homelab-admin/homelab-public-context
1
0
Fork 0
Code Activity
Files
assistant-runtime
homelab-public-context/runtime/history/HOMELAB-CLUSTER-KB-V1-EXTERNAL-DNS-TLS-GITEA-ROUTE-PROBE-READ-ONLY-20260805T120500Z.txt
T

35 lines
12 KiB
Plaintext
Raw Permalink Blame History

CHAT_OUTPUT_BEGIN
COMMAND_ID=HOMELAB-CLUSTER-KB-V1-EXTERNAL-DNS-TLS-GITEA-ROUTE-PROBE-READ-ONLY-20260805T120500Z
STATUS=OK
RC=0
HOST=pve01
MODE=verify
COMPONENT=cluster-knowledge-base-error-system
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
COMMAND_SHA256=906ae82c320561f5adc8e6cad76be836c23d57ccd4fede88f5be6c7374feffd2
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=de264857bc353abb684c0721414f153afb1ca52fc770dff2beaeaa2c2708ec21
SANITIZED_OUTPUT_SHA256=de264857bc353abb684c0721414f153afb1ca52fc770dff2beaeaa2c2708ec21
OUTPUT_BEGIN
HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-EXTERNAL-DNS-TLS-GITEA-ROUTE-PROBE-READ-ONLY-20260805T120500Z","command_rc":0,"mutation_outcome":"NO_MUTATION","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"status":"OK","version":1}
{"authorization_header_sent":false,"changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-EXTERNAL-DNS-TLS-GITEA-ROUTE-PROBE-READ-ONLY-20260805T120500Z","command_rc":0,"cookies_sent":false,"correction_of_previous_logic_gap":{"exact_fix":"resolve the external hostname, validate TLS with SNI, fingerprint bounded HTTP responses, query only unauthenticated read-only Gitea API routes after endpoint proof, and correlate raw addresses only in memory with current host and Proxmox guest addresses","proven_gap":"no reverse-proxy runtime for git.gram1.ru was visible in the authoritative host process tree","regression_test":"owner is accepted only from an exact repository API match; header values, response bodies and addresses are never emitted"},"credentials_sent":false,"dns":{"address_count":1,"addresses":[{"family":4,"scope":"private","sha256":"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834"}],"available":true,"invalid_line_count":0,"probe":{"duration_seconds":0.002,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":84,"stdout_sha256":"d50c5f28e19b1bed5be2d0644d817c7363c5adabdaba2ca13ccd4be3c0a72402","stdout_truncated":false},"raw_addresses_emitted":false},"error_fingerprint":"4386418883fecf6bcd72b7578656cc2670252b1407aee4cf799f68a2c4c81b18","gitea_endpoint_verified":true,"host_route_match":{"available":true,"match_count":0,"matches":[],"parse_ok":true,"probe":{"duration_seconds":0.001,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":5120,"stdout_sha256":"0e068a003da26f71b2a6e5708405317b436dca875735018c837d61223ccc4956","stdout_truncated":false},"raw_addresses_emitted":false},"latest_exact_result_basis":{"capsule_sha256":"11496ba512483980dd255b87f80cf1287e3577bd658519df69f4c33402a4ea84","changes_made":false,"command_id":"HOMELAB-CLUSTER-KB-V1-REVERSE-PROXY-UPSTREAM-ROUTE-PROBE-READ-ONLY-20260805T115700Z","command_rc":0,"control_plane_error":null,"error_fingerprint":"d0e3f6d1868de96b69186b1648ad45421abeb47f2efeedf75d7adf02ab97c1bf","mutation_outcome":"NO_MUTATION","next_action":"RUN_ONE_READ_ONLY_EXTERNAL_DNS_TLS_ROUTE_PROBE","output_complete":true,"output_sha256":"504ad5dbad1e41f319c56995c907211bf1ea6e8bc30f6a17835c05023ffc4723","output_truncated_in_json":false,"rc":0,"rollback_restored":null,"rollback_started":false,"root_cause_classification":"NO_REVERSE_PROXY_RUNTIME_FOUND_IN_HOST_VISIBLE_PROCESS_TREE","runner_document_rc":0,"runner_json_sha256":"1d1c1e0d5a03e82465a678f293032fffd1aa55df4faf670fc250871e10c44d03","runner_rc":0,"runner_text_sha256":"d19742c795c6ce20b0b19417cf994940b32cb67256576c09c4a7c7994af904bd","runner_wrapper_matches_document":true,"status":"OK"},"mutation_outcome":"NO_MUTATION","network_request_count":3,"network_requests_made":true,"next_action":"RUN_ONE_READ_ONLY_GITEA_PUBLIC_OWNER_AND_AUTH_CONTEXT_DISCOVERY","output_truncated_in_json":false,"pre_command_known_error_gate":{"checked":true,"count":26,"ids":["candidate-scan-limit-20260805","runner-wrapper-mismatch-20260805","gitea-owner-hardcoded-