homelab-admin/homelab-public-context
1
0
Fork 0
Code Activity

runtime: publish SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1

Browse Source
This commit is contained in:
homelab-runtime-publisher
2026-09-15 04:46:21 +00:00
parent 71af1ae399
commit 99d3668b41
4 changed files with 184 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runtime/history/SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1.json
+38
View File
File diff suppressed because one or more lines are too long
runtime/history/SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1.txt
+78
View File
@@ -0,0 +1,78 @@
CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=infra-dr-backupv2-ct112-proven-producer-contract-rca
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=988c99c9bc6150d1f9dfc568332e87c814789ff4079280ff82d6acfbc8719f10
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=d7ffb79efa33fd264096ea556839aa44ab14119d53e059b3d29d9f8f66115b35
SANITIZED_OUTPUT_SHA256=d7ffb79efa33fd264096ea556839aa44ab14119d53e059b3d29d9f8f66115b35
OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1
MODE=READ_ONLY_CT112_PROVEN_PRODUCER_CONTRACT_RCA
NO_BACKUP_EXECUTION=YES
NO_FILE_MUTATION=YES
CURRENT_ID_GITEA_FRESHNESS=404_404_PASS
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
P270_SHA256=97015277a4f3f8129c0fd11eb70c06293026366f1f8232a97feeed513a2dbcef
P282_SHA256=73c6cb7773eb8e82d1e7ed5ab4733b4afb88f74ae69c09125d0378d6e480e012
ENGINE392_SHA256=7d96b9842de06277ea1be45e1f58e35c8a116a922425317954d339a333fe84f0
SOURCE_AND_ENGINE_IDENTITIES=PASS
ANCHOR_270_BINDING=PASS
ANCHOR_282_BINDING=PASS
ANCHOR_392A_BINDING=PASS
P270_FLAGS={"has_100000":true,"has_dumpdir":false,"has_lxc_usernsexec":false,"has_perl":true,"has_proc_fd":true,"has_tmpdir":false,"has_var_tmp":true,"has_vzdump":true}
P282_FLAGS={"has_100000":false,"has_dumpdir":false,"has_lxc_usernsexec":false,"has_perl":true,"has_proc_fd":false,"has_tmpdir":false,"has_var_tmp":false,"has_vzdump":true}
ENGINE392_FLAGS={"has_100000":true,"has_dumpdir":true,"has_lxc_usernsexec":false,"has_perl":false,"has_proc_fd":false,"has_tmpdir":false,"has_var_tmp":true,"has_vzdump":true}
P270_RELEVANT_LINES=["4:Only explicit produce() executes vzdump. Private bounded stderr/exit metadata retained.","18:need(type(d) is dict and set(d)=={'root_uid','root_gid','id_map'},'IDMAP_SCHEMA')","19:need(type(d['root_uid']) is int and type(d['root_gid']) is int,'IDMAP_VALUE')","20:need(d['root_uid']==d['root_gid']==100000,'ONLY_DEFAULT_UNPRIVILEGED_IDMAP')","21:expect=[['u',0,100000,65536],['g',0,100000,65536]]","22:need(type(d['id_map']) is list and len(d['id_map'])==2,'IDMAP_ROWS')","24:need(type(row) is list and len(row)==4 and type(row[0]) is str and all(type(n) is int for n in row[1:]) and row==exp,'IDMAP_NONDEFAULT')","25:return d['root_uid'],d['root_gid']","35:need(not any(s['name']=='vzdump' for s in snaps),'EXISTING_VZDUMP_SNAPSHOT_NO_AUTOCLEAN')","52:class PerlPin:","53:\"\"\"Dedicated read/execute-only pin for the observed system Perl hardlink pair.","61:need(self.path.name=='perl' and self.alias.name=='perl5.40.1' and self.path.parent==self.alias.parent,'PERL_PATH_POLICY')","62:need(self.path.is_absolute() and '..' not in self.path.parts,'PERL_PATH_POLICY')","69:need(s.st_uid==0 and not s.st_mode&0o022,'PERL_PARENT_UNTRUSTED')","72:need(stat.S_ISREG(s.st_mode) and s.st_uid==s.st_gid==0 and s.st_nlink==2,'PERL_SYSTEM_IDENTITY')","73:need(stat.S_IMODE(s.st_mode)==0o755,'PERL_SYSTEM_PERMISSIONS')","74:need(0<s.st_size<=32*1024**2,'PERL_SIZE_BOUND')","75:need(os.pread(self.fd,4,0)==b'\\x7fELF','PERL_ELF_REQUIRED')","81:s=os.fstat(self.fd);need(0<s.st_size<=32*1024**2,'PERL_SIZE_BOUND')","85:need(bool(b),'PERL_SHORT_READ');h.update(b);offset+=len(b)","88:need(self.fd is not None and self.parent is not None,'PERL_CLOSED')","92:need(t.ident(s)+(s.st_nlink,)==self.identity,'PERL_IDENTITY_CHANGED')","93:need(self._digest()==self.sha256,'PERL_CONTENT_CHANGED')","100:need(s.st_uid==0 and not s.st_mode&0o022,'PERL_PARENT_UNTRUSTED')","102:need((a.st_dev,a.st_ino)==(b.st_dev,b.st_ino),'PERL_PARENT_CHANGED')","104:except OSError:raise old.PVEError('PERL_PATH_CHANGED') from None","106:need(type(args) is list and all(type(x) is str and '\\x00' not in x for x in args),'PERL_ARGV')","107:need(type(seconds) in (int,float) and 0<seconds<=30,'PERL_DEADLINE')","110:p=subprocess.Popen(['/proc/self/fd/'+str(self.fd),*args],pass_fds=(self.fd,),","116:left=deadline-time.monotonic();need(left>0,'PERL_TIMEOUT')","121:need(len(out)+len(b)<=16384,'PERL_STDOUT_BOUND');out.extend(b)","122:left=deadline-time.monotonic();need(left>0,'PERL_TIMEOUT')","124:except subprocess.TimeoutExpired:raise old.PVEError('PERL_TIMEOUT') from None","143:('/usr/share/perl5/PVE/LXC.pm','/usr/share/perl5/PVE/VZDump/LXC.pm')}","145:'print JSON::PP->new->canonical->encode({root_uid=>0+$u,root_gid=>0+$g,'","147:with PerlPin('/usr/bin/perl','/usr/bin/perl5.40.1') as pin:","149:need(rc==0,'PVE_IDMAP_READ_FAILED')","153:except (ValueError,UnicodeError):raise old.PVEError('PVE_IDMAP_JSON') from None","164:need(s.st_uid==0,'TEMP_PARENT_OWNER')","171:class MappedScratch:","172:\"\"\"Root-owned, mapped-GID traverse-only, no access for others. No recursive cleanup.\"\"\"","173:def __init__(self,gid,base='/var/tmp'):","174:need(type(gid) is int and gid==100000,'TEMP_GID_POLICY')","175:self.parent=_parent(base);self.fd=None;self.gid=gid","181:os.fchown(self.fd,0,gid);os.fchmod(self.fd,0o710)","192:need(a.st_uid==b.st_uid==0 and a.st_gid==b.st_gid==self.gid and stat.S_IMODE(a.st_mode)==stat.S_IMODE(b.st_mode)==0o710,'TEMP_PERMISSIONS_CHANGED')","197:def probe(self,uid,private_path):","198:need(type(uid) is int and uid==100000,'TEMP_UID_POLICY');self.check()","216:for code,u,g,args in ((positive,uid,self.gid,[str(self.path),str(private_path)]),(negative,uid+1,self.gid+1,[str(self.path)])):","219:need(p.returncode==0,'MAPPED_TEMP_PERMISSION_PROBE_FAILED')","295:uid,gid=validate_mapping(mapping)","303:scratch=MappedScratch(gid)","304:emit('PVE_TEMP_DIRECTORY',scratch.path);emit('PVE_TEMP_MODE','0710');emit('PVE_TEMP_GID',gid)","305:t.create(work/'PVE_TEMP.json',core.canonical_bytes({'path':str(scratch.path),'mode':'0710','uid':0,'gid':gid,'identity':list(scratch.identity)}))","306:scratch.probe(uid,work);emit('MAPPED_UID_ACCESS_AND_ISOLATION_PROBE','PASS')","312:result=capture_archive(old.dump_argv(job,tools['vzdump']['path'],scratch.path,int(time.time())),dest,job['archive_cap_bytes'],seconds,free_guard)","325:emit('VZDUMP_PROCESS_STARTED','YES' if info.get('process_started') else 'NO')","326:emit('VZDUMP_PROCESS_RC',info.get('producer_rc'));emit('PRIVATE_STDERR_BYTES',info.get('stderr_bytes_retained'))"]
