diff --git a/runtime/history/SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1.json b/runtime/history/SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1.json
new file mode 100644
index 00000000..523f417f
--- /dev/null
+++ b/runtime/history/SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "spb-vm130-egress-policy-rca",
+  "started_at_utc": "2026-09-22T16:57:42Z",
+  "finished_at_utc": "2026-09-22T16:57:46Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "f865795e23fb24fac99743dd841426764468398337cbd94620e4375f63f0e7aa",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340",
+  "sanitized_output_sha256": "d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "SPB9128_RCA={\"guest\":{\"ok\":true,\"data\":{\"hostname\":\"edge-vm\",\"netbird_service\":\"active\",\"default_v4\":true,\"targets\":{\"acme-v02.api.letsencrypt.org\":[{\"ip_hash\":\"5786251088dd9c13\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"5a49954884866ec5\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}}],\"api.cloudflare.com\":[{\"ip_hash\":\"b0744ce2a1b023db\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"7cb5cee0ebb33f07\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}},{\"ip_hash\":\"c6984b66666387ed\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"cfffc0defbd50741\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}},{\"ip_hash\":\"969b1202bb584ec5\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"9d264f8ab0166b91\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}},{\"ip_hash\":\"11f9ecc608d7a6f3\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"6f64c9a460831f9e\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}}],\"1.1.1.1\":[{\"ip_hash\":\"f1412386aa8db257\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"1cf8f6049ad12605\"},\"tcp53\":{\"ok\":false,\"error\":\"OSError\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}}],\"8.8.8.8\":[{\"ip_hash\":\"838c4c2573848f58\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"f67ace164f3792ff\"},\"tcp53\":{\"ok\":false,\"error\":\"OSError\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}}]},\"ip_rules\":[\"0:\\tfrom all lookup local\",\"100:\\tfrom [ADDR] lookup main\",\"101:\\tfrom [ADDR] lookup 17777\",\"105:\\tfrom all lookup main suppress_prefixlength 0\",\"110:\\tnot from all fwmark 0x1bd00 lookup 7120\",\"32766:\\tfrom all lookup main\",\"32767:\\tfrom all lookup default\"],\"ip_routes\":[\"default dev wg-edge01 table 17777 scope link \",\"default dev wt0 table 7120 \",\"default via [ADDR] dev eth0 proto static \",\"[ADDR] dev wg-taftauto proto kernel scope link src [ADDR] \",\"[ADDR] dev wg-edge01 proto kernel scope link src [ADDR] \",\"[ADDR] dev br-915a81681c3e proto kernel scope link src [ADDR] \",\"[ADDR] dev wt0 proto kernel scope link src [ADDR] \",\"[ADDR] dev docker0 proto kernel scope link src [ADDR] linkdown \",\"[ADDR] dev br-4d894f9e427b proto kernel scope link src [ADDR] linkdown \",\"[ADDR] dev br-d41b3e918fbc proto kernel scope link src [ADDR] \",\"[ADDR] dev br-a4e31561a8d5 proto kernel scope link src [ADDR] \",\"[ADDR] via [ADDR] dev eth0 src [ADDR] \",\"[ADDR] dev eth0 proto kernel scope link src [ADDR] \",\"[ADDR] dev br-f43db13d76c4 proto kernel scope link src [ADDR] \",\"[ADDR] dev br-8122fec51f39 proto kernel scope link src [ADDR] \",\"[ADDR] dev br-5f66e1018bdd proto kernel scope link src [ADDR] \",\"local [ADDR] dev wg-taftauto table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev wg-taftauto table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev wg-edge01 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev wg-edge01 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-915a81681c3e table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-915a81681c3e table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev wt0 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev wt0 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev lo table local proto kernel scope host src [ADDR] \",\"local [ADDR] dev lo table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev lo table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev docker0 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev docker0 table local proto kernel scope link src [ADDR] linkdown \",\"local [ADDR] dev br-4d894f9e427b table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-4d894f9e427b table local proto kernel scope link src [ADDR] linkdown \",\"local [ADDR] dev br-d41b3e918fbc table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-d41b3e918fbc table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-a4e31561a8d5 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-a4e31561a8d5 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev eth0 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev eth0 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-f43db13d76c4 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-f43db13d76c4 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-8122fec51f39 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-8122fec51f39 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-5f66e1018bdd table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-5f66e1018bdd table local proto kernel scope link src [ADDR] \"],\"sysctls\":{\"net.ipv4.conf.all.rp_filter\":\"0\",\"net.ipv4.conf.all.src_valid_mark\":\"1\",\"net.ipv4.ip_forward\":\"1\"},\"nft_output\":[[\"\\tchain OUTPUT { # handle 6\",\"\\t\\ttype nat hook output priority dstnat; policy accept;\",\"\\t\\tip daddr != [ADDR] fib daddr type local counter packets 155792 bytes 9523752 jump DOCKER # handle 7\",\"\\t}\"],[\"\\tchain OUTPUT { # handle 4\",\"\\t\\ttype nat hook output priority dstnat; policy accept;\",\"\\t\\tip6 daddr != [ADDR6] fib daddr type local counter packets 0 bytes 0 jump DOCKER # handle 5\",\"\\t}\"],[\"\\tchain netbird-raw-out { # handle 52\",\"\\t\\ttype filter hook output priority raw; policy accept;\",\"\\t\\toifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54\",\"\\t\\toifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55\",\"\\t}\"]],\"nft_netbird\":[[\"\\tchain netbird-rt-fwd { # handle 31\",\"\\t\\tct state established,related counter packets 2112153 bytes 3401847160 accept # handle 37\",\"\\t}\"],[\"\\tchain netbird-rt-postrouting { # handle 32\",\"\\t\\ttype nat hook postrouting priority srcnat - 1; policy accept;\",\"\\t\\tmeta mark 0x0001bd21 oifname != \\\"lo\\\" counter packets 0 bytes 0 masquerade # handle 38\",\"\\t\\tmeta mark 0x0001bd22 oifname \\\"wt0\\\" counter packets 0 bytes 0 masquerade # handle 39\",\"\\t}\"],[\"\\tchain netbird-rt-redirect { # handle 33\",\"\\t\\ttype nat hook prerouting priority dstnat; policy accept;\",\"\\t}\"],[\"\\tchain netbird-mangle-postrouting { # handle 34\",\"\\t\\ttype filter hook postrouting priority mangle; policy accept;\",\"\\t\\toifname \\\"wt0\\\" ct state new ct mark set 0x0001bd11 # handle 42\",\"\\t}\"],[\"\\tchain netbird-mangle-prerouting { # handle 35\",\"\\t\\ttype filter hook prerouting priority mangle; policy accept;\",\"\\t\\tiifname \\\"wt0\\\" ct state new ct mark set 0x0001bd10 # handle 41\",\"\\t\\tiifname \\\"wt0\\\" ip saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 61\",\"\\t\\tiifname \\\"wt0\\\" ip saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 64\",\"\\t\\tiifname \\\"wt0\\\" ip saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 67\",\"\\t}\"],[\"\\tchain netbird-mangle-forward { # handle 36\",\"\\t\\ttype filter hook forward priority mangle; policy accept;\",\"\\t\\toifname \\\"wt0\\\" tcp flags syn counter packets 12281 bytes 736860 tcp option maxseg size > 1240 tcp option maxseg size set 1240 # handle 40\",\"\\t}\"],[\"\\tchain netbird-acl-input-rules { # handle 43\",\"\\t\\tct state established,related counter packets 7605032 bytes 6107862874 accept # handle 44\",\"\\t\\tip saddr @nb0000001 accept # handle 59\",\"\\t\\tip saddr @nb0000043 accept # handle 63\",\"\\t\\tip saddr @nb0000055 accept # handle 66\",\"\\t}\"],[\"\\tchain netbird-acl-input-filter { # handle 45\",\"\\t\\ttype filter hook input priority filter; policy accept;\",\"\\t\\tiifname \\\"wt0\\\" jump netbird-acl-input-rules # handle 46\",\"\\t\\tiifname \\\"wt0\\\" drop # handle 47\",\"\\t}\"],[\"\\tchain netbird-acl-forward-filter { # handle 48\",\"\\t\\ttype filter hook forward priority filter; policy accept;\",\"\\t\\tmeta mark 0x0001bd20 accept # handle 51\",\"\\t\\tiifname \\\"wt0\\\" jump netbird-rt-fwd # handle 49\",\"\\t\\tiifname \\\"wt0\\\" drop # handle 50\",\"\\t}\"],[\"\\tchain netbird-raw-out { # handle 52\",\"\\t\\ttype filter hook output priority raw; policy accept;\",\"\\t\\toifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54\",\"\\t\\toifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55\",\"\\t}\"],[\"\\tchain netbird-raw-pre { # handle 53\",\"\\t\\ttype filter hook prerouting priority raw; policy accept;\",\"\\t\\tiifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 84862 bytes 15870648 notrack # handle 56\",\"\\t\\tiifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp dport 3128 counter packets 64757 bytes 23705604 notrack # handle 57\",\"\\t}\"],[\"\\tchain netbird-rt-fwd { # handle 1\",\"\\t\\tct state established,related counter packets 0 bytes 0 accept # handle 7\",\"\\t}\"],[\"\\tchain netbird-rt-postrouting { # handle 2\",\"\\t\\ttype nat hook postrouting priority srcnat - 1; policy accept;\",\"\\t\\tmeta mark 0x0001bd21 oifname != \\\"lo\\\" counter packets 0 bytes 0 masquerade # handle 8\",\"\\t\\tmeta mark 0x0001bd22 oifname \\\"wt0\\\" counter packets 0 bytes 0 masquerade # handle 9\",\"\\t}\"],[\"\\tchain netbird-rt-redirect { # handle 3\",\"\\t\\ttype nat hook prerouting priority dstnat; policy accept;\",\"\\t}\"],[\"\\tchain netbird-mangle-postrouting { # handle 4\",\"\\t\\ttype filter hook postrouting priority mangle; policy accept;\",\"\\t\\toifname \\\"wt0\\\" ct state new ct mark set 0x0001bd11 # handle 12\",\"\\t}\"],[\"\\tchain netbird-mangle-prerouting { # handle 5\",\"\\t\\ttype filter hook prerouting priority mangle; policy accept;\",\"\\t\\tiifname \\\"wt0\\\" ct state new ct mark set 0x0001bd10 # handle 11\",\"\\t\\tiifname \\\"wt0\\\" ip6 saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 25\",\"\\t\\tiifname \\\"wt0\\\" ip6 saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 28\",\"\\t\\tiifname \\\"wt0\\\" ip6 saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 31\",\"\\t}\"],[\"\\tchain netbird-mangle-forward { # handle 6\",\"\\t\\ttype filter hook forward priority mangle; policy accept;\",\"\\t\\toifname \\\"wt0\\\" tcp flags syn counter packets 0 bytes 0 tcp option maxseg size > 1220 tcp option maxseg size set 1220 # handle 10\",\"\\t}\"],[\"\\tchain netbird-acl-input-rules { # handle 13\",\"\\t\\tct state established,related counter packets 12 bytes 3817 accept # handle 14\",\"\\t\\tip6 saddr @nb0000001 accept # handle 23\",\"\\t\\tip6 saddr @nb0000043 accept # handle 27\",\"\\t\\tip6 saddr @nb0000055 accept # handle 30\",\"\\t}\"],[\"\\tchain netbird-acl-input-filter { # handle 15\",\"\\t\\ttype filter hook input priority filter; policy accept;\",\"\\t\\tiifname \\\"wt0\\\" jump netbird-acl-input-rules # handle 16\",\"\\t\\tiifname \\\"wt0\\\" drop # handle 17\",\"\\t}\"],[\"\\tchain netbird-acl-forward-filter { # handle 18\",\"\\t\\ttype filter hook forward priority filter; policy accept;\",\"\\t\\tmeta mark 0x0001bd20 accept # handle 21\",\"\\t\\tiifname \\\"wt0\\\" jump netbird-rt-fwd # handle 19\",\"\\t\\tiifname \\\"wt0\\\" drop # handle 20\",\"\\t}\"]],\"nft_snikket\":[],\"iptables\":[\":OUTPUT ACCEPT [0:0]\",\"-A PREROUTING -d [ADDR] ! -i br-f43db13d76c4 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-a4e31561a8d5 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-8122fec51f39 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 2375 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8081 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 7422 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8088 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 12345 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 3100 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-d41b3e918fbc -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 9999 -j DROP\",\":FORWARD ACCEPT [4378479:806482115]\",\":OUTPUT ACCEPT [0:0]\",\"-A INPUT ! -i lo -p tcp -m tcp --dport 81 -j DROP\",\"-A DOCKER ! -i br-4d894f9e427b -o br-4d894f9e427b -j DROP\",\"-A DOCKER ! -i br-5f66e1018bdd -o br-5f66e1018bdd -j DROP\",\"-A DOCKER ! -i br-8122fec51f39 -o br-8122fec51f39 -j DROP\",\"-A DOCKER ! -i br-915a81681c3e -o br-915a81681c3e -j DROP\",\"-A DOCKER ! -i br-a4e31561a8d5 -o br-a4e31561a8d5 -j DROP\",\"-A DOCKER ! -i br-d41b3e918fbc -o br-d41b3e918fbc -j DROP\",\"-A DOCKER ! -i br-f43db13d76c4 -o br-f43db13d76c4 -j DROP\",\"-A DOCKER ! -i docker0 -o docker0 -j DROP\",\":OUTPUT ACCEPT [6007854:372026992]\",\"-A OUTPUT ! -d [ADDR] -m addrtype --dst-type LOCAL -j DOCKER\"]}},\"pve03\":{\"rc\":0,\"lines\":[\"QM_CONFIG_BEGIN\",\"name: edge-vm\",\"net0: virtio=[ADDR6],bridge=vmbr0,firewall=1\",\"QM_CONFIG_END\",\"FWFILE=/etc/pve/firewall/cluster.fw EXISTS=1\",\"2:enable: 1\",\"3:policy_in: DROP\",\"4:policy_out: ACCEPT\",\"7:IN ACCEPT -source [ADDR]\",\"8:IN ACCEPT -source [ADDR]\",\"9:IN ACCEPT -source [ADDR]\",\"10:IN ACCEPT -source [ADDR] -p tcp -dport 22\",\"11:IN ACCEPT -source [ADDR] -p tcp -dport 8006\",\"12:IN ACCEPT -source [ADDR] -p tcp -dport 9100\",\"13:IN ACCEPT -source [ADDR] -p tcp -dport 9101\",\"14:IN ACCEPT -source [ADDR] -p tcp -dport 22\",\"15:IN ACCEPT -source [ADDR] -p tcp -dport 8006\",\"16:IN ACCEPT -p icmp\",\"FWFILE=/etc/pve/firewall/130.fw EXISTS=1\",\"2:enable: 1\",\"3:policy_in: ACCEPT\",\"4:policy_out: ACCEPT\",\"7:OUT DROP -dest [ADDR] -log nolog\",\"8:OUT DROP -dest [ADDR] -log nolog\",\"9:OUT DROP -dest [ADDR] -log nolog\",\"FWFILE=/etc/pve/nodes/pve03/host.fw EXISTS=1\",\"3:enable: 1\",\"PVEFW_BEGIN\",\"Status: enabled/running\",\"PVEFW_END\",\"LINKS_BEGIN\",\"vmbr0            UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> \",\"tap130i0         UNKNOWN        [ADDR6] <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> \",\"fwbr130i0        UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> \",\"fwpr130p0@fwln130i0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> \",\"fwln130i0@fwpr130p0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> \",\"LINKS_END\",\"BRIDGE_BEGIN\",\"4: nic1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 4 \",\"7: tap130i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 \",\"9: fwpr130p0@fwln130i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 \",\"10: fwln130i0@fwpr130p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 \",\"13: fwpr190p0@fwln190i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 \",\"22: fwpr211p0@fwln211i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 \",\"BRIDGE_END\",\"NFT_BEGIN\",\"NFT_END\",\"PVE03_TCP={\\\"[ADDR]:53\\\":true,\\\"[ADDR]:443\\\":true,\\\"[ADDR]:53\\\":true,\\\"[ADDR]:443\\\":true}\"],\"stderr_sha\":null}}\nTASK_COMPLETE=true\nTASK_RESULT=PASS_SPB_VM130_EGRESS_POLICY_RCA\nDECISION=READ_EXACT_9128_THEN_REPAIR_ONLY_PROVEN_LAYER\n"
+}
diff --git a/runtime/history/SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1.txt b/runtime/history/SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1.txt
new file mode 100644
index 00000000..766fc861
--- /dev/null
+++ b/runtime/history/SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1.txt
@@ -0,0 +1,36 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=spb-vm130-egress-policy-rca
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=f865795e23fb24fac99743dd841426764468398337cbd94620e4375f63f0e7aa
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340
+SANITIZED_OUTPUT_SHA256=d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340
+OUTPUT_BEGIN