20260805","gitea-git-auth-unavailable-20260805","pvesh-adapter-context-unreadable-20260805","gitea-process-self-match-20260805","sanitize-non-string-attributeerror-20260805","reader-path-env-misclassified-as-route-20260805","reader-loopback-only-probe-20260805","reader-capability-not-secret-20260805","reader-systemd-unit-parsed-as-python-20260805","reader-helper-contract-coverage-gap-20260805","reader-capability-root-empty-suffix-404-20260805","reader-generic-suffix-missed-exact-operation-20260805","reader-feed-500-without-origin-20260805","reader-sandbox-global-binding-undefined-20260805","reader-negative-control-exception-polluted-classification-20260805","reader-result-regex-candidate-not-proven-20260805","reader-fake-dependency-contract-incomplete-20260805","reader-manifest-alias-dataflow-gap-20260805","reader-result-output-bound-after-compaction-20260805","reader-result-reference-invalid-json-assumption-20260805","reader-file-backed-feed-serves-manifest-only-20260805","reader-exact-text-gitea-marker-context-unmapped-20260805","reader-gitea-marker-detail-false-positive-pve-no-candidate-20260805","reverse-proxy-runtime-not-host-visible-20260805"]},"prevention_test":{"must_run_before_future_gitea_commands":true,"name":"external_dns_tls_gitea_route_preflight","requirements":["verify exact prior result identity and complete known-error register","resolve git.gram1.ru without constructing a repository owner","validate TLS certificate with SNI and default trust store","send no Authorization, Cookie or credential material","perform only GET requests to bounded public read-only routes","accept repository identity only from an exact homelab-ops API record","keep raw DNS, peer and guest addresses only in memory","emit no response body, certificate body, secret header value or private address"]},"private_addresses_emitted":false,"proxmox_guest_route_match":{"authoritative":true,"errors":[],"guest_count":5,"match_count":0,"matches":[],"raw_addresses_emitted":false},"public_repository_match_count":0,"pvedaemon_identity":{"probe":{"duration_seconds":0.007,"rc":0,"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_bytes":284,"stdout_sha256":"8193a63509e825e5d63983689cfa0c365fef9a840ff92983113df47795c763b4","stdout_truncated":false},"process":{"comm":"pvedaemon","exe_basename":"perl","pid":1799,"valid":true},"properties":{"ActiveState":"active","ExecStart_sha256":"a3150f62d0b148854d825fc1ad00044d56247d9a482d99c87460dd73434f094e","FragmentPath_sha256":"da8690b37d8c88bdcde49e5a9a300f998ba1411fb56fee338891fbafa3619da3","LoadState":"loaded","MainPID":"1799","SubState":"running"},"valid":true},"raw_response_bodies_emitted":false,"rc":0,"read_only":true,"ready_for_exact_repository_content_analysis":false,"ready_for_matched_guest_storage_probe":false,"real_file_mutations_made":false,"regression_tests":{"checks":{"address_token_does_not_emit_raw":true,"exact_repository_filter":true,"header_values_hashed":true,"owner_not_hardcoded":true,"private_address_classification":true,"same_host_location_detected":true},"passed":true},"repository_exact_match_count":0,"repository_matches":[],"repository_search_probes":[{"address":{"family":4,"scope":"private","sha256":"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834"},"body_bytes":21,"body_emitted":false,"body_sha256":"45b93ccefd22e5ec4796dc8d5173e3060566fec357528dfe20b3bd814d9bc430","body_truncated":false,"duration_seconds":0.049,"exact_repository_match_count":0,"headers":{"authorization_header_received":false,"gitea_header_names":[],"header_count":14,"header_names":["access-control-expose-headers","cache-control","connection","content-length","content-type","date","origin-agent-cluster","referrer-policy","vary","x-content-type-options","x-dns-prefetch-control","x-frame-options","x-permitted-cross-domain-policies","x-total-count"],"location":null,"raw_header_values_emitted":false,"selected_value_hashes":{"content-type":"ce58f2c43b3e44fcde114a5337223939cb05fd032fdc1d01d096014708e5b904"},"set_cookie_names":[]},"json_parse_ok":true,"json_top_keys":["data","ok"],"json_top_type":"dict","ok":true,"status":200,"tls":{"alpn":null,"certificate_bytes":935,"certificate_sha256":"3167a6916d6fad2e15d1c19af823f314e5e4abfc08e3ba20ee2cd79557897ff9","cipher":"TLS_AES_256_GCM_SHA384","issuer_sha256":"a2cb00a1e3ca4f683f54d985c0e520bed9e9222db68ada11fc02bbb8928ca430","not_after":"Sep 