P282_RELEVANT_LINES=["1:\"\"\"282R1 bounded CT112 adapter; proven 270 capture/temp/Perl implementation unchanged.","14:PerlPin=proven.PerlPin","18:MappedScratch=proven.MappedScratch","68:uid,gid=validate_mapping(mapping)","76:scratch=MappedScratch(gid)","77:emit('PVE_TEMP_DIRECTORY',scratch.path);emit('PVE_TEMP_MODE','0710');emit('PVE_TEMP_GID',gid)","78:t.create(work/'PVE_TEMP.json',core.canonical_bytes({'path':str(scratch.path),'mode':'0710','uid':0,'gid':gid,'identity':list(scratch.identity)}))","79:scratch.probe(uid,work);emit('MAPPED_UID_ACCESS_AND_ISOLATION_PROBE','PASS')","85:result=capture_archive(old.dump_argv(job,tools['vzdump']['path'],scratch.path,int(time.time())),dest,job['archive_cap_bytes'],seconds,free_guard)","98:emit('VZDUMP_PROCESS_STARTED','YES' if info.get('process_started') else 'NO')","99:emit('VZDUMP_PROCESS_RC',info.get('producer_rc'));emit('PRIVATE_STDERR_BYTES',info.get('stderr_bytes_retained'))"]
ENGINE392_RELEVANT_LINES=["366:def _pve_dumpdir_spec(guest_type):","367:if guest_type=='lxc': return (0o710,100000)","376:# Use a direct /var/tmp child exactly like the accepted CT110/CT112 producer class.","377:# A mapped LXC root must be able to traverse every parent component; a root-only","379:srcdir=f'/var/tmp/homelab-vzdump-v2-{gen}'","380:mode,gid=_pve_dumpdir_spec(typ)","381:ssh_remote(node,['install','-d','-m',f'{mode:o}','-o','0','-g',str(gid),srcdir],timeout=30)","383:if q.stdout.decode().strip()!=f'{mode:o}:0:{gid}': raise BackupError('PVE_DUMPDIR_ACCESS_CONTRACT')","386:ssh_remote(node,['vzdump',str(vmid),'--mode','snapshot','--compress','zstd','--dumpdir',srcdir],timeout=7200)","389:if len(files)!=1: raise BackupError('VZDUMP_OUTPUT_NOT_UNIQUE')","396:if not pathlib.Path(local).is_file() or pathlib.Path(local).stat().st_size<=0: raise BackupError('VZDUMP_PAYLOAD_MISSING')","610:if p.is_file() and not p.is_symlink() and st.st_uid==0 and (st.st_mode & 0o777)==0o600: safe.append(p)","852:assert _pve_dumpdir_spec('lxc')==(0o710,100000)","853:assert _pve_dumpdir_spec('qemu')==(0o700,0)"]
P282_RELEVANT_CALLS=["MappedScratch(gid)","capture_archive(old.dump_argv(job,tools['vzdump']['path'],scratch.path,int(time.time())),dest,job['archive_cap_bytes'],seconds,free_guard)","core.canonical_bytes({'path':str(scratch.path),'mode':'0710','uid':0,'gid':gid,'identity':list(scratch.identity)})","emit('MAPPED_UID_ACCESS_AND_ISOLATION_PROBE','PASS')","emit('PVE_TEMP_GID',gid)","emit('VZDUMP_PROCESS_RC',info.get('producer_rc'))","emit('VZDUMP_PROCESS_STARTED','YES' if info.get('process_started') else 'NO')","old.dump_argv(job,tools['vzdump']['path'],scratch.path,int(time.time()))","scratch.probe(uid,work)","t.create(work/'PVE_TEMP.json',core.canonical_bytes({'path':str(scratch.path),'mode':'0710','uid':0,'gid':gid,'identity':list(scratch.identity)}))"]