+SPB9128_RCA={"guest":{"ok":true,"data":{"hostname":"edge-vm","netbird_service":"active","default_v4":true,"targets":{"acme-v02.api.letsencrypt.org":[{"ip_hash":"5786251088dd9c13","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"5a49954884866ec5"},"tcp443":{"ok":false,"error":"OSError"}}],"api.cloudflare.com":[{"ip_hash":"b0744ce2a1b023db","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"7cb5cee0ebb33f07"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"c6984b66666387ed","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"cfffc0defbd50741"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"969b1202bb584ec5","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"9d264f8ab0166b91"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"11f9ecc608d7a6f3","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"6f64c9a460831f9e"},"tcp443":{"ok":false,"error":"OSError"}}],"1.1.1.1":[{"ip_hash":"f1412386aa8db257","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"1cf8f6049ad12605"},"tcp53":{"ok":false,"error":"OSError"},"tcp443":{"ok":false,"error":"OSError"}}],"8.8.8.8":[{"ip_hash":"838c4c2573848f58","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"f67ace164f3792ff"},"tcp53":{"ok":false,"error":"OSError"},"tcp443":{"ok":false,"error":"OSError"}}]},"ip_rules":["0:\tfrom all lookup local","100:\tfrom [ADDR] lookup main","101:\tfrom [ADDR] lookup 17777","105:\tfrom all lookup main suppress_prefixlength 0","110:\tnot from all fwmark 0x1bd00 lookup 7120","32766:\tfrom all lookup main","32767:\tfrom all lookup default"],"ip_routes":["default dev wg-edge01 table 17777 scope link ","default dev wt0 table 7120 ","default via [ADDR] dev eth0 proto static ","[ADDR] dev wg-taftauto proto kernel scope link src [ADDR] ","[ADDR] dev wg-edge01 proto kernel scope link src [ADDR] ","[ADDR] dev br-915a81681c3e proto kernel scope link src [ADDR] ","[ADDR] dev wt0 proto kernel scope link src [ADDR] ","[ADDR] dev docker0 proto kernel scope link src [ADDR] linkdown ","[ADDR] dev br-4d894f9e427b proto kernel scope link src [ADDR] linkdown ","[ADDR] dev br-d41b3e918fbc proto kernel scope link src [ADDR] ","[ADDR] dev br-a4e31561a8d5 proto kernel scope link src [ADDR] ","[ADDR] via [ADDR] dev eth0 src [ADDR] ","[ADDR] dev eth0 proto kernel scope link src [ADDR] ","[ADDR] dev br-f43db13d76c4 proto kernel scope link src [ADDR] ","[ADDR] dev br-8122fec51f39 proto kernel scope link src [ADDR] ","[ADDR] dev br-5f66e1018bdd proto kernel scope link src [ADDR] ","local [ADDR] dev wg-taftauto table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wg-taftauto table local proto kernel scope link src [ADDR] ","local [ADDR] dev wg-edge01 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wg-edge01 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-915a81681c3e table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-915a81681c3e table local proto kernel scope link src [ADDR] ","local [ADDR] dev wt0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wt0 table local proto kernel scope link src [ADDR] ","local [ADDR] dev lo table local proto kernel scope host src [ADDR] ","local [ADDR] dev lo table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev lo table local proto kernel scope link src [ADDR] ","local [ADDR] dev docker0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev docker0 table local proto kernel scope link src [ADDR] linkdown ","local [ADDR] dev br-4d894f9e427b table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-4d894f9e427b table local proto kernel scope link src [ADDR] linkdown ","local [ADDR] dev br-d41b3e918fbc table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-d41b3e918fbc table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-a4e31561a8d5 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-a4e31561a8d5 table local proto kernel scope link src [ADDR] ","local [ADDR] dev eth0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev eth0 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-f43db13d76c4 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-f43db13d76c4 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-8122fec51f39 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-8122fec51f39 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-5f66e1018bdd table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-5f66e1018bdd table local proto kernel scope link src [ADDR] "],"sysctls":{"net.ipv4.conf.all.rp_filter":"0","net.ipv4.conf.all.src_valid_mark":"1","net.ipv4.ip_forward":"1"},"nft_output":[["\tchain OUTPUT { # handle 6","\t\ttype nat hook output priority dstnat; policy accept;","\t\tip daddr != [ADDR] fib daddr type local counter packets 155792 bytes 9523752 jump DOCKER # handle 7","\t}"],["\tchain OUTPUT { # handle 4","\t\ttype nat hook output priority dstnat; policy accept;","\t\tip6 daddr != [ADDR6] fib daddr type local counter packets 0 bytes 0 jump DOCKER # handle 5","\t}"],["\tchain netbird-raw-out { # handle 52","\t\ttype filter hook output priority raw; policy accept;","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55","\t}"]],"nft_netbird":[["\tchain netbird-rt-fwd { # handle 31","\t\tct state established,related counter packets 2112153 bytes 3401847160 accept # handle 37","\t}"],["\tchain netbird-rt-postrouting { # handle 32","\t\ttype nat hook postrouting priority srcnat - 1; policy accept;","\t\tmeta mark 0x0001bd21 oifname != \"lo\" counter packets 0 bytes 0 masquerade # handle 38","\t\tmeta mark 0x0001bd22 oifname \"wt0\" counter packets 0 bytes 0 masquerade # handle 39","\t}"],["\tchain netbird-rt-redirect { # handle 33","\t\ttype nat hook prerouting priority dstnat; policy accept;","\t}"],["\tchain netbird-mangle-postrouting { # handle 34","\t\ttype filter hook postrouting priority mangle; policy accept;","\t\toifname \"wt0\" ct state new ct mark set 0x0001bd11 # handle 42","\t}"],["\tchain netbird-mangle-prerouting { # handle 35","\t\ttype filter hook prerouting priority mangle; policy accept;","\t\tiifname \"wt0\" ct state new ct mark set 0x0001bd10 # handle 41","\t\tiifname \"wt0\" ip saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 61","\t\tiifname \"wt0\" ip saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 64","\t\tiifname \"wt0\" ip saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 67","\t}"],["\tchain netbird-mangle-forward { # handle 36","\t\ttype filter hook forward priority mangle; policy accept;","\t\toifname \"wt0\" tcp flags syn counter packets 12281 bytes 736860 tcp option maxseg size > 1240 tcp option maxseg size set 1240 # handle 40","\t}"],["\tchain netbird-acl-input-rules { # handle 43","\t\tct state established,related counter packets 7605032 bytes 6107862874 accept # handle 44","\t\tip saddr @nb0000001 accept # handle 59","\t\tip saddr @nb0000043 accept # handle 63","\t\tip saddr @nb0000055 accept # handle 66","\t}"],["\tchain netbird-acl-input-filter { # handle 45","\t\ttype filter hook input priority filter; policy accept;","\t\tiifname \"wt0\" jump netbird-acl-input-rules # handle 46","\t\tiifname \"wt0\" drop # handle 47","\t}"],["\tchain netbird-acl-forward-filter { # handle 48","\t\ttype filter hook forward priority filter; policy accept;","\t\tmeta mark 0x0001bd20 accept # handle 51","\t\tiifname \"wt0\" jump netbird-rt-fwd # handle 49","\t\tiifname \"wt0\" drop # handle 50","\t}"],["\tchain netbird-raw-out { # handle 52","\t\ttype filter hook output priority raw; policy accept;","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55","\t}"],["\tchain netbird-raw-pre { # handle 53","\t\ttype filter hook prerouting priority raw; policy accept;","\t\tiifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 84862 bytes 15870648 notrack # handle 56","\t\tiifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 3128 counter packets 64757 bytes 23705604 notrack # handle 57","\t}"],["\tchain netbird-rt-fwd { # handle 1","\t\tct state established,related counter packets 0 bytes 0 accept # handle 7","\t}"],["\tchain netbird-rt-postrouting { # handle 2","\t\ttype nat hook postrouting priority srcnat - 1; policy accept;","\t\tmeta mark 0x0001bd21 oifname != \"lo\" counter packets 0 bytes 0 masquerade # handle 8","\t\tmeta mark 0x0001bd22 oifname \"wt0\" counter packets 0 bytes 0 masquerade # handle 9","\t}"],["\tchain netbird-rt-redirect { # handle 3","\t\ttype nat hook prerouting priority dstnat; policy accept;","\t}"],["\tchain netbird-mangle-postrouting { # handle 4","\t\ttype filter hook postrouting priority mangle; policy accept;","\t\toifname \"wt0\" ct state new ct mark set 0x0001bd11 # handle 12","\t}"],["\tchain netbird-mangle-prerouting { # handle 5","\t\ttype filter hook prerouting priority mangle; policy accept;","\t\tiifname \"wt0\" ct state new ct mark set 0x0001bd10 # handle 11","\t\tiifname \"wt0\" ip6 saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 25","\t\tiifname \"wt0\" ip6 saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 