CHAT_OUTPUT_BEGIN
COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=newfi-stagingedge-public-ingress-topology-rca-v6
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=8c1deae24d2c2e50bd7eca16ab18b10c78eb623b43884a033be8abcb060328de
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=475297be47aae03d0ef913ed8d3c90d3f0eabe4b0a86b02e6cccd5e805171e4f
SANITIZED_OUTPUT_SHA256=2740dbcc0eb7d919991be01db110d70f85f1c7ab59bcebf520b56960fa9399f9
OUTPUT_BEGIN
ERROR_REGISTER_CHECK=OK
REFERENCE_CHECK=OK
AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
NEWFI42_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
NEWFI42_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735
NEWFI42_TRUST_FILE_PRESENT=true
NEWFI42_TRUST_FILE_SHA256=5ff80132df401240519f48091ed62c139183c325000ef7dd253e7f676a539b2c
NEWFI42_TRUST_EDGEVM_MARKER=true
NEWFI42_TRUST_REJECTED_MARKER=false
NEWFI42_ERROR_RELEVANT_LINE_COUNT=50
NEWFI42_ERROR_RELEVANT_LINES=[{"line":19,"text":"CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo."},{"line":28,"text":"VM130 edge-vm has secondary disk backup=0 risk."},{"line":52,"text":"edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo."},{"line":170,"text":"41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm."},{"line":171,"text":"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm."},{"line":172,"text":"Fix: build reconciliation from pve01 and edge-vm health files by correct owner."},{"line":213,"text":"## ROUTER_CLI_STDIN_APPLY_FAILURE_20260630"},{"line":214,"text":"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix."},{"line":215,"text":"- Evidence: [LONG_REDACTED].txt."},{"line":219,"text":"## [LONG_REDACTED]"},{"line":221,"text":"- Evidence: [LONG_REDACTED].txt showed COMMAND_COUNT=1."},{"line":224,"text":"## [LONG_REDACTED]"},{"line":225,"text":"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list."},{"line":226,"text":"- Evidence: [LONG_REDACTED].txt."},{"line":228,"text":"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes."},{"line":232,"text":"- Evidence: [LONG_REDACTED].txt has blank [LONG_REDACTED] fields."},{"line":235,"text":"## [LONG_REDACTED]"},{"line":236,"text":"- Context: while moving Moscow Router monitor rules to _WEBADMIN_Bridge1, two _WEBADMIN_Bridge0 Nextcloud Talk TURN rules were accidentally removed."},{"line":238,"text":"- Verification proof: 399_ROUTER_ACL_RESTORE_AFTER_UI_PROOF.txt."},{"line":239,"text":"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing."},{"line":241,"text":"## [LONG_REDACTED]"},{"line":242,"text":"- Context: proof 400 tested Moscow router HTTPS monitor from Homepage container with custom Node lookup callback."},{"line":247,"text":"## [LONG_REDACTED]"},{"line":248,"text":"- Context: Moscow Router Homepage monitor after ACL fix."},{"line":250,"text":"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths."},{"line":251,"text":"- Impact: Homepage siteMonitor cannot be made green via direct router HTTP URL until router web service allows the Bridge1/Proxmox/protected segment or an explicit safe monitor endpoint is used."},{"line":255,"text":"- Context: installing edge-vm Moscow router health endpoint."},{"line":261,"text":"## [LONG_REDACTED]"},{"line":262,"text":"- Context: Moscow Router Homepage siteMonitor attempt using http://[PRIVATE_IP]:5080."},{"line":264,"text":"- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm."},{"line":265,"text":"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage."},{"line":267,"text":"## [LONG_REDACTED]"},{"line":268,"text":"- Context: applying Moscow Router Homepage siteMonitor health endpoint."},{"line":273,"text":"## [LONG_REDACTED]"},{"line":274,"text":"- Context: applying Moscow Router Homepage health endpoint."},{"line":276,"text":"- Evidence: proof 408 showed SyntaxError in /tmp/homepage-router-moscow-apply-fixed.py."},{"line":582,"text":"- Context: pvepro.ru root/www currently point to the Mailcow VPS and return Mailcow with TLS hostname mismatch."},{"line":583,"text":"- Decision: because pve01 has no SSH key access to the external VPS, do not modify the VPS. Instead move only pvepro.ru and www.pvepro.ru A records to edge and serve an edge landing page."