ENGINE392_RELEVANT_CALLS=["BackupError('PVE_DUMPDIR_ACCESS_CONTRACT')","BackupError('VZDUMP_OUTPUT_NOT_UNIQUE')","BackupError('VZDUMP_PAYLOAD_MISSING')","_pve_dumpdir_spec('lxc')","_pve_dumpdir_spec('qemu')","_pve_dumpdir_spec(typ)","ssh_remote(node,['install','-d','-m',f'{mode:o}','-o','0','-g',str(gid),srcdir],timeout=30)","ssh_remote(node,['vzdump',str(vmid),'--mode','snapshot','--compress','zstd','--dumpdir',srcdir],timeout=7200)","str(gid)"]
P282_ENGINE392_STRUCTURAL_DIFF=["has_100000:P282=False:ENGINE392=True","has_dumpdir:P282=False:ENGINE392=True","has_perl:P282=True:ENGINE392=False","has_var_tmp:P282=False:ENGINE392=True"]
HOMELAB_APP_CLOUD_QUORUM_QUEUE_TIMER_ENABLED=enabled
HOMELAB_APP_CLOUD_QUORUM_QUEUE_TIMER_ACTIVE=active
HOMELAB_VM_CLOUD_QUORUM_QUEUE_TIMER_ENABLED=enabled
HOMELAB_VM_CLOUD_QUORUM_QUEUE_TIMER_ACTIVE=active
HOMELAB_CONTROL_BACKUP_TIMER_ENABLED=enabled
HOMELAB_CONTROL_BACKUP_TIMER_ACTIVE=active
HOMELAB_BACKUP_V2_TIMER_ENABLED=disabled
HOMELAB_BACKUP_V2_TIMER_ACTIVE=inactive
RCA_READY=YES
NEXT_GATE=CT112_MINIMAL_PROVEN_CONTRACT_FIX_THEN_REPEATED_GREEN_CUTOVER_CLOSURE
STATUS=OK
PHASE=COMPLETE
REASON=NONE
CHANGES_MADE=false
MUTATION_OUTCOME=NO_MUTATION
BACKUP_EXECUTIONS=0
CLOUD_WRITES=0
CLOUD_DELETIONS=0
SYSTEMD_MUTATIONS=0
SCHEDULER_CUTOVER=NO
LEGACY_BACKUP_DISABLES=0
HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1","rollback_restored":null,"rollback_started":false,"status":"OK","version":1}
OUTPUT_END
CHAT_OUTPUT_END
runtime/latest.json
+16 -16
View File
File diff suppressed because one or more lines are too long
runtime/latest.txt
+52 -86
View File
@@ -1,112 +1,78 @@
CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260915-INFRA-DR-BACKUPV2-FINAL-GREEN-RCA-FIX-392A-R1
STATUS=FAIL
RC=2
COMMAND_ID=SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1
STATUS=OK
RC=0
HOST=pve01
MODE=change
COMPONENT=infra-dr-backupv2-final-green-rca-fix
MODE=read-only
COMPONENT=infra-dr-backupv2-ct112-proven-producer-contract-rca
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=298e0e8e4e05f5ddf8a8e09afe0b632249df71e9185e4f80fdb57d14520c5d8e
COMMAND_SHA256=988c99c9bc6150d1f9dfc568332e87c814789ff4079280ff82d6acfbc8719f10
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=FAIL
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=2
CHANGES_MADE=true
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=MUTATED
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=e7166ee608c773871aed867560a2c4cfbb9865c17d9c5ad8b6d69b041fbb6d68
SANITIZED_OUTPUT_SHA256=e7166ee608c773871aed867560a2c4cfbb9865c17d9c5ad8b6d69b041fbb6d68
RAW_EVIDENCE_SHA256=d7ffb79efa33fd264096ea556839aa44ab14119d53e059b3d29d9f8f66115b35
SANITIZED_OUTPUT_SHA256=d7ffb79efa33fd264096ea556839aa44ab14119d53e059b3d29d9f8f66115b35
OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260915-INFRA-DR-BACKUPV2-FINAL-GREEN-RCA-FIX-392A-R1
MODE=CHANGE_BACKUPV2_FINAL_GREEN_RCA_FIX
SIXTH_USER_LAUNCH_INTERNAL_GATE=A
SCHEDULER_CUTOVER=NO
LEGACY_BACKUP_DISABLES=0
NO_RETENTION_DELETE=YES
COMMAND_ID=SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1
MODE=READ_ONLY_CT112_PROVEN_PRODUCER_CONTRACT_RCA
NO_BACKUP_EXECUTION=YES
NO_FILE_MUTATION=YES
CURRENT_ID_GITEA_FRESHNESS=404_404_PASS
