runtime: publish SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1

runtime/history/SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "usa-direct-ssh-cleanup-audit",
+  "started_at_utc": "2026-09-28T14:02:50Z",
+  "finished_at_utc": "2026-09-28T14:02:56Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "63d5688af6e15bc10d01f2cb02820458daa9f9186034ebed89f40bb7d5333132",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "9f3df5d6a51d987662f2fe3ee016eb9dbab2bf237c3e964b6ae99f61d2a3f637",
+  "sanitized_output_sha256": "9f3df5d6a51d987662f2fe3ee016eb9dbab2bf237c3e964b6ae99f61d2a3f637",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "USA_DIRECT_SSH_CLEANUP_AUDIT=V1\nMODE=read-only\nMUTATION_BOUNDARY=NONE\nGOAL=VERIFY_99056_CLEANUP_AND_REGAIN_DIRECT_USA_OPERATOR_ACCESS\nPVE01_OPERATOR_KEY_FINGERPRINT=SHA256:wipXiBB3cpAwyWap9LcB185WjEEmDxtRJsI/UuMVAp0\nPVE01_OPERATOR_KEY_MATCH=true\nUSA_SSH_KEYSCAN_RC=0\nUSA_HOSTKEY_FINGERPRINT=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE\nUSA_HOSTKEY_MATCH=true\nUSA_DIRECT_OPERATOR_SSH_RC=0\nUSA_DIRECT_OPERATOR_AUTH=true\nAUDIT_VERSION=9\nAUDIT_HOSTNAME=pvepro\nAUDIT_UID=0\nAUDIT_USER=root\nAUDIT_KERNEL=6.1.0-53-amd64\nAUDIT_UPTIME_SECONDS=13513\nAUDIT_OS_ID=debian\nAUDIT_OS_VERSION_ID=12\nAUDIT_99056_IPTABLES_RULE_COUNT=0\nAUDIT_IPTABLES_PRESENT=true\nAUDIT_IPTABLES_VERSION=iptables v1.8.9 (nf_tables)\nAUDIT_IPTABLES_INPUT_POLICY=ACCEPT\nAUDIT_IPTABLES_FORWARD_POLICY=DROP\nAUDIT_IPTABLES_MOLDOVA_REF_COUNT=0\nAUDIT_IPTABLES_MOLDOVA_443_REF_COUNT=0\nAUDIT_IPTABLES_MOLDOVA_3478_REF_COUNT=0\nAUDIT_IPTABLES_443_ACCEPT_COUNT=1\nAUDIT_IPTABLES_443_DROP_REJECT_COUNT=0\nAUDIT_IPTABLES_3478_ACCEPT_COUNT=1\nAUDIT_IPTABLES_3478_DROP_REJECT_COUNT=0\nAUDIT_99056_RUN_FILE_COUNT=0\nAUDIT_99056_SYSTEMD_UNIT_COUNT=0\nAUDIT_NFT_PRESENT=true\nAUDIT_NFT_INPUT_POLICY_DROP_COUNT=0\nAUDIT_NFT_FORWARD_POLICY_DROP_COUNT=1\nAUDIT_NFT_MOLDOVA_REF_COUNT=0\nAUDIT_NFT_MOLDOVA_443_REF_COUNT=0\nAUDIT_NFT_MOLDOVA_3478_REF_COUNT=0\nAUDIT_NFT_443_DROP_REJECT_COUNT=0\nAUDIT_NFT_3478_DROP_REJECT_COUNT=0\nAUDIT_NFT_MOLDOVA_MATCH_HINT=NONE\nAUDIT_UFW_PRESENT=false\nAUDIT_UFW_ACTIVE=false\nAUDIT_UFW_MOLDOVA_REF_COUNT=0\nAUDIT_UFW_443_ALLOW_COUNT=0\nAUDIT_UFW_3478_ALLOW_COUNT=0\nAUDIT_IPSET_PRESENT=false\nAUDIT_IPSET_MOLDOVA_MEMBER_COUNT=0\nAUDIT_TCP_22_LISTEN=true\nAUDIT_TCP_80_LISTEN=true\nAUDIT_TCP_443_LISTEN=true\nAUDIT_TCP_33073_LISTEN=false\nAUDIT_TCP_33080_LISTEN=false\nAUDIT_TCP_10000_LISTEN=false\nAUDIT_UDP_3478_LISTEN=true\nAUDIT_LOOPBACK_HTTPS_NB_PVEPRO=000\nAUDIT_LOOPBACK_OIDC_NB_PVEPRO=000\nAUDIT_DOCKER_PRESENT=true\nAUDIT_DOCKER_VERSION=Docker version 29.7.2, build a7dcaa6\nAUDIT_DOCKER_ACTIVE=true\nAUDIT_COMPOSE_V2=true\nAUDIT_COMPOSE_VERSION=Docker Compose version