probe\":{\"duration_seconds\":0.001,\"rc\":0,\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_bytes\":5120,\"stdout_sha256\":\"0e068a003da26f71b2a6e5708405317b436dca875735018c837d61223ccc4956\",\"stdout_truncated\":false},\"raw_addresses_emitted\":false},\"latest_exact_result_basis\":{\"capsule_sha256\":\"11496ba512483980dd255b87f80cf1287e3577bd658519df69f4c33402a4ea84\",\"changes_made\":false,\"command_id\":\"HOMELAB-CLUSTER-KB-V1-REVERSE-PROXY-UPSTREAM-ROUTE-PROBE-READ-ONLY-20260805T115700Z\",\"command_rc\":0,\"control_plane_error\":null,\"error_fingerprint\":\"d0e3f6d1868de96b69186b1648ad45421abeb47f2efeedf75d7adf02ab97c1bf\",\"mutation_outcome\":\"NO_MUTATION\",\"next_action\":\"RUN_ONE_READ_ONLY_EXTERNAL_DNS_TLS_ROUTE_PROBE\",\"output_complete\":true,\"output_sha256\":\"504ad5dbad1e41f319c56995c907211bf1ea6e8bc30f6a17835c05023ffc4723\",\"output_truncated_in_json\":false,\"rc\":0,\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"NO_REVERSE_PROXY_RUNTIME_FOUND_IN_HOST_VISIBLE_PROCESS_TREE\",\"runner_document_rc\":0,\"runner_json_sha256\":\"1d1c1e0d5a03e82465a678f293032fffd1aa55df4faf670fc250871e10c44d03\",\"runner_rc\":0,\"runner_text_sha256\":\"d19742c795c6ce20b0b19417cf994940b32cb67256576c09c4a7c7994af904bd\",\"runner_wrapper_matches_document\":true,\"status\":\"OK\"},\"mutation_outcome\":\"NO_MUTATION\",\"network_request_count\":3,\"network_requests_made\":true,\"next_action\":\"RUN_ONE_READ_ONLY_GITEA_PUBLIC_OWNER_AND_AUTH_CONTEXT_DISCOVERY\",\"output_truncated_in_json\":false,\"pre_command_known_error_gate\":{\"checked\":true,\"count\":26,\"ids\":[\"candidate-scan-limit-20260805\",\"runner-wrapper-mismatch-20260805\",\"gitea-owner-hardcoded-20260805\",\"gitea-git-auth-unavailable-20260805\",\"pvesh-adapter-context-unreadable-20260805\",\"gitea-process-self-match-20260805\",\"sanitize-non-string-attributeerror-20260805\",\"reader-path-env-misclassified-as-route-20260805\",\"reader-loopback-only-probe-20260805\",\"reader-capability-not-secret-20260805\",\"reader-systemd-unit-parsed-as-python-20260805\",\"reader-helper-contract-coverage-gap-20260805\",\"reader-capability-root-empty-suffix-404-20260805\",\"reader-generic-suffix-missed-exact-operation-20260805\",\"reader-feed-500-without-origin-20260805\",\"reader-sandbox-global-binding-undefined-20260805\",\"reader-negative-control-exception-polluted-classification-20260805\",\"reader-result-regex-candidate-not-proven-20260805\",\"reader-fake-dependency-contract-incomplete-20260805\",\"reader-manifest-alias-dataflow-gap-20260805\",\"reader-result-output-bound-after-compaction-20260805\",\"reader-result-reference-invalid-json-assumption-20260805\",\"reader-file-backed-feed-serves-manifest-only-20260805\",\"reader-exact-text-gitea-marker-context-unmapped-20260805\",\"reader-gitea-marker-detail-false-positive-pve-no-candidate-20260805\",\"reverse-proxy-runtime-not-host-visible-20260805\"]},\"prevention_test\":{\"must_run_before_future_gitea_commands\":true,\"name\":\"external_dns_tls_gitea_route_preflight\",\"requirements\":[\"verify exact prior result identity and complete known-error register\",\"resolve git.gram1.ru without constructing a repository owner\",\"validate TLS certificate with SNI and default trust store\",\"send no Authorization, Cookie or credential material\",\"perform only GET requests to bounded public read-only routes\",\"accept repository identity only from an exact homelab-ops API record\",\"keep raw DNS, peer and