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
ERROR_REGISTER_FRESH_READ=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
REFERENCE_FRESH_READ=OK
ANCHOR_391_RUNTIME_IDENTITY=PASS
RCA_391_CT112=ROOT_ONLY_STAGING_PARENT_BLOCKED_MAPPED_LXC_TRAVERSAL
RCA_391_ROUTER=BATCHMODE_YES_DISABLED_PROVEN_SSHPASS_FILE_AUTH
RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
P270_SHA256=97015277a4f3f8129c0fd11eb70c06293026366f1f8232a97feeed513a2dbcef
P282_SHA256=73c6cb7773eb8e82d1e7ed5ab4733b4afb88f74ae69c09125d0378d6e480e012
ENGINE392_SHA256=7d96b9842de06277ea1be45e1f58e35c8a116a922425317954d339a333fe84f0
TIMER392_SHA256=5469057602452b303a01ccb8057085c1b0e447973e5ed198cebf7dd5daf58e9d
ENGINE392_FIX_STAGE=PASS
SYSTEMD_MUTATIONS=1
VPS_OPERATOR_KEY_BOOTSTRAP={"md-relay":"ALREADY_OPERATOR_KEY","spb-ingress":"ALREADY_OPERATOR_KEY","us-netbird":"ALREADY_US_OPERATOR_KEY"}
GREEN1_CT112=FAIL
GREEN1_CT112_REASON=COMMAND_FAILED
GREEN1_NODE_PVE01=PASS
GREEN1_NODE_PVE01_GENERATION=v2-node-pve01-20260915T040859Z-9187f2b9a0b4
GREEN1_NODE_PVE01_PAYLOAD_BYTES=14589
GREEN1_NODE_PVE01_REPLICAS=2
GREEN1_NODE_PVE01_ALLOCATOR_HEALTHY=13
GREEN1_MD_RELAY=PASS
GREEN1_MD_RELAY_GENERATION=v2-md-relay-20260915T040919Z-dce4df238c44
GREEN1_MD_RELAY_PAYLOAD_BYTES=1317
GREEN1_MD_RELAY_REPLICAS=2
GREEN1_MD_RELAY_ALLOCATOR_HEALTHY=13
GREEN1_SPB_INGRESS=PASS
GREEN1_SPB_INGRESS_GENERATION=v2-spb-ingress-20260915T040945Z-d5a0f829f2db
GREEN1_SPB_INGRESS_PAYLOAD_BYTES=11803
GREEN1_SPB_INGRESS_REPLICAS=2
GREEN1_SPB_INGRESS_ALLOCATOR_HEALTHY=13
GREEN1_US_NETBIRD=PASS
GREEN1_US_NETBIRD_GENERATION=v2-us-netbird-20260915T041008Z-524bf01114e8
GREEN1_US_NETBIRD_PAYLOAD_BYTES=33988012
GREEN1_US_NETBIRD_REPLICAS=2
GREEN1_US_NETBIRD_ALLOCATOR_HEALTHY=13
GREEN1_ROUTER_NETCRAZE=PASS
GREEN1_ROUTER_NETCRAZE_GENERATION=v2-router-netcraze-20260915T041046Z-4c2a0d596bf1
GREEN1_ROUTER_NETCRAZE_PAYLOAD_BYTES=4178
GREEN1_ROUTER_NETCRAZE_REPLICAS=2
GREEN1_ROUTER_NETCRAZE_ALLOCATOR_HEALTHY=13
GREEN1_XF_CODEVIPE=PASS
GREEN1_XF_CODEVIPE_GENERATION=v2-xf-codevipe-20260915T041109Z-5f86289a9d31
GREEN1_XF_CODEVIPE_PAYLOAD_BYTES=39796061
GREEN1_XF_CODEVIPE_REPLICAS=2
GREEN1_XF_CODEVIPE_ALLOCATOR_HEALTHY=13
GREEN1_XF_ZAKRUTIM=PASS
GREEN1_XF_ZAKRUTIM_GENERATION=v2-xf-zakrutim-20260915T042328Z-6cba14c13511
GREEN1_XF_ZAKRUTIM_PAYLOAD_BYTES=45049171
GREEN1_XF_ZAKRUTIM_REPLICAS=2
GREEN1_XF_ZAKRUTIM_ALLOCATOR_HEALTHY=13
GREEN1_CONTROL_BOOTSTRAP_V2=PASS
GREEN1_CONTROL_BOOTSTRAP_V2_GENERATION=control-bootstrap-v2-pve01-20260914T210856Z
GREEN1_CONTROL_BOOTSTRAP_V2_PAYLOAD_BYTES=0
GREEN1_CONTROL_BOOTSTRAP_V2_REPLICAS=2
GREEN1_TARGET_COUNT=9
GREEN1_PASS_COUNT=8
GREEN1_FAIL_COUNT=1
GREEN1_CLOUD_BACKUP_TARGET_COUNT=8
GREEN1_CONTROL_VERIFY_TARGET_COUNT=1
ENGINE_STATUS=FAIL
ENGINE_REASON=GREEN1_TARGET_FAILURES
GREEN1_ENGINE_RC=2
GREEN1_STDERR_BYTES=0
GREEN1_STDERR_SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
STATUS=FAIL
PHASE=GREEN1
REASON=GREEN1_NOT_ALL_PASS
GREEN1_EXCEPTION_CLASS=RuntimeError
CHANGES_MADE=true
MUTATION_OUTCOME=MUTATED
SOURCE_AND_ENGINE_IDENTITIES=PASS
ANCHOR_270_BINDING=PASS
ANCHOR_282_BINDING=PASS
ANCHOR_392A_BINDING=PASS