28","\t\tiifname \"wt0\" ip6 saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 31","\t}"],["\tchain netbird-mangle-forward { # handle 6","\t\ttype filter hook forward priority mangle; policy accept;","\t\toifname \"wt0\" tcp flags syn counter packets 0 bytes 0 tcp option maxseg size > 1220 tcp option maxseg size set 1220 # handle 10","\t}"],["\tchain netbird-acl-input-rules { # handle 13","\t\tct state established,related counter packets 12 bytes 3817 accept # handle 14","\t\tip6 saddr @nb0000001 accept # handle 23","\t\tip6 saddr @nb0000043 accept # handle 27","\t\tip6 saddr @nb0000055 accept # handle 30","\t}"],["\tchain netbird-acl-input-filter { # handle 15","\t\ttype filter hook input priority filter; policy accept;","\t\tiifname \"wt0\" jump netbird-acl-input-rules # handle 16","\t\tiifname \"wt0\" drop # handle 17","\t}"],["\tchain netbird-acl-forward-filter { # handle 18","\t\ttype filter hook forward priority filter; policy accept;","\t\tmeta mark 0x0001bd20 accept # handle 21","\t\tiifname \"wt0\" jump netbird-rt-fwd # handle 19","\t\tiifname \"wt0\" drop # handle 20","\t}"]],"nft_snikket":[],"iptables":[":OUTPUT ACCEPT [0:0]","-A PREROUTING -d [ADDR] ! -i br-f43db13d76c4 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-a4e31561a8d5 -j DROP","-A PREROUTING -d [ADDR] ! -i br-8122fec51f39 -j DROP","-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 2375 -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8081 -j DROP","-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 7422 -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8088 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 12345 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 3100 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-d41b3e918fbc -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 9999 -j DROP",":FORWARD ACCEPT [4378479:806482115]",":OUTPUT ACCEPT [0:0]","-A INPUT ! -i lo -p tcp -m tcp --dport 81 -j DROP","-A DOCKER ! -i br-4d894f9e427b -o br-4d894f9e427b -j DROP","-A DOCKER ! -i br-5f66e1018bdd -o br-5f66e1018bdd -j DROP","-A DOCKER ! -i br-8122fec51f39 -o br-8122fec51f39 -j DROP","-A DOCKER ! -i br-915a81681c3e -o br-915a81681c3e -j DROP","-A DOCKER ! -i br-a4e31561a8d5 -o br-a4e31561a8d5 -j DROP","-A DOCKER ! -i br-d41b3e918fbc -o br-d41b3e918fbc -j DROP","-A DOCKER ! -i br-f43db13d76c4 -o br-f43db13d76c4 -j DROP","-A DOCKER ! -i docker0 -o docker0 -j DROP",":OUTPUT ACCEPT [6007854:372026992]","-A OUTPUT ! -d [ADDR] -m addrtype --dst-type LOCAL -j DOCKER"]}},"pve03":{"rc":0,"lines":["QM_CONFIG_BEGIN","name: edge-vm","net0: virtio=[ADDR6],bridge=vmbr0,firewall=1","QM_CONFIG_END","FWFILE=/etc/pve/firewall/cluster.fw EXISTS=1","2:enable: 1","3:policy_in: DROP","4:policy_out: ACCEPT","7:IN ACCEPT -source [ADDR]","8:IN ACCEPT -source [ADDR]","9:IN ACCEPT -source [ADDR]","10:IN ACCEPT -source [ADDR] -p tcp -dport 22","11:IN ACCEPT -source [ADDR] -p tcp -dport 8006","12:IN ACCEPT -source [ADDR] -p tcp -dport 9100","13:IN ACCEPT -source [ADDR] -p tcp -dport 9101","14:IN ACCEPT -source [ADDR] -p tcp -dport 22","15:IN ACCEPT -source [ADDR] -p tcp -dport 8006","16:IN ACCEPT -p icmp","FWFILE=/etc/pve/firewall/130.fw EXISTS=1","2:enable: 1","3:policy_in: ACCEPT","4:policy_out: ACCEPT","7:OUT DROP -dest [ADDR] -log nolog","8:OUT DROP -dest [ADDR] -log nolog","9:OUT DROP -dest [ADDR] -log nolog","FWFILE=/etc/pve/nodes/pve03/host.fw EXISTS=1","3:enable: 1","PVEFW_BEGIN","Status: enabled/running","PVEFW_END","LINKS_BEGIN","vmbr0            UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","tap130i0         UNKNOWN        [ADDR6] <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> ","fwbr130i0        UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","fwpr130p0@fwln130i0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","fwln130i0@fwpr130p0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","LINKS_END","BRIDGE_BEGIN","4: nic1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 4 ","7: tap130i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 ","9: fwpr130p0@fwln130i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","10: fwln130i0@fwpr130p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 ","13: fwpr190p0@fwln190i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","22: fwpr211p0@fwln211i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","BRIDGE_END","NFT_BEGIN","NFT_END","PVE03_TCP={\"[ADDR]:53\":true,\"[ADDR]:443\":true,\"[ADDR]:53\":true,\"[ADDR]:443\":true}"],"stderr_sha":null}}
+TASK_COMPLETE=true
+TASK_RESULT=PASS_SPB_VM130_EGRESS_POLICY_RCA
+DECISION=READ_EXACT_9128_THEN_REPAIR_ONLY_PROVEN_LAYER
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index 9200d4b0..523f417f 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "SUPPORT-260922-SPB-VM130-EGRESS443-RCA-9127R1",
+  "command_id": "SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
   "mode": "read-only",
-  "component": "spb-vm130-egress443-rca",
-  "started_at_utc": "2026-09-22T16:47:01Z",
-  "finished_at_utc": "2026-09-22T16:47:12Z",
+  "component": "spb-vm130-egress-policy-rca",
+  "started_at_utc": "2026-09-22T16:57:42Z",
+  "finished_at_utc": "2026-09-22T16:57:46Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "b3f1619d5b158d06878e967e54b9f648fb6a9d0dab6fda545f12eeb6203c58f4",
+  "command_sha256": "f865795e23fb24fac99743dd841426764468398337cbd94620e4375f63f0e7aa",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "822011e0fe77955a376d346132c142ef77e22468e068695904628be95f438567",
-  "sanitized_output_sha256": "822011e0fe77955a376d346132c142ef77e22468e068695904628be95f438567",
+  "raw_evidence_sha256": "d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340",
+  "sanitized_output_sha256": "d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "SPB9127_RCA={\"guest\":{\"ok\":true,\"data\":{\"hostname\":\"edge-vm\",\"default_v4\":true,\"route_get\":{\"letsencrypt\":{\"rc\":1,\"hash\":null,\"stderr_sha\":\"bc3a564baee1d4c0\"},\"cloudflare\":{\"rc\":1,\"hash\":null,\"stderr_sha\":\"2005d2187698358b\"},\"cloudflare_dns\":{\"rc\":0,\"hash\":\"b1bac959b7f164a9\",\"stderr_sha\":null},\"google_dns\":{\"rc\":0,\"hash\":\"cbe7dc74e06520d1\",\"stderr_sha\":null}},\"tcp\":{\"letsencrypt_443\":{\"ok\":false,\"error\":\"OSError\"},\"cloudflare_443\":{\"ok\":false,\"error\":\"OSError\"},\"cloudflare_dns_443\":{\"ok\":false,\"error\":\"OSError\"},\"cloudflare_dns_53\":{\"ok\":false,\"error\":\"OSError\"},\"google_dns_443\":{\"ok\":false,\"error\":\"OSError\"},\"google_dns_53\":{\"ok\":false,\"error\":\"OSError\"}},\"nft\":{\"rc\":0,\"drop_reject_count\":33,\"output_443_hits\":[],\"table_chain_lines\":[\"table ip filter { # handle 1\",\"chain FORWARD { # handle 1\",\"chain DOCKER { # handle 4\",\"chain DOCKER-FORWARD { # handle 5\",\"chain DOCKER-BRIDGE { # handle 6\",\"chain DOCKER-CT { # handle 7\",\"chain DOCKER-INTERNAL { # handle 8\",\"chain INPUT { # handle 54\",\"chain DOCKER-USER { # handle 56\",\"table ip nat { # handle 3\",\"chain POSTROUTING { # handle 1\",\"chain DOCKER { # handle 3\",\"chain PREROUTING { # handle 4\",\"chain OUTPUT { # handle 6\",\"table ip snikket_edge_prod { # handle 6\",\"chain prerouting { # handle 1\",\"chain postrouting { # handle 2\",\"table ip6 nat { # handle 7\",\"chain DOCKER { # handle 1\",\"chain PREROUTING { # handle 2\",\"chain OUTPUT { # handle 4\",\"table ip6 filter { # handle 8\",\"chain DOCKER { # handle 1\",\"chain DOCKER-FORWARD { # handle 2\",\"chain DOCKER-BRIDGE { # handle 3\",\"chain DOCKER-CT { # handle 4\",\"chain DOCKER-INTERNAL { # handle 5\",\"chain FORWARD { # handle 6\",\"chain INPUT { # handle 13\",\"chain DOCKER-USER { # handle 15\",\"table ip raw { # handle 9\",\"chain PREROUTING { # handle 1\",\"table ip netbird { # handle 10\",\"chain netbird-rt-fwd { # handle 31\",\"chain netbird-rt-postrouting { # handle 32\",\"chain netbird-rt-redirect { # handle 33\",\"chain netbird-mangle-postrouting { # handle 34\",\"chain netbird-mangle-prerouting { # handle 35\",\"chain netbird-mangle-forward { # handle 36\",\"chain netbird-acl-input-rules { # handle 43\",\"chain netbird-acl-input-filter { # handle 45\",\"chain netbird-acl-forward-filter { # handle 48\",\"chain netbird-raw-out { # handle 52\",\"chain netbird-raw-pre { # handle 53\",\"table ip6 netbird { # handle 11\",\"chain netbird-rt-fwd { # handle 1\",\"chain netbird-rt-postrouting { # handle 2\",\"chain netbird-rt-redirect { # handle 3\",\"chain netbird-mangle-postrouting { # handle 4\",\"chain netbird-mangle-prerouting { # handle 5\",\"chain netbird-mangle-forward { # handle 6\",\"chain netbird-acl-input-rules { # handle 13\",\"chain netbird-acl-input-filter { # handle 15\",\"chain netbird-acl-forward-filter { # handle 18\"]},\"iptables\":{\"rc\":0,\"443_hits\":[],\"drop_reject_count\":9},\"ufw\":\"\",\"firewalld\":\"\"}},\"pve03\":{\"rc\":2,\"lines\":[\"PVE03_CURL_LE_RC=0\",\"PVE03_CURL_CF_RC=22\"],\"stderr_sha\":\"58a62ee7d936df00\"}}\nTASK_COMPLETE=true\nTASK_RESULT=PASS_SPB_VM130_EGRESS443_RCA\nDECISION=READ_EXACT_9127_THEN_REPAIR_NARROWEST_EGRESS_LAYER\n"