v5.5.0\nAUDIT_COMPOSE_PATH=/opt/netbird/docker-compose.yml\nAUDIT_COMPOSE_EXISTS=true\nAUDIT_COMPOSE_SHA256=d6e9a3fa91ae603357baa1139c7f46ba9f812a0c34e5bbcee70b1a5a78cbd7b9\nAUDIT_COMPOSE_DIR=/opt/netbird\nAUDIT_ENV_EXISTS=false\nAUDIT_ENV_SHA256=NONE\nAUDIT_COMPOSE_CONFIG_VALID=true\nAUDIT_COMPOSE_SERVICES=netbird-server,traefik,dashboard\nAUDIT_COMPOSE_IMAGES=netbirdio/dashboard:latest,netbirdio/netbird-server:latest,traefik:v3.6\nAUDIT_COMPOSE_VOLUMES=netbird_traefik_letsencrypt,netbird_data\nAUDIT_RENDERED_MOLDOVA_REF_COUNT=0\nAUDIT_NETBIRD_CLIENT_PRESENT=false\nAUDIT_NETBIRD_CLIENT_VERSION=NONE\nAUDIT_NETBIRD_SERVICE_ACTIVE=false\nAUDIT_NETBIRD_SERVICE_ENABLED=false\nAUDIT_NETBIRD_WT0_PRESENT=false\nAUDIT_NETBIRD_APT_INSTALLED=NONE\nAUDIT_NETBIRD_APT_CANDIDATE=NONE\nAUDIT_OPT_NETBIRD_MOLDOVA_REF_COUNT=0\nAUDIT_OPT_NETBIRD_MOLDOVA_REF_FILES=NONE\nAUDIT_OPT_AVAILABLE_KB=34350608\nAUDIT_BACKUP_DIR_EXISTS=false\nAUDIT_CHANGES_MADE=false\nUSA_99056_CLEANUP_VERIFIED=true\nUSA_GUEST_MOLDOVA_REFERENCE_COUNT=0\nUSA_GUEST_PORT_DROP_REJECT_COUNT=0\nUSA_GUEST_NFT_DROP_POLICY_COUNT=1\nDECISION=HOLD_DIRECT_SSH_REGAINED_BUT_LOCAL_STACK_NOT_FULLY_READY\nNEXT_GATE=REPAIR_LOCAL_NETBIRD_STACK_BEFORE_EXTERNAL_CUTOVER\nTASK_RESULT=PASS_USA_DIRECT_SSH_CLEANUP_AUDIT\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
+}

runtime/history/SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1.txt

@@ -0,0 +1,130 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=usa-direct-ssh-cleanup-audit
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=63d5688af6e15bc10d01f2cb02820458daa9f9186034ebed89f40bb7d5333132
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=9f3df5d6a51d987662f2fe3ee016eb9dbab2bf237c3e964b6ae99f61d2a3f637
+SANITIZED_OUTPUT_SHA256=9f3df5d6a51d987662f2fe3ee016eb9dbab2bf237c3e964b6ae99f61d2a3f637
+OUTPUT_BEGIN
+USA_DIRECT_SSH_CLEANUP_AUDIT=V1
+MODE=read-only
+MUTATION_BOUNDARY=NONE
+GOAL=VERIFY_99056_CLEANUP_AND_REGAIN_DIRECT_USA_OPERATOR_ACCESS
+PVE01_OPERATOR_KEY_FINGERPRINT=SHA256:wipXiBB3cpAwyWap9LcB185WjEEmDxtRJsI/UuMVAp0
+PVE01_OPERATOR_KEY_MATCH=true
+USA_SSH_KEYSCAN_RC=0
+USA_HOSTKEY_FINGERPRINT=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE
+USA_HOSTKEY_MATCH=true
+USA_DIRECT_OPERATOR_SSH_RC=0
+USA_DIRECT_OPERATOR_AUTH=true
+AUDIT_VERSION=9
+AUDIT_HOSTNAME=pvepro
+AUDIT_UID=0
+AUDIT_USER=root
+AUDIT_KERNEL=6.1.0-53-amd64
+AUDIT_UPTIME_SECONDS=13513
+AUDIT_OS_ID=debian
+AUDIT_OS_VERSION_ID=12
+AUDIT_99056_IPTABLES_RULE_COUNT=0
+AUDIT_IPTABLES_PRESENT=true
+AUDIT_IPTABLES_VERSION=iptables v1.8.9 (nf_tables)
+AUDIT_IPTABLES_INPUT_POLICY=ACCEPT
+AUDIT_IPTABLES_FORWARD_POLICY=DROP
+AUDIT_IPTABLES_MOLDOVA_REF_COUNT=0
+AUDIT_IPTABLES_MOLDOVA_443_REF_COUNT=0
+AUDIT_IPTABLES_MOLDOVA_3478_REF_COUNT=0
+AUDIT_IPTABLES_443_ACCEPT_COUNT=1
+AUDIT_IPTABLES_443_DROP_REJECT_COUNT=0
+AUDIT_IPTABLES_3478_ACCEPT_COUNT=1
+AUDIT_IPTABLES_3478_DROP_REJECT_COUNT=0
+AUDIT_99056_RUN_FILE_COUNT=0
+AUDIT_99056_SYSTEMD_UNIT_COUNT=0
+AUDIT_NFT_PRESENT=true
+AUDIT_NFT_INPUT_POLICY_DROP_COUNT=0
+AUDIT_NFT_FORWARD_POLICY_DROP_COUNT=1
+AUDIT_NFT_MOLDOVA_REF_COUNT=0
+AUDIT_NFT_MOLDOVA_443_REF_COUNT=0
+AUDIT_NFT_MOLDOVA_3478_REF_COUNT=0
+AUDIT_NFT_443_DROP_REJECT_COUNT=0
+AUDIT_NFT_3478_DROP_REJECT_COUNT=0
+AUDIT_NFT_MOLDOVA_MATCH_HINT=NONE
+AUDIT_UFW_PRESENT=false