P270_FLAGS={"has_100000":true,"has_dumpdir":false,"has_lxc_usernsexec":false,"has_perl":true,"has_proc_fd":true,"has_tmpdir":false,"has_var_tmp":true,"has_vzdump":true}
P282_FLAGS={"has_100000":false,"has_dumpdir":false,"has_lxc_usernsexec":false,"has_perl":true,"has_proc_fd":false,"has_tmpdir":false,"has_var_tmp":false,"has_vzdump":true}
ENGINE392_FLAGS={"has_100000":true,"has_dumpdir":true,"has_lxc_usernsexec":false,"has_perl":false,"has_proc_fd":false,"has_tmpdir":false,"has_var_tmp":true,"has_vzdump":true}
P270_RELEVANT_LINES=["4:Only explicit produce() executes vzdump. Private bounded stderr/exit metadata retained.","18:need(type(d) is dict and set(d)=={'root_uid','root_gid','id_map'},'IDMAP_SCHEMA')","19:need(type(d['root_uid']) is int and type(d['root_gid']) is int,'IDMAP_VALUE')","20:need(d['root_uid']==d['root_gid']==100000,'ONLY_DEFAULT_UNPRIVILEGED_IDMAP')","21:expect=[['u',0,100000,65536],['g',0,100000,65536]]","22:need(type(d['id_map']) is list and len(d['id_map'])==2,'IDMAP_ROWS')","24:need(type(row) is list and len(row)==4 and type(row[0]) is str and all(type(n) is int for n in row[1:]) and row==exp,'IDMAP_NONDEFAULT')","25:return d['root_uid'],d['root_gid']","35:need(not any(s['name']=='vzdump' for s in snaps),'EXISTING_VZDUMP_SNAPSHOT_NO_AUTOCLEAN')","52:class PerlPin:","53:\"\"\"Dedicated read/execute-only pin for the observed system Perl hardlink pair.","61:need(self.path.name=='perl' and self.alias.name=='perl5.40.1' and self.path.parent==self.alias.parent,'PERL_PATH_POLICY')","62:need(self.path.is_absolute() and '..' not in self.path.parts,'PERL_PATH_POLICY')","69:need(s.st_uid==0 and not s.st_mode&0o022,'PERL_PARENT_UNTRUSTED')","72:need(stat.S_ISREG(s.st_mode) and s.st_uid==s.st_gid==0 and s.st_nlink==2,'PERL_SYSTEM_IDENTITY')","73:need(stat.S_IMODE(s.st_mode)==0o755,'PERL_SYSTEM_PERMISSIONS')","74:need(0<s.st_size<=32*1024**2,'PERL_SIZE_BOUND')","75:need(os.pread(self.fd,4,0)==b'\\x7fELF','PERL_ELF_REQUIRED')","81:s=os.fstat(self.fd);need(0<s.st_size<=32*1024**2,'PERL_SIZE_BOUND')","85:need(bool(b),'PERL_SHORT_READ');h.update(b);offset+=len(b)","88:need(self.fd is not None and self.parent is not None,'PERL_CLOSED')","92:need(t.ident(s)+(s.st_nlink,)==self.identity,'PERL_IDENTITY_CHANGED')","93:need(self._digest()==self.sha256,'PERL_CONTENT_CHANGED')","100:need(s.st_uid==0 and not s.st_mode&0o022,'PERL_PARENT_UNTRUSTED')","102:need((a.st_dev,a.st_ino)==(b.st_dev,b.st_ino),'PERL_PARENT_CHANGED')","104:except OSError:raise old.PVEError('PERL_PATH_CHANGED') from None","106:need(type(args) is list and all(type(x) is str and '\\x00' not in x for x in args),'PERL_ARGV')","107:need(type(seconds) in (int,float) and 0<seconds<=30,'PERL_DEADLINE')","110:p=subprocess.Popen(['/proc/self/fd/'+str(self.fd),*args],pass_fds=(self.fd,),","116:left=deadline-time.monotonic();need(left>0,'PERL_TIMEOUT')","121:need(len(out)+len(b)<=16384,'PERL_STDOUT_BOUND');out.extend(b)","122:left=deadline-time.monotonic();need(left>0,'PERL_TIMEOUT')","124:except subprocess.TimeoutExpired:raise old.PVEError('PERL_TIMEOUT') from None","143:('/usr/share/perl5/PVE/LXC.pm','/usr/share/perl5/PVE/VZDump/LXC.pm')}","145:'print JSON::PP->new->canonical->encode({root_uid=>0+$u,root_gid=>0+$g,'","147:with PerlPin('/usr/bin/perl','/usr/bin/perl5.40.1') as pin:","149:need(rc==0,'PVE_IDMAP_READ_FAILED')","153:except (ValueError,UnicodeError):raise old.PVEError('PVE_IDMAP_JSON') from None","164:need(s.st_uid==0,'TEMP_PARENT_OWNER')","171:class MappedScratch:","172:\"\"\"Root-owned, mapped-GID traverse-only, no access for others. No recursive cleanup.