+  "output": "SPB9128_RCA={\"guest\":{\"ok\":true,\"data\":{\"hostname\":\"edge-vm\",\"netbird_service\":\"active\",\"default_v4\":true,\"targets\":{\"acme-v02.api.letsencrypt.org\":[{\"ip_hash\":\"5786251088dd9c13\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"5a49954884866ec5\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}}],\"api.cloudflare.com\":[{\"ip_hash\":\"b0744ce2a1b023db\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"7cb5cee0ebb33f07\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}},{\"ip_hash\":\"c6984b66666387ed\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"cfffc0defbd50741\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}},{\"ip_hash\":\"969b1202bb584ec5\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"9d264f8ab0166b91\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}},{\"ip_hash\":\"11f9ecc608d7a6f3\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"6f64c9a460831f9e\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}}],\"1.1.1.1\":[{\"ip_hash\":\"f1412386aa8db257\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"1cf8f6049ad12605\"},\"tcp53\":{\"ok\":false,\"error\":\"OSError\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}}],\"8.8.8.8\":[{\"ip_hash\":\"838c4c2573848f58\",\"route\":{\"rc\":0,\"stderr_sha\":null,\"dev\":\"wt0\",\"has_via\":false,\"line_hash\":\"f67ace164f3792ff\"},\"tcp53\":{\"ok\":false,\"error\":\"OSError\"},\"tcp443\":{\"ok\":false,\"error\":\"OSError\"}}]},\"ip_rules\":[\"0:\\tfrom all lookup local\",\"100:\\tfrom [ADDR] lookup main\",\"101:\\tfrom [ADDR] lookup 17777\",\"105:\\tfrom all lookup main suppress_prefixlength 0\",\"110:\\tnot from all fwmark 0x1bd00 lookup 7120\",\"32766:\\tfrom all lookup main\",\"32767:\\tfrom all lookup default\"],\"ip_routes\":[\"default dev wg-edge01 table 17777 scope link \",\"default dev wt0 table 7120 \",\"default via [ADDR] dev eth0 proto static \",\"[ADDR] dev wg-taftauto proto kernel scope link src [ADDR] \",\"[ADDR] dev wg-edge01 proto kernel scope link src [ADDR] \",\"[ADDR] dev br-915a81681c3e proto kernel scope link src [ADDR] \",\"[ADDR] dev wt0 proto kernel scope link src [ADDR] \",\"[ADDR] dev docker0 proto kernel scope link src [ADDR] linkdown \",\"[ADDR] dev br-4d894f9e427b proto kernel scope link src [ADDR] linkdown \",\"[ADDR] dev br-d41b3e918fbc proto kernel scope link src [ADDR] \",\"[ADDR] dev br-a4e31561a8d5 proto kernel scope link src [ADDR] \",\"[ADDR] via [ADDR] dev eth0 src [ADDR] \",\"[ADDR] dev eth0 proto kernel scope link src [ADDR] \",\"[ADDR] dev br-f43db13d76c4 proto kernel scope link src [ADDR] \",\"[ADDR] dev br-8122fec51f39 proto kernel scope link src [ADDR] \",\"[ADDR] dev br-5f66e1018bdd proto kernel scope link src [ADDR] \",\"local [ADDR] dev wg-taftauto table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev wg-taftauto table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev wg-edge01 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev wg-edge01 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-915a81681c3e table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-915a81681c3e table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev wt0 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev wt0 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev lo table local proto kernel scope host src [ADDR] \",\"local [ADDR] dev lo table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev lo table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev docker0 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev docker0 table local proto kernel scope link src [ADDR] linkdown \",\"local [ADDR] dev br-4d894f9e427b table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-4d894f9e427b table local proto kernel scope link src [ADDR] linkdown \",\"local [ADDR] dev br-d41b3e918fbc table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-d41b3e918fbc table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-a4e31561a8d5 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-a4e31561a8d5 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev eth0 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev eth0 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-f43db13d76c4 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-f43db13d76c4 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-8122fec51f39 table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-8122fec51f39 table local proto kernel scope link src [ADDR] \",\"local [ADDR] dev br-5f66e1018bdd table local proto kernel scope host src [ADDR] \",\"broadcast [ADDR] dev br-5f66e1018bdd table local proto kernel scope link src [ADDR] \"],\"sysctls\":{\"net.ipv4.conf.all.rp_filter\":\"0\",\"net.ipv4.conf.all.src_valid_mark\":\"1\",\"net.ipv4.ip_forward\":\"1\"},\"nft_output\":[[\"\\tchain OUTPUT { # handle 6\",\"\\t\\ttype nat hook output priority dstnat; policy accept;\",\"\\t\\tip daddr != [ADDR] fib daddr type local counter packets 155792 bytes 9523752 jump DOCKER # handle 7\",\"\\t}\"],[\"\\tchain OUTPUT { # handle 4\",\"\\t\\ttype nat hook output priority dstnat; policy accept;\",\"\\t\\tip6 daddr != [ADDR6] fib daddr type local counter packets 0 bytes 0 jump DOCKER # handle 5\",\"\\t}\"],[\"\\tchain netbird-raw-out { # handle 52\",\"\\t\\ttype filter hook output priority raw; policy accept;\",\"\\t\\toifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54\",\"\\t\\toifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55\",\"\\t}\"]],\"nft_netbird\":[[\"\\tchain netbird-rt-fwd { # handle 31\",\"\\t\\tct state established,related counter packets 2112153 bytes 3401847160 accept # handle 37\",\"\\t}\"],[\"\\tchain netbird-rt-postrouting { # handle 32\",\"\\t\\ttype nat hook postrouting priority srcnat - 1; policy accept;\",\"\\t\\tmeta mark 0x0001bd21 oifname != \\\"lo\\\" counter packets 0 bytes 0 masquerade # handle 38\",\"\\t\\tmeta mark 0x0001bd22 oifname \\\"wt0\\\" counter packets 0 bytes 0 masquerade # handle 39\",\"\\t}\"],[\"\\tchain netbird-rt-redirect { # handle 33\",\"\\t\\ttype nat hook prerouting priority dstnat; policy accept;\",\"\\t}\"],[\"\\tchain netbird-mangle-postrouting { # handle 34\",\"\\t\\ttype filter hook postrouting priority mangle; policy accept;\",\"\\t\\toifname \\\"wt0\\\" ct state new ct mark set 0x0001bd11 # handle 42\",\"\\t}\"],[\"\\tchain netbird-mangle-prerouting { # handle 35\",\"\\t\\ttype filter hook prerouting priority mangle; policy accept;\",\"\\t\\tiifname \\\"wt0\\\" ct state new ct mark set 0x0001bd10 # handle 41\",\"\\t\\tiifname \\\"wt0\\\" ip saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 61\",\"\\t\\tiifname \\\"wt0\\\" ip saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 64\",\"\\t\\tiifname \\\"wt0\\\" ip saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 67\",\"\\t}\"],[\"\\tchain netbird-mangle-forward { # handle 36\",\"\\t\\ttype filter hook forward priority mangle; policy accept;\",\"\\t\\toifname \\\"wt0\\\" tcp flags syn counter packets 12281 bytes 736860 tcp option maxseg size > 1240 tcp option maxseg size set 1240 # handle 40\",\"\\t}\"],[\"\\tchain netbird-acl-input-rules { # handle 43\",\"\\t\\tct state established,related counter packets 7605032 bytes 6107862874 accept # handle 44\",\"\\t\\tip saddr @nb0000001 accept # handle 59\",\"\\t\\tip saddr @nb0000043 accept # handle 63\",\"\\t\\tip saddr @nb0000055 accept # handle 66\",\"\\t}\"],[\"\\tchain netbird-acl-input-filter { # handle 45\",\"\\t\\ttype filter hook input priority filter; policy