guest addresses only in memory\",\"emit no response body, certificate body, secret header value or private address\"]},\"private_addresses_emitted\":false,\"proxmox_guest_route_match\":{\"authoritative\":true,\"errors\":[],\"guest_count\":5,\"match_count\":0,\"matches\":[],\"raw_addresses_emitted\":false},\"public_repository_match_count\":0,\"pvedaemon_identity\":{\"probe\":{\"duration_seconds\":0.007,\"rc\":0,\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stderr_truncated\":false,\"stdout_bytes\":284,\"stdout_sha256\":\"8193a63509e825e5d63983689cfa0c365fef9a840ff92983113df47795c763b4\",\"stdout_truncated\":false},\"process\":{\"comm\":\"pvedaemon\",\"exe_basename\":\"perl\",\"pid\":1799,\"valid\":true},\"properties\":{\"ActiveState\":\"active\",\"ExecStart_sha256\":\"a3150f62d0b148854d825fc1ad00044d56247d9a482d99c87460dd73434f094e\",\"FragmentPath_sha256\":\"da8690b37d8c88bdcde49e5a9a300f998ba1411fb56fee338891fbafa3619da3\",\"LoadState\":\"loaded\",\"MainPID\":\"1799\",\"SubState\":\"running\"},\"valid\":true},\"raw_response_bodies_emitted\":false,\"rc\":0,\"read_only\":true,\"ready_for_exact_repository_content_analysis\":false,\"ready_for_matched_guest_storage_probe\":false,\"real_file_mutations_made\":false,\"regression_tests\":{\"checks\":{\"address_token_does_not_emit_raw\":true,\"exact_repository_filter\":true,\"header_values_hashed\":true,\"owner_not_hardcoded\":true,\"private_address_classification\":true,\"same_host_location_detected\":true},\"passed\":true},\"repository_exact_match_count\":0,\"repository_matches\":[],\"repository_search_probes\":[{\"address\":{\"family\":4,\"scope\":\"private\",\"sha256\":\"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834\"},\"body_bytes\":21,\"body_emitted\":false,\"body_sha256\":\"45b93ccefd22e5ec4796dc8d5173e3060566fec357528dfe20b3bd814d9bc430\",\"body_truncated\":false,\"duration_seconds\":0.049,\"exact_repository_match_count\":0,\"headers\":{\"authorization_header_received\":false,\"gitea_header_names\":[],\"header_count\":14,\"header_names\":[\"access-control-expose-headers\",\"cache-control\",\"connection\",\"content-length\",\"content-type\",\"date\",\"origin-agent-cluster\",\"referrer-policy\",\"vary\",\"x-content-type-options\",\"x-dns-prefetch-control\",\"x-frame-options\",\"x-permitted-cross-domain-policies\",\"x-total-count\"],\"location\":null,\"raw_header_values_emitted\":false,\"selected_value_hashes\":{\"content-type\":\"ce58f2c43b3e44fcde114a5337223939cb05fd032fdc1d01d096014708e5b904\"},\"set_cookie_names\":[]},\"json_parse_ok\":true,\"json_top_keys\":[\"data\",\"ok\"],\"json_top_type\":\"dict\",\"ok\":true,\"status\":200,\"tls\":{\"alpn\":null,\"certificate_bytes\":935,\"certificate_sha256\":\"3167a6916d6fad2e15d1c19af823f314e5e4abfc08e3ba20ee2cd79557897ff9\",\"cipher\":\"TLS_AES_256_GCM_SHA384\",\"issuer_sha256\":\"a2cb00a1e3ca4f683f54d985c0e520bed9e9222db68ada11fc02bbb8928ca430\",\"not_after\":\"Sep 13 14:36:55 2026 GMT\",\"not_before\":\"Jun 15 14:36:56 2026 