\"\"\"","173:def __init__(self,gid,base='/var/tmp'):","174:need(type(gid) is int and gid==100000,'TEMP_GID_POLICY')","175:self.parent=_parent(base);self.fd=None;self.gid=gid","181:os.fchown(self.fd,0,gid);os.fchmod(self.fd,0o710)","192:need(a.st_uid==b.st_uid==0 and a.st_gid==b.st_gid==self.gid and stat.S_IMODE(a.st_mode)==stat.S_IMODE(b.st_mode)==0o710,'TEMP_PERMISSIONS_CHANGED')","197:def probe(self,uid,private_path):","198:need(type(uid) is int and uid==100000,'TEMP_UID_POLICY');self.check()","216:for code,u,g,args in ((positive,uid,self.gid,[str(self.path),str(private_path)]),(negative,uid+1,self.gid+1,[str(self.path)])):","219:need(p.returncode==0,'MAPPED_TEMP_PERMISSION_PROBE_FAILED')","295:uid,gid=validate_mapping(mapping)","303:scratch=MappedScratch(gid)","304:emit('PVE_TEMP_DIRECTORY',scratch.path);emit('PVE_TEMP_MODE','0710');emit('PVE_TEMP_GID',gid)","305:t.create(work/'PVE_TEMP.json',core.canonical_bytes({'path':str(scratch.path),'mode':'0710','uid':0,'gid':gid,'identity':list(scratch.identity)}))","306:scratch.probe(uid,work);emit('MAPPED_UID_ACCESS_AND_ISOLATION_PROBE','PASS')","312:result=capture_archive(old.dump_argv(job,tools['vzdump']['path'],scratch.path,int(time.time())),dest,job['archive_cap_bytes'],seconds,free_guard)","325:emit('VZDUMP_PROCESS_STARTED','YES' if info.get('process_started') else 'NO')","326:emit('VZDUMP_PROCESS_RC',info.get('producer_rc'));emit('PRIVATE_STDERR_BYTES',info.get('stderr_bytes_retained'))"]
P282_RELEVANT_LINES=["1:\"\"\"282R1 bounded CT112 adapter; proven 270 capture/temp/Perl implementation unchanged.","14:PerlPin=proven.PerlPin","18:MappedScratch=proven.MappedScratch","68:uid,gid=validate_mapping(mapping)","76:scratch=MappedScratch(gid)","77:emit('PVE_TEMP_DIRECTORY',scratch.path);emit('PVE_TEMP_MODE','0710');emit('PVE_TEMP_GID',gid)","78:t.create(work/'PVE_TEMP.json',core.canonical_bytes({'path':str(scratch.path),'mode':'0710','uid':0,'gid':gid,'identity':list(scratch.identity)}))","79:scratch.probe(uid,work);emit('MAPPED_UID_ACCESS_AND_ISOLATION_PROBE','PASS')","85:result=capture_archive(old.dump_argv(job,tools['vzdump']['path'],scratch.path,int(time.time())),dest,job['archive_cap_bytes'],seconds,free_guard)","98:emit('VZDUMP_PROCESS_STARTED','YES' if info.get('process_started') else 'NO')","99:emit('VZDUMP_PROCESS_RC',info.get('producer_rc'));emit('PRIVATE_STDERR_BYTES',info.get('stderr_bytes_retained'))"]