},{"line":598,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":599,"text":"- Current limitation: there is no safe private remote access path to the dacha router yet."},{"line":600,"text":"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet."},{"line":604,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":605,"text":"- Current limitation: there is no safe private remote access path to the dacha router yet."},{"line":606,"text":"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet."},{"line":610,"text":"- Context: configuring private management path for taftauto.ru dacha router."},{"line":612,"text":"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually."},{"line":613,"text":"- Rule: do not open router public admin or certificate deployment until WireGuard handshake is proven."},{"line":626,"text":"- Fix: rebuild SmartApe under External Homelabs with 2-space item indentation, remove Router Moscow, rebuild Sites category."},{"line":647,"text":"## [LONG_REDACTED]"},{"line":648,"text":"- Previous apply looked for Russian Router card name, but active Homepage Useful group contains Router and Public Domain."}]
NEWFI42_REFERENCE_RELEVANT_LINE_COUNT=50
NEWFI42_REFERENCE_RELEVANT_LINES=[{"line":14,"text":"- VM130 edge-vm | pve03 | running | KEEP"},{"line":75,"text":"NOTE edge-vm disk scsi1 backup=0 risk must be documented"},{"line":90,"text":"HEALTH_NOT_OK item=ingress-dns-route-slo.txt line=STATUS=WARN"},{"line":149,"text":"- У VM130 edge-vm есть риск: дополнительный диск backup=0."},{"line":166,"text":"- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host."},{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":234,"text":"- WAN DHCP observed in router log: 95.84.154.183/23, gateway 95.84.154.1."},{"line":235,"text":"- ISP DNS observed in router log: 77.37.251.33, 77.37.255.30."},{"line":282,"text":"- Default router: [PRIVATE_IP]."},{"line":312,"text":"- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm."},{"line":315,"text":"### NAT / port forwarding"},{"line":324,"text":"- _WEBADMIN_GigabitEthernet1 permits admin PC [PRIVATE_IP] outbound TCP 80/443."},{"line":327,"text":"### Router management"},{"line":333,"text":"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26."},{"line":339,"text":"### Router services"},{"line":354,"text":"### Router automation warning"},{"line":357,"text":"- Automation must use router CLI syntax, not bash syntax."},{"line":366,"text":"- edge-vm: no UPS/NUT/APCUPSD integration discovered."},{"line":371,"text":"- NetBird service is active on pve01, pve02, pve03 and edge-vm."},{"line":376,"text":"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16."},{"line":395,"text":"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs."},{"line":396,"text":"- pve01 owns many [LONG_REDACTED] VPS/rclone/sops/scrutiny jobs."},{"line":455,"text":"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening an"},{"line":456,"text":"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBi"},{"line":459,"text":"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03."},{"line":531,"text":"- Main active workload: VM130 edge-vm."},{"line":545,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":560,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":575,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":590,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":597,"text":"### VM130 edge-vm"},{"line":600,"text":"- Name: edge-vm."},{"line":608,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":626,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":643,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":653,"text":"## [LONG_REDACTED]"},{"line":672,"text":"- git.gram1.ru -> [PRIVATE_IP]."},{"line":682,"text":"### Router ingress"},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP]."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on [PRIVATE_IP]."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host [PRIVATE_IP]."},{"line":686,"text":"- NPMplus admin listener is bound to localhost on edge-vm, [PRIVATE_IP]:81; public disabled legacy host npm.gram1.ru exists but enabled=0."},{"line":689,"text":"- Host: edge-vm, [PRIVATE_IP]."},{"line":694,"text":"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus."},{"line":705,"text":"- git.gram1.ru -> http://[PRIVATE_IP]:3002, cert=29, ssl_forced=1, enabled=1."},{"line":754,"text":"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55."},{"line":762,"text":"- NPMplus schema/listen inventory: [LONG_REDACTED].txt."},{"line":769,"text":"- Host: edge-vm, IP [PRIVATE_IP]."},{"line":774,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"line":826,"text":"- Ingress/security: npmplus, socket-proxy, crowdsec."}]