accept;\",\"\\t\\tiifname \\\"wt0\\\" jump netbird-acl-input-rules # handle 46\",\"\\t\\tiifname \\\"wt0\\\" drop # handle 47\",\"\\t}\"],[\"\\tchain netbird-acl-forward-filter { # handle 48\",\"\\t\\ttype filter hook forward priority filter; policy accept;\",\"\\t\\tmeta mark 0x0001bd20 accept # handle 51\",\"\\t\\tiifname \\\"wt0\\\" jump netbird-rt-fwd # handle 49\",\"\\t\\tiifname \\\"wt0\\\" drop # handle 50\",\"\\t}\"],[\"\\tchain netbird-raw-out { # handle 52\",\"\\t\\ttype filter hook output priority raw; policy accept;\",\"\\t\\toifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54\",\"\\t\\toifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55\",\"\\t}\"],[\"\\tchain netbird-raw-pre { # handle 53\",\"\\t\\ttype filter hook prerouting priority raw; policy accept;\",\"\\t\\tiifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 84862 bytes 15870648 notrack # handle 56\",\"\\t\\tiifname \\\"lo\\\" ip saddr [ADDR] ip daddr [ADDR] udp dport 3128 counter packets 64757 bytes 23705604 notrack # handle 57\",\"\\t}\"],[\"\\tchain netbird-rt-fwd { # handle 1\",\"\\t\\tct state established,related counter packets 0 bytes 0 accept # handle 7\",\"\\t}\"],[\"\\tchain netbird-rt-postrouting { # handle 2\",\"\\t\\ttype nat hook postrouting priority srcnat - 1; policy accept;\",\"\\t\\tmeta mark 0x0001bd21 oifname != \\\"lo\\\" counter packets 0 bytes 0 masquerade # handle 8\",\"\\t\\tmeta mark 0x0001bd22 oifname \\\"wt0\\\" counter packets 0 bytes 0 masquerade # handle 9\",\"\\t}\"],[\"\\tchain netbird-rt-redirect { # handle 3\",\"\\t\\ttype nat hook prerouting priority dstnat; policy accept;\",\"\\t}\"],[\"\\tchain netbird-mangle-postrouting { # handle 4\",\"\\t\\ttype filter hook postrouting priority mangle; policy accept;\",\"\\t\\toifname \\\"wt0\\\" ct state new ct mark set 0x0001bd11 # handle 12\",\"\\t}\"],[\"\\tchain netbird-mangle-prerouting { # handle 5\",\"\\t\\ttype filter hook prerouting priority mangle; policy accept;\",\"\\t\\tiifname \\\"wt0\\\" ct state new ct mark set 0x0001bd10 # handle 11\",\"\\t\\tiifname \\\"wt0\\\" ip6 saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 25\",\"\\t\\tiifname \\\"wt0\\\" ip6 saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 28\",\"\\t\\tiifname \\\"wt0\\\" ip6 saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 31\",\"\\t}\"],[\"\\tchain netbird-mangle-forward { # handle 6\",\"\\t\\ttype filter hook forward priority mangle; policy accept;\",\"\\t\\toifname \\\"wt0\\\" tcp flags syn counter packets 0 bytes 0 tcp option maxseg size > 1220 tcp option maxseg size set 1220 # handle 10\",\"\\t}\"],[\"\\tchain netbird-acl-input-rules { # handle 13\",\"\\t\\tct state established,related counter packets 12 bytes 3817 accept # handle 14\",\"\\t\\tip6 saddr @nb0000001 accept # handle 23\",\"\\t\\tip6 saddr @nb0000043 accept # handle 27\",\"\\t\\tip6 saddr @nb0000055 accept # handle 30\",\"\\t}\"],[\"\\tchain netbird-acl-input-filter { # handle 15\",\"\\t\\ttype filter hook input priority filter; policy accept;\",\"\\t\\tiifname \\\"wt0\\\" jump netbird-acl-input-rules # handle 16\",\"\\t\\tiifname \\\"wt0\\\" drop # handle 17\",\"\\t}\"],[\"\\tchain netbird-acl-forward-filter { # handle 18\",\"\\t\\ttype filter hook forward priority filter; policy accept;\",\"\\t\\tmeta mark 0x0001bd20 accept # handle 21\",\"\\t\\tiifname \\\"wt0\\\" jump netbird-rt-fwd # handle 19\",\"\\t\\tiifname \\\"wt0\\\" drop # handle 20\",\"\\t}\"]],\"nft_snikket\":[],\"iptables\":[\":OUTPUT ACCEPT [0:0]\",\"-A PREROUTING -d [ADDR] ! -i br-f43db13d76c4 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-a4e31561a8d5 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-8122fec51f39 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 2375 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8081 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 7422 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8088 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 12345 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 3100 -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP\",\"-A PREROUTING -d [ADDR] ! -i br-d41b3e918fbc -j DROP\",\"-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 9999 -j DROP\",\":FORWARD ACCEPT [4378479:806482115]\",\":OUTPUT ACCEPT [0:0]\",\"-A INPUT ! -i lo -p tcp -m tcp --dport 81 -j DROP\",\"-A DOCKER ! -i br-4d894f9e427b -o br-4d894f9e427b -j DROP\",\"-A DOCKER ! -i br-5f66e1018bdd -o br-5f66e1018bdd -j DROP\",\"-A DOCKER ! -i br-8122fec51f39 -o br-8122fec51f39 -j DROP\",\"-A DOCKER ! -i br-915a81681c3e -o br-915a81681c3e -j DROP\",\"-A DOCKER ! -i br-a4e31561a8d5 -o br-a4e31561a8d5 -j DROP\",\"-A DOCKER ! -i br-d41b3e918fbc -o br-d41b3e918fbc -j DROP\",\"-A DOCKER ! -i br-f43db13d76c4 -o br-f43db13d76c4 -j DROP\",\"-A DOCKER ! -i docker0 -o docker0 -j DROP\",\":OUTPUT ACCEPT [6007854:372026992]\",\"-A OUTPUT ! -d [ADDR] -m addrtype --dst-type LOCAL -j DOCKER\"]}},\"pve03\":{\"rc\":0,\"lines\":[\"QM_CONFIG_BEGIN\",\"name: edge-vm\",\"net0: virtio=[ADDR6],bridge=vmbr0,firewall=1\",\"QM_CONFIG_END\",\"FWFILE=/etc/pve/firewall/cluster.fw EXISTS=1\",\"2:enable: 1\",\"3:policy_in: DROP\",\"4:policy_out: ACCEPT\",\"7:IN ACCEPT -source [ADDR]\",\"8:IN ACCEPT -source [ADDR]\",\"9:IN ACCEPT -source [ADDR]\",\"10:IN ACCEPT -source [ADDR] -p tcp -dport 22\",\"11:IN ACCEPT -source [ADDR] -p tcp -dport 8006\",\"12:IN ACCEPT -source [ADDR] -p tcp -dport 9100\",\"13:IN ACCEPT -source [ADDR] -p tcp -dport 9101\",\"14:IN ACCEPT -source [ADDR] -p tcp -dport 22\",\"15:IN ACCEPT -source [ADDR] -p tcp -dport 8006\",\"16:IN ACCEPT -p icmp\",\"FWFILE=/etc/pve/firewall/130.fw EXISTS=1\",\"2:enable: 1\",\"3:policy_in: ACCEPT\",\"4:policy_out: ACCEPT\",\"7:OUT DROP -dest [ADDR] -log nolog\",\"8:OUT DROP -dest [ADDR] -log nolog\",\"9:OUT DROP -dest [ADDR] -log nolog\",\"FWFILE=/etc/pve/nodes/pve03/host.fw EXISTS=1\",\"3:enable: 1\",\"PVEFW_BEGIN\",\"Status: enabled/running\",\"PVEFW_END\",\"LINKS_BEGIN\",\"vmbr0            UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> \",\"tap130i0         UNKNOWN        [ADDR6] <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> \",\"fwbr130i0        UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> \",\"fwpr130p0@fwln130i0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> \",\"fwln130i0@fwpr130p0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> \",\"LINKS_END\",\"BRIDGE_BEGIN\",\"4: nic1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 4 \",\"7: tap130i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 \",\"9: fwpr130p0@fwln130i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 \",\"10: fwln130i0@fwpr130p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 \",\"13: fwpr190p0@fwln190i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 \",\"22: fwpr211p0@fwln211i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 \",\"BRIDGE_END\",\"NFT_BEGIN\",\"NFT_END\",\"PVE03_TCP={\\\"[ADDR]:53\\\":true,\\\"[ADDR]:443\\\":true,\\\"[ADDR]:53\\\":true,\\\"[ADDR]:443\\\":true}\"],\"stderr_sha\":null}}\nTASK_COMPLETE=true\nTASK_RESULT=PASS_SPB_VM130_EGRESS_POLICY_RCA\nDECISION=READ_EXACT_9128_THEN_REPAIR_ONLY_PROVEN_LAYER\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 32106c07..766fc861 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,15 +1,15 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=SUPPORT-260922-SPB-VM130-EGRESS443-RCA-9127R1
+COMMAND_ID=SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1
 STATUS=OK
 RC=0
 HOST=pve01
 MODE=read-only
-COMPONENT=spb-vm130-egress443-rca
+COMPONENT=spb-vm130-egress-policy-rca
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=b3f1619d5b158d06878e967e54b9f648fb6a9d0dab6fda545f12eeb6203c58f4
+COMMAND_SHA256=f865795e23fb24fac99743dd841426764468398337cbd94620e4375f63f0e7aa
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
@@ -24,13 +24,13 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=822011e0fe77955a376d346132c142ef77e22468e068695904628be95f438567
-SANITIZED_OUTPUT_SHA256=822011e0fe77955a376d346132c142ef77e22468e068695904628be95f438567
+RAW_EVIDENCE_SHA256=d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340
+SANITIZED_OUTPUT_SHA256=d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340
 OUTPUT_BEGIN