+AUDIT_UFW_ACTIVE=false
+AUDIT_UFW_MOLDOVA_REF_COUNT=0
+AUDIT_UFW_443_ALLOW_COUNT=0
+AUDIT_UFW_3478_ALLOW_COUNT=0
+AUDIT_IPSET_PRESENT=false
+AUDIT_IPSET_MOLDOVA_MEMBER_COUNT=0
+AUDIT_TCP_22_LISTEN=true
+AUDIT_TCP_80_LISTEN=true
+AUDIT_TCP_443_LISTEN=true
+AUDIT_TCP_33073_LISTEN=false
+AUDIT_TCP_33080_LISTEN=false
+AUDIT_TCP_10000_LISTEN=false
+AUDIT_UDP_3478_LISTEN=true
+AUDIT_LOOPBACK_HTTPS_NB_PVEPRO=000
+AUDIT_LOOPBACK_OIDC_NB_PVEPRO=000
+AUDIT_DOCKER_PRESENT=true
+AUDIT_DOCKER_VERSION=Docker version 29.7.2, build a7dcaa6
+AUDIT_DOCKER_ACTIVE=true
+AUDIT_COMPOSE_V2=true
+AUDIT_COMPOSE_VERSION=Docker Compose version v5.5.0
+AUDIT_COMPOSE_PATH=/opt/netbird/docker-compose.yml
+AUDIT_COMPOSE_EXISTS=true
+AUDIT_COMPOSE_SHA256=d6e9a3fa91ae603357baa1139c7f46ba9f812a0c34e5bbcee70b1a5a78cbd7b9
+AUDIT_COMPOSE_DIR=/opt/netbird
+AUDIT_ENV_EXISTS=false
+AUDIT_ENV_SHA256=NONE
+AUDIT_COMPOSE_CONFIG_VALID=true
+AUDIT_COMPOSE_SERVICES=netbird-server,traefik,dashboard
+AUDIT_COMPOSE_IMAGES=netbirdio/dashboard:latest,netbirdio/netbird-server:latest,traefik:v3.6
+AUDIT_COMPOSE_VOLUMES=netbird_traefik_letsencrypt,netbird_data
+AUDIT_RENDERED_MOLDOVA_REF_COUNT=0
+AUDIT_NETBIRD_CLIENT_PRESENT=false
+AUDIT_NETBIRD_CLIENT_VERSION=NONE
+AUDIT_NETBIRD_SERVICE_ACTIVE=false
+AUDIT_NETBIRD_SERVICE_ENABLED=false
+AUDIT_NETBIRD_WT0_PRESENT=false
+AUDIT_NETBIRD_APT_INSTALLED=NONE
+AUDIT_NETBIRD_APT_CANDIDATE=NONE
+AUDIT_OPT_NETBIRD_MOLDOVA_REF_COUNT=0
+AUDIT_OPT_NETBIRD_MOLDOVA_REF_FILES=NONE
+AUDIT_OPT_AVAILABLE_KB=34350608
+AUDIT_BACKUP_DIR_EXISTS=false
+AUDIT_CHANGES_MADE=false
+USA_99056_CLEANUP_VERIFIED=true
+USA_GUEST_MOLDOVA_REFERENCE_COUNT=0
+USA_GUEST_PORT_DROP_REJECT_COUNT=0
+USA_GUEST_NFT_DROP_POLICY_COUNT=1
+DECISION=HOLD_DIRECT_SSH_REGAINED_BUT_LOCAL_STACK_NOT_FULLY_READY
+NEXT_GATE=REPAIR_LOCAL_NETBIRD_STACK_BEFORE_EXTERNAL_CUTOVER
+TASK_RESULT=PASS_USA_DIRECT_SSH_CLEANUP_AUDIT
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
+
+OUTPUT_END
+CHAT_OUTPUT_END

runtime/latest.json

@@ -1,38 +1,38 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "SUPPORT-260928-USA-TEMP-FIREWALL-BYPASS-RCA-99056R1",
+  "command_id": "SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
-  "mode": "change",
-  "component": "usa-temp-firewall-bypass-rca",
-  "started_at_utc": "2026-09-28T13:54:00Z",
-  "finished_at_utc": "2026-09-28T13:56:32Z",
+  "mode": "read-only",
+  "component": "usa-direct-ssh-cleanup-audit",
+  "started_at_utc": "2026-09-28T14:02:50Z",
+  "finished_at_utc": "2026-09-28T14:02:56Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "4adb2e429adb1e15b1c19b871daf15a16810fec524f9ccdbc86cdf4e18aa0ccd",
+  "command_sha256": "63d5688af6e15bc10d01f2cb02820458daa9f9186034ebed89f40bb7d5333132",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
-  "change_declared": true,
+  "change_declared": false,
   "result_contract_valid": true,
-  "result_contract_status": "OK",
+  "result_contract_status": null,
   "result_contract_error": null,
   "command_rc": 0,
-  "changes_made": true,