NEWFI42_TRUST_RELEVANT_LINE_COUNT=37
NEWFI42_TRUST_RELEVANT_LINES=[{"line":1,"text":"# NetBird VPS trust readiness"},{"line":14,"text":"public_ip=188.127.235.6"},{"line":21,"text":"netbird_vps_backup_ok=1"},{"line":22,"text":"netbird_vps_offhost_ok=1"},{"line":23,"text":"netbird_vps_restore_ok=1"},{"line":27,"text":"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved."},{"line":37,"text":"--- HOST=188.127.235.6"},{"line":39,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)"},{"line":40,"text":"KNOWN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)"},{"line":41,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)"},{"line":43,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ED25519)"},{"line":44,"text":"KEYSCAN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] 188.127.235.6 (RSA)"},{"line":45,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ECDSA)"},{"line":63,"text":"REMOTE_HOSTNAME=edge-vm"},{"line":71,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)"},{"line":72,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)"},{"line":73,"text":"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)"},{"line":77,"text":"REMOTE_HOSTNAME=edge-vm"},{"line":85,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)"},{"line":86,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)"},{"line":87,"text":"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)"},{"line":102,"text":"PUBLIC_STRICT   ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'"},{"line":103,"text":"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking."},{"line":107,"text":"--- [LONG_REDACTED].txt"},{"line":108,"text":"STATUS=OK TS=2026-07-07T15:15:14Z TYPE=external-probe-vps BAD=0 WARN=0 MODE=STRATEGY_ONLY DEPLOYED=NO [LONG_REDACTED] [LONG_REDACTED] BACKUP_HOSTKEYS=no PVE01_PUBLIC_SMOKE_BAD=0 INDEPENDENT_RUNNER=missing [LONG_REDACTED].md"},{"line":109,"text":"--- [LONG_REDACTED].txt"},{"line":111,"text":"SERVICE=netbird-vps-backup"},{"line":113,"text":"VPS_IP=188.127.235.6"},{"line":114,"text":"[LONG_REDACTED]"},{"line":115,"text":"[LONG_REDACTED]"},{"line":119,"text":"--- [LONG_REDACTED].txt"},{"line":121,"text":"SERVICE=netbird-vps-offhost"},{"line":124,"text":"[LONG_REDACTED]"},{"line":129,"text":"--- [LONG_REDACTED].txt"},{"line":131,"text":"SERVICE=netbird-vps-restore-validation"},{"line":134,"text":"[LONG_REDACTED].tgz"},{"line":153,"text":"edge-vm service=active/enabled wt0_ip=100.100.60.182/16 management=yes signal=yes peers=6/9 Connected"}]
NEWFI42_TEXT_FILES_SCANNED=336
NEWFI42_TOPOLOGY_MATCH_FILE_COUNT=50
NEWFI42_TOPOLOGY_MATCH_FILES_TRUNCATED=false
NEWFI42_TOPOLOGY_MATCH_FILES=[{"path":"/etc/pve/.rrd","tags":["EDGE_VM"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md.bak-corrected-20260630T185336Z","tags":["ROUTER"]},{"path":"/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","tags":["REJECTED_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md","tags":["ROUTER"]},{"path":"/etc/pve/31_HOMELAB_REFERENCE.