GMT\",\"san_dns_count\":1,\"san_dns_set_sha256\":\"92feea413ab6bd72fdd8b9102d872777d284d002a6be3e5323ca6e848105ee88\",\"subject_sha256\":\"73734b3d8b5d72ebc682048e49206f83650c4dcdd39985f7035e770bfe75bb39\",\"target_san_present\":true,\"tls_version\":\"TLSv1.3\"}}],\"result_projection\":{\"bytes\":11275,\"max_bytes\":30000,\"steps\":[]},\"rollback_restored\":null,\"rollback_started\":false,\"root_cause_classification\":\"EXTERNAL_GITEA_ENDPOINT_VERIFIED_REPOSITORY_NOT_DISCOVERED_ANONYMOUSLY\",\"root_probes\":[{\"address\":{\"family\":4,\"scope\":\"private\",\"sha256\":\"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834\"},\"body_bytes\":14474,\"body_emitted\":false,\"body_marker_counts\":{\"csrf\":0,\"gitea\":28,\"repository\":0},\"body_sha256\":\"cd60c8c9dbd3185fdb9007c4a563330ffe6dc7304a4848200828226c462097e0\",\"body_truncated\":false,\"duration_seconds\":0.089,\"headers\":{\"authorization_header_received\":false,\"gitea_header_names\":[],\"header_count\":13,\"header_names\":[\"cache-control\",\"connection\",\"content-type\",\"date\",\"origin-agent-cluster\",\"referrer-policy\",\"set-cookie\",\"transfer-encoding\",\"vary\",\"x-content-type-options\",\"x-dns-prefetch-control\",\"x-frame-options\",\"x-permitted-cross-domain-policies\"],\"location\":null,\"raw_header_values_emitted\":false,\"selected_value_hashes\":{\"content-type\":\"5e30ae15588f8f014141a57300f8f4b77a0491527336d05b413fc899e803db1a\"},\"set_cookie_names\":[\"i_like_gitea\"]},\"ok\":true,\"reason_sha256\":\"565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3\",\"status\":200,\"tls\":{\"alpn\":null,\"certificate_bytes\":935,\"certificate_sha256\":\"3167a6916d6fad2e15d1c19af823f314e5e4abfc08e3ba20ee2cd79557897ff9\",\"cipher\":\"TLS_AES_256_GCM_SHA384\",\"issuer_sha256\":\"a2cb00a1e3ca4f683f54d985c0e520bed9e9222db68ada11fc02bbb8928ca430\",\"not_after\":\"Sep 13 14:36:55 2026 GMT\",\"not_before\":\"Jun 15 14:36:56 2026 GMT\",\"san_dns_count\":1,\"san_dns_set_sha256\":\"92feea413ab6bd72fdd8b9102d872777d284d002a6be3e5323ca6e848105ee88\",\"subject_sha256\":\"73734b3d8b5d72ebc682048e49206f83650c4dcdd39985f7035e770bfe75bb39\",\"target_san_present\":true,\"tls_version\":\"TLSv1.3\"}}],\"schema\":1,\"status\":\"OK\",\"version_probes\":[{\"address\":{\"family\":4,\"scope\":\"private\",\"sha256\":\"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834\"},\"body_bytes\":20,\"body_emitted\":false,\"body_sha256\":\"1965a151d0917ac3201bff84c8fa774c01c3b53b40e70ac0b1ffce0b4ea84284\",\"body_truncated\":false,\"duration_seconds\":0.048,\"headers\":{\"authorization_header_received\":false,\"gitea_header_names\":[],\"header_count\":12,\"header_names\":[\"cache-control\",\"connection\",\"content-length\",\"content-type\",\"date\",\"origin-agent-cluster\",\"referrer-policy\",\"vary\",\"x-content-type-options\",\"x-dns-prefetch-control\",\"x-frame-options\",\"x-permitted-cross-domain-policies\"],\"location\":null,\"raw_header_values_emitted\":false,\"selected_value_hashes\":{\"content-type\":\"ce58f2c43b3e44fcde114a5337223939cb05fd032fdc1d01d096014708e5b904\"},\"set_cookie_names\":[]},\"json_parse_ok\":true,\"json_top_keys\":[\"version\"],\"json_top_type\":\"dict\",\"ok\":true,\"status\":200,\"tls\":{\"alpn\":null,\"certificate_bytes\":935,\"certificate_sha256\":\"3167a6916d6fad2e15d1c19af823f314e5e4abfc08e3ba20ee2cd79557897ff9\",\"cipher\":\"TLS_AES_256_GCM_SHA384\",\"issuer_sha256\":\"a2cb00a1e3ca4f683f54d985c0e520bed9e9222db68ada11fc02bbb8928ca430\",\"not_after\":\"Sep 13 14:36:55 2026 GMT\",\"not_before\":\"Jun 15 14:36:56 2026 GMT\",\"san_dns_count\":1,\"san_dns_set_sha256\":\"92feea413ab6bd72fdd8b9102d872777d284d002a6be3e5323ca6e848105ee88\",\"subject_sha256\":\"73734b3d8b5d72ebc682048e49206f83650c4dcdd39985f7035e770bfe75bb39\",\"target_san_present\":true,\"tls_version\":\"TLSv1.3\"},\"version_present\":true,\"version_sha256\":\"3b1c8cabc1ef17c66eee01a79e66212adb30d60c9678631ee0f59bf3d7c1404e\"}]}\n" }