-  "rollback_started": true,
+  "changes_made": false,
+  "rollback_started": false,
   "rollback_restored": null,
-  "mutation_outcome": "ROLLBACK_UNKNOWN",
+  "mutation_outcome": "NO_MUTATION",
   "sanitized": true,
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "6926cc5d596e09ae2decbf3b0fa210f362f6198d5b34de64db3a4bc8f391e081",
-  "sanitized_output_sha256": "6926cc5d596e09ae2decbf3b0fa210f362f6198d5b34de64db3a4bc8f391e081",
+  "raw_evidence_sha256": "9f3df5d6a51d987662f2fe3ee016eb9dbab2bf237c3e964b6ae99f61d2a3f637",
+  "sanitized_output_sha256": "9f3df5d6a51d987662f2fe3ee016eb9dbab2bf237c3e964b6ae99f61d2a3f637",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "USA_TEMP_FIREWALL_BYPASS_RCA=V1\nMODE=change\nMUTATION_BOUNDARY=TEMP_IPTABLES_ACCEPT_22_443_3478_ONLY\nGOAL=SEPARATE_GUEST_FIREWALL_FROM_PROVIDER_FILTER\nFAILSAFE_CLEANUP_DELAY_SECONDS=80\nPVE01_DURING_PROBE_RC=0\nPVE01_DURING_DIRECT_HTTPS=000\nPVE01_DURING_DIRECT_OIDC=000\nPVE01_DURING_DIRECT_TLS_OK=false\nPVE01_DURING_DIRECT_ALPN=TimeoutError\nPVE01_DURING_DIRECT_TLS_VERSION=NONE\nPVE01_DURING_DIRECT_STUN_OK=true\nPVE01_DURING_DIRECT_STUN_CLASS=SUCCESS\nPVE01_DURING_DIRECT_SSH_HOSTKEY=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE\nPVE01_DURING_DIRECT_SSH_HOSTKEY_MATCH=true\nPVE01_DURING_NETBIRD_STATUS_RC=0\nPVE01_DURING_NETBIRD_MANAGEMENT_CONNECTED=true\nPVE01_DURING_NETBIRD_SIGNAL_CONNECTED=true\nPVE01_DURING_NETBIRD_IP=100.100.131.41\nPVE01_DURING_DIRECT_HTTPS_READY=false\nPVE01_DURING_DIRECT_H2_READY=false\nPVE01_DURING_DIRECT_STUN_READY=true\nPVE02_HOSTKEY_FINGERPRINT=SHA256:UYF9KcBiAeblzcEJPvL0pgaoDPLHFQsVuG0ZTTow0aM\nPVE02_HOSTKEY_MATCH=true\nPVE02_DURING_PROBE_SSH_RC=0\nPVE02_DURING_DIRECT_HTTPS=000\nPVE02_DURING_DIRECT_OIDC=000\nPVE02_DURING_DIRECT_TLS_OK=false\nPVE02_DURING_DIRECT_ALPN=TimeoutError\nPVE02_DURING_DIRECT_TLS_VERSION=NONE\nPVE02_DURING_DIRECT_STUN_OK=true\nPVE02_DURING_DIRECT_STUN_CLASS=SUCCESS\nPVE02_DURING_DIRECT_SSH_HOSTKEY=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE\nPVE02_DURING_DIRECT_SSH_HOSTKEY_MATCH=true\nPVE02_DURING_NETBIRD_STATUS_RC=0\nPVE02_DURING_NETBIRD_MANAGEMENT_CONNECTED=true\nPVE02_DURING_NETBIRD_SIGNAL_CONNECTED=true\nPVE02_DURING_NETBIRD_IP=100.100.91.76\nPVE02_DURING_DIRECT_HTTPS_READY=false\nPVE02_DURING_DIRECT_H2_READY=false\nPVE02_DURING_DIRECT_STUN_READY=true\nDURING_ANY_DIRECT_HTTPS_READY=false\nDURING_ANY_DIRECT_H2_READY=false\nDURING_ANY_DIRECT_STUN_READY=true\nDURING_ANY_DIRECT_SSH_KEX_READY=true\nPVE01_AFTER_PROBE_RC=0\nPVE01_AFTER_DIRECT_HTTPS=000\nPVE01_AFTER_DIRECT_OIDC=000\nPVE01_AFTER_DIRECT_TLS_OK=false\nPVE01_AFTER_DIRECT_ALPN=TimeoutError\nPVE01_AFTER_DIRECT_TLS_VERSION=NONE\nPVE01_AFTER_DIRECT_STUN_OK=true\nPVE01_AFTER_DIRECT_STUN_CLASS=SUCCESS\nPVE01_AFTER_DIRECT_SSH_HOSTKEY=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE\nPVE01_AFTER_DIRECT_SSH_HOSTKEY_MATCH=true\nPVE01_AFTER_NETBIRD_STATUS_RC=0\nPVE01_AFTER_NETBIRD_MANAGEMENT_CONNECTED=true\nPVE01_AFTER_NETBIRD_SIGNAL_CONNECTED=true\nPVE01_AFTER_NETBIRD_IP=100.100