-SPB9127_RCA={"guest":{"ok":true,"data":{"hostname":"edge-vm","default_v4":true,"route_get":{"letsencrypt":{"rc":1,"hash":null,"stderr_sha":"bc3a564baee1d4c0"},"cloudflare":{"rc":1,"hash":null,"stderr_sha":"2005d2187698358b"},"cloudflare_dns":{"rc":0,"hash":"b1bac959b7f164a9","stderr_sha":null},"google_dns":{"rc":0,"hash":"cbe7dc74e06520d1","stderr_sha":null}},"tcp":{"letsencrypt_443":{"ok":false,"error":"OSError"},"cloudflare_443":{"ok":false,"error":"OSError"},"cloudflare_dns_443":{"ok":false,"error":"OSError"},"cloudflare_dns_53":{"ok":false,"error":"OSError"},"google_dns_443":{"ok":false,"error":"OSError"},"google_dns_53":{"ok":false,"error":"OSError"}},"nft":{"rc":0,"drop_reject_count":33,"output_443_hits":[],"table_chain_lines":["table ip filter { # handle 1","chain FORWARD { # handle 1","chain DOCKER { # handle 4","chain DOCKER-FORWARD { # handle 5","chain DOCKER-BRIDGE { # handle 6","chain DOCKER-CT { # handle 7","chain DOCKER-INTERNAL { # handle 8","chain INPUT { # handle 54","chain DOCKER-USER { # handle 56","table ip nat { # handle 3","chain POSTROUTING { # handle 1","chain DOCKER { # handle 3","chain PREROUTING { # handle 4","chain OUTPUT { # handle 6","table ip snikket_edge_prod { # handle 6","chain prerouting { # handle 1","chain postrouting { # handle 2","table ip6 nat { # handle 7","chain DOCKER { # handle 1","chain PREROUTING { # handle 2","chain OUTPUT { # handle 4","table ip6 filter { # handle 8","chain DOCKER { # handle 1","chain DOCKER-FORWARD { # handle 2","chain DOCKER-BRIDGE { # handle 3","chain DOCKER-CT { # handle 4","chain DOCKER-INTERNAL { # handle 5","chain FORWARD { # handle 6","chain INPUT { # handle 13","chain DOCKER-USER { # handle 15","table ip raw { # handle 9","chain PREROUTING { # handle 1","table ip netbird { # handle 10","chain netbird-rt-fwd { # handle 31","chain netbird-rt-postrouting { # handle 32","chain netbird-rt-redirect { # handle 33","chain netbird-mangle-postrouting { # handle 34","chain netbird-mangle-prerouting { # handle 35","chain netbird-mangle-forward { # handle 36","chain netbird-acl-input-rules { # handle 43","chain netbird-acl-input-filter { # handle 45","chain netbird-acl-forward-filter { # handle 48","chain netbird-raw-out { # handle 52","chain netbird-raw-pre { # handle 53","table ip6 netbird { # handle 11","chain netbird-rt-fwd { # handle 1","chain netbird-rt-postrouting { # handle 2","chain netbird-rt-redirect { # handle 3","chain netbird-mangle-postrouting { # handle 4","chain netbird-mangle-prerouting { # handle 5","chain netbird-mangle-forward { # handle 6","chain netbird-acl-input-rules { # handle 13","chain netbird-acl-input-filter { # handle 15","chain netbird-acl-forward-filter { # handle 18"]},"iptables":{"rc":0,"443_hits":[],"drop_reject_count":9},"ufw":"","firewalld":""}},"pve03":{"rc":2,"lines":["PVE03_CURL_LE_RC=0","PVE03_CURL_CF_RC=22"],"stderr_sha":"58a62ee7d936df00"}}
+SPB9128_RCA={"guest":{"ok":true,"data":{"hostname":"edge-vm","netbird_service":"active","default_v4":true,"targets":{"acme-v02.api.letsencrypt.org":[{"ip_hash":"5786251088dd9c13","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"5a49954884866ec5"},"tcp443":{"ok":false,"error":"OSError"}}],"api.cloudflare.com":[{"ip_hash":"b0744ce2a1b023db","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"7cb5cee0ebb33f07"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"c6984b66666387ed","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"cfffc0defbd50741"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"969b1202bb584ec5","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"9d264f8ab0166b91"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"11f9ecc608d7a6f3","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"6f64c9a460831f9e"},"tcp443":{"ok":false,"error":"OSError"}}],"1.1.1.1":[{"ip_hash":"f1412386aa8db257","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"1cf8f6049ad12605"},"tcp53":{"ok":false,"error":"OSError"},"tcp443":{"ok":false,"error":"OSError"}}],"8.8.8.8":[{"ip_hash":"838c4c2573848f58","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"f67ace164f3792ff"},"tcp53":{"ok":false,"error":"OSError"},"tcp443":{"ok":false,"error":"OSError"}}]},"ip_rules":["0:\tfrom all lookup local","100:\tfrom [ADDR] lookup main","101:\tfrom [ADDR] lookup 17777","105:\tfrom all lookup main suppress_prefixlength 0","110:\tnot from all fwmark 0x1bd00 lookup 7120","32766:\tfrom all lookup main","32767:\tfrom all lookup default"],"ip_routes":["default dev wg-edge01 table 17777 scope link ","default dev wt0 table 7120 ","default via [ADDR] dev eth0 proto static ","[ADDR] dev wg-taftauto proto kernel scope link src [ADDR] ","[ADDR] dev wg-edge01 proto kernel scope link src [ADDR] ","[ADDR] dev br-915a81681c3e proto kernel scope link src [ADDR] ","[ADDR] dev wt0 proto kernel scope link src [ADDR] ","[ADDR] dev docker0 proto kernel scope link src [ADDR] linkdown ","[ADDR] dev br-4d894f9e427b proto kernel scope link src [ADDR] linkdown ","[ADDR] dev br-d41b3e918fbc proto kernel scope link src [ADDR] ","[ADDR] dev br-a4e31561a8d5 proto kernel scope link src [ADDR] ","[ADDR] via [ADDR] dev eth0 src [ADDR] ","[ADDR] dev eth0 proto kernel scope link src [ADDR] ","[ADDR] dev br-f43db13d76c4 proto kernel scope link src [ADDR] ","[ADDR] dev br-8122fec51f39 proto kernel scope link src [ADDR] ","[ADDR] dev br-5f66e1018bdd proto kernel scope link src [ADDR] ","local [ADDR] dev wg-taftauto table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wg-taftauto table local proto kernel scope link src [ADDR] ","local [ADDR] dev wg-edge01 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wg-edge01 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-915a81681c3e table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-915a81681c3e table local proto kernel scope link src [ADDR] ","local [ADDR] dev wt0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wt0 table local proto kernel scope link src [ADDR] ","local [ADDR] dev lo table local proto kernel scope host src [ADDR] ","local [ADDR] dev lo table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev lo table local proto kernel scope link src [ADDR] ","local [ADDR] dev docker0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev docker0 table local proto kernel scope link src [ADDR] linkdown ","local [ADDR] dev br-4d894f9e427b table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-4d894f9e427b table local proto kernel scope link src [ADDR] linkdown ","local [ADDR] dev br-d41b3e918fbc table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-d41b3e918fbc table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-a4e31561a8d5 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-a4e31561a8d5 table local proto kernel scope link src [ADDR] ","local [ADDR] dev eth0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev eth0 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-f43db13d76c4 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-f43db13d76c4 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-8122fec51f39 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-8122fec51f39 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-5f66e1018bdd table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-5f66e1018bdd table local proto kernel scope link src [ADDR] "],"sysctls":{"net.ipv4.conf.all.rp_filter":"0","net.ipv4.conf.all.src_valid_mark":"1","net.ipv4.ip_forward":"1"},"nft_output":[["\tchain OUTPUT { # handle 6","\t\ttype nat hook output priority dstnat; policy accept;","\t\tip daddr != [ADDR] fib daddr type local counter packets 155792 bytes 9523752 jump DOCKER # handle 7","\t}"],["\tchain OUTPUT { # handle 4","\t\ttype nat hook output priority dstnat; policy accept;","\t\tip6 daddr != [ADDR6] fib daddr type local counter packets 0 bytes 0 jump DOCKER # handle 5","\t}"],["\tchain netbird-raw-out { # handle 52","\t\ttype filter hook output priority raw; policy accept;","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55","\t}"]],"nft_netbird":[["\tchain netbird-rt-fwd { # handle 31","\t\tct state established,related counter packets 2112153 bytes 3401847160 accept # handle 37","\t}"],["\tchain netbird-rt-postrouting { # handle 32","\t\ttype nat hook postrouting priority srcnat - 1; policy accept;","\t\tmeta mark 0x0001bd21 oifname != \"lo\" counter