ENGINE392_RELEVANT_LINES=["366:def _pve_dumpdir_spec(guest_type):","367:if guest_type=='lxc': return (0o710,100000)","376:# Use a direct /var/tmp child exactly like the accepted CT110/CT112 producer class.","377:# A mapped LXC root must be able to traverse every parent component; a root-only","379:srcdir=f'/var/tmp/homelab-vzdump-v2-{gen}'","380:mode,gid=_pve_dumpdir_spec(typ)","381:ssh_remote(node,['install','-d','-m',f'{mode:o}','-o','0','-g',str(gid),srcdir],timeout=30)","383:if q.stdout.decode().strip()!=f'{mode:o}:0:{gid}': raise BackupError('PVE_DUMPDIR_ACCESS_CONTRACT')","386:ssh_remote(node,['vzdump',str(vmid),'--mode','snapshot','--compress','zstd','--dumpdir',srcdir],timeout=7200)","389:if len(files)!=1: raise BackupError('VZDUMP_OUTPUT_NOT_UNIQUE')","396:if not pathlib.Path(local).is_file() or pathlib.Path(local).stat().st_size<=0: raise BackupError('VZDUMP_PAYLOAD_MISSING')","610:if p.is_file() and not p.is_symlink() and st.st_uid==0 and (st.st_mode & 0o777)==0o600: safe.append(p)","852:assert _pve_dumpdir_spec('lxc')==(0o710,100000)","853:assert _pve_dumpdir_spec('qemu')==(0o700,0)"]
P282_RELEVANT_CALLS=["MappedScratch(gid)","capture_archive(old.dump_argv(job,tools['vzdump']['path'],scratch.path,int(time.time())),dest,job['archive_cap_bytes'],seconds,free_guard)","core.canonical_bytes({'path':str(scratch.path),'mode':'0710','uid':0,'gid':gid,'identity':list(scratch.identity)})","emit('MAPPED_UID_ACCESS_AND_ISOLATION_PROBE','PASS')","emit('PVE_TEMP_GID',gid)","emit('VZDUMP_PROCESS_RC',info.get('producer_rc'))","emit('VZDUMP_PROCESS_STARTED','YES' if info.get('process_started') else 'NO')","old.dump_argv(job,tools['vzdump']['path'],scratch.path,int(time.time()))","scratch.probe(uid,work)","t.create(work/'PVE_TEMP.json',core.canonical_bytes({'path':str(scratch.path),'mode':'0710','uid':0,'gid':gid,'identity':list(scratch.identity)}))"]
ENGINE392_RELEVANT_CALLS=["BackupError('PVE_DUMPDIR_ACCESS_CONTRACT')","BackupError('VZDUMP_OUTPUT_NOT_UNIQUE')","BackupError('VZDUMP_PAYLOAD_MISSING')","_pve_dumpdir_spec('lxc')","_pve_dumpdir_spec('qemu')","_pve_dumpdir_spec(typ)","ssh_remote(node,['install','-d','-m',f'{mode:o}','-o','0','-g',str(gid),srcdir],timeout=30)","ssh_remote(node,['vzdump',str(vmid),'--mode','snapshot','--compress','zstd','--dumpdir',srcdir],timeout=7200)","str(gid)"]
P282_ENGINE392_STRUCTURAL_DIFF=["has_100000:P282=False:ENGINE392=True","has_dumpdir:P282=False:ENGINE392=True","has_perl:P282=True:ENGINE392=False","has_var_tmp:P282=False:ENGINE392=True"]
HOMELAB_APP_CLOUD_QUORUM_QUEUE_TIMER_ENABLED=enabled
HOMELAB_APP_CLOUD_QUORUM_QUEUE_TIMER_ACTIVE=active
HOMELAB_VM_CLOUD_QUORUM_QUEUE_TIMER_ENABLED=enabled
HOMELAB_VM_CLOUD_QUORUM_QUEUE_TIMER_ACTIVE=active
HOMELAB_CONTROL_BACKUP_TIMER_ENABLED=enabled
HOMELAB_CONTROL_BACKUP_TIMER_ACTIVE=active
HOMELAB_BACKUP_V2_TIMER_ENABLED=disabled
HOMELAB_BACKUP_V2_TIMER_ACTIVE=inactive
RCA_READY=YES
NEXT_GATE=CT112_MINIMAL_PROVEN_CONTRACT_FIX_THEN_REPEATED_GREEN_CUTOVER_CLOSURE
STATUS=OK
PHASE=COMPLETE
REASON=NONE
CHANGES_MADE=false
MUTATION_OUTCOME=NO_MUTATION
BACKUP_EXECUTIONS=0
CLOUD_WRITES=0
CLOUD_DELETIONS=0
SYSTEMD_MUTATIONS=0
SCHEDULER_CUTOVER=NO
LEGACY_BACKUP_DISABLES=0
HOMELAB_RESULT_CONTRACT={"changes_made":true,"command_id":"SUPPORT-260915-INFRA-DR-BACKUPV2-FINAL-GREEN-RCA-FIX-392A-R1","rollback_restored":null,"rollback_started":false,"status":"FAIL","version":1}
HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"SUPPORT-260915-INFRA-DR-BACKUPV2-CT112-PROVEN-PRODUCER-CONTRACT-RCA-393R1","rollback_restored":null,"rollback_started":false,"status":"OK","version":1}
OUTPUT_END
CHAT_OUTPUT_END