.131.41\nPVE01_AFTER_DIRECT_HTTPS_READY=false\nPVE01_AFTER_DIRECT_H2_READY=false\nPVE01_AFTER_DIRECT_STUN_READY=true\nPVE01_POSTWINDOW_CONTROL_HEALTHY=true\nPVE02_DURING_CONTROL_HEALTHY=true\nDECISION=PASS_TEMP_ACCEPT_RULES_IMPROVED_DIRECT_USA_PATH\nNEXT_GATE=VERIFY_TEMP_RULE_CLEANUP_THEN_GUARDED_GUEST_FIREWALL_REPAIR\nTASK_RESULT=PASS_USA_TEMP_FIREWALL_BYPASS_RCA\nCHANGES_MADE=true\nROLLBACK_STARTED=true\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=TEMP_RULES_FAILSAFE_SCHEDULED_AND_WINDOW_EXPIRED\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260928-USA-TEMP-FIREWALL-BYPASS-RCA-99056R1\",\"status\":\"OK\",\"changes_made\":true,\"rollback_started\":true,\"rollback_restored\":null}\n"
+  "output": "USA_DIRECT_SSH_CLEANUP_AUDIT=V1\nMODE=read-only\nMUTATION_BOUNDARY=NONE\nGOAL=VERIFY_99056_CLEANUP_AND_REGAIN_DIRECT_USA_OPERATOR_ACCESS\nPVE01_OPERATOR_KEY_FINGERPRINT=SHA256:wipXiBB3cpAwyWap9LcB185WjEEmDxtRJsI/UuMVAp0\nPVE01_OPERATOR_KEY_MATCH=true\nUSA_SSH_KEYSCAN_RC=0\nUSA_HOSTKEY_FINGERPRINT=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE\nUSA_HOSTKEY_MATCH=true\nUSA_DIRECT_OPERATOR_SSH_RC=0\nUSA_DIRECT_OPERATOR_AUTH=true\nAUDIT_VERSION=9\nAUDIT_HOSTNAME=pvepro\nAUDIT_UID=0\nAUDIT_USER=root\nAUDIT_KERNEL=6.1.0-53-amd64\nAUDIT_UPTIME_SECONDS=13513\nAUDIT_OS_ID=debian\nAUDIT_OS_VERSION_ID=12\nAUDIT_99056_IPTABLES_RULE_COUNT=0\nAUDIT_IPTABLES_PRESENT=true\nAUDIT_IPTABLES_VERSION=iptables v1.8.9 (nf_tables)\nAUDIT_IPTABLES_INPUT_POLICY=ACCEPT\nAUDIT_IPTABLES_FORWARD_POLICY=DROP\nAUDIT_IPTABLES_MOLDOVA_REF_COUNT=0\nAUDIT_IPTABLES_MOLDOVA_443_REF_COUNT=0\nAUDIT_IPTABLES_MOLDOVA_3478_REF_COUNT=0\nAUDIT_IPTABLES_443_ACCEPT_COUNT=1\nAUDIT_IPTABLES_443_DROP_REJECT_COUNT=0\nAUDIT_IPTABLES_3478_ACCEPT_COUNT=1\nAUDIT_IPTABLES_3478_DROP_REJECT_COUNT=0\nAUDIT_99056_RUN_FILE_COUNT=0\nAUDIT_99056_SYSTEMD_UNIT_COUNT=0\nAUDIT_NFT_PRESENT=true\nAUDIT_NFT_INPUT_POLICY_DROP_COUNT=0\nAUDIT_NFT_FORWARD_POLICY_DROP_COUNT=1\nAUDIT_NFT_MOLDOVA_REF_COUNT=0\nAUDIT_NFT_MOLDOVA_443_REF_COUNT=0\nAUDIT_NFT_MOLDOVA_3478_REF_COUNT=0\nAUDIT_NFT_443_DROP_REJECT_COUNT=0\nAUDIT_NFT_3478_DROP_REJECT_COUNT=0\nAUDIT_NFT_MOLDOVA_MATCH_HINT=NONE\nAUDIT_UFW_PRESENT=false\nAUDIT_UFW_ACTIVE=false\nAUDIT_UFW_MOLDOVA_REF_COUNT=0\nAUDIT_UFW_443_ALLOW_COUNT=0\nAUDIT_UFW_3478_ALLOW_COUNT=0\nAUDIT_IPSET_PRESENT=false\nAUDIT_IPSET_MOLDOVA_MEMBER_COUNT=0\nAUDIT_TCP_22_LISTEN=true\nAUDIT_TCP_80_LISTEN=true\nAUDIT_TCP_443_LISTEN=true\nAUDIT_TCP_33073_LISTEN=false\nAUDIT_TCP_33080_LISTEN=false\nAUDIT_TCP_10000_LISTEN=false\nAUDIT_UDP_3478_LISTEN=true\nAUDIT_LOOPBACK_HTTPS_NB_PVEPRO=000\nAUDIT_LOOPBACK_OIDC_NB_PVEPRO=000\nAUDIT_DOCKER_PRESENT=true\nAUDIT_DOCKER_VERSION=Docker version 29.7.2, build a7dcaa6\nAUDIT_DOCKER_ACTIVE=true\nAUDIT_COMPOSE_V2=true\nAUDIT_COMPOSE_VERSION=Docker Compose version