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md","tags":["REJECTED_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_CLUSTER_BACKLOG.md","tags":["EDGE_VM","ROUTER"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_GAP_CLASSIFICATION.md","tags":["ROUTER"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md","tags":["PUBLIC_IP","EDGE_VM","STAGING_HOST","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/etc/pve/priv/authorized_keys","tags":["EDGE_VM","NAT_FORWARD"]},{"path":"/etc/pve/nodes/pve03/qemu-server/130.conf","tags":["EDGE_VM"]},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","tags":["REJECTED_IP","EDGE_VM","NAT_FORWARD"]},{"path":"/var/lib/homelab-netbird-vps-trust/latest.md","tags":["REJECTED_IP","EDGE_VM"]},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","tags":["REJECTED_IP","EDGE_VM"]},{"path":"/srv/homelab-ops/observed/cluster-guests.json","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/observed/source-snapshots/dependency-map-latest.tsv","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/inventory/access-paths.json","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/changes/CR-2026-0081/home-forward-retire-package.sha256","tags":["PUBLIC_80_443"]},{"path":"/srv/homelab-ops/changes/CR-2026-0018/design.md","tags":["NAT_FORWARD"]},{"path":"/srv/homelab-ops/changes/CR-2026-0080/task-package.sha256","tags":["NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-vm150-rebuild-v2/task.json","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-status","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-monthly-selftest-watch","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft","tags":["PUBLIC_IP","NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft","tags":["PUBLIC_IP","NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/README.txt","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py","tags":["PUBLIC_IP","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/README.txt","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md","tags":["PUBLIC_IP","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-18-gitea-edge-publisher-v3-design-v1.1.md","tags":["NAT_FORWARD","TUNNEL"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md","tags":["PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md","tags":["PUBLIC_IP","EDGE_VM","ROUTER"]},{"path":"/srv/homelab-ops/kb/AI_CONTEXT.md","tags":["PUBLIC_IP","EDGE_VM"]},{"path":"/srv/homelab-ops/kb/inventory/guests.json","tags":["EDGE_VM","NAT_FORWARD","TUNNEL"]},{"path":"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py","tags":["PUBLIC_IP","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_turn_dns_retire.py","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py","tags":["PUBLIC_IP","ROUTER"]}]
NEWFI42_OPS_GIT_STATUS_RC=0
NEWFI42_OPS_GIT_STATUS_SHA256=5fbcb2990ad25e368c12219bf3ddca36e464d044e7acac16696fa8cd54159185
NEWFI42_OPS_GIT_HEAD_RC=0
NEWFI42_OPS_GIT_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579
NEWFI42_NETWORK_RELATED_UNIT_QUERY_RC=0
NEWFI42_NETWORK_RELATED_UNITS=[{"unit":"\u25cf","load":"gssproxy.service","active":"not-found","sub":"inactive"},{"unit":"netbird-peers-health.service","load":"loaded","active":"inactive","sub":"dead"},{"unit":"netbird.service","load":"loaded","active":"active","sub":"running"},{"unit":"pveproxy.service","load":"loaded","active":"active","sub":"running"},{"unit":"spiceproxy.service","load":"loaded","active":"active","sub":"running"},{"unit":"systemd-ask-password-wall.service","load":"loaded","active":"inactive","sub":"dead"}]
NEWFI42_NFT_QUERY_RC=0
NEWFI42_NFT_RELEVANT_RULE_COUNT=0
NEWFI42_NFT_RELEVANT_LOCATIONS=[]
NEWFI42_ROUTE_TO_PUBLIC_IP_RC=0
NEWFI42_ROUTE_TO_PUBLIC_IP={"dev":"vmbr0","gateway_present":true,"gateway_sha256":"4f9da1283166a1e9f4e6bc7dd240c76aef85772177f717f92abb6e8e2bb8de90","prefsrc_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9"}
NEWFI42_DNS_A={"newfi-staging.gram1.ru":{"ips":["185.225.35.6"],"sources":["getent","dig"]},"chat.gram1.ru":{"ips":["[PRIVATE_IP]"],"sources":["getent","dig"]},"git.gram1.ru":{"ips":["[PRIVATE_IP]"],"sources":["getent","dig"]},"newfi.ru":{"ips":["185.225.35.6"],"sources":["getent","dig"]}}
NEWFI42_DNS_STAGE_SHARES_IP_WITH_CHAT=false
NEWFI42_DNS_STAGE_SHARES_IP_WITH_GIT=false
NEWFI42_AUTHORITY_FORWARDING_ASSERTION_PRESENT=true
NEWFI42_LOCAL_FORWARDING_RELATED_FILE_EVIDENCE=true
NEWFI42_EXPLICIT_PUBLIC_IP_CONFIG_REFERENCE=true
NEWFI42_DECISION=PUBLIC_INGRESS_CONTROL_PLANE_REFERENCE_FOUND_REVIEW_EXACT_MATCHED_PATHS_BEFORE_FIX
NEWFI42_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735
NEWFI42_KNOWN_HOSTS_UNCHANGED=true
NEWFI42_CHANGES_MADE=false
NEWFI42_MUTATION_SCOPE=NONE_READ_ONLY
NEWFI42_RCA_EXECUTION=PASS

OUTPUT_END
CHAT_OUTPUT_END