13 14:36:55 2026 GMT","not_before":"Jun 15 14:36:56 2026 GMT","san_dns_count":1,"san_dns_set_sha256":"92feea413ab6bd72fdd8b9102d872777d284d002a6be3e5323ca6e848105ee88","subject_sha256":"73734b3d8b5d72ebc682048e49206f83650c4dcdd39985f7035e770bfe75bb39","target_san_present":true,"tls_version":"TLSv1.3"}}],"result_projection":{"bytes":11275,"max_bytes":30000,"steps":[]},"rollback_restored":null,"rollback_started":false,"root_cause_classification":"EXTERNAL_GITEA_ENDPOINT_VERIFIED_REPOSITORY_NOT_DISCOVERED_ANONYMOUSLY","root_probes":[{"address":{"family":4,"scope":"private","sha256":"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834"},"body_bytes":14474,"body_emitted":false,"body_marker_counts":{"csrf":0,"gitea":28,"repository":0},"body_sha256":"cd60c8c9dbd3185fdb9007c4a563330ffe6dc7304a4848200828226c462097e0","body_truncated":false,"duration_seconds":0.089,"headers":{"authorization_header_received":false,"gitea_header_names":[],"header_count":13,"header_names":["cache-control","connection","content-type","date","origin-agent-cluster","referrer-policy","set-cookie","transfer-encoding","vary","x-content-type-options","x-dns-prefetch-control","x-frame-options","x-permitted-cross-domain-policies"],"location":null,"raw_header_values_emitted":false,"selected_value_hashes":{"content-type":"5e30ae15588f8f014141a57300f8f4b77a0491527336d05b413fc899e803db1a"},"set_cookie_names":["i_like_gitea"]},"ok":true,"reason_sha256":"565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3","status":200,"tls":{"alpn":null,"certificate_bytes":935,"certificate_sha256":"3167a6916d6fad2e15d1c19af823f314e5e4abfc08e3ba20ee2cd79557897ff9","cipher":"TLS_AES_256_GCM_SHA384","issuer_sha256":"a2cb00a1e3ca4f683f54d985c0e520bed9e9222db68ada11fc02bbb8928ca430","not_after":"Sep 13 14:36:55 2026 GMT","not_before":"Jun 15 14:36:56 2026 GMT","san_dns_count":1,"san_dns_set_sha256":"92feea413ab6bd72fdd8b9102d872777d284d002a6be3e5323ca6e848105ee88","subject_sha256":"73734b3d8b5d72ebc682048e49206f83650c4dcdd39985f7035e770bfe75bb39","target_san_present":true,"tls_version":"TLSv1.3"}}],"schema":1,"status":"OK","version_probes":[{"address":{"family":4,"scope":"private","sha256":"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834"},"body_bytes":20,"body_emitted":false,"body_sha256":"1965a151d0917ac3201bff84c8fa774c01c3b53b40e70ac0b1ffce0b4ea84284","body_truncated":false,"duration_seconds":0.048,"headers":{"authorization_header_received":false,"gitea_header_names":[],"header_count":12,"header_names":["cache-control","connection","content-length","content-type","date","origin-agent-cluster","referrer-policy","vary","x-content-type-options","x-dns-prefetch-control","x-frame-options","x-permitted-cross-domain-policies"],"location":null,"raw_header_values_emitted":false,"selected_value_hashes":{"content-type":"ce58f2c43b3e44fcde114a5337223939cb05fd032fdc1d01d096014708e5b904"},"set_cookie_names":[]},"json_parse_ok":true,"json_top_keys":["version"],"json_top_type":"dict","ok":true,"status":200,"tls":{"alpn":null,"certificate_bytes":935,"certificate_sha256":"3167a6916d6fad2e15d1c19af823f314e5e4abfc08e3ba20ee2cd79557897ff9","cipher":"TLS_AES_256_GCM_SHA384","issuer_sha256":"a2cb00a1e3ca4f683f54d985c0e520bed9e9222db68ada11fc02bbb8928ca430","not_after":"Sep 13 14:36:55 2026 GMT","not_before":"Jun 15 14:36:56 2026 GMT","san_dns_count":1,"san_dns_set_sha256":"92feea413ab6bd72fdd8b9102d872777d284d002a6be3e5323ca6e848105ee88","subject_sha256":"73734b3d8b5d72ebc682048e49206f83650c4dcdd39985f7035e770bfe75bb39","target_san_present":true,"tls_version":"TLSv1.3"},"version_present":true,"version_sha256":"3b1c8cabc1ef17c66eee01a79e66212adb30d60c9678631ee0f59bf3d7c1404e"}]}
OUTPUT_END
CHAT_OUTPUT_END
View Git Blame Copy Permalink