v5.5.0\nAUDIT_COMPOSE_PATH=/opt/netbird/docker-compose.yml\nAUDIT_COMPOSE_EXISTS=true\nAUDIT_COMPOSE_SHA256=d6e9a3fa91ae603357baa1139c7f46ba9f812a0c34e5bbcee70b1a5a78cbd7b9\nAUDIT_COMPOSE_DIR=/opt/netbird\nAUDIT_ENV_EXISTS=false\nAUDIT_ENV_SHA256=NONE\nAUDIT_COMPOSE_CONFIG_VALID=true\nAUDIT_COMPOSE_SERVICES=netbird-server,traefik,dashboard\nAUDIT_COMPOSE_IMAGES=netbirdio/dashboard:latest,netbirdio/netbird-server:latest,traefik:v3.6\nAUDIT_COMPOSE_VOLUMES=netbird_traefik_letsencrypt,netbird_data\nAUDIT_RENDERED_MOLDOVA_REF_COUNT=0\nAUDIT_NETBIRD_CLIENT_PRESENT=false\nAUDIT_NETBIRD_CLIENT_VERSION=NONE\nAUDIT_NETBIRD_SERVICE_ACTIVE=false\nAUDIT_NETBIRD_SERVICE_ENABLED=false\nAUDIT_NETBIRD_WT0_PRESENT=false\nAUDIT_NETBIRD_APT_INSTALLED=NONE\nAUDIT_NETBIRD_APT_CANDIDATE=NONE\nAUDIT_OPT_NETBIRD_MOLDOVA_REF_COUNT=0\nAUDIT_OPT_NETBIRD_MOLDOVA_REF_FILES=NONE\nAUDIT_OPT_AVAILABLE_KB=34350608\nAUDIT_BACKUP_DIR_EXISTS=false\nAUDIT_CHANGES_MADE=false\nUSA_99056_CLEANUP_VERIFIED=true\nUSA_GUEST_MOLDOVA_REFERENCE_COUNT=0\nUSA_GUEST_PORT_DROP_REJECT_COUNT=0\nUSA_GUEST_NFT_DROP_POLICY_COUNT=1\nDECISION=HOLD_DIRECT_SSH_REGAINED_BUT_LOCAL_STACK_NOT_FULLY_READY\nNEXT_GATE=REPAIR_LOCAL_NETBIRD_STACK_BEFORE_EXTERNAL_CUTOVER\nTASK_RESULT=PASS_USA_DIRECT_SSH_CLEANUP_AUDIT\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
 }

runtime/latest.txt

@@ -1,104 +1,130 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=SUPPORT-260928-USA-TEMP-FIREWALL-BYPASS-RCA-99056R1
+COMMAND_ID=SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1
 STATUS=OK
 RC=0
 HOST=pve01
-MODE=change
-COMPONENT=usa-temp-firewall-bypass-rca
+MODE=read-only
+COMPONENT=usa-direct-ssh-cleanup-audit
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=4adb2e429adb1e15b1c19b871daf15a16810fec524f9ccdbc86cdf4e18aa0ccd
+COMMAND_SHA256=63d5688af6e15bc10d01f2cb02820458daa9f9186034ebed89f40bb7d5333132
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
-CHANGE_DECLARED=true
+CHANGE_DECLARED=false
 RESULT_CONTRACT_VALID=true
-RESULT_CONTRACT_STATUS=OK
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
 RESULT_CONTRACT_ERROR=NONE
 COMMAND_RC=0
-CHANGES_MADE=true
-ROLLBACK_STARTED=true
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
-MUTATION_OUTCOME=ROLLBACK_UNKNOWN
+MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=6926cc5d596e09ae2decbf3b0fa210f362f6198d5b34de64db3a4bc8f391e081
-SANITIZED_OUTPUT_SHA256=6926cc5d596e09ae2decbf3b0fa210f362f6198d5b34de64db3a4bc8f391e081
+RAW_EVIDENCE_SHA256=9f3df5d6a51d987662f2fe3ee016eb9dbab2bf237c3e964b6ae99f61d2a3f637
+SANITIZED_OUTPUT_SHA256=9f3df5d6a51d987662f2fe3ee016eb9dbab2bf237c3e964b6ae99f61d2a3f637
 OUTPUT_BEGIN
-USA_TEMP_FIREWALL_BYPASS_RCA=V1
-MODE=change
-MUTATION_BOUNDARY=TEMP_IPTABLES_ACCEPT_22_443_3478_ONLY
-GOAL=SEPARATE_GUEST_FIREWALL_FROM_PROVIDER_FILTER
-FAILSAFE_CLEANUP_DELAY_SECONDS=80
-PVE01_DURING_PROBE_RC=0
-PVE01_DURING_DIRECT_HTTPS=000
-PVE01_DURING_DIRECT_OIDC=000
-PVE01_DURING_DIRECT_TLS_OK=false
-PVE01_DURING_DIRECT_ALPN=TimeoutError
-PVE01_DURING_DIRECT_TLS_VERSION=NONE
-PVE01_DURING_DIRECT_STUN_OK=true
-PVE01_DURING_DIRECT_STUN_CLASS=SUCCESS
-PVE01_DURING_DIRECT_SSH_HOSTKEY=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE
-PVE01_DURING_DIRECT_SSH_HOSTKEY_MATCH=true