packets 0 bytes 0 masquerade # handle 38","\t\tmeta mark 0x0001bd22 oifname \"wt0\" counter packets 0 bytes 0 masquerade # handle 39","\t}"],["\tchain netbird-rt-redirect { # handle 33","\t\ttype nat hook prerouting priority dstnat; policy accept;","\t}"],["\tchain netbird-mangle-postrouting { # handle 34","\t\ttype filter hook postrouting priority mangle; policy accept;","\t\toifname \"wt0\" ct state new ct mark set 0x0001bd11 # handle 42","\t}"],["\tchain netbird-mangle-prerouting { # handle 35","\t\ttype filter hook prerouting priority mangle; policy accept;","\t\tiifname \"wt0\" ct state new ct mark set 0x0001bd10 # handle 41","\t\tiifname \"wt0\" ip saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 61","\t\tiifname \"wt0\" ip saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 64","\t\tiifname \"wt0\" ip saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 67","\t}"],["\tchain netbird-mangle-forward { # handle 36","\t\ttype filter hook forward priority mangle; policy accept;","\t\toifname \"wt0\" tcp flags syn counter packets 12281 bytes 736860 tcp option maxseg size > 1240 tcp option maxseg size set 1240 # handle 40","\t}"],["\tchain netbird-acl-input-rules { # handle 43","\t\tct state established,related counter packets 7605032 bytes 6107862874 accept # handle 44","\t\tip saddr @nb0000001 accept # handle 59","\t\tip saddr @nb0000043 accept # handle 63","\t\tip saddr @nb0000055 accept # handle 66","\t}"],["\tchain netbird-acl-input-filter { # handle 45","\t\ttype filter hook input priority filter; policy accept;","\t\tiifname \"wt0\" jump netbird-acl-input-rules # handle 46","\t\tiifname \"wt0\" drop # handle 47","\t}"],["\tchain netbird-acl-forward-filter { # handle 48","\t\ttype filter hook forward priority filter; policy accept;","\t\tmeta mark 0x0001bd20 accept # handle 51","\t\tiifname \"wt0\" jump netbird-rt-fwd # handle 49","\t\tiifname \"wt0\" drop # handle 50","\t}"],["\tchain netbird-raw-out { # handle 52","\t\ttype filter hook output priority raw; policy accept;","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55","\t}"],["\tchain netbird-raw-pre { # handle 53","\t\ttype filter hook prerouting priority raw; policy accept;","\t\tiifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 84862 bytes 15870648 notrack # handle 56","\t\tiifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 3128 counter packets 64757 bytes 23705604 notrack # handle 57","\t}"],["\tchain netbird-rt-fwd { # handle 1","\t\tct state established,related counter packets 0 bytes 0 accept # handle 7","\t}"],["\tchain netbird-rt-postrouting { # handle 2","\t\ttype nat hook postrouting priority srcnat - 1; policy accept;","\t\tmeta mark 0x0001bd21 oifname != \"lo\" counter packets 0 bytes 0 masquerade # handle 8","\t\tmeta mark 0x0001bd22 oifname \"wt0\" counter packets 0 bytes 0 masquerade # handle 9","\t}"],["\tchain netbird-rt-redirect { # handle 3","\t\ttype nat hook prerouting priority dstnat; policy accept;","\t}"],["\tchain netbird-mangle-postrouting { # handle 4","\t\ttype filter hook postrouting priority mangle; policy accept;","\t\toifname \"wt0\" ct state new ct mark set 0x0001bd11 # handle 12","\t}"],["\tchain netbird-mangle-prerouting { # handle 5","\t\ttype filter hook prerouting priority mangle; policy accept;","\t\tiifname \"wt0\" ct state new ct mark set 0x0001bd10 # handle 11","\t\tiifname \"wt0\" ip6 saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 25","\t\tiifname \"wt0\" ip6 saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 28","\t\tiifname \"wt0\" ip6 saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 31","\t}"],["\tchain netbird-mangle-forward { # handle 6","\t\ttype filter hook forward priority mangle; policy accept;","\t\toifname \"wt0\" tcp flags syn counter packets 0 bytes 0 tcp option maxseg size > 1220 tcp option maxseg size set 1220 # handle 10","\t}"],["\tchain netbird-acl-input-rules { # handle 13","\t\tct state established,related counter packets 12 bytes 3817 accept # handle 14","\t\tip6 saddr @nb0000001 accept # handle 23","\t\tip6 saddr @nb0000043 accept # handle 27","\t\tip6 saddr @nb0000055 accept # handle 30","\t}"],["\tchain netbird-acl-input-filter { # handle 15","\t\ttype filter hook input priority filter; policy accept;","\t\tiifname \"wt0\" jump netbird-acl-input-rules # handle 16","\t\tiifname \"wt0\" drop # handle 17","\t}"],["\tchain netbird-acl-forward-filter { # handle 18","\t\ttype filter hook forward priority filter; policy accept;","\t\tmeta mark 0x0001bd20 accept # handle 21","\t\tiifname \"wt0\" jump netbird-rt-fwd # handle 19","\t\tiifname \"wt0\" drop # handle 20","\t}"]],"nft_snikket":[],"iptables":[":OUTPUT ACCEPT [0:0]","-A PREROUTING -d [ADDR] ! -i br-f43db13d76c4 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-a4e31561a8d5 -j DROP","-A PREROUTING -d [ADDR] ! -i br-8122fec51f39 -j DROP","-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 2375 -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8081 -j DROP","-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 7422 -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8088 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 12345 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 3100 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-d41b3e918fbc -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 9999 -j DROP",":FORWARD ACCEPT [4378479:806482115]",":OUTPUT ACCEPT [0:0]","-A INPUT ! -i lo -p tcp -m tcp --dport 81 -j DROP","-A DOCKER ! -i br-4d894f9e427b -o br-4d894f9e427b -j DROP","-A DOCKER ! -i br-5f66e1018bdd -o br-5f66e1018bdd -j DROP","-A DOCKER ! -i br-8122fec51f39 -o br-8122fec51f39 -j DROP","-A DOCKER ! -i br-915a81681c3e -o br-915a81681c3e -j DROP","-A DOCKER ! -i br-a4e31561a8d5 -o br-a4e31561a8d5 -j DROP","-A DOCKER ! -i br-d41b3e918fbc -o br-d41b3e918fbc -j DROP","-A DOCKER ! -i br-f43db13d76c4 -o br-f43db13d76c4 -j DROP","-A DOCKER ! -i docker0 -o docker0 -j DROP",":OUTPUT ACCEPT [6007854:372026992]","-A OUTPUT ! -d [ADDR] -m addrtype --dst-type LOCAL -j DOCKER"]}},"pve03":{"rc":0,"lines":["QM_CONFIG_BEGIN","name: edge-vm","net0: virtio=[ADDR6],bridge=vmbr0,firewall=1","QM_CONFIG_END","FWFILE=/etc/pve/firewall/cluster.fw EXISTS=1","2:enable: 1","3:policy_in: DROP","4:policy_out: ACCEPT","7:IN ACCEPT -source [ADDR]","8:IN ACCEPT -source [ADDR]","9:IN ACCEPT -source [ADDR]","10:IN ACCEPT -source [ADDR] -p tcp -dport 22","11:IN ACCEPT -source [ADDR] -p tcp -dport 8006","12:IN ACCEPT -source [ADDR] -p tcp -dport 9100","13:IN ACCEPT -source [ADDR] -p tcp -dport 9101","14:IN ACCEPT -source [ADDR] -p tcp -dport 22","15:IN ACCEPT -source [ADDR] -p tcp -dport 8006","16:IN ACCEPT -p icmp","FWFILE=/etc/pve/firewall/130.fw EXISTS=1","2:enable: 1","3:policy_in: ACCEPT","4:policy_out: ACCEPT","7:OUT DROP -dest [ADDR] -log nolog","8:OUT DROP -dest [ADDR] -log nolog","9:OUT DROP -dest [ADDR] -log nolog","FWFILE=/etc/pve/nodes/pve03/host.fw EXISTS=1","3:enable: 1","PVEFW_BEGIN","Status: enabled/running","PVEFW_END","LINKS_BEGIN","vmbr0            UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","tap130i0         UNKNOWN        [ADDR6] <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> ","fwbr130i0        UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","fwpr130p0@fwln130i0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","fwln130i0@fwpr130p0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","LINKS_END","BRIDGE_BEGIN","4: nic1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 4 ","7: tap130i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 ","9: fwpr130p0@fwln130i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","10: fwln130i0@fwpr130p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 ","13: fwpr190p0@fwln190i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","22: fwpr211p0@fwln211i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","BRIDGE_END","NFT_BEGIN","NFT_END","PVE03_TCP={\"[ADDR]:53\":true,\"[ADDR]:443\":true,\"[ADDR]:53\":true,\"[ADDR]:443\":true}"],"stderr_sha":null}}
 TASK_COMPLETE=true
-TASK_RESULT=PASS_SPB_VM130_EGRESS443_RCA
-DECISION=READ_EXACT_9127_THEN_REPAIR_NARROWEST_EGRESS_LAYER
+TASK_RESULT=PASS_SPB_VM130_EGRESS_POLICY_RCA
+DECISION=READ_EXACT_9128_THEN_REPAIR_ONLY_PROVEN_LAYER
 
 OUTPUT_END
 CHAT_OUTPUT_END