-PVE01_DURING_NETBIRD_STATUS_RC=0
-PVE01_DURING_NETBIRD_MANAGEMENT_CONNECTED=true
-PVE01_DURING_NETBIRD_SIGNAL_CONNECTED=true
-PVE01_DURING_NETBIRD_IP=100.100.131.41
-PVE01_DURING_DIRECT_HTTPS_READY=false
-PVE01_DURING_DIRECT_H2_READY=false
-PVE01_DURING_DIRECT_STUN_READY=true
-PVE02_HOSTKEY_FINGERPRINT=SHA256:UYF9KcBiAeblzcEJPvL0pgaoDPLHFQsVuG0ZTTow0aM
-PVE02_HOSTKEY_MATCH=true
-PVE02_DURING_PROBE_SSH_RC=0
-PVE02_DURING_DIRECT_HTTPS=000
-PVE02_DURING_DIRECT_OIDC=000
-PVE02_DURING_DIRECT_TLS_OK=false
-PVE02_DURING_DIRECT_ALPN=TimeoutError
-PVE02_DURING_DIRECT_TLS_VERSION=NONE
-PVE02_DURING_DIRECT_STUN_OK=true
-PVE02_DURING_DIRECT_STUN_CLASS=SUCCESS
-PVE02_DURING_DIRECT_SSH_HOSTKEY=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE
-PVE02_DURING_DIRECT_SSH_HOSTKEY_MATCH=true
-PVE02_DURING_NETBIRD_STATUS_RC=0
-PVE02_DURING_NETBIRD_MANAGEMENT_CONNECTED=true
-PVE02_DURING_NETBIRD_SIGNAL_CONNECTED=true
-PVE02_DURING_NETBIRD_IP=100.100.91.76
-PVE02_DURING_DIRECT_HTTPS_READY=false
-PVE02_DURING_DIRECT_H2_READY=false
-PVE02_DURING_DIRECT_STUN_READY=true
-DURING_ANY_DIRECT_HTTPS_READY=false
-DURING_ANY_DIRECT_H2_READY=false
-DURING_ANY_DIRECT_STUN_READY=true
-DURING_ANY_DIRECT_SSH_KEX_READY=true
-PVE01_AFTER_PROBE_RC=0
-PVE01_AFTER_DIRECT_HTTPS=000
-PVE01_AFTER_DIRECT_OIDC=000
-PVE01_AFTER_DIRECT_TLS_OK=false
-PVE01_AFTER_DIRECT_ALPN=TimeoutError
-PVE01_AFTER_DIRECT_TLS_VERSION=NONE
-PVE01_AFTER_DIRECT_STUN_OK=true
-PVE01_AFTER_DIRECT_STUN_CLASS=SUCCESS
-PVE01_AFTER_DIRECT_SSH_HOSTKEY=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE
-PVE01_AFTER_DIRECT_SSH_HOSTKEY_MATCH=true
-PVE01_AFTER_NETBIRD_STATUS_RC=0
-PVE01_AFTER_NETBIRD_MANAGEMENT_CONNECTED=true
-PVE01_AFTER_NETBIRD_SIGNAL_CONNECTED=true
-PVE01_AFTER_NETBIRD_IP=100.100.131.41
-PVE01_AFTER_DIRECT_HTTPS_READY=false
-PVE01_AFTER_DIRECT_H2_READY=false
-PVE01_AFTER_DIRECT_STUN_READY=true
-PVE01_POSTWINDOW_CONTROL_HEALTHY=true
-PVE02_DURING_CONTROL_HEALTHY=true
-DECISION=PASS_TEMP_ACCEPT_RULES_IMPROVED_DIRECT_USA_PATH
-NEXT_GATE=VERIFY_TEMP_RULE_CLEANUP_THEN_GUARDED_GUEST_FIREWALL_REPAIR
-TASK_RESULT=PASS_USA_TEMP_FIREWALL_BYPASS_RCA
-CHANGES_MADE=true
-ROLLBACK_STARTED=true
+USA_DIRECT_SSH_CLEANUP_AUDIT=V1
+MODE=read-only
+MUTATION_BOUNDARY=NONE
+GOAL=VERIFY_99056_CLEANUP_AND_REGAIN_DIRECT_USA_OPERATOR_ACCESS
+PVE01_OPERATOR_KEY_FINGERPRINT=SHA256:wipXiBB3cpAwyWap9LcB185WjEEmDxtRJsI/UuMVAp0
+PVE01_OPERATOR_KEY_MATCH=true
+USA_SSH_KEYSCAN_RC=0
+USA_HOSTKEY_FINGERPRINT=SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE
+USA_HOSTKEY_MATCH=true
+USA_DIRECT_OPERATOR_SSH_RC=0
+USA_DIRECT_OPERATOR_AUTH=true
+AUDIT_VERSION=9
+AUDIT_HOSTNAME=pvepro
+AUDIT_UID=0
+AUDIT_USER=root
+AUDIT_KERNEL=6.1.0-53-amd64
+AUDIT_UPTIME_SECONDS=13513
+AUDIT_OS_ID=debian
+AUDIT_OS_VERSION_ID=12
+AUDIT_99056_IPTABLES_RULE_COUNT=0
+AUDIT_IPTABLES_PRESENT=true
+AUDIT_IPTABLES_VERSION=iptables v1.8.9 (nf_tables)
+AUDIT_IPTABLES_INPUT_POLICY=ACCEPT
+AUDIT_IPTABLES_FORWARD_POLICY=DROP
+AUDIT_IPTABLES_MOLDOVA_REF_COUNT=0
+AUDIT_IPTABLES_MOLDOVA_443_REF_COUNT=0
+AUDIT_IPTABLES_MOLDOVA_3478_REF_COUNT=0
+AUDIT_IPTABLES_443_ACCEPT_COUNT=1
+AUDIT_IPTABLES_443_DROP_REJECT_COUNT=0
+AUDIT_IPTABLES_3478_ACCEPT_COUNT=1
+AUDIT_IPTABLES_3478_DROP_REJECT_COUNT=0
+AUDIT_99056_RUN_FILE_COUNT=0
+AUDIT_99056_SYSTEMD_UNIT_COUNT=0
+AUDIT_NFT_PRESENT=true
+AUDIT_NFT_INPUT_POLICY_DROP_COUNT=0
+AUDIT_NFT_FORWARD_POLICY_DROP_COUNT=1
+AUDIT_NFT_MOLDOVA_REF_COUNT=0
+AUDIT_NFT_MOLDOVA_443_REF_COUNT=0
+AUDIT_NFT_MOLDOVA_3478_REF_COUNT=0
+AUDIT_NFT_443_DROP_REJECT_COUNT=0
+AUDIT_NFT_3478_DROP_REJECT_COUNT=0
+AUDIT_NFT_MOLDOVA_MATCH_HINT=NONE
+AUDIT_UFW_PRESENT=false
+AUDIT_UFW_ACTIVE=false
+AUDIT_UFW_MOLDOVA_REF_COUNT=0
+AUDIT_UFW_443_ALLOW_COUNT=0
+AUDIT_UFW_3478_ALLOW_COUNT=0
+AUDIT_IPSET_PRESENT=false
+AUDIT_IPSET_MOLDOVA_MEMBER_COUNT=0
+AUDIT_TCP_22_LISTEN=true
+AUDIT_TCP_80_LISTEN=true
+AUDIT_TCP_443_LISTEN=true
+AUDIT_TCP_33073_LISTEN=false
+AUDIT_TCP_33080_LISTEN=false
+AUDIT_TCP_10000_LISTEN=false
+AUDIT_UDP_3478_LISTEN=true
+AUDIT_LOOPBACK_HTTPS_NB_PVEPRO=000
+AUDIT_LOOPBACK_OIDC_NB_PVEPRO=000
+AUDIT_DOCKER_PRESENT=true
+AUDIT_DOCKER_VERSION=Docker version 29.7.2, build a7dcaa6
+AUDIT_DOCKER_ACTIVE=true
+AUDIT_COMPOSE_V2=true
+AUDIT_COMPOSE_VERSION=Docker Compose version v5.5.0
+AUDIT_COMPOSE_PATH=/opt/netbird/docker-compose.yml
+AUDIT_COMPOSE_EXISTS=true
+AUDIT_COMPOSE_SHA256=d6e9a3fa91ae603357baa1139c7f46ba9f812a0c34e5bbcee70b1a5a78cbd7b9
+AUDIT_COMPOSE_DIR=/opt/netbird
+AUDIT_ENV_EXISTS=false
+AUDIT_ENV_SHA256=NONE
+AUDIT_COMPOSE_CONFIG_VALID=true
+AUDIT_COMPOSE_SERVICES=netbird-server,traefik,dashboard
+AUDIT_COMPOSE_IMAGES=netbirdio/dashboard:latest,netbirdio/netbird-server:latest,traefik:v3.6
+AUDIT_COMPOSE_VOLUMES=netbird_traefik_letsencrypt,netbird_data
+AUDIT_RENDERED_MOLDOVA_REF_COUNT=0
+AUDIT_NETBIRD_CLIENT_PRESENT=false
+AUDIT_NETBIRD_CLIENT_VERSION=NONE
+AUDIT_NETBIRD_SERVICE_ACTIVE=false
+AUDIT_NETBIRD_SERVICE_ENABLED=false
+AUDIT_NETBIRD_WT0_PRESENT=false
+AUDIT_NETBIRD_APT_INSTALLED=NONE
+AUDIT_NETBIRD_APT_CANDIDATE=NONE
+AUDIT_OPT_NETBIRD_MOLDOVA_REF_COUNT=0
+AUDIT_OPT_NETBIRD_MOLDOVA_REF_FILES=NONE
+AUDIT_OPT_AVAILABLE_KB=34350608
+AUDIT_BACKUP_DIR_EXISTS=false
+AUDIT_CHANGES_MADE=false
+USA_99056_CLEANUP_VERIFIED=true
+USA_GUEST_MOLDOVA_REFERENCE_COUNT=0
+USA_GUEST_PORT_DROP_REJECT_COUNT=0
+USA_GUEST_NFT_DROP_POLICY_COUNT=1
+DECISION=HOLD_DIRECT_SSH_REGAINED_BUT_LOCAL_STACK_NOT_FULLY_READY
+NEXT_GATE=REPAIR_LOCAL_NETBIRD_STACK_BEFORE_EXTERNAL_CUTOVER
+TASK_RESULT=PASS_USA_DIRECT_SSH_CLEANUP_AUDIT
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
-MUTATION_OUTCOME=TEMP_RULES_FAILSAFE_SCHEDULED_AND_WINDOW_EXPIRED
-HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260928-USA-TEMP-FIREWALL-BYPASS-RCA-99056R1","status":"OK","changes_made":true,"rollback_started":true,"rollback_restored":null}
+MUTATION_OUTCOME=NO_MUTATION
+HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260928-USA-DIRECT-SSH-CLEANUP-AUDIT-99057R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
 
 OUTPUT_END
